xref: /illumos-gate/usr/src/cmd/krb5/slave/kprop.c (revision 80ab886d233f514d54c2a6bdeb9fdfd951bd6881)
1 /*
2  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * slave/kprop.c
10  *
11  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
12  * All Rights Reserved.
13  *
14  * Export of this software from the United States of America may
15  *   require a specific license from the United States Government.
16  *   It is the responsibility of any person or organization contemplating
17  *   export to obtain such a license before exporting.
18  *
19  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
20  * distribute this software and its documentation for any purpose and
21  * without fee is hereby granted, provided that the above copyright
22  * notice appear in all copies and that both that copyright notice and
23  * this permission notice appear in supporting documentation, and that
24  * the name of M.I.T. not be used in advertising or publicity pertaining
25  * to distribution of the software without specific, written prior
26  * permission.  Furthermore if you modify this software you must label
27  * your software as modified software and not distribute it in such a
28  * fashion that it might be confused with the original M.I.T. software.
29  * M.I.T. makes no representations about the suitability of
30  * this software for any purpose.  It is provided "as is" without express
31  * or implied warranty.
32  *
33  *
34  */
35 
36 
37 #include <errno.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <ctype.h>
41 #include <sys/file.h>
42 #include <signal.h>
43 #include <string.h>
44 #include <sys/types.h>
45 #include <sys/time.h>
46 #include <sys/stat.h>
47 #include <sys/socket.h>
48 #include <netinet/in.h>
49 #include <sys/param.h>
50 #include <netdb.h>
51 #include <fcntl.h>
52 #include <libintl.h>
53 #include <locale.h>
54 #include <k5-int.h>
55 #include "com_err.h"
56 #include "kprop.h"
57 static char *kprop_version = KPROP_PROT_VERSION;
58 
59 char	*progname = 0;
60 int     debug = 0;
61 char	*srvtab = 0;
62 char	*slave_host;
63 char	*realm = 0;
64 char	*file = KPROP_DEFAULT_FILE;
65 short	port = 0;
66 
67 krb5_principal	my_principal;		/* The Kerberos principal we'll be */
68 				/* running under, initialized in */
69 				/* get_tickets() */
70 krb5_ccache	ccache;		/* Credentials cache which we'll be using */
71 krb5_creds	creds;
72 krb5_address	sender_addr;
73 krb5_address	receiver_addr;
74 
75 void	PRS
76 	 (int, char **);
77 void	get_tickets
78 	 (krb5_context);
79 static void usage
80 	 (void);
81 krb5_error_code open_connection
82 	(char *, int *, char *, int);
83 void	kerberos_authenticate
84 	 (krb5_context, krb5_auth_context *,
85 		   int, krb5_principal, krb5_creds **);
86 int	open_database
87 	 (krb5_context, char *, int *);
88 void	close_database
89 	 (krb5_context, int);
90 void	xmit_database
91 	 (krb5_context, krb5_auth_context, krb5_creds *,
92 		   int, int, int);
93 void	send_error
94 	 (krb5_context, krb5_creds *, int, char *, krb5_error_code);
95 void	update_last_prop_file
96 	 (char *, char *);
97 
98 static void usage()
99 {
100 	fprintf(stderr,
101 		gettext
102 		("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"),
103 		progname);
104 	exit(1);
105 }
106 
107 int
108 main(argc, argv)
109 	int	argc;
110 	char	**argv;
111 {
112 	int	fd, database_fd, database_size;
113 	krb5_error_code	retval;
114 	krb5_context context;
115 	krb5_creds *my_creds;
116 	krb5_auth_context auth_context;
117 #define	ERRMSGSIZ	256
118 	char	Errmsg[ERRMSGSIZ];
119 
120 	(void) setlocale(LC_ALL, "");
121 
122 #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
123 #define	TEXT_DOMAIN	"KPROP_TEST"	/* Use this only if it weren't */
124 #endif
125 
126 	(void) textdomain(TEXT_DOMAIN);
127 
128 	retval = krb5_init_context(&context);
129 	if (retval) {
130 		com_err(argv[0], retval, gettext("while initializing krb5"));
131 		exit(1);
132 	}
133 	PRS(argc, argv);
134 	get_tickets(context);
135 
136 	database_fd = open_database(context, file, &database_size);
137 	if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) {
138 		com_err(progname, retval, gettext("%s while opening connection to %s"),
139 			Errmsg, slave_host);
140 		exit(1);
141 	}
142 	if (fd < 0) {
143 		fprintf(stderr,
144 			gettext("%s: %s while opening connection to %s\n"),
145 			progname, Errmsg, slave_host);
146 		exit(1);
147 	}
148 	kerberos_authenticate(context, &auth_context, fd, my_principal,
149 			      &my_creds);
150 	xmit_database(context, auth_context, my_creds, fd, database_fd,
151 		      database_size);
152 	update_last_prop_file(slave_host, file);
153 	printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host);
154 	krb5_free_cred_contents(context, my_creds);
155 	close_database(context, database_fd);
156 	exit(0);
157 }
158 void PRS(argc, argv)
159 	int	argc;
160 	char	**argv;
161 {
162 	int c;
163 	register char	*word, ch;
164 	extern int optind;
165 	extern char *optarg;
166 
167 	progname = argv[0];
168 	while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) {
169 		switch (c) {
170 				case 'r':
171 			realm = optarg;
172 					if (!realm)
173 						usage();
174 					break;
175 				case 'f':
176 			file = optarg;
177 					if (!file)
178 						usage();
179 					break;
180 				case 'd':
181 					debug++;
182 					break;
183 				case 'P':
184 			port = atoi(optarg);
185 					if (!port)
186 						usage();
187 					break;
188 				case 's':
189 			srvtab = optarg;
190 					if (!srvtab)
191 						usage();
192 					break;
193 		case '?':
194 				default:
195 			printf (gettext("Error \n"));
196 					usage();
197 				}
198 			}
199 	argc -= optind;
200 	argv = &argv[optind];
201 	if (*argv)
202 		slave_host = *argv;
203 			else
204 		usage();
205 
206 }
207 
208 void get_tickets(context)
209     krb5_context context;
210 {
211 	char   my_host_name[MAXHOSTNAMELEN];
212 	char   buf[BUFSIZ];
213 	char   *cp;
214 	struct hostent *hp;
215 	krb5_error_code retval;
216 	static char tkstring[] = "/tmp/kproptktXXXXXX";
217 	krb5_keytab keytab = NULL;
218 	krb5_get_init_creds_opt opt;
219 	char *svcname = NULL;
220 	char *def_realm = NULL;
221 	char *master_host = NULL;
222 
223 
224 	/*
225 	 * Figure out what tickets we'll be using to send stuff
226 	 */
227 	if (realm) {
228 	    if ((def_realm = strdup(realm)) == NULL) {
229 	      com_err(progname, ENOMEM,
230 		      gettext("while allocating default realm name '%s'"),
231 		      realm);
232 	      exit(1);
233 	    }
234 	} else {
235 	    retval = krb5_get_default_realm(context, &def_realm);
236 	    if (retval) {
237 	        com_err(progname, retval,
238 			gettext("while getting default realm"));
239 	        exit(1);
240 	    }
241 	}
242 
243 	/*
244 	 * Always pick up the master hostname from krb5.conf, as
245 	 * opposed to picking up the localhost, so we do not get bit
246 	 * if the master KDC is HA and hence points to a logicalhost.
247 	 */
248 	retval = kadm5_get_master(context, def_realm, &master_host);
249 	if (retval) {
250 	    free(def_realm);
251 	    com_err(progname, retval,
252 		gettext("while getting admin server fqdn"));
253 	    exit(1);
254 	}
255 
256 	retval = krb5_sname_to_principal(context, master_host, NULL,
257 					 KRB5_NT_SRV_HST, &my_principal);
258 
259 	free(def_realm);
260 	free(master_host);
261 	if (retval) {
262 	    com_err(progname, errno, gettext("while setting client principal name"));
263 	    exit(1);
264 	}
265 
266 	if (realm) {
267 	    (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data);
268 	    krb5_princ_set_realm_length(context, my_principal, strlen(realm));
269 	    krb5_princ_set_realm_data(context, my_principal, strdup(realm));
270 	}
271 #if 0
272 	krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL;
273 #endif
274 
275 	/*
276 	 * Initialize cache file which we're going to be using
277 	 */
278 	(void) mktemp(tkstring);
279 	snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring);
280 	if (retval = krb5_cc_resolve(context, buf, &ccache)) {
281 		com_err(progname, retval, gettext("while opening credential cache %s"),
282 			buf);
283 		exit(1);
284 	}
285 	if (retval = krb5_cc_initialize(context, ccache, my_principal)) {
286 		com_err (progname, retval, gettext("when initializing cache %s"),
287 			 buf);
288 		exit(1);
289 	}
290 
291 	/*
292 	 * Get the tickets we'll need.
293 	 *
294 	 * Construct the principal name for the slave host.
295 	 */
296 	memset((char *)&creds, 0, sizeof(creds));
297 	retval = krb5_sname_to_principal(context,
298 					 slave_host, KPROP_SERVICE_NAME,
299 					 KRB5_NT_SRV_HST, &creds.server);
300 	if (retval) {
301 	    com_err(progname, errno, gettext("while setting server principal name"));
302 	    (void) krb5_cc_destroy(context, ccache);
303 	    exit(1);
304 	}
305 	if (realm) {
306 	    (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data);
307 	    krb5_princ_set_realm_length(context, creds.server, strlen(realm));
308 	    krb5_princ_set_realm_data(context, creds.server, strdup(realm));
309 	}
310 
311 	/*
312 	 * Now fill in the client....
313 	 */
314 	if (retval = krb5_copy_principal(context, my_principal, &creds.client)) {
315 		com_err(progname, retval, gettext("While copying client principal"));
316 		(void) krb5_cc_destroy(context, ccache);
317 		exit(1);
318 	}
319 	if (srvtab) {
320 		if (retval = krb5_kt_resolve(context, srvtab, &keytab)) {
321 			com_err(progname, retval, gettext("while resolving keytab"));
322 			(void) krb5_cc_destroy(context, ccache);
323 			exit(1);
324 		}
325 	}
326 	(void) memset(&opt, 0, sizeof (opt));
327 	krb5_get_init_creds_opt_init(&opt);
328 	retval = krb5_unparse_name(context,  creds.server, &svcname);
329 	if (retval) {
330 		com_err(progname, errno, gettext("while parsing svc principal name"));
331 		(void) krb5_cc_destroy(context, ccache);
332 		exit (1);
333 	}
334 	retval = krb5_get_init_creds_keytab(context, &creds, creds.client,
335 				keytab,  0, svcname, &opt);
336 
337 	if (svcname)
338 		free(svcname);
339 
340 	if (retval) {
341 		com_err(progname, retval, gettext("while getting initial ticket\n"));
342 		(void) krb5_cc_destroy(context, ccache);
343 		exit(1);
344 	}
345 
346 	if (keytab)
347 	    (void) krb5_kt_close(context, keytab);
348 
349 	/*
350 	 * Now destroy the cache right away --- the credentials we
351 	 * need will be in my_creds.
352 	 */
353 	if (retval = krb5_cc_destroy(context, ccache)) {
354 		com_err(progname, retval, gettext("while destroying ticket cache"));
355 		exit(1);
356 	}
357 }
358 
359 /* SUNW14resync - SOCKET is defed in 1.4 in port-sockets.h */
360 #ifdef SOCKET
361 #undef SOCKET
362 #endif
363 
364 krb5_error_code
365 open_connection(host, fd, Errmsg, ErrmsgSz)
366 	char	*host;
367 	int	*fd;
368 	char	*Errmsg;
369 	int	 ErrmsgSz;
370 {
371 	int	s;
372 	krb5_error_code	retval;
373 
374 	int	socket_length;
375 	struct addrinfo hints, *ai, *aitop;
376 	struct sockaddr_storage	  ss;
377 	char serv_or_port[NI_MAXSERV];
378 	enum err_types {SOCKET, CONNECT};
379 	int which_err;
380 
381 	memset(&hints, 0, sizeof(hints));
382 	hints.ai_family = AF_UNSPEC;    /* go for either IPv4 or v6 */
383 	hints.ai_socktype = SOCK_STREAM;
384 
385 	if (port != 0)
386 		(void) snprintf(serv_or_port, sizeof(serv_or_port), ("%hu"),
387 				port);
388 	else
389 		strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port));
390 
391 	if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) {
392 		(void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"),
393 				host);
394 		*fd = -1;
395 		return(0);
396 	}
397 
398 	for (ai = aitop; ai; ai = ai->ai_next) {
399 		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
400 			continue;
401 
402 		s = socket(ai->ai_family, SOCK_STREAM, 0);
403 		if (s < 0) {
404 			which_err = SOCKET;
405 			retval = errno;
406 			continue;
407 		}
408 
409 		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
410 		    errno != EINPROGRESS) {
411 			which_err = CONNECT;
412 			retval = errno;
413 			close(s);
414 			continue;	/* fail -- try next */
415 		}
416 
417 		break; /* success */
418 	}
419 
420 	if (ai == NULL) {
421 		switch (which_err) {
422 			case SOCKET:
423 				(void) snprintf(Errmsg, ERRMSGSIZ,
424 						gettext("in call to socket"));
425 				break;
426 			case CONNECT:
427 				(void) snprintf(Errmsg, ERRMSGSIZ,
428 						gettext("in call to connect"));
429 				break;
430 			default :
431 				retval = -1; /* generic error */
432 				(void) snprintf(Errmsg, ERRMSGSIZ,
433 					gettext("could not setup network"));
434 				break;
435 		}
436 		if (aitop != NULL)
437 			freeaddrinfo(aitop);
438 		return(retval);
439 	}
440 
441 	*fd = s;
442 
443 	/*
444 	 * Set receiver_addr and sender_addr.
445 	 */
446 	if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr)
447 			== NULL) {
448 		retval = errno;
449 		com_err(progname, errno,
450 			gettext("while converting socket address"));
451 		if (aitop != NULL)
452 			freeaddrinfo(aitop);
453 		return(retval);
454 	}
455 	if (aitop != NULL)
456 		freeaddrinfo(aitop);
457 
458 	socket_length = sizeof(ss);
459 	if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) {
460 		retval = errno;
461 		close(s);
462 		(void) snprintf(Errmsg, ERRMSGSIZ,
463 				gettext("in call to getsockname"));
464 		return(retval);
465 	}
466 
467 	if (cvtkaddr(&ss, &sender_addr) == NULL) {
468 		retval = errno;
469 		com_err(progname, errno,
470 			gettext("while converting socket address"));
471 		return(retval);
472 	}
473 
474 	return(0);
475 }
476 
477 
478 void kerberos_authenticate(context, auth_context, fd, me, new_creds)
479     krb5_context context;
480     krb5_auth_context *auth_context;
481     int	fd;
482     krb5_principal me;
483     krb5_creds ** new_creds;
484 {
485 	krb5_error_code	retval;
486 	krb5_error	*error = NULL;
487 	krb5_ap_rep_enc_part	*rep_result;
488 
489     if (retval = krb5_auth_con_init(context, auth_context))
490 	exit(1);
491 
492     krb5_auth_con_setflags(context, *auth_context,
493 			   KRB5_AUTH_CONTEXT_DO_SEQUENCE);
494 
495     if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr,
496 				        &receiver_addr)) {
497 	com_err(progname, retval, gettext("in krb5_auth_con_setaddrs"));
498 	exit(1);
499     }
500 
501 	if (retval = krb5_sendauth(context, auth_context, (void *)&fd,
502 				   kprop_version, me, creds.server,
503 				   AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
504 				   &error, &rep_result, new_creds)) {
505 		com_err(progname, retval, gettext("while authenticating to server"));
506 		if (error) {
507 			if (error->error == KRB_ERR_GENERIC) {
508 				if (error->text.data)
509 					fprintf(stderr,
510 						gettext("Generic remote error: %s\n"),
511 						error->text.data);
512 			} else if (error->error) {
513 				com_err(progname,
514 					error->error + ERROR_TABLE_BASE_krb5,
515 					gettext("signalled from server"));
516 				if (error->text.data)
517 					fprintf(stderr,
518 					gettext("Error text from server: %s\n"),
519 						error->text.data);
520 			}
521 			krb5_free_error(context, error);
522 		}
523 		exit(1);
524 	}
525 	krb5_free_ap_rep_enc_part(context, rep_result);
526 }
527 
528 char * dbpathname;
529 /*
530  * Open the Kerberos database dump file.  Takes care of locking it
531  * and making sure that the .ok file is more recent that the database
532  * dump file itself.
533  *
534  * Returns the file descriptor of the database dump file.  Also fills
535  * in the size of the database file.
536  */
537 int
538 open_database(context, data_fn, size)
539     krb5_context context;
540     char *data_fn;
541     int	*size;
542 {
543 	int		fd;
544 	int		err;
545 	struct stat 	stbuf, stbuf_ok;
546 	char		*data_ok_fn;
547 	static char ok[] = ".dump_ok";
548 
549 	dbpathname = strdup(data_fn);
550 	if (!dbpathname) {
551  	    com_err(progname, ENOMEM, gettext("allocating database file name '%s'"),
552  		    data_fn);
553  	    exit(1);
554  	}
555 	if ((fd = open(dbpathname, O_RDONLY)) < 0) {
556 		com_err(progname, errno, gettext("while trying to open %s"),
557 			dbpathname);
558 		exit(1);
559 	}
560 
561 	err = krb5_lock_file(context, fd,
562 			     KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
563 	if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
564 	    com_err(progname, 0, gettext("database locked"));
565 	    exit(1);
566 	} else if (err) {
567 	    com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname);
568 	    exit(1);
569 	}
570 	if (fstat(fd, &stbuf)) {
571 		com_err(progname, errno, gettext("while trying to stat %s"),
572 			data_fn);
573 		exit(1);
574 	}
575 	if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1))
576 	    == NULL) {
577 		com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn"));
578 		exit(1);
579 	}
580 	strcpy(data_ok_fn, data_fn);
581 	strcat(data_ok_fn, ok);
582 	if (stat(data_ok_fn, &stbuf_ok)) {
583 		com_err(progname, errno, gettext("while trying to stat %s"),
584 			data_ok_fn);
585 		free(data_ok_fn);
586 		exit(1);
587 	}
588 	free(data_ok_fn);
589 	if (stbuf.st_mtime > stbuf_ok.st_mtime) {
590 		com_err(progname, 0, gettext("'%s' more recent than '%s'."),
591 			data_fn, data_ok_fn);
592 		exit(1);
593 	}
594 	*size = stbuf.st_size;
595 	return(fd);
596 }
597 
598 void
599 close_database(context, fd)
600     krb5_context context;
601     int fd;
602 {
603     int err;
604     if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK))
605 	com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname);
606     free(dbpathname);
607     (void)close(fd);
608     return;
609 }
610 
611 /*
612  * Now we send over the database.  We use the following protocol:
613  * Send over a KRB_SAFE message with the size.  Then we send over the
614  * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV.
615  * Then we expect to see a KRB_SAFE message with the size sent back.
616  *
617  * At any point in the protocol, we may send a KRB_ERROR message; this
618  * will abort the entire operation.
619  */
620 void
621 xmit_database(context, auth_context, my_creds, fd, database_fd, database_size)
622     krb5_context context;
623     krb5_auth_context auth_context;
624     krb5_creds *my_creds;
625     int	fd;
626     int	database_fd;
627     int	database_size;
628 {
629 	krb5_int32	send_size, sent_size, n;
630 	krb5_data	inbuf, outbuf;
631 	char		buf[KPROP_BUFSIZ];
632 	krb5_error_code	retval;
633 	krb5_error	*error;
634 
635 	/*
636 	 * Send over the size
637 	 */
638 	send_size = htonl(database_size);
639 	inbuf.data = (char *) &send_size;
640 	inbuf.length = sizeof(send_size); /* must be 4, really */
641 	/* KPROP_CKSUMTYPE */
642 	if (retval = krb5_mk_safe(context, auth_context, &inbuf,
643 				  &outbuf, NULL)) {
644 		com_err(progname, retval, gettext("while encoding database size"));
645 		send_error(context, my_creds, fd, gettext("while encoding database size"), retval);
646 		exit(1);
647 	}
648 	if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) {
649 		krb5_free_data_contents(context, &outbuf);
650 		com_err(progname, retval, gettext("while sending database size"));
651 		exit(1);
652 	}
653 	krb5_free_data_contents(context, &outbuf);
654     /*
655      * Initialize the initial vector.
656      */
657     if (retval = krb5_auth_con_initivector(context, auth_context)) {
658 	send_error(context, my_creds, fd,
659 		   gettext("failed while initializing i_vector"), retval);
660 	com_err(progname, retval, gettext("while allocating i_vector"));
661 	exit(1);
662     }
663 	/*
664 	 * Send over the file, block by block....
665 	 */
666 	inbuf.data = buf;
667 	sent_size = 0;
668 	while (n = read(database_fd, buf, sizeof(buf))) {
669 		inbuf.length = n;
670 		if (retval = krb5_mk_priv(context, auth_context, &inbuf,
671 					  &outbuf, NULL)) {
672 			snprintf(buf, sizeof (buf),
673 				gettext("while encoding database block starting at %d"),
674 				sent_size);
675 			com_err(progname, retval, buf);
676 			send_error(context, my_creds, fd, buf, retval);
677 			exit(1);
678 		}
679 		if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) {
680 			krb5_free_data_contents(context, &outbuf);
681 			com_err(progname, retval,
682 				gettext("while sending database block starting at %d"),
683 				sent_size);
684 			exit(1);
685 		}
686 		krb5_free_data_contents(context, &outbuf);
687 		sent_size += n;
688 		if (debug)
689 			printf(gettext("%d bytes sent.\n"), sent_size);
690 	}
691 	if (sent_size != database_size) {
692 		com_err(progname, 0, gettext("Premature EOF found for database file!"));
693 		send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"),
694 			   KRB5KRB_ERR_GENERIC);
695 		exit(1);
696 	}
697 	/*
698 	 * OK, we've sent the database; now let's wait for a success
699 	 * indication from the remote end.
700 	 */
701 	if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) {
702 		com_err(progname, retval,
703 			gettext("while reading response from server"));
704 		exit(1);
705 	}
706 	/*
707 	 * If we got an error response back from the server, display
708 	 * the error message
709 	 */
710 	if (krb5_is_krb_error(&inbuf)) {
711 		if (retval = krb5_rd_error(context, &inbuf, &error)) {
712 			com_err(progname, retval,
713 				gettext("while decoding error response from server"));
714 			exit(1);
715 		}
716 		if (error->error == KRB_ERR_GENERIC) {
717 			if (error->text.data)
718 				fprintf(stderr,
719 				gettext("Generic remote error: %s\n"),
720 					error->text.data);
721 		} else if (error->error) {
722 			com_err(progname, error->error + ERROR_TABLE_BASE_krb5,
723 				gettext("signalled from server"));
724 			if (error->text.data)
725 				fprintf(stderr,
726 				gettext("Error text from server: %s\n"),
727 					error->text.data);
728 		}
729 		krb5_free_error(context, error);
730 		exit(1);
731 	}
732 	if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) {
733 		com_err(progname, retval,
734 			gettext("while decoding final size packet from server"));
735 		exit(1);
736 	}
737 	memcpy((char *)&send_size, outbuf.data, sizeof(send_size));
738 	send_size = ntohl(send_size);
739 	if (send_size != database_size) {
740 		com_err(progname, 0,
741 			gettext("Kpropd sent database size %d, expecting %d"),
742 			send_size, database_size);
743 		exit(1);
744 	}
745 	free(outbuf.data);
746 	free(inbuf.data);
747 }
748 
749 void
750 send_error(context, my_creds, fd, err_text, err_code)
751     krb5_context context;
752     krb5_creds *my_creds;
753     int	fd;
754     char	*err_text;
755     krb5_error_code	err_code;
756 {
757 	krb5_error	error;
758 	const char	*text;
759 	krb5_data	outbuf;
760 
761 	memset((char *)&error, 0, sizeof(error));
762 	krb5_us_timeofday(context, &error.ctime, &error.cusec);
763 	error.server = my_creds->server;
764 	error.client = my_principal;
765 	error.error = err_code - ERROR_TABLE_BASE_krb5;
766 	if (error.error > 127)
767 		error.error = KRB_ERR_GENERIC;
768 	if (err_text)
769 		text = err_text;
770 	else
771 		text = error_message(err_code);
772 	error.text.length = strlen(text) + 1;
773 	if (error.text.data = malloc(error.text.length)) {
774 		strcpy(error.text.data, text);
775 		if (!krb5_mk_error(context, &error, &outbuf)) {
776 			(void) krb5_write_message(context, (void *)&fd,&outbuf);
777 			krb5_free_data_contents(context, &outbuf);
778 		}
779 		free(error.text.data);
780 	}
781 }
782 
783 void update_last_prop_file(hostname, file_name)
784 	char *hostname;
785 	char *file_name;
786 {
787 	/* handle slave locking/failure stuff */
788 	char *file_last_prop;
789 	int fd;
790 	static char last_prop[]=".last_prop";
791 
792 	if ((file_last_prop = (char *)malloc(strlen(file_name) +
793 					     strlen(hostname) + 1 +
794 					     strlen(last_prop) + 1)) == NULL) {
795 		com_err(progname, ENOMEM,
796 			gettext("while allocating filename for update_last_prop_file"));
797 		return;
798 	}
799 	strcpy(file_last_prop, file_name);
800 
801 	/*
802 	 * If a nondefault file name was specified then we should not add an
803 	 * extraneous host name to the file name given that a file name could
804 	 * have already specified a host name and therefore would be redundant.
805 	 */
806 	if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) {
807 		strcat(file_last_prop, ".");
808 		strcat(file_last_prop, hostname);
809 	}
810 	strcat(file_last_prop, last_prop);
811 	if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
812 		com_err(progname, errno,
813 			gettext("while creating 'last_prop' file, '%s'"),
814 			file_last_prop);
815 		free(file_last_prop);
816 		return;
817 	}
818 	write(fd, "", 1);
819 	free(file_last_prop);
820 	close(fd);
821 	return;
822 }
823