xref: /illumos-gate/usr/src/cmd/krb5/krb5kdc/main.c (revision 80ab886d233f514d54c2a6bdeb9fdfd951bd6881)
1 /*
2  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * kdc/main.c
10  *
11  * Copyright 1990,2001 by the Massachusetts Institute of Technology.
12  *
13  * Export of this software from the United States of America may
14  *   require a specific license from the United States Government.
15  *   It is the responsibility of any person or organization contemplating
16  *   export to obtain such a license before exporting.
17  *
18  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
19  * distribute this software and its documentation for any purpose and
20  * without fee is hereby granted, provided that the above copyright
21  * notice appear in all copies and that both that copyright notice and
22  * this permission notice appear in supporting documentation, and that
23  * the name of M.I.T. not be used in advertising or publicity pertaining
24  * to distribution of the software without specific, written prior
25  * permission.  Furthermore if you modify this software you must label
26  * your software as modified software and not distribute it in such a
27  * fashion that it might be confused with the original M.I.T. software.
28  * M.I.T. makes no representations about the suitability of
29  * this software for any purpose.  It is provided "as is" without express
30  * or implied warranty.
31  *
32  *
33  * Main procedure body for the KDC server process.
34  */
35 
36 #include <stdio.h>
37 #include <syslog.h>
38 #include <signal.h>
39 #include <errno.h>
40 #include <netdb.h>
41 
42 #include "k5-int.h"
43 #include "com_err.h"
44 #include "adm.h"
45 #include "adm_proto.h"
46 #include "kdc_util.h"
47 #include "extern.h"
48 #include "kdc5_err.h"
49 #include <libintl.h>
50 #include <locale.h>
51 
52 #ifdef HAVE_NETINET_IN_H
53 #include <netinet/in.h>
54 #endif
55 
56 kdc_realm_t *find_realm_data (char *, krb5_ui_4);
57 
58 void usage (char *);
59 
60 krb5_sigtype request_exit (int);
61 krb5_sigtype request_hup  (int);
62 
63 void setup_signal_handlers (void);
64 
65 krb5_error_code setup_sam (void);
66 
67 void initialize_realms (krb5_context, int, char **);
68 
69 void finish_realms (char *);
70 
71 static int nofork = 0;
72 static int rkey_init_done = 0;
73 
74 /* Solaris Kerberos: global here that other functions access */
75 int max_tcp_data_connections;
76 
77 #ifdef POSIX_SIGNALS
78 static struct sigaction s_action;
79 #endif /* POSIX_SIGNALS */
80 
81 #define	KRB5_KDC_MAX_REALMS	32
82 
83 /*
84  * Find the realm entry for a given realm.
85  */
86 kdc_realm_t *
87 find_realm_data(rname, rsize)
88     char 	*rname;
89     krb5_ui_4	rsize;
90 {
91     int i;
92     for (i=0; i<kdc_numrealms; i++) {
93 	if ((rsize == strlen(kdc_realmlist[i]->realm_name)) &&
94 	    !strncmp(rname, kdc_realmlist[i]->realm_name, rsize))
95 	    return(kdc_realmlist[i]);
96     }
97     return((kdc_realm_t *) NULL);
98 }
99 
100 krb5_error_code
101 setup_server_realm(sprinc)
102     krb5_principal	sprinc;
103 {
104     krb5_error_code	kret;
105     kdc_realm_t		*newrealm;
106 
107     kret = 0;
108     if (kdc_numrealms > 1) {
109 	if (!(newrealm = find_realm_data(sprinc->realm.data,
110 					 (krb5_ui_4) sprinc->realm.length)))
111 	    kret = ENOENT;
112 	else
113 	    kdc_active_realm = newrealm;
114     }
115     else
116 	kdc_active_realm = kdc_realmlist[0];
117     return(kret);
118 }
119 
120 static void
121 finish_realm(rdp)
122     kdc_realm_t *rdp;
123 {
124     if (rdp->realm_dbname)
125 	free(rdp->realm_dbname);
126     if (rdp->realm_mpname)
127 	free(rdp->realm_mpname);
128     if (rdp->realm_stash)
129 	free(rdp->realm_stash);
130     if (rdp->realm_ports)
131 	free(rdp->realm_ports);
132     if (rdp->realm_tcp_ports)
133 	free(rdp->realm_tcp_ports);
134     if (rdp->realm_kstypes)
135 	free(rdp->realm_kstypes);
136     if (rdp->realm_keytab)
137 	krb5_kt_close(rdp->realm_context, rdp->realm_keytab);
138     if (rdp->realm_context) {
139 	if (rdp->realm_mprinc)
140 	    krb5_free_principal(rdp->realm_context, rdp->realm_mprinc);
141 	if (rdp->realm_mkey.length && rdp->realm_mkey.contents) {
142 	    memset(rdp->realm_mkey.contents, 0, rdp->realm_mkey.length);
143 	    free(rdp->realm_mkey.contents);
144 	}
145 	if (rdp->realm_tgskey.length && rdp->realm_tgskey.contents) {
146 	    memset(rdp->realm_tgskey.contents, 0, rdp->realm_tgskey.length);
147 	    free(rdp->realm_tgskey.contents);
148 	}
149 	krb5_db_fini(rdp->realm_context);
150 	if (rdp->realm_tgsprinc)
151 	    krb5_free_principal(rdp->realm_context, rdp->realm_tgsprinc);
152 	krb5_free_context(rdp->realm_context);
153     }
154     free(rdp);
155 }
156 
157 /*
158  * Initialize a realm control structure from the alternate profile or from
159  * the specified defaults.
160  *
161  * After we're complete here, the essence of the realm is embodied in the
162  * realm data and we should be all set to begin operation for that realm.
163  */
164 static krb5_error_code
165 init_realm(progname, rdp, realm, def_dbname, def_mpname,
166 		 def_enctype, def_udp_ports, def_tcp_ports, def_manual)
167     char		*progname;
168     kdc_realm_t		*rdp;
169     char		*realm;
170     char		*def_dbname;
171     char		*def_mpname;
172     krb5_enctype	def_enctype;
173     char		*def_udp_ports;
174     char		*def_tcp_ports;
175     krb5_boolean	def_manual;
176 {
177     krb5_error_code	kret;
178     krb5_boolean	manual;
179     krb5_db_entry	db_entry;
180     int			num2get;
181     krb5_boolean	more;
182     krb5_boolean	db_inited;
183     krb5_realm_params	*rparams;
184     krb5_key_data	*kdata;
185     krb5_key_salt_tuple	*kslist;
186     krb5_int32		nkslist;
187     int			i;
188     krb5_deltat		now, krb5_kdb_max_time;
189 
190     db_inited = 0;
191     memset((char *) rdp, 0, sizeof(kdc_realm_t));
192     if (!realm) {
193 	kret = EINVAL;
194 	goto whoops;
195     }
196 
197     rdp->realm_name = realm;
198     kret = krb5_init_context(&rdp->realm_context);
199     if (kret) {
200 	com_err(progname, kret, gettext("while getting context for realm %s"),
201 		realm);
202 	goto whoops;
203     }
204 
205     kret = krb5_read_realm_params(rdp->realm_context, rdp->realm_name,
206 				  (char *) NULL, (char *) NULL, &rparams);
207     if (kret) {
208 	com_err(progname, kret, gettext("while reading realm parameters"));
209 	goto whoops;
210     }
211 
212     /* Handle profile file name */
213     if (rparams && rparams->realm_profile)
214 	rdp->realm_profile = strdup(rparams->realm_profile);
215 
216     /* Handle database name */
217     if (rparams && rparams->realm_dbname)
218 	rdp->realm_dbname = strdup(rparams->realm_dbname);
219     else
220 	rdp->realm_dbname = (def_dbname) ? strdup(def_dbname) :
221 	    strdup(DEFAULT_KDB_FILE);
222 
223     /* Handle master key name */
224     if (rparams && rparams->realm_mkey_name)
225 	rdp->realm_mpname = strdup(rparams->realm_mkey_name);
226     else
227 	rdp->realm_mpname = (def_mpname) ? strdup(def_mpname) :
228 	    strdup(KRB5_KDB_M_NAME);
229 
230     /* Handle KDC ports */
231     if (rparams && rparams->realm_kdc_ports)
232 	rdp->realm_ports = strdup(rparams->realm_kdc_ports);
233     else
234 	rdp->realm_ports = strdup(def_udp_ports);
235     if (rparams && rparams->realm_kdc_tcp_ports)
236 	rdp->realm_tcp_ports = strdup(rparams->realm_kdc_tcp_ports);
237     else
238 	rdp->realm_tcp_ports = strdup(def_tcp_ports);
239 
240     /* Handle stash file */
241     if (rparams && rparams->realm_stash_file) {
242 	rdp->realm_stash = strdup(rparams->realm_stash_file);
243 	manual = FALSE;
244     } else
245 	manual = def_manual;
246 
247     /* Handle master key type */
248     if (rparams && rparams->realm_enctype_valid)
249 	rdp->realm_mkey.enctype = (krb5_enctype) rparams->realm_enctype;
250     else
251 	rdp->realm_mkey.enctype = manual ? def_enctype : ENCTYPE_UNKNOWN;
252     if ((kret = krb5_timeofday(rdp->realm_context, &now))) {
253 	com_err(progname, kret, gettext("while getting timeofday"));
254 	goto whoops;
255     }
256 
257     /* Handle ticket maximum life */
258     if (rparams && rparams->realm_max_life_valid)
259    	rdp->realm_maxlife = rparams->realm_max_life;
260     else
261 	rdp->realm_maxlife = KRB5_KDB_EXPIRATION - now - 3600;
262 
263     /* Handle ticket renewable maximum life */
264     if (rparams && rparams->realm_max_rlife_valid)
265    	rdp->realm_maxrlife = rparams->realm_max_rlife;
266     else
267    	rdp->realm_maxrlife = KRB5_KDB_EXPIRATION - now - 3600;
268 
269     /* Handle key/salt list */
270     if (rparams && rparams->realm_num_keysalts) {
271 	rdp->realm_kstypes = rparams->realm_keysalts;
272 	rdp->realm_nkstypes = rparams->realm_num_keysalts;
273 	rparams->realm_keysalts = NULL;
274 	rparams->realm_num_keysalts = 0;
275 	kslist = (krb5_key_salt_tuple *) rdp->realm_kstypes;
276 	nkslist = rdp->realm_nkstypes;
277     } else {
278 	/*
279 	 * XXX  Initialize default key/salt list.
280 	 */
281 	if ((kslist = (krb5_key_salt_tuple *)
282 	     malloc(sizeof(krb5_key_salt_tuple)))) {
283 	    kslist->ks_enctype = ENCTYPE_DES_CBC_CRC;
284 	    kslist->ks_salttype = KRB5_KDB_SALTTYPE_NORMAL;
285 	    rdp->realm_kstypes = kslist;
286 	    rdp->realm_nkstypes = 1;
287 	    nkslist = 1;
288 	}
289 	else {
290 	    com_err(progname, ENOMEM,
291 		    gettext("while setting up key/salt list for realm %s"),
292 		    realm);
293 	    exit(1);
294 	}
295     }
296 
297     if (rparams)
298 	krb5_free_realm_params(rdp->realm_context, rparams);
299 
300     /*
301      * We've got our parameters, now go and setup our realm context.
302      */
303 
304     /* Set the default realm of this context */
305     if ((kret = krb5_set_default_realm(rdp->realm_context, realm))) {
306 	com_err(progname, kret, gettext("while setting default realm to %s"),
307 		realm);
308 	goto whoops;
309     }
310 
311     /* Assemble and parse the master key name */
312     if ((kret = krb5_db_setup_mkey_name(rdp->realm_context, rdp->realm_mpname,
313 					rdp->realm_name, (char **) NULL,
314 					&rdp->realm_mprinc))) {
315 	com_err(progname, kret,
316 		gettext("while setting up master key name %s for realm %s"),
317 		rdp->realm_mpname, realm);
318 	goto whoops;
319     }
320 
321     /*
322      * Get the master key.
323      */
324     if ((kret = krb5_db_fetch_mkey(rdp->realm_context, rdp->realm_mprinc,
325 				   rdp->realm_mkey.enctype, manual,
326 				   FALSE, rdp->realm_stash,
327 				   0, &rdp->realm_mkey))) {
328 	com_err(progname, kret,
329 		gettext("while fetching master key %s for realm %s"),
330 		rdp->realm_mpname, realm);
331 	goto whoops;
332     }
333 
334     /* Set and open the database. */
335     if (rdp->realm_dbname &&
336 	(kret = krb5_db_set_name(rdp->realm_context, rdp->realm_dbname))) {
337 	com_err(progname, kret,
338 		gettext("while setting database name to %s for realm %s"),
339 		rdp->realm_dbname, realm);
340 	goto whoops;
341     }
342     if ((kret = krb5_db_init(rdp->realm_context))) {
343 	com_err(progname, kret,
344 		gettext("while initializing database "),
345 		gettext("for realm %s"), realm);
346 	goto whoops;
347     } else
348 	db_inited = 1;
349 
350     /* Verify the master key */
351     if ((kret = krb5_db_verify_master_key(rdp->realm_context,
352 					  rdp->realm_mprinc,
353 					  &rdp->realm_mkey))) {
354 	com_err(progname, kret,
355 		gettext("while verifying master key for realm %s"),
356 		realm);
357 	goto whoops;
358     }
359 
360     /* Fetch the master key and get its version number */
361     num2get = 1;
362     kret = krb5_db_get_principal(rdp->realm_context, rdp->realm_mprinc,
363 				 &db_entry, &num2get, &more);
364     if (!kret) {
365 	if (num2get != 1)
366 	    kret = KRB5_KDB_NOMASTERKEY;
367 	else {
368 	    if (more) {
369 		krb5_db_free_principal(rdp->realm_context,
370 				       &db_entry,
371 				       num2get);
372 		kret = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE;
373 	    }
374 	}
375     }
376     if (kret) {
377 	com_err(progname, kret,
378 		gettext("while fetching master entry for realm %s"),
379 		realm);
380 	goto whoops;
381     }
382 
383     /*
384      * Get the most recent master key.  Search the key list in
385      * the order specified by the key/salt list.
386      */
387     kdata = (krb5_key_data *) NULL;
388     for (i=0; i<nkslist; i++) {
389 	if (!(kret = krb5_dbe_find_enctype(rdp->realm_context,
390 					   &db_entry,
391 					   kslist[i].ks_enctype,
392 					   -1,
393 					   -1,
394 					   &kdata)))
395 	    break;
396     }
397     if (!kdata) {
398 	com_err(progname, kret,
399 		gettext("while finding master key for realm %s"),
400 		realm);
401 	goto whoops;
402     }
403     rdp->realm_mkvno = kdata->key_data_kvno;
404     krb5_db_free_principal(rdp->realm_context, &db_entry, num2get);
405 
406     if ((kret = krb5_db_set_mkey(rdp->realm_context, &rdp->realm_mkey))) {
407 	com_err(progname, kret,
408 		gettext("while processing master key for realm %s"),
409 		realm);
410 	goto whoops;
411     }
412 
413     /* Set up the keytab */
414     if ((kret = krb5_ktkdb_resolve(rdp->realm_context,
415 				   NULL,
416 				   &rdp->realm_keytab))) {
417 	com_err(progname, kret,
418 		gettext("while resolving kdb keytab for realm %s"),
419 		realm);
420 	goto whoops;
421     }
422 
423     /* Preformat the TGS name */
424     if ((kret = krb5_build_principal(rdp->realm_context, &rdp->realm_tgsprinc,
425 				     strlen(realm), realm, KRB5_TGS_NAME,
426 				     realm, (char *) NULL))) {
427 	com_err(progname, kret,
428 		gettext("while building TGS name for realm %s"),
429 		realm);
430 	goto whoops;
431     }
432 
433     /* Get the TGS database entry */
434     num2get = 1;
435     if (!(kret = krb5_db_get_principal(rdp->realm_context,
436 				       rdp->realm_tgsprinc,
437 				       &db_entry,
438 				       &num2get,
439 				       &more))) {
440 	if (num2get != 1)
441 	    kret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
442 	else {
443 	    if (more) {
444 		krb5_db_free_principal(rdp->realm_context,
445 				       &db_entry,
446 				       num2get);
447 		kret = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE;
448 	    }
449 	}
450     }
451     if (kret) {
452 	com_err(progname, kret,
453 		gettext("while fetching TGS entry for realm %s"),
454 		realm);
455 	goto whoops;
456     }
457     /*
458      * Get the most recent TGS key.  Search the key list in
459      * the order specified by the key/salt list.
460      */
461     kdata = (krb5_key_data *) NULL;
462     for (i=0; i<nkslist; i++) {
463 	if (!(kret = krb5_dbe_find_enctype(rdp->realm_context,
464 					   &db_entry,
465 					   kslist[i].ks_enctype,
466 					   -1,
467 					   -1,
468 					   &kdata)))
469 	    break;
470     }
471     if (!kdata) {
472 	com_err(progname, kret,
473 		gettext("while finding TGS key for realm %s"),
474 		realm);
475 	goto whoops;
476     }
477     if (!(kret = krb5_dbekd_decrypt_key_data(rdp->realm_context,
478 					     &rdp->realm_mkey,
479 					     kdata,
480 					     &rdp->realm_tgskey, NULL))){
481 	rdp->realm_tgskvno = kdata->key_data_kvno;
482     }
483     krb5_db_free_principal(rdp->realm_context,
484 			   &db_entry,
485 			   num2get);
486     if (kret) {
487 	com_err(progname, kret,
488 		gettext("while decrypting TGS key for realm %s"),
489 		realm);
490 	goto whoops;
491     }
492 
493     if (!rkey_init_done) {
494 	krb5_timestamp now;
495 	krb5_data seed;
496 #ifdef KRB5_KRB4_COMPAT
497 	krb5_keyblock temp_key;
498 #endif
499 	/*
500 	 * If all that worked, then initialize the random key
501 	 * generators.
502 	 */
503 
504 	if ((kret = krb5_timeofday(rdp->realm_context, &now)))
505 	    goto whoops;
506 	seed.length = sizeof(now);
507 	seed.data = (char *) &now;
508 	if ((kret = krb5_c_random_seed(rdp->realm_context, &seed)))
509 	    goto whoops;
510 
511 	seed.length = rdp->realm_mkey.length;
512 	seed.data = (char *)rdp->realm_mkey.contents;
513 
514 	if ((kret = krb5_c_random_seed(rdp->realm_context, &seed)))
515 	    goto whoops;
516 
517 #ifdef KRB5_KRB4_COMPAT
518 	if ((kret = krb5_c_make_random_key(rdp->realm_context,
519 					   ENCTYPE_DES_CBC_CRC, &temp_key))) {
520 	    com_err(progname, kret,
521 		    "while initializing V4 random key generator");
522 	    goto whoops;
523 	}
524 
525 	(void) des_init_random_number_generator(temp_key.contents);
526 	krb5_free_keyblock_contents(rdp->realm_context, &temp_key);
527 #endif
528 	rkey_init_done = 1;
529     }
530  whoops:
531     /*
532      * If we choked, then clean up any dirt we may have dropped on the floor.
533      */
534     if (kret) {
535 	finish_realm(rdp);
536     }
537     return(kret);
538 }
539 
540 krb5_sigtype
541 request_exit(signo)
542     int signo;
543 {
544     signal_requests_exit = 1;
545 
546 #ifdef POSIX_SIGTYPE
547     return;
548 #else
549     return(0);
550 #endif
551 }
552 
553 krb5_sigtype
554 request_hup(signo)
555     int signo;
556 {
557     signal_requests_hup = 1;
558 
559 #ifdef POSIX_SIGTYPE
560     return;
561 #else
562     return(0);
563 #endif
564 }
565 
566 void
567 setup_signal_handlers()
568 {
569 #ifdef POSIX_SIGNALS
570     (void) sigemptyset(&s_action.sa_mask);
571     s_action.sa_flags = 0;
572     s_action.sa_handler = request_exit;
573     (void) sigaction(SIGINT, &s_action, (struct sigaction *) NULL);
574     (void) sigaction(SIGTERM, &s_action, (struct sigaction *) NULL);
575     s_action.sa_handler = request_hup;
576     (void) sigaction(SIGHUP, &s_action, (struct sigaction *) NULL);
577 #else  /* POSIX_SIGNALS */
578     signal(SIGINT, request_exit);
579     signal(SIGTERM, request_exit);
580     signal(SIGHUP, request_hup);
581 #endif /* POSIX_SIGNALS */
582 
583     return;
584 }
585 
586 krb5_error_code
587 setup_sam()
588 {
589     return krb5_c_make_random_key(kdc_context, ENCTYPE_DES_CBC_MD5, &psr_key);
590 }
591 
592 void
593 usage(name)
594 char *name;
595 {
596     fprintf(stderr, gettext("usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-n]\n"), name);
597     return;
598 }
599 
600 void
601 initialize_realms(kcontext, argc, argv)
602     krb5_context 	kcontext;
603     int			argc;
604     char		**argv;
605 {
606     int 		c;
607     char		*db_name = (char *) NULL;
608     char		*mkey_name = (char *) NULL;
609     char		*rcname = KDCRCACHE;
610     char		*lrealm;
611     krb5_error_code	retval;
612     krb5_enctype	menctype = ENCTYPE_UNKNOWN;
613     kdc_realm_t		*rdatap;
614     krb5_boolean	manual = FALSE;
615     char		*default_udp_ports = 0;
616     char		*default_tcp_ports = 0;
617     krb5_pointer	aprof;
618     const char		*hierarchy[3];
619 #ifdef KRB5_KRB4_COMPAT
620     char                *v4mode = 0;
621 #endif
622     extern char *optarg;
623 #ifdef ATHENA_DES3_KLUDGE
624     extern struct krb5_keytypes krb5_enctypes_list[];
625     extern int krb5_enctypes_length;
626 #endif
627 
628     if (!krb5_aprof_init(DEFAULT_KDC_PROFILE, KDC_PROFILE_ENV, &aprof)) {
629 	hierarchy[0] = "kdcdefaults";
630 	hierarchy[1] = "kdc_ports";
631 	hierarchy[2] = (char *) NULL;
632 	if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_udp_ports))
633 	    default_udp_ports = 0;
634 	hierarchy[1] = "kdc_tcp_ports";
635 	if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_tcp_ports))
636 	    default_tcp_ports = 0;
637 	hierarchy[1] = "kdc_max_tcp_connections";
638 	if (krb5_aprof_get_int32(aprof, hierarchy, TRUE,
639 		&max_tcp_data_connections)) {
640 	    max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS;
641 	} else if (max_tcp_data_connections < MIN_KDC_TCP_CONNECTIONS) {
642 	    max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS;
643 	}
644 #ifdef KRB5_KRB4_COMPAT
645 	hierarchy[1] = "v4_mode";
646 	if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &v4mode))
647 	    v4mode = 0;
648 #endif
649 	/* aprof_init can return 0 with aprof == NULL */
650 	if (aprof)
651 	     krb5_aprof_finish(aprof);
652     }
653     if (default_udp_ports == 0)
654 	default_udp_ports = strdup(DEFAULT_KDC_UDP_PORTLIST);
655     if (default_tcp_ports == 0)
656 	default_tcp_ports = strdup(DEFAULT_KDC_TCP_PORTLIST);
657     /*
658      * Loop through the option list.  Each time we encounter a realm name,
659      * use the previously scanned options to fill in for defaults.
660      */
661     while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n")) != -1) { /* SUNW */
662 	switch(c) {
663 	case 'r':			/* realm name for db */
664 	    if (!find_realm_data(optarg, (krb5_ui_4) strlen(optarg))) {
665 		if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) {
666 		    if ((retval = init_realm(argv[0], rdatap, optarg, db_name,
667 					     mkey_name, menctype,
668 					     default_udp_ports,
669 					     default_tcp_ports, manual))) {
670 			fprintf(stderr,gettext("%s: cannot initialize realm %s\n"),
671 				argv[0], optarg);
672 			exit(1);
673 		    }
674 		    kdc_realmlist[kdc_numrealms] = rdatap;
675 		    kdc_numrealms++;
676 		}
677 	    }
678 	    break;
679 	case 'd':			/* pathname for db */
680 	    db_name = optarg;
681 	    break;
682 	case 'm':			/* manual type-in of master key */
683 	    manual = TRUE;
684 	    if (menctype == ENCTYPE_UNKNOWN)
685 		menctype = ENCTYPE_DES_CBC_CRC;
686 	    break;
687 	case 'M':			/* master key name in DB */
688 	    mkey_name = optarg;
689 	    break;
690 	case 'n':
691 	    nofork++;			/* don't detach from terminal */
692 	    break;
693 	case 'k':			/* enctype for master key */
694 	    if (krb5_string_to_enctype(optarg, &menctype))
695 		com_err(argv[0], 0,
696 		gettext("invalid enctype %s"), optarg);
697 	    break;
698 	case 'R':
699 	    rcname = optarg;
700 	    break;
701 	case 'p':
702 	    if (default_udp_ports)
703 		free(default_udp_ports);
704 	    default_udp_ports = strdup(optarg);
705 
706 	    if (default_tcp_ports)
707 		free(default_tcp_ports);
708 	    default_tcp_ports = strdup(optarg);
709 
710 	    break;
711 	case '4':
712 #ifdef KRB5_KRB4_COMPAT
713 	    if (v4mode)
714 		free(v4mode);
715 	    v4mode = strdup(optarg);
716 #endif
717 	    break;
718 	case '3':
719 #ifdef ATHENA_DES3_KLUDGE
720 	    if (krb5_enctypes_list[krb5_enctypes_length-1].etype
721 		!= ENCTYPE_LOCAL_DES3_HMAC_SHA1) {
722 		fprintf(stderr,
723 			"internal inconsistency in enctypes_list"
724 			" while disabling\n"
725 			"des3-marc-hmac-sha1 enctype\n");
726 		exit(1);
727 	    }
728 	    krb5_enctypes_length--;
729 	    break;
730 #endif
731 	case '?':
732 	default:
733 	    usage(argv[0]);
734 	    exit(1);
735 	}
736     }
737 
738 #ifdef KRB5_KRB4_COMPAT
739     /*
740      * Setup the v4 mode
741      */
742     process_v4_mode(argv[0], v4mode);
743 #endif
744 
745     /*
746      * Check to see if we processed any realms.
747      */
748     if (kdc_numrealms == 0) {
749 	/* no realm specified, use default realm */
750 	if ((retval = krb5_get_default_realm(kcontext, &lrealm))) {
751 	    com_err(argv[0], retval,
752 		gettext("while attempting to retrieve default realm"));
753 	    exit(1);
754 	}
755 	if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) {
756 	    if ((retval = init_realm(argv[0], rdatap, lrealm, db_name,
757 				     mkey_name, menctype, default_udp_ports,
758 				     default_tcp_ports, manual))) {
759 		fprintf(stderr,
760 			gettext("%s: cannot initialize realm %s\n"),
761 			argv[0], lrealm);
762 		exit(1);
763 	    }
764 	    kdc_realmlist[0] = rdatap;
765 	    kdc_numrealms++;
766 	}
767     }
768 
769 #ifdef USE_RCACHE
770     /*
771      * Now handle the replay cache.
772      */
773     if ((retval = kdc_initialize_rcache(kcontext, rcname))) {
774 	com_err(argv[0], retval, gettext("while initializing KDC replay cache"));
775 	exit(1);
776     }
777 #endif
778 
779     /* Ensure that this is set for our first request. */
780     kdc_active_realm = kdc_realmlist[0];
781     if (default_udp_ports)
782 	free(default_udp_ports);
783     if (default_tcp_ports)
784 	free(default_tcp_ports);
785 
786     return;
787 }
788 
789 void
790 finish_realms(prog)
791     char *prog;
792 {
793     int i;
794 
795     for (i = 0; i < kdc_numrealms; i++) {
796 	finish_realm(kdc_realmlist[i]);
797 	kdc_realmlist[i] = 0;
798     }
799 }
800 
801 /*
802  outline:
803 
804  process args & setup
805 
806  initialize database access (fetch master key, open DB)
807 
808  initialize network
809 
810  loop:
811  	listen for packet
812 
813 	determine packet type, dispatch to handling routine
814 		(AS or TGS (or V4?))
815 
816 	reflect response
817 
818 	exit on signal
819 
820  clean up secrets, close db
821 
822  shut down network
823 
824  exit
825  */
826 
827 int main(argc, argv)
828      int argc;
829      char *argv[];
830 {
831     krb5_error_code	retval;
832     krb5_context	kcontext;
833     int			*port_list;
834     int errout = 0;
835 
836     (void) setlocale(LC_ALL, "");
837 
838 #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
839 #define	TEXT_DOMAIN	"KRB5KDC_TEST"	/* Use this only if it weren't */
840 #endif
841 
842     (void) textdomain(TEXT_DOMAIN);
843 
844     if (strrchr(argv[0], '/'))
845 	argv[0] = strrchr(argv[0], '/')+1;
846 
847     if (!(kdc_realmlist = (kdc_realm_t **) malloc(sizeof(kdc_realm_t *) *
848 						  KRB5_KDC_MAX_REALMS))) {
849 	fprintf(stderr, gettext("%s: cannot get memory for realm list\n"), argv[0]);
850 	exit(1);
851     }
852     memset((char *) kdc_realmlist, 0,
853 	   (size_t) (sizeof(kdc_realm_t *) * KRB5_KDC_MAX_REALMS));
854     port_list = NULL;
855 
856     /*
857      * A note about Kerberos contexts: This context, "kcontext", is used
858      * for the KDC operations, i.e. setup, network connection and error
859      * reporting.  The per-realm operations use the "realm_context"
860      * associated with each realm.
861      */
862     retval = krb5_init_context(&kcontext);
863     if (retval) {
864 	    com_err(argv[0], retval, gettext("while initializing krb5"));
865 	    exit(1);
866     }
867     krb5_klog_init(kcontext, "kdc", argv[0], 1);
868     /* initialize_kdc5_error_table();  SUNWresync121 XXX */
869 
870     /*
871      * Scan through the argument list
872      */
873     initialize_realms(kcontext, argc, argv);
874 
875     setup_signal_handlers();
876 
877     if (retval = setup_sam()) {
878 	com_err(argv[0], retval, gettext("while initializing SAM"));
879 	finish_realms(argv[0]);
880 	return 1;
881     }
882 
883     if ((retval = setup_network(argv[0]))) {
884 	com_err(argv[0], retval, gettext("while initializing network"));
885 	finish_realms(argv[0]);
886 	return 1;
887     }
888     if (!nofork && daemon(0, 0)) {
889 	com_err(argv[0], errno, gettext("while detaching from tty"));
890 	finish_realms(argv[0]);
891 	return 1;
892     }
893     if (retval = krb5_klog_syslog(LOG_INFO, "commencing operation")) {
894 	com_err(argv[0], retval, gettext("while logging message"));
895 	errout++;
896 	};
897 
898     if ((retval = listen_and_process(argv[0]))) {
899 	com_err(argv[0], retval, gettext("while processing network requests"));
900 	errout++;
901     }
902     if ((retval = closedown_network(argv[0]))) {
903 	com_err(argv[0], retval, gettext("while shutting down network"));
904 	errout++;
905     }
906     krb5_klog_syslog(LOG_INFO, "shutting down");
907     krb5_klog_close(kdc_context);
908     finish_realms(argv[0]);
909     krb5_free_context(kcontext);
910     return errout;
911 }
912