xref: /titanic_41/usr/src/cmd/keyserv/keyserv.c (revision 146832db19eb2048b216b5dd0ba4424c7d0dfd17)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
28 /*	All Rights Reserved   */
29 
30 /*
31  * University Copyright- Copyright (c) 1982, 1986, 1988
32  * The Regents of the University of California
33  * All Rights Reserved
34  *
35  * University Acknowledgment- Portions of this document are derived from
36  * software developed by the University of California, Berkeley, and its
37  * contributors.
38  */
39 
40 /*
41  * keyserv - server for storing private encryption keys
42  *   keyserv(1M) performs multiple functions:  it stores secret keys per uid; it
43  *   performs public key encryption and decryption operations; and it generates
44  *   "random" keys.  keyserv(1M) will talk to no one but a local root process on
45  *   the local transport only.
46  */
47 
48 #include <stdio.h>
49 #include <stdio_ext.h>
50 #include <stdlib.h>
51 #include <sys/types.h>
52 #include <sys/stat.h>
53 #include <sys/uio.h>
54 #include <unistd.h>
55 #include <string.h>
56 #include <deflt.h>
57 #include <rpc/rpc.h>
58 #include <sys/param.h>
59 #include <sys/file.h>
60 #include <sys/resource.h>
61 #include <pwd.h>
62 #include <rpc/des_crypt.h>
63 #include <rpc/key_prot.h>
64 #include <thread.h>
65 #include "rpc/svc_mt.h"
66 #include <rpcsvc/nis_dhext.h>
67 #include <syslog.h>
68 #include <libscf.h>
69 
70 #include "debug.h"
71 #include "keyserv_cache.h"
72 
73 #ifdef KEYSERV_RANDOM
74 extern long random();
75 #endif
76 
77 extern keystatus pk_setkey();
78 extern keystatus pk_encrypt();
79 extern keystatus pk_decrypt();
80 extern keystatus pk_netput();
81 extern keystatus pk_netget();
82 extern keystatus pk_get_conv_key();
83 extern bool_t svc_get_local_cred();
84 
85 extern keystatus pk_setkey3();
86 extern keystatus pk_encrypt3();
87 extern keystatus pk_decrypt3();
88 extern keystatus pk_netput3();
89 extern keystatus pk_netget3();
90 extern keystatus pk_get_conv_key3();
91 extern keystatus pk_clear3();
92 
93 extern int init_mechs();
94 extern int addmasterkey();
95 extern int storeotherrootkeys();
96 extern int setdeskeyarray();
97 
98 extern int getdomainname();
99 
100 static void randomize();
101 static void usage();
102 static void defaults();
103 static int getrootkey();
104 static int get_cache_size(char *);
105 static bool_t get_auth();
106 
107 #ifdef DEBUG
108 extern int test_debug();
109 extern int real_debug();
110 int debugging = 1;
111 #else
112 int debugging = 0;
113 #endif
114 
115 static void keyprogram();
116 static des_block masterkey;
117 char *getenv();
118 static char ROOTKEY[] = "/etc/.rootkey";
119 
120 static char *defaults_file = "/etc/default/keyserv";
121 static int use_nobody_keys = TRUE;
122 
123 /*
124  * Hack to allow the keyserver to use AUTH_DES. The only functions
125  * that get called are key_encryptsession_pk, key_decryptsession_pk,
126  * and key_gendes.
127  *
128  * The approach is to have the keyserver fill in pointers to local
129  * implementations of these functions, and to call those in key_call().
130  */
131 
132 bool_t __key_encrypt_pk_2_svc();
133 bool_t __key_decrypt_pk_2_svc();
134 bool_t __key_gen_1_svc();
135 
136 extern bool_t (*__key_encryptsession_pk_LOCAL)();
137 extern bool_t (*__key_decryptsession_pk_LOCAL)();
138 extern bool_t (*__key_gendes_LOCAL)();
139 
140 static int nthreads = 32;
141 
142 /* Disk caching of common keys on by default */
143 int disk_caching = 1;
144 
145 mechanism_t **mechs;
146 
147 /*
148  * The default size for all types of mech.
149  * positive integers denote multiples of 1MB
150  * negative integers denote number of entries
151  * same goes for non-null entries in cache_size
152  */
153 static int default_cache = 1;
154 
155 int *cache_size;
156 char **cache_options;
157 
158 int
159 main(int argc, char *argv[])
160 {
161 	int sflag = 0, s1flag = 0, s2flag = 0, nflag = 0, dflag = 0, eflag = 0;
162 	char *options, *value;
163 	extern char *optarg;
164 	extern int optind;
165 	int c, d;
166 	struct rlimit rl;
167 	int mode = RPC_SVC_MT_AUTO;
168 	int maxrecsz = RPC_MAXDATASIZE;
169 
170 	void detachfromtty(void);
171 	int setmodulus();
172 	int pk_nodefaultkeys();
173 	int svc_create_local_service();
174 
175 	char domainname[MAXNETNAMELEN + 1];
176 
177 	/*
178 	 * Set our allowed number of file descriptors to the max
179 	 * of what the system will allow, limited by FD_SETSIZE.
180 	 */
181 	if (getrlimit(RLIMIT_NOFILE, &rl) == 0) {
182 		rlim_t limit;
183 
184 		if ((limit = rl.rlim_max) > FD_SETSIZE)
185 			limit = FD_SETSIZE;
186 		rl.rlim_cur = limit;
187 		(void) setrlimit(RLIMIT_NOFILE, &rl);
188 		(void) enable_extended_FILE_stdio(-1, -1);
189 	}
190 
191 	__key_encryptsession_pk_LOCAL = &__key_encrypt_pk_2_svc;
192 	__key_decryptsession_pk_LOCAL = &__key_decrypt_pk_2_svc;
193 	__key_gendes_LOCAL = &__key_gen_1_svc;
194 
195 	/*
196 	 * Pre-option initialisation
197 	 */
198 	(void) umask(066);	/* paranoia */
199 	if (geteuid() != 0) {
200 		(void) fprintf(stderr, "%s must be run as root\n", argv[0]);
201 		exit(1);
202 	}
203 	setmodulus(HEXMODULUS);
204 	openlog("keyserv", LOG_PID, LOG_DAEMON);
205 
206 	/*
207 	 * keyserv will not work with a null domainname.
208 	 */
209 	if (getdomainname(domainname, MAXNETNAMELEN+1) ||
210 	    (domainname[0] == '\0')) {
211 		syslog(LOG_ERR, "could not get a valid domainname.\n");
212 		exit(SMF_EXIT_ERR_CONFIG);
213 	}
214 
215 	/*
216 	 * Initialise security mechanisms
217 	 */
218 	cache_size = NULL;
219 	cache_options = NULL;
220 	if (init_mechs() == -1) {
221 		disk_caching = 0;
222 	}
223 
224 	defaults();
225 
226 	while ((c = getopt(argc, argv, "ndDet:cs:")) != -1)
227 		switch (c) {
228 		case 'n':
229 			nflag++;
230 			break;
231 		case 'd':
232 			dflag++;
233 			use_nobody_keys = FALSE;
234 			break;
235 		case 'e':
236 			eflag++;
237 			use_nobody_keys = TRUE;
238 			break;
239 		case 'D':
240 			debugging = 1;
241 			break;
242 		case 't':
243 			nthreads = atoi(optarg);
244 			break;
245 		case 'c':
246 			disk_caching = 0;
247 			break;
248 		case 's':
249 			if (!disk_caching) {
250 				fprintf(stderr, "missing configuration file");
251 				fprintf(stderr, " or -c option specified\n");
252 				usage();
253 			}
254 			sflag++;
255 			/*
256 			 * Which version of [-s] do we have...?
257 			 */
258 			if (strchr((const char *) optarg, '=') == NULL) {
259 				/*
260 				 * -s <size>
261 				 */
262 				if (s1flag) {
263 					fprintf(stderr, "duplicate"
264 					    " [-s <size>]\n");
265 					usage();
266 				}
267 				s1flag++;
268 				default_cache = get_cache_size(optarg);
269 				break;
270 			}
271 			/*
272 			 * -s <mechtype>=<size>[,...]
273 			 */
274 			s2flag++;
275 			options = optarg;
276 			while (*options != '\0') {
277 				d = getsubopt(&options, cache_options, &value);
278 				if (d == -1) {
279 					/* Ignore unknown mechtype */
280 					continue;
281 				}
282 				if (value == NULL) {
283 					fprintf(stderr,
284 					    "missing cache size for "
285 					    "mechtype %s\n", cache_options[d]);
286 					usage();
287 				}
288 				cache_size[d] = get_cache_size(value);
289 			}
290 			break;
291 		default:
292 			usage();
293 			break;
294 		}
295 
296 
297 	if (dflag && eflag) {
298 		(void) fprintf(stderr, "specify only one of -d and -e\n");
299 		usage();
300 	}
301 
302 	if (use_nobody_keys == FALSE) {
303 		pk_nodefaultkeys();
304 	}
305 
306 	if (optind != argc) {
307 		usage();
308 	}
309 
310 	if (!disk_caching && sflag) {
311 		fprintf(stderr, "missing configuration file");
312 		fprintf(stderr, " or -c option specified\n");
313 		usage();
314 	}
315 
316 	if (debugging) {
317 		if (disk_caching) {
318 			char **cpp = cache_options;
319 			int *ip = cache_size;
320 			(void) fprintf(stderr, "default disk cache size: ");
321 			if (default_cache < 0) {
322 				(void) fprintf(stderr, "%d entries\n",
323 				    abs(default_cache));
324 			} else {
325 				(void) fprintf(stderr, "%dMB\n", default_cache);
326 			}
327 
328 			(void) fprintf(stderr, "supported mechanisms:\n");
329 			(void) fprintf(stderr, "\talias\t\tdisk cache size\n");
330 			(void) fprintf(stderr, "\t=====\t\t===============\n");
331 			while (*cpp != NULL) {
332 				(void) fprintf(stderr, "\t%s\t\t", *cpp++);
333 				if (*ip < 0) {
334 					(void) fprintf(stderr, "%d entries\n",
335 					    abs(*ip));
336 				} else {
337 					(void) fprintf(stderr, "%dMB\n", *ip);
338 				}
339 				ip++;
340 			}
341 		} else {
342 			(void) fprintf(stderr,
343 			    "common key disk caching disabled\n");
344 		}
345 	}
346 	/*
347 	 * Post-option initialisation
348 	 */
349 	if (disk_caching) {
350 		int i;
351 		for (i = 0; mechs[i]; i++) {
352 			if ((AUTH_DES_COMPAT_CHK(mechs[i])) ||
353 			    (mechs[i]->keylen < 0) || (mechs[i]->algtype < 0))
354 				continue;
355 			create_cache_file(mechs[i]->keylen, mechs[i]->algtype,
356 			    cache_size[i] ? cache_size[i] : default_cache);
357 		}
358 	}
359 	getrootkey(&masterkey, nflag);
360 
361 	/*
362 	 * Set MT mode
363 	 */
364 	if (nthreads > 0) {
365 		(void) rpc_control(RPC_SVC_MTMODE_SET, &mode);
366 		(void) rpc_control(RPC_SVC_THRMAX_SET, &nthreads);
367 	}
368 
369 	/*
370 	 * Enable non-blocking mode and maximum record size checks for
371 	 * connection oriented transports.
372 	 */
373 	if (!rpc_control(RPC_SVC_CONNMAXREC_SET, &maxrecsz)) {
374 		syslog(LOG_INFO, "unable to set max RPC record size");
375 	}
376 
377 	if (svc_create_local_service(keyprogram, KEY_PROG, KEY_VERS,
378 	    "netpath", "keyserv") == 0) {
379 		syslog(LOG_ERR,
380 		    "%s: unable to create service for version %d\n",
381 		    argv[0], KEY_VERS);
382 		exit(1);
383 	}
384 
385 	if (svc_create_local_service(keyprogram, KEY_PROG, KEY_VERS2,
386 	    "netpath", "keyserv") == 0) {
387 		syslog(LOG_ERR,
388 		    "%s: unable to create service for version %d\n",
389 		    argv[0], KEY_VERS2);
390 		exit(1);
391 	}
392 
393 	if (svc_create_local_service(keyprogram, KEY_PROG, KEY_VERS3,
394 	    "netpath", "keyserv") == 0) {
395 		syslog(LOG_ERR,
396 		    "%s: unable to create service for version %d\n",
397 		    argv[0], KEY_VERS3);
398 		exit(1);
399 	}
400 
401 	if (!debugging) {
402 		detachfromtty();
403 	}
404 
405 	if (svc_create(keyprogram, KEY_PROG, KEY_VERS, "door") == 0) {
406 		syslog(LOG_ERR,
407 		    "%s: unable to create service over doors for version %d\n",
408 		    argv[0], KEY_VERS);
409 		exit(1);
410 	}
411 
412 	if (svc_create(keyprogram, KEY_PROG, KEY_VERS2, "door") == 0) {
413 		syslog(LOG_ERR,
414 		    "%s: unable to create service over doors for version %d\n",
415 		    argv[0], KEY_VERS2);
416 		exit(1);
417 	}
418 
419 	if (svc_create(keyprogram, KEY_PROG, KEY_VERS3, "door") == 0) {
420 		syslog(LOG_ERR,
421 		    "%s: unable to create service over doors for version %d\n",
422 		    argv[0], KEY_VERS3);
423 		exit(1);
424 	}
425 
426 	svc_run();
427 	abort();
428 	/* NOTREACHED */
429 	return (0);
430 }
431 
432 
433 /*
434  * In the event that we don't get a root password, we try to
435  * randomize the master key the best we can
436  */
437 static void
438 randomize(master)
439 	des_block *master;
440 {
441 	int i;
442 	int seed;
443 	struct timeval tv;
444 	int shift;
445 
446 	seed = 0;
447 	for (i = 0; i < 1024; i++) {
448 		(void) gettimeofday(&tv, (struct timezone *)NULL);
449 		shift = i % 8 * sizeof (int);
450 		seed ^= (tv.tv_usec << shift) | (tv.tv_usec >> (32 - shift));
451 	}
452 #ifdef KEYSERV_RANDOM
453 	srandom(seed);
454 	master->key.low = random();
455 	master->key.high = random();
456 	srandom(seed);
457 #else
458 	/* use stupid dangerous bad rand() */
459 	srand(seed);
460 	master->key.low = rand();
461 	master->key.high = rand();
462 	srand(seed);
463 #endif
464 }
465 
466 static char *
467 fgets_ignorenul(char *s, int n, FILE *stream)
468 {
469 	int fildes = fileno(stream);
470 	int i = 0;
471 	int rs = 0;
472 	char c;
473 
474 	if (fildes < 0)
475 		return (NULL);
476 
477 	while (i < n - 1) {
478 		rs = read(fildes, &c, 1);
479 		switch (rs) {
480 		case 1:
481 			break;
482 		case 0:
483 			/* EOF */
484 			if (i > 0)
485 				s[i] = '\0';
486 			return (NULL);
487 			break;
488 		default:
489 			return (NULL);
490 		}
491 		switch (c) {
492 		case '\0':
493 			break;
494 		case '\n':
495 			s[i] = c;
496 			s[++i] = '\0';
497 			return (s);
498 		default:
499 		if (c != '\0')
500 			s[i++] = c;
501 		}
502 	}
503 	s[i] = '\0';
504 	return (s);
505 }
506 
507 /* Should last until 16384-bit DH keys */
508 #define	MAXROOTKEY_LINE_LEN	4224
509 #define	MAXROOTKEY_LEN		4096
510 #define	ROOTKEY_FILE		"/etc/.rootkey"
511 
512 static int
513 getotherrootkeys(char *name)
514 {
515 	FILE		*rootkey;
516 	char		line[MAXROOTKEY_LINE_LEN];
517 	char		key[MAXROOTKEY_LEN];
518 	algtype_t	algtype;
519 	int		count = 0;
520 
521 	if (!(rootkey = fopen(ROOTKEY, "r")))
522 		return (0);
523 
524 	while (fgets_ignorenul(line, MAXROOTKEY_LINE_LEN, rootkey)) {
525 		debug(KEYSERV_DEBUG0, ("ROOTKEY %d: %s\n", count, line));
526 		count++;
527 		if (sscanf(line, "%s %d", key, &algtype) < 2) {
528 			/*
529 			 * No encryption algorithm found in the file
530 			 * (algtype) so default to DES.
531 			 */
532 			algtype = AUTH_DES_ALGTYPE;
533 		}
534 		if (!strlen(key))
535 			continue;
536 		addmasterkey(key, name, algtype);
537 	}
538 	fclose(rootkey);
539 	return (1);
540 }
541 
542 /*
543  * Try to get root's secret key, by prompting if terminal is a tty, else trying
544  * from standard input.
545  * Returns 1 on success.
546  */
547 static int
548 getrootkey(master, prompt)
549 	des_block *master;
550 	int prompt;
551 {
552 	char *passwd;
553 	char name[MAXNETNAMELEN + 1];
554 	char secret[HEXKEYBYTES + 1];
555 	FILE *fp;
556 	int passwd2des();
557 	int retval;
558 
559 	randomize(master);
560 	if (!getnetname(name)) {
561 	    (void) fprintf(stderr, "keyserv: \
562 failed to generate host's netname when establishing root's key.\n");
563 	    return (0);
564 	}
565 	if (!prompt) {
566 		return (getotherrootkeys(name));
567 	}
568 	/*
569 	 * Decrypt yellow pages publickey entry to get secret key
570 	 */
571 	passwd = getpass("root password:");
572 	passwd2des(passwd, master);
573 	if (!getsecretkey(name, secret, passwd)) {
574 		(void) fprintf(stderr,
575 		"Can't find %s's secret key\n", name);
576 		return (0);
577 	}
578 	if (secret[0] == 0) {
579 		(void) fprintf(stderr,
580 	"Password does not decrypt secret key for %s\n", name);
581 		return (0);
582 	}
583 	if ((fp = fopen(ROOTKEY, "w")) == NULL) {
584 		(void) fprintf(stderr,
585 			"Cannot open %s for write\n", ROOTKEY);
586 		return (0);
587 	}
588 	retval = storeotherrootkeys(fp, name, passwd, secret);
589 	fclose(fp);
590 	return (retval);
591 }
592 
593 /*
594  * Procedures to implement RPC service.  These procedures are named
595  * differently from the definitions in key_prot.h (generated by rpcgen)
596  * because they take different arguments.
597  */
598 char *
599 strstatus(status)
600 	keystatus status;
601 {
602 	switch (status) {
603 	case KEY_SUCCESS:
604 		return ("KEY_SUCCESS");
605 	case KEY_NOSECRET:
606 		return ("KEY_NOSECRET");
607 	case KEY_UNKNOWN:
608 		return ("KEY_UNKNOWN");
609 	case KEY_SYSTEMERR:
610 		return ("KEY_SYSTEMERR");
611 	case KEY_BADALG:
612 		return ("KEY_BADALG");
613 	case KEY_BADLEN:
614 		return ("KEY_BADLEN");
615 	default:
616 		return ("(bad result code)");
617 	}
618 }
619 
620 bool_t
621 __key_set_1_svc(uid, key, status)
622 	uid_t uid;
623 	keybuf key;
624 	keystatus *status;
625 {
626 	if (debugging) {
627 		(void) fprintf(stderr, "set(%d, %.*s) = ", uid,
628 				sizeof (keybuf), key);
629 	}
630 	*status = pk_setkey(uid, key);
631 	if (debugging) {
632 		(void) fprintf(stderr, "%s\n", strstatus(*status));
633 		(void) fflush(stderr);
634 	}
635 	return (TRUE);
636 }
637 
638 bool_t
639 __key_encrypt_pk_2_svc(uid, arg, res)
640 	uid_t uid;
641 	cryptkeyarg2 *arg;
642 	cryptkeyres *res;
643 {
644 
645 	if (debugging) {
646 		(void) fprintf(stderr, "encrypt(%d, %s, %08x%08x) = ", uid,
647 				arg->remotename, arg->deskey.key.high,
648 				arg->deskey.key.low);
649 	}
650 	res->cryptkeyres_u.deskey = arg->deskey;
651 	res->status = pk_encrypt(uid, arg->remotename, &(arg->remotekey),
652 				&res->cryptkeyres_u.deskey);
653 	if (debugging) {
654 		if (res->status == KEY_SUCCESS) {
655 			(void) fprintf(stderr, "%08x%08x\n",
656 					res->cryptkeyres_u.deskey.key.high,
657 					res->cryptkeyres_u.deskey.key.low);
658 		} else {
659 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
660 		}
661 		(void) fflush(stderr);
662 	}
663 	return (TRUE);
664 }
665 
666 bool_t
667 __key_decrypt_pk_2_svc(uid, arg, res)
668 	uid_t uid;
669 	cryptkeyarg2 *arg;
670 	cryptkeyres *res;
671 {
672 
673 	if (debugging) {
674 		(void) fprintf(stderr, "decrypt(%d, %s, %08x%08x) = ", uid,
675 				arg->remotename, arg->deskey.key.high,
676 				arg->deskey.key.low);
677 	}
678 	res->cryptkeyres_u.deskey = arg->deskey;
679 	res->status = pk_decrypt(uid, arg->remotename, &(arg->remotekey),
680 				&res->cryptkeyres_u.deskey);
681 	if (debugging) {
682 		if (res->status == KEY_SUCCESS) {
683 			(void) fprintf(stderr, "%08x%08x\n",
684 					res->cryptkeyres_u.deskey.key.high,
685 					res->cryptkeyres_u.deskey.key.low);
686 		} else {
687 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
688 		}
689 		(void) fflush(stderr);
690 	}
691 	return (TRUE);
692 }
693 
694 bool_t
695 __key_net_put_2_svc(uid, arg, status)
696 	uid_t uid;
697 	key_netstarg *arg;
698 	keystatus *status;
699 {
700 
701 	if (debugging) {
702 		(void) fprintf(stderr, "net_put(%s, %.*s, %.*s) = ",
703 			arg->st_netname, sizeof (arg->st_pub_key),
704 			arg->st_pub_key, sizeof (arg->st_priv_key),
705 			arg->st_priv_key);
706 	};
707 
708 	*status = pk_netput(uid, arg);
709 
710 	if (debugging) {
711 		(void) fprintf(stderr, "%s\n", strstatus(*status));
712 		(void) fflush(stderr);
713 	}
714 
715 	return (TRUE);
716 }
717 
718 /* ARGSUSED */
719 bool_t
720 __key_net_get_2_svc(uid, arg, keynetname)
721 	uid_t uid;
722 	void *arg;
723 	key_netstres *keynetname;
724 {
725 
726 	if (debugging)
727 		(void) fprintf(stderr, "net_get(%d) = ", uid);
728 
729 	keynetname->status = pk_netget(uid, &keynetname->key_netstres_u.knet);
730 	if (debugging) {
731 		if (keynetname->status == KEY_SUCCESS) {
732 			fprintf(stderr, "<%s, %.*s, %.*s>\n",
733 			keynetname->key_netstres_u.knet.st_netname,
734 			sizeof (keynetname->key_netstres_u.knet.st_pub_key),
735 			keynetname->key_netstres_u.knet.st_pub_key,
736 			sizeof (keynetname->key_netstres_u.knet.st_priv_key),
737 			keynetname->key_netstres_u.knet.st_priv_key);
738 		} else {
739 			(void) fprintf(stderr, "NOT FOUND\n");
740 		}
741 		(void) fflush(stderr);
742 	}
743 
744 	return (TRUE);
745 
746 }
747 
748 bool_t
749 __key_get_conv_2_svc(uid, arg, res)
750 	uid_t uid;
751 	keybuf arg;
752 	cryptkeyres *res;
753 {
754 
755 	if (debugging)
756 		(void) fprintf(stderr, "get_conv(%d, %.*s) = ", uid,
757 			sizeof (arg), arg);
758 
759 
760 	res->status = pk_get_conv_key(uid, arg, res);
761 
762 	if (debugging) {
763 		if (res->status == KEY_SUCCESS) {
764 			(void) fprintf(stderr, "%08x%08x\n",
765 				res->cryptkeyres_u.deskey.key.high,
766 				res->cryptkeyres_u.deskey.key.low);
767 		} else {
768 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
769 		}
770 		(void) fflush(stderr);
771 	}
772 	return (TRUE);
773 }
774 
775 
776 bool_t
777 __key_encrypt_1_svc(uid, arg, res)
778 	uid_t uid;
779 	cryptkeyarg *arg;
780 	cryptkeyres *res;
781 {
782 
783 	if (debugging) {
784 		(void) fprintf(stderr, "encrypt(%d, %s, %08x%08x) = ", uid,
785 				arg->remotename, arg->deskey.key.high,
786 				arg->deskey.key.low);
787 	}
788 	res->cryptkeyres_u.deskey = arg->deskey;
789 	res->status = pk_encrypt(uid, arg->remotename, NULL,
790 				&res->cryptkeyres_u.deskey);
791 	if (debugging) {
792 		if (res->status == KEY_SUCCESS) {
793 			(void) fprintf(stderr, "%08x%08x\n",
794 					res->cryptkeyres_u.deskey.key.high,
795 					res->cryptkeyres_u.deskey.key.low);
796 		} else {
797 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
798 		}
799 		(void) fflush(stderr);
800 	}
801 	return (TRUE);
802 }
803 
804 bool_t
805 __key_decrypt_1_svc(uid, arg, res)
806 	uid_t uid;
807 	cryptkeyarg *arg;
808 	cryptkeyres *res;
809 {
810 	if (debugging) {
811 		(void) fprintf(stderr, "decrypt(%d, %s, %08x%08x) = ", uid,
812 				arg->remotename, arg->deskey.key.high,
813 				arg->deskey.key.low);
814 	}
815 	res->cryptkeyres_u.deskey = arg->deskey;
816 	res->status = pk_decrypt(uid, arg->remotename, NULL,
817 				&res->cryptkeyres_u.deskey);
818 	if (debugging) {
819 		if (res->status == KEY_SUCCESS) {
820 			(void) fprintf(stderr, "%08x%08x\n",
821 					res->cryptkeyres_u.deskey.key.high,
822 					res->cryptkeyres_u.deskey.key.low);
823 		} else {
824 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
825 		}
826 		(void) fflush(stderr);
827 	}
828 	return (TRUE);
829 }
830 
831 /* ARGSUSED */
832 bool_t
833 __key_gen_1_svc(v, s, key)
834 	void *v;
835 	struct svc_req *s;
836 	des_block *key;
837 {
838 	struct timeval time;
839 	static des_block keygen;
840 	static mutex_t keygen_mutex = DEFAULTMUTEX;
841 	int r;
842 
843 	(void) gettimeofday(&time, (struct timezone *)NULL);
844 	(void) mutex_lock(&keygen_mutex);
845 	keygen.key.high += (time.tv_sec ^ time.tv_usec);
846 	keygen.key.low += (time.tv_sec ^ time.tv_usec);
847 	r = ecb_crypt((char *)&masterkey, (char *)&keygen, sizeof (keygen),
848 		DES_ENCRYPT | DES_HW);
849 	if (r != DESERR_NONE && r != DESERR_NOHWDEVICE) {
850 		mutex_unlock(&keygen_mutex);
851 		return (FALSE);
852 	}
853 	*key = keygen;
854 	mutex_unlock(&keygen_mutex);
855 
856 	des_setparity_g(key);
857 	if (debugging) {
858 		(void) fprintf(stderr, "gen() = %08x%08x\n", key->key.high,
859 					key->key.low);
860 		(void) fflush(stderr);
861 	}
862 	return (TRUE);
863 }
864 
865 /* ARGSUSED */
866 bool_t
867 __key_getcred_1_svc(uid, name, res)
868 	uid_t uid;
869 	netnamestr *name;
870 	getcredres *res;
871 {
872 	struct unixcred *cred;
873 
874 	cred = &res->getcredres_u.cred;
875 	if (!netname2user(*name, (uid_t *)&cred->uid, (gid_t *)&cred->gid,
876 			(int *)&cred->gids.gids_len,
877 					(gid_t *)cred->gids.gids_val)) {
878 		res->status = KEY_UNKNOWN;
879 	} else {
880 		res->status = KEY_SUCCESS;
881 	}
882 	if (debugging) {
883 		(void) fprintf(stderr, "getcred(%s) = ", *name);
884 		if (res->status == KEY_SUCCESS) {
885 			(void) fprintf(stderr, "uid=%d, gid=%d, grouplen=%d\n",
886 				cred->uid, cred->gid, cred->gids.gids_len);
887 		} else {
888 			(void) fprintf(stderr, "%s\n", strstatus(res->status));
889 		}
890 		(void) fflush(stderr);
891 	}
892 	return (TRUE);
893 }
894 
895 /*
896  * Version 3 procedures follow...
897  */
898 
899 static bool_t
900 __key_set_3_svc(uid_t uid, setkeyarg3 *arg, keystatus *status)
901 {
902 	debug(KEYSERV_DEBUG, ("__key_set_3_svc(%d, %d, %d)",
903 	    uid, arg->algtype, arg->keylen));
904 	*status = pk_setkey3(uid, arg);
905 	debug(KEYSERV_DEBUG, ("__key_set_3_svc %s", strstatus(*status)));
906 	return (TRUE);
907 }
908 
909 static bool_t
910 __key_encrypt_3_svc(uid_t uid, cryptkeyarg3 *arg, cryptkeyres3 *res)
911 {
912 	int len, i;
913 	des_block *dp;
914 
915 	debug(KEYSERV_DEBUG, ("encrypt_3(%d %d %s)", uid,
916 	    arg->deskey.deskeyarray_len, arg->remotename));
917 	res->status = pk_encrypt3(uid, arg, &res->cryptkeyres3_u.deskey);
918 	len = res->cryptkeyres3_u.deskey.deskeyarray_len;
919 	dp = res->cryptkeyres3_u.deskey.deskeyarray_val;
920 	for (i = 0; i < len; i++) {
921 		debug(KEYSERV_DEBUG0, ("encrypt_3 retval[%d] == (%x,%x)",
922 		    i, dp->key.high, dp->key.low));
923 		dp++;
924 	}
925 	debug(KEYSERV_DEBUG, ("encrypt_3 returned %s", strstatus(res->status)));
926 	return (TRUE);
927 }
928 
929 static bool_t
930 __key_decrypt_3_svc(uid_t uid, cryptkeyarg3 *arg, cryptkeyres3 *res)
931 {
932 	int len, i;
933 	des_block *dp;
934 
935 	debug(KEYSERV_DEBUG, ("decrypt_3(%d, %d, %s)", uid,
936 	    arg->deskey.deskeyarray_len, arg->remotename));
937 	res->status = pk_decrypt3(uid, arg, &res->cryptkeyres3_u.deskey);
938 	len = res->cryptkeyres3_u.deskey.deskeyarray_len;
939 	dp = res->cryptkeyres3_u.deskey.deskeyarray_val;
940 	for (i = 0; i < len; i++) {
941 		debug(KEYSERV_DEBUG0, ("decrypt_3 retval[%d] == (%x,%x)",
942 		    i, dp->key.high, dp->key.low));
943 		dp++;
944 	}
945 	debug(KEYSERV_DEBUG, ("decrypt_3 returned %s", strstatus(res->status)));
946 	return (TRUE);
947 }
948 
949 /* ARGSUSED */
950 static bool_t
951 __key_gen_3_svc(void *v, keynum_t *kp, deskeyarray *res)
952 {
953 	int i;
954 	keynum_t keynum = *kp;
955 
956 	debug(KEYSERV_DEBUG, ("gen_3(%d %x)", keynum, res));
957 	res->deskeyarray_val = 0;
958 	if (!setdeskeyarray(res, keynum)) {
959 		return (FALSE);
960 	}
961 	for (i = 0; i < keynum; i++) {
962 		debug(KEYSERV_DEBUG, ("gen_3 calling gen_1 %x",
963 		    res->deskeyarray_val+i));
964 		__key_gen_1_svc((void *) NULL, (struct svc_req *)NULL,
965 		    res->deskeyarray_val+i);
966 		debug(KEYSERV_DEBUG, ("gen_3 val %d %x",
967 		    i, *(int *)(res->deskeyarray_val+i)));
968 	}
969 	return (TRUE);
970 }
971 
972 static void
973 __key_gen_3_svc_free(deskeyarray *dp)
974 {
975 	free(dp->deskeyarray_val);
976 }
977 
978 static bool_t
979 __key_getcred_3_svc(uid_t uid, netnamestr *name, getcredres3 *res)
980 {
981 	return (__key_getcred_1_svc(uid, name, (getcredres *)res));
982 }
983 
984 static bool_t
985 __key_encrypt_pk_3_svc(uid_t uid, cryptkeyarg3 *arg, cryptkeyres3 *res)
986 {
987 	debug(KEYSERV_DEBUG, ("encrypt_pk_3(%d, %s)", uid, arg->remotename));
988 	res->status = pk_encrypt3(uid, arg, &res->cryptkeyres3_u.deskey);
989 	debug(KEYSERV_DEBUG, ("encrypt returned %s", strstatus(res->status)));
990 	return (TRUE);
991 }
992 
993 static void
994 __key_encrypt_pk_3_svc_free(cryptkeyres3 *res)
995 {
996 	if (res->status == KEY_SUCCESS) {
997 		free(res->cryptkeyres3_u.deskey.deskeyarray_val);
998 	}
999 }
1000 
1001 static bool_t
1002 __key_decrypt_pk_3(uid_t uid, cryptkeyarg3 *arg, cryptkeyres3 *res)
1003 {
1004 	debug(KEYSERV_DEBUG, ("decrypt_pk_3(%d, %s)", uid, arg->remotename));
1005 	res->status = pk_decrypt3(uid, arg, &res->cryptkeyres3_u.deskey);
1006 	debug(KEYSERV_DEBUG, ("encrypt returned %s", strstatus(res->status)));
1007 	return (TRUE);
1008 }
1009 
1010 static void
1011 __key_decrypt_pk_3_free(cryptkeyres3 *res)
1012 {
1013 	if (res->status == KEY_SUCCESS) {
1014 		free(res->cryptkeyres3_u.deskey.deskeyarray_val);
1015 	}
1016 }
1017 
1018 static bool_t
1019 __key_net_put_3_svc(uid_t uid, key_netstarg3 *arg, keystatus *status)
1020 {
1021 	debug(KEYSERV_DEBUG, ("net_put_3 (%d, %x)", uid, arg));
1022 	*status = pk_netput3(uid, arg);
1023 	debug(KEYSERV_DEBUG, ("net_put_3 ret %s", strstatus(*status)));
1024 	return (TRUE);
1025 }
1026 
1027 static bool_t
1028 __key_net_get_3_svc(uid_t uid, mechtype *arg, key_netstres3 *keynetname)
1029 {
1030 	debug(KEYSERV_DEBUG, ("net_get_3 (%d, %x)", uid, arg));
1031 	keynetname->status = pk_netget3(uid,
1032 	    arg, &keynetname->key_netstres3_u.knet);
1033 	debug(KEYSERV_DEBUG,
1034 	    ("net_get_3 ret %s", strstatus(keynetname->status)));
1035 	return (TRUE);
1036 }
1037 
1038 static void
1039 __key_net_get_3_svc_free(key_netstres3 *keynetname)
1040 {
1041 	if (keynetname->status == KEY_SUCCESS) {
1042 		free(keynetname->key_netstres3_u.knet.st_priv_key.keybuf3_val);
1043 		free(keynetname->key_netstres3_u.knet.st_pub_key.keybuf3_val);
1044 		free(keynetname->key_netstres3_u.knet.st_netname);
1045 	}
1046 }
1047 
1048 static bool_t
1049 __key_get_conv_3_svc(uid_t uid, deskeyarg3 *arg, cryptkeyres3 *res)
1050 {
1051 	debug(KEYSERV_DEBUG, ("get_conv_3(%d %x %x)", uid, arg, res));
1052 	res->status = pk_get_conv_key3(uid, arg, res);
1053 	debug(KEYSERV_DEBUG,
1054 	    ("get_conv_3 ret %s", strstatus(res->status)));
1055 	return (TRUE);
1056 }
1057 
1058 /* ARGSUSED */
1059 static bool_t
1060 __key_clear_3_svc(uid_t uid, void *arg, keystatus *status)
1061 {
1062 	debug(KEYSERV_DEBUG, ("clear_3(%d)", uid));
1063 	*status = pk_clear3(uid);
1064 	debug(KEYSERV_DEBUG, ("clear_3 ret %s", strstatus(*status)));
1065 	return (TRUE);
1066 }
1067 
1068 /*
1069  * RPC boilerplate
1070  */
1071 static void
1072 keyprogram(rqstp, transp)
1073 	struct svc_req *rqstp;
1074 	SVCXPRT *transp;
1075 {
1076 	union {
1077 		keybuf key_set_1_arg;
1078 		cryptkeyarg key_encrypt_1_arg;
1079 		cryptkeyarg key_decrypt_1_arg;
1080 		netnamestr key_getcred_1_arg;
1081 		cryptkeyarg key_encrypt_2_arg;
1082 		cryptkeyarg key_decrypt_2_arg;
1083 		netnamestr key_getcred_2_arg;
1084 		cryptkeyarg2 key_encrypt_pk_2_arg;
1085 		cryptkeyarg2 key_decrypt_pk_2_arg;
1086 		key_netstarg key_net_put_2_arg;
1087 		netobj  key_get_conv_2_arg;
1088 		keybuf3 key_set_3_arg;
1089 		cryptkeyarg3 key_encrypt_3_arg;
1090 		cryptkeyarg3 key_decrypt_3_arg;
1091 		cryptkeyarg3 key_encrypt_pk_3_arg;
1092 		cryptkeyarg3 key_decrypt_pk_3_arg;
1093 		keynum_t key_gen_3_arg;
1094 		netnamestr key_getcred_3_arg;
1095 		key_netstarg3 key_net_put_3_arg;
1096 		key_netstarg3 key_net_get_3_arg;
1097 		deskeyarg3 key_get_conv_3_arg;
1098 	} argument;
1099 	union {
1100 		keystatus status;
1101 		cryptkeyres cres;
1102 		des_block key;
1103 		getcredres gres;
1104 		key_netstres keynetname;
1105 		cryptkeyres3 cres3;
1106 		deskeyarray keyarray;
1107 		getcredres3 gres3;
1108 		key_netstres3 keynetname3;
1109 	} result;
1110 	uint_t gids[MAXGIDS];
1111 	char netname_str[MAXNETNAMELEN + 1];
1112 	bool_t (*xdr_argument)(), (*xdr_result)();
1113 	bool_t (*local)();
1114 	void (*local_free)() = NULL;
1115 	bool_t retval;
1116 	uid_t uid;
1117 	int check_auth;
1118 
1119 	switch (rqstp->rq_proc) {
1120 	case NULLPROC:
1121 		svc_sendreply(transp, xdr_void, (char *)NULL);
1122 		return;
1123 
1124 	case KEY_SET:
1125 		xdr_argument = xdr_keybuf;
1126 		xdr_result = xdr_int;
1127 		local = __key_set_1_svc;
1128 		check_auth = 1;
1129 		break;
1130 
1131 	case KEY_ENCRYPT:
1132 		xdr_argument = xdr_cryptkeyarg;
1133 		xdr_result = xdr_cryptkeyres;
1134 		local = __key_encrypt_1_svc;
1135 		check_auth = 1;
1136 		break;
1137 
1138 	case KEY_DECRYPT:
1139 		xdr_argument = xdr_cryptkeyarg;
1140 		xdr_result = xdr_cryptkeyres;
1141 		local = __key_decrypt_1_svc;
1142 		check_auth = 1;
1143 		break;
1144 
1145 	case KEY_GEN:
1146 		xdr_argument = xdr_void;
1147 		xdr_result = xdr_des_block;
1148 		local = __key_gen_1_svc;
1149 		check_auth = 0;
1150 		break;
1151 
1152 	case KEY_GETCRED:
1153 		xdr_argument = xdr_netnamestr;
1154 		xdr_result = xdr_getcredres;
1155 		local = __key_getcred_1_svc;
1156 		result.gres.getcredres_u.cred.gids.gids_val = gids;
1157 		check_auth = 0;
1158 		break;
1159 
1160 	case KEY_ENCRYPT_PK:
1161 		xdr_argument = xdr_cryptkeyarg2;
1162 		xdr_result = xdr_cryptkeyres;
1163 		local = __key_encrypt_pk_2_svc;
1164 		check_auth = 1;
1165 		break;
1166 
1167 	case KEY_DECRYPT_PK:
1168 		xdr_argument = xdr_cryptkeyarg2;
1169 		xdr_result = xdr_cryptkeyres;
1170 		local = __key_decrypt_pk_2_svc;
1171 		check_auth = 1;
1172 		break;
1173 
1174 
1175 	case KEY_NET_PUT:
1176 		xdr_argument = xdr_key_netstarg;
1177 		xdr_result = xdr_keystatus;
1178 		local = __key_net_put_2_svc;
1179 		check_auth = 1;
1180 		break;
1181 
1182 	case KEY_NET_GET:
1183 		xdr_argument = (xdrproc_t)xdr_void;
1184 		xdr_result = xdr_key_netstres;
1185 		local = __key_net_get_2_svc;
1186 		result.keynetname.key_netstres_u.knet.st_netname = netname_str;
1187 		check_auth = 1;
1188 		break;
1189 
1190 	case KEY_GET_CONV:
1191 		xdr_argument = (xdrproc_t)xdr_keybuf;
1192 		xdr_result = xdr_cryptkeyres;
1193 		local = __key_get_conv_2_svc;
1194 		check_auth = 1;
1195 		break;
1196 
1197 	/*
1198 	 * Version 3 procedures follow...
1199 	 */
1200 
1201 	case KEY_SET_3:
1202 		xdr_argument = (xdrproc_t)xdr_setkeyarg3;
1203 		xdr_result = xdr_keystatus;
1204 		local = __key_set_3_svc;
1205 		check_auth = 1;
1206 		break;
1207 
1208 	case KEY_ENCRYPT_3:
1209 		xdr_argument = (xdrproc_t)xdr_cryptkeyarg3;
1210 		xdr_result = xdr_cryptkeyres3;
1211 		local = __key_encrypt_3_svc;
1212 		check_auth = 1;
1213 		break;
1214 
1215 	case KEY_DECRYPT_3:
1216 		xdr_argument = (xdrproc_t)xdr_cryptkeyarg3;
1217 		xdr_result = xdr_cryptkeyres3;
1218 		local = __key_decrypt_3_svc;
1219 		check_auth = 1;
1220 		break;
1221 
1222 	case KEY_GEN_3:
1223 		xdr_argument = (xdrproc_t)xdr_keynum_t;
1224 		xdr_result = xdr_deskeyarray;
1225 		local = __key_gen_3_svc;
1226 		local_free = __key_gen_3_svc_free;
1227 		check_auth = 0;
1228 		break;
1229 
1230 	case KEY_GETCRED_3:
1231 		xdr_argument = (xdrproc_t)xdr_netnamestr;
1232 		xdr_result = xdr_getcredres3;
1233 		local = __key_getcred_3_svc;
1234 		check_auth = 0;
1235 		break;
1236 
1237 	case KEY_ENCRYPT_PK_3:
1238 		xdr_argument = (xdrproc_t)xdr_cryptkeyarg3;
1239 		xdr_result = xdr_cryptkeyres3;
1240 		local = __key_encrypt_pk_3_svc;
1241 		local_free = __key_encrypt_pk_3_svc_free;
1242 		check_auth = 1;
1243 		break;
1244 
1245 	case KEY_DECRYPT_PK_3:
1246 		xdr_argument = (xdrproc_t)xdr_cryptkeyarg3;
1247 		xdr_result = xdr_cryptkeyres3;
1248 		local = __key_decrypt_pk_3;
1249 		local_free = __key_decrypt_pk_3_free;
1250 		check_auth = 1;
1251 		break;
1252 
1253 	case KEY_NET_PUT_3:
1254 		xdr_argument = (xdrproc_t)xdr_key_netstarg3;
1255 		xdr_result = xdr_keystatus;
1256 		local = __key_net_put_3_svc;
1257 		check_auth = 1;
1258 		break;
1259 
1260 	case KEY_NET_GET_3:
1261 		xdr_argument = (xdrproc_t)xdr_mechtype;
1262 		xdr_result = xdr_key_netstres3;
1263 		local = __key_net_get_3_svc;
1264 		local_free = __key_net_get_3_svc_free;
1265 		check_auth = 1;
1266 		break;
1267 
1268 	case KEY_GET_CONV_3:
1269 		xdr_argument = (xdrproc_t)xdr_deskeyarg3;
1270 		xdr_result = xdr_cryptkeyres3;
1271 		local = __key_get_conv_3_svc;
1272 		check_auth = 1;
1273 		break;
1274 
1275 	case KEY_CLEAR_3:
1276 		xdr_argument = (xdrproc_t)xdr_void;
1277 		xdr_result = xdr_keystatus;
1278 		local = __key_clear_3_svc;
1279 		check_auth = 1;
1280 		break;
1281 
1282 	default:
1283 		svcerr_noproc(transp);
1284 		return;
1285 	}
1286 	if (check_auth) {
1287 		if (!get_auth(transp, rqstp, &uid)) {
1288 			if (debugging) {
1289 				(void) fprintf(stderr,
1290 					"not local privileged process\n");
1291 			}
1292 			svcerr_weakauth(transp);
1293 			return;
1294 		}
1295 	}
1296 
1297 	memset((char *)&argument, 0, sizeof (argument));
1298 	if (!svc_getargs(transp, xdr_argument, (caddr_t)&argument)) {
1299 		svcerr_decode(transp);
1300 		return;
1301 	}
1302 	retval = (*local)(uid, &argument, &result);
1303 	if (retval && !svc_sendreply(transp, xdr_result, (char *)&result)) {
1304 		if (debugging)
1305 			(void) fprintf(stderr, "unable to reply\n");
1306 		svcerr_systemerr(transp);
1307 	}
1308 	if (!svc_freeargs(transp, xdr_argument, (caddr_t)&argument)) {
1309 		if (debugging)
1310 			(void) fprintf(stderr,
1311 			"unable to free arguments\n");
1312 		exit(1);
1313 	}
1314 	if (local_free) {
1315 		(*local_free)(&result);
1316 	}
1317 }
1318 
1319 static bool_t
1320 get_auth(trans, rqstp, uid)
1321 	SVCXPRT *trans;
1322 	struct svc_req *rqstp;
1323 	uid_t *uid;
1324 {
1325 	svc_local_cred_t cred;
1326 
1327 	if (!svc_get_local_cred(trans, &cred)) {
1328 		if (debugging)
1329 			fprintf(stderr, "svc_get_local_cred failed %s %s\n",
1330 				trans->xp_netid, trans->xp_tp);
1331 		return (FALSE);
1332 	}
1333 	if (debugging)
1334 		fprintf(stderr, "local_uid  %d\n", cred.euid);
1335 	if (rqstp->rq_cred.oa_flavor == AUTH_SYS ||
1336 	    rqstp->rq_cred.oa_flavor == AUTH_LOOPBACK) {
1337 /* LINTED pointer alignment */
1338 		*uid = ((struct authunix_parms *)rqstp->rq_clntcred)->aup_uid;
1339 		return (*uid == cred.euid || cred.euid == 0);
1340 	} else {
1341 		*uid = cred.euid;
1342 		return (TRUE);
1343 	}
1344 }
1345 
1346 static int
1347 get_cache_size(size)
1348 char *size;
1349 {
1350 	int csize, len;
1351 
1352 	len = (int)strlen(size);
1353 	if (len == 0) {
1354 		usage();
1355 	}
1356 
1357 	if (size[len-1] == 'M' || size[len-1] == 'm') {
1358 		/*
1359 		 * cache size in MB
1360 		 */
1361 		size[len-1] = '\0';
1362 		csize = atoi(size);
1363 	} else {
1364 		csize = atoi(size);
1365 		/*
1366 		 * negative size indicates number of entries in cache
1367 		 */
1368 		csize = 0 - csize;
1369 	}
1370 
1371 	if (csize == 0) {
1372 		(void) fprintf(stderr, "invalid cache size: %s\n", size);
1373 		usage();
1374 	}
1375 
1376 	return (csize);
1377 }
1378 
1379 static void
1380 usage()
1381 {
1382 	(void) fprintf(stderr, "usage: \n");
1383 	(void) fprintf(stderr, "keyserv [-c]|[-s ");
1384 	(void) fprintf(stderr, "<size>|<mechtype>=<size>[,...]] [-n] [-D] ");
1385 	(void) fprintf(stderr, "[-d | -e] ");
1386 	(void) fprintf(stderr, "[-t threads]\n");
1387 	(void) fprintf(stderr, "-d disables the use of default keys\n");
1388 	(void) fprintf(stderr, "-e enables the use of default keys\n");
1389 	exit(1);
1390 }
1391 
1392 static void
1393 defaults(void)
1394 {
1395 	register int  flags;
1396 	register char *ptr;
1397 
1398 	if (defopen(defaults_file) == 0) {
1399 		/*
1400 		 * ignore case
1401 		 */
1402 		flags = defcntl(DC_GETFLAGS, 0);
1403 		TURNOFF(flags, DC_CASE);
1404 		(void) defcntl(DC_SETFLAGS, flags);
1405 
1406 		if ((ptr = defread("ENABLE_NOBODY_KEYS=")) != NULL) {
1407 			if (strcasecmp(ptr, "NO") == 0) {
1408 				use_nobody_keys = FALSE;
1409 			}
1410 		}
1411 
1412 		(void) defopen((char *)NULL);
1413 	}
1414 }
1415