xref: /titanic_51/usr/src/cmd/krb5/slave/kprop.c (revision 45526e9775395f5d44bad3f5430041f32c84ce1e)
17c478bd9Sstevel@tonic-gate /*
2*45526e97Ssemery  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
37c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate  */
57c478bd9Sstevel@tonic-gate 
67c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
77c478bd9Sstevel@tonic-gate 
87c478bd9Sstevel@tonic-gate /*
97c478bd9Sstevel@tonic-gate  * slave/kprop.c
107c478bd9Sstevel@tonic-gate  *
117c478bd9Sstevel@tonic-gate  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
127c478bd9Sstevel@tonic-gate  * All Rights Reserved.
137c478bd9Sstevel@tonic-gate  *
147c478bd9Sstevel@tonic-gate  * Export of this software from the United States of America may
157c478bd9Sstevel@tonic-gate  *   require a specific license from the United States Government.
167c478bd9Sstevel@tonic-gate  *   It is the responsibility of any person or organization contemplating
177c478bd9Sstevel@tonic-gate  *   export to obtain such a license before exporting.
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
207c478bd9Sstevel@tonic-gate  * distribute this software and its documentation for any purpose and
217c478bd9Sstevel@tonic-gate  * without fee is hereby granted, provided that the above copyright
227c478bd9Sstevel@tonic-gate  * notice appear in all copies and that both that copyright notice and
237c478bd9Sstevel@tonic-gate  * this permission notice appear in supporting documentation, and that
247c478bd9Sstevel@tonic-gate  * the name of M.I.T. not be used in advertising or publicity pertaining
257c478bd9Sstevel@tonic-gate  * to distribution of the software without specific, written prior
267c478bd9Sstevel@tonic-gate  * permission.  Furthermore if you modify this software you must label
277c478bd9Sstevel@tonic-gate  * your software as modified software and not distribute it in such a
287c478bd9Sstevel@tonic-gate  * fashion that it might be confused with the original M.I.T. software.
297c478bd9Sstevel@tonic-gate  * M.I.T. makes no representations about the suitability of
307c478bd9Sstevel@tonic-gate  * this software for any purpose.  It is provided "as is" without express
317c478bd9Sstevel@tonic-gate  * or implied warranty.
327c478bd9Sstevel@tonic-gate  *
337c478bd9Sstevel@tonic-gate  *
347c478bd9Sstevel@tonic-gate  */
357c478bd9Sstevel@tonic-gate 
367c478bd9Sstevel@tonic-gate 
377c478bd9Sstevel@tonic-gate #include <errno.h>
387c478bd9Sstevel@tonic-gate #include <stdio.h>
397c478bd9Sstevel@tonic-gate #include <stdlib.h>
407c478bd9Sstevel@tonic-gate #include <ctype.h>
417c478bd9Sstevel@tonic-gate #include <sys/file.h>
427c478bd9Sstevel@tonic-gate #include <signal.h>
437c478bd9Sstevel@tonic-gate #include <string.h>
447c478bd9Sstevel@tonic-gate #include <sys/types.h>
457c478bd9Sstevel@tonic-gate #include <sys/time.h>
467c478bd9Sstevel@tonic-gate #include <sys/stat.h>
477c478bd9Sstevel@tonic-gate #include <sys/socket.h>
487c478bd9Sstevel@tonic-gate #include <netinet/in.h>
497c478bd9Sstevel@tonic-gate #include <sys/param.h>
507c478bd9Sstevel@tonic-gate #include <netdb.h>
517c478bd9Sstevel@tonic-gate #include <fcntl.h>
527c478bd9Sstevel@tonic-gate #include <libintl.h>
537c478bd9Sstevel@tonic-gate #include <locale.h>
547c478bd9Sstevel@tonic-gate #include <k5-int.h>
557c478bd9Sstevel@tonic-gate #include "com_err.h"
567c478bd9Sstevel@tonic-gate #include "kprop.h"
577c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION;
587c478bd9Sstevel@tonic-gate 
597c478bd9Sstevel@tonic-gate char	*progname = 0;
607c478bd9Sstevel@tonic-gate int     debug = 0;
617c478bd9Sstevel@tonic-gate char	*srvtab = 0;
627c478bd9Sstevel@tonic-gate char	*slave_host;
637c478bd9Sstevel@tonic-gate char	*realm = 0;
647c478bd9Sstevel@tonic-gate char	*file = KPROP_DEFAULT_FILE;
657c478bd9Sstevel@tonic-gate short	port = 0;
667c478bd9Sstevel@tonic-gate 
677c478bd9Sstevel@tonic-gate krb5_principal	my_principal;		/* The Kerberos principal we'll be */
687c478bd9Sstevel@tonic-gate 				/* running under, initialized in */
697c478bd9Sstevel@tonic-gate 				/* get_tickets() */
707c478bd9Sstevel@tonic-gate krb5_ccache	ccache;		/* Credentials cache which we'll be using */
717c478bd9Sstevel@tonic-gate /* krb5_creds 	my_creds;	/* My credentials */
727c478bd9Sstevel@tonic-gate krb5_creds	creds;
737c478bd9Sstevel@tonic-gate krb5_address	sender_addr;
747c478bd9Sstevel@tonic-gate krb5_address	receiver_addr;
757c478bd9Sstevel@tonic-gate 
767c478bd9Sstevel@tonic-gate void	PRS
777c478bd9Sstevel@tonic-gate 	 (int, char **);
787c478bd9Sstevel@tonic-gate void	get_tickets
797c478bd9Sstevel@tonic-gate 	 (krb5_context);
807c478bd9Sstevel@tonic-gate static void usage
817c478bd9Sstevel@tonic-gate 	 (void);
827c478bd9Sstevel@tonic-gate krb5_error_code open_connection
837c478bd9Sstevel@tonic-gate 	(char *, int *, char *, int);
847c478bd9Sstevel@tonic-gate void	kerberos_authenticate
857c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context *,
867c478bd9Sstevel@tonic-gate 		   int, krb5_principal, krb5_creds **);
877c478bd9Sstevel@tonic-gate int	open_database
887c478bd9Sstevel@tonic-gate 	 (krb5_context, char *, int *);
897c478bd9Sstevel@tonic-gate void	close_database
907c478bd9Sstevel@tonic-gate 	 (krb5_context, int);
917c478bd9Sstevel@tonic-gate void	xmit_database
927c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context, krb5_creds *,
937c478bd9Sstevel@tonic-gate 		   int, int, int);
947c478bd9Sstevel@tonic-gate void	send_error
957c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_creds *, int, char *, krb5_error_code);
967c478bd9Sstevel@tonic-gate void	update_last_prop_file
977c478bd9Sstevel@tonic-gate 	 (char *, char *);
987c478bd9Sstevel@tonic-gate 
997c478bd9Sstevel@tonic-gate static void usage()
1007c478bd9Sstevel@tonic-gate {
1017c478bd9Sstevel@tonic-gate 	fprintf(stderr,
1027c478bd9Sstevel@tonic-gate 		gettext
1037c478bd9Sstevel@tonic-gate 		("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"),
1047c478bd9Sstevel@tonic-gate 		progname);
1057c478bd9Sstevel@tonic-gate 	exit(1);
1067c478bd9Sstevel@tonic-gate }
1077c478bd9Sstevel@tonic-gate 
1087c478bd9Sstevel@tonic-gate int
1097c478bd9Sstevel@tonic-gate main(argc, argv)
1107c478bd9Sstevel@tonic-gate 	int	argc;
1117c478bd9Sstevel@tonic-gate 	char	**argv;
1127c478bd9Sstevel@tonic-gate {
1137c478bd9Sstevel@tonic-gate 	int	fd, database_fd, database_size;
1147c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
1157c478bd9Sstevel@tonic-gate 	krb5_context context;
1167c478bd9Sstevel@tonic-gate 	krb5_creds *my_creds;
1177c478bd9Sstevel@tonic-gate 	krb5_auth_context auth_context;
1187c478bd9Sstevel@tonic-gate #define	ERRMSGSIZ	256
1197c478bd9Sstevel@tonic-gate 	char	Errmsg[ERRMSGSIZ];
1207c478bd9Sstevel@tonic-gate 
1217c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1227c478bd9Sstevel@tonic-gate 
1237c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
1247c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"KPROP_TEST"	/* Use this only if it weren't */
1257c478bd9Sstevel@tonic-gate #endif
1267c478bd9Sstevel@tonic-gate 
1277c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1287c478bd9Sstevel@tonic-gate 
1297c478bd9Sstevel@tonic-gate 	retval = krb5_init_context(&context);
1307c478bd9Sstevel@tonic-gate 	if (retval) {
1317c478bd9Sstevel@tonic-gate 		com_err(argv[0], retval, gettext("while initializing krb5"));
1327c478bd9Sstevel@tonic-gate 		exit(1);
1337c478bd9Sstevel@tonic-gate 	}
1347c478bd9Sstevel@tonic-gate 	PRS(argc, argv);
1357c478bd9Sstevel@tonic-gate 	get_tickets(context);
1367c478bd9Sstevel@tonic-gate 
1377c478bd9Sstevel@tonic-gate 	database_fd = open_database(context, file, &database_size);
1387c478bd9Sstevel@tonic-gate 	if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) {
1397c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("%s while opening connection to %s"),
1407c478bd9Sstevel@tonic-gate 			Errmsg, slave_host);
1417c478bd9Sstevel@tonic-gate 		exit(1);
1427c478bd9Sstevel@tonic-gate 	}
1437c478bd9Sstevel@tonic-gate 	if (fd < 0) {
1447c478bd9Sstevel@tonic-gate 		fprintf(stderr,
1457c478bd9Sstevel@tonic-gate 			gettext("%s: %s while opening connection to %s\n"),
1467c478bd9Sstevel@tonic-gate 			progname, Errmsg, slave_host);
1477c478bd9Sstevel@tonic-gate 		exit(1);
1487c478bd9Sstevel@tonic-gate 	}
1497c478bd9Sstevel@tonic-gate 	kerberos_authenticate(context, &auth_context, fd, my_principal,
1507c478bd9Sstevel@tonic-gate 			      &my_creds);
1517c478bd9Sstevel@tonic-gate 	xmit_database(context, auth_context, my_creds, fd, database_fd,
1527c478bd9Sstevel@tonic-gate 		      database_size);
1537c478bd9Sstevel@tonic-gate 	update_last_prop_file(slave_host, file);
1547c478bd9Sstevel@tonic-gate 	printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host);
1557c478bd9Sstevel@tonic-gate 	krb5_free_cred_contents(context, my_creds);
1567c478bd9Sstevel@tonic-gate 	close_database(context, database_fd);
1577c478bd9Sstevel@tonic-gate 	exit(0);
1587c478bd9Sstevel@tonic-gate }
1597c478bd9Sstevel@tonic-gate void PRS(argc, argv)
1607c478bd9Sstevel@tonic-gate 	int	argc;
1617c478bd9Sstevel@tonic-gate 	char	**argv;
1627c478bd9Sstevel@tonic-gate {
1637c478bd9Sstevel@tonic-gate 	int c;
1647c478bd9Sstevel@tonic-gate 	register char	*word, ch;
1657c478bd9Sstevel@tonic-gate 	extern int optind;
1667c478bd9Sstevel@tonic-gate 	extern char *optarg;
1677c478bd9Sstevel@tonic-gate 
1687c478bd9Sstevel@tonic-gate 	progname = argv[0];
1697c478bd9Sstevel@tonic-gate 	while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) {
1707c478bd9Sstevel@tonic-gate 		switch (c) {
1717c478bd9Sstevel@tonic-gate 				case 'r':
1727c478bd9Sstevel@tonic-gate 			realm = optarg;
1737c478bd9Sstevel@tonic-gate 					if (!realm)
1747c478bd9Sstevel@tonic-gate 						usage();
1757c478bd9Sstevel@tonic-gate 					break;
1767c478bd9Sstevel@tonic-gate 				case 'f':
1777c478bd9Sstevel@tonic-gate 			file = optarg;
1787c478bd9Sstevel@tonic-gate 					if (!file)
1797c478bd9Sstevel@tonic-gate 						usage();
1807c478bd9Sstevel@tonic-gate 					break;
1817c478bd9Sstevel@tonic-gate 				case 'd':
1827c478bd9Sstevel@tonic-gate 					debug++;
1837c478bd9Sstevel@tonic-gate 					break;
1847c478bd9Sstevel@tonic-gate 				case 'P':
185*45526e97Ssemery 			port = atoi(optarg);
1867c478bd9Sstevel@tonic-gate 					if (!port)
1877c478bd9Sstevel@tonic-gate 						usage();
1887c478bd9Sstevel@tonic-gate 					break;
1897c478bd9Sstevel@tonic-gate 				case 's':
1907c478bd9Sstevel@tonic-gate 			srvtab = optarg;
1917c478bd9Sstevel@tonic-gate 					if (!srvtab)
1927c478bd9Sstevel@tonic-gate 						usage();
1937c478bd9Sstevel@tonic-gate 					break;
1947c478bd9Sstevel@tonic-gate 		case '?':
1957c478bd9Sstevel@tonic-gate 				default:
1967c478bd9Sstevel@tonic-gate 			printf (gettext("Error \n"));
1977c478bd9Sstevel@tonic-gate 					usage();
1987c478bd9Sstevel@tonic-gate 				}
1997c478bd9Sstevel@tonic-gate 			}
2007c478bd9Sstevel@tonic-gate 	argc -= optind;
2017c478bd9Sstevel@tonic-gate 	argv = &argv[optind];
2027c478bd9Sstevel@tonic-gate 	if (*argv)
2037c478bd9Sstevel@tonic-gate 		slave_host = *argv;
2047c478bd9Sstevel@tonic-gate 			else
2057c478bd9Sstevel@tonic-gate 		usage();
2067c478bd9Sstevel@tonic-gate 
2077c478bd9Sstevel@tonic-gate }
2087c478bd9Sstevel@tonic-gate 
2097c478bd9Sstevel@tonic-gate void get_tickets(context)
2107c478bd9Sstevel@tonic-gate     krb5_context context;
2117c478bd9Sstevel@tonic-gate {
2127c478bd9Sstevel@tonic-gate 	char   my_host_name[MAXHOSTNAMELEN];
2137c478bd9Sstevel@tonic-gate 	char   buf[BUFSIZ];
2147c478bd9Sstevel@tonic-gate 	char   *cp;
2157c478bd9Sstevel@tonic-gate 	struct hostent *hp;
2167c478bd9Sstevel@tonic-gate 	krb5_error_code retval;
2177c478bd9Sstevel@tonic-gate 	static char tkstring[] = "/tmp/kproptktXXXXXX";
2187c478bd9Sstevel@tonic-gate 	krb5_keytab keytab = NULL;
2197c478bd9Sstevel@tonic-gate 	krb5_get_init_creds_opt opt;
2207c478bd9Sstevel@tonic-gate 	char *svcname = NULL;
2217c478bd9Sstevel@tonic-gate 	char *def_realm = NULL;
2227c478bd9Sstevel@tonic-gate 	char *master_host = NULL;
2237c478bd9Sstevel@tonic-gate 
2247c478bd9Sstevel@tonic-gate 
2257c478bd9Sstevel@tonic-gate 	/*
2267c478bd9Sstevel@tonic-gate 	 * Figure out what tickets we'll be using to send stuff
2277c478bd9Sstevel@tonic-gate 	 */
2287c478bd9Sstevel@tonic-gate 	if (realm) {
2297c478bd9Sstevel@tonic-gate 	    if ((def_realm = strdup(realm)) == NULL) {
2307c478bd9Sstevel@tonic-gate 	      com_err(progname, ENOMEM,
2317c478bd9Sstevel@tonic-gate 		      gettext("while allocating default realm name '%s'"),
2327c478bd9Sstevel@tonic-gate 		      realm);
2337c478bd9Sstevel@tonic-gate 	      exit(1);
2347c478bd9Sstevel@tonic-gate 	    }
2357c478bd9Sstevel@tonic-gate 	} else {
2367c478bd9Sstevel@tonic-gate 	    retval = krb5_get_default_realm(context, &def_realm);
2377c478bd9Sstevel@tonic-gate 	    if (retval) {
2387c478bd9Sstevel@tonic-gate 	        com_err(progname, retval,
2397c478bd9Sstevel@tonic-gate 			gettext("while getting default realm"));
2407c478bd9Sstevel@tonic-gate 	        exit(1);
2417c478bd9Sstevel@tonic-gate 	    }
2427c478bd9Sstevel@tonic-gate 	}
2437c478bd9Sstevel@tonic-gate 
2447c478bd9Sstevel@tonic-gate 	/*
2457c478bd9Sstevel@tonic-gate 	 * Always pick up the master hostname from krb5.conf, as
2467c478bd9Sstevel@tonic-gate 	 * opposed to picking up the localhost, so we do not get bit
2477c478bd9Sstevel@tonic-gate 	 * if the master KDC is HA and hence points to a logicalhost.
2487c478bd9Sstevel@tonic-gate 	 */
2497c478bd9Sstevel@tonic-gate 	retval = kadm5_get_master(context, def_realm, &master_host);
2507c478bd9Sstevel@tonic-gate 	if (retval) {
2517c478bd9Sstevel@tonic-gate 	    free(def_realm);
2527c478bd9Sstevel@tonic-gate 	    com_err(progname, retval,
2537c478bd9Sstevel@tonic-gate 		gettext("while getting admin server fqdn"));
2547c478bd9Sstevel@tonic-gate 	    exit(1);
2557c478bd9Sstevel@tonic-gate 	}
2567c478bd9Sstevel@tonic-gate 
2577c478bd9Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context, master_host, NULL,
2587c478bd9Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &my_principal);
2597c478bd9Sstevel@tonic-gate 
2607c478bd9Sstevel@tonic-gate 	free(def_realm);
2617c478bd9Sstevel@tonic-gate 	free(master_host);
2627c478bd9Sstevel@tonic-gate 	if (retval) {
2637c478bd9Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting client principal name"));
2647c478bd9Sstevel@tonic-gate 	    exit(1);
2657c478bd9Sstevel@tonic-gate 	}
2667c478bd9Sstevel@tonic-gate 
2677c478bd9Sstevel@tonic-gate 	if (realm) {
2687c478bd9Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data);
2697c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, my_principal, strlen(realm));
2707c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, my_principal, strdup(realm));
2717c478bd9Sstevel@tonic-gate 	}
2727c478bd9Sstevel@tonic-gate #if 0
2737c478bd9Sstevel@tonic-gate 	krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL;
2747c478bd9Sstevel@tonic-gate #endif
2757c478bd9Sstevel@tonic-gate 
2767c478bd9Sstevel@tonic-gate 	/*
2777c478bd9Sstevel@tonic-gate 	 * Initialize cache file which we're going to be using
2787c478bd9Sstevel@tonic-gate 	 */
2797c478bd9Sstevel@tonic-gate 	(void) mktemp(tkstring);
2807c478bd9Sstevel@tonic-gate 	snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring);
2817c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_resolve(context, buf, &ccache)) {
2827c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while opening credential cache %s"),
2837c478bd9Sstevel@tonic-gate 			buf);
2847c478bd9Sstevel@tonic-gate 		exit(1);
2857c478bd9Sstevel@tonic-gate 	}
2867c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_initialize(context, ccache, my_principal)) {
2877c478bd9Sstevel@tonic-gate 		com_err (progname, retval, gettext("when initializing cache %s"),
2887c478bd9Sstevel@tonic-gate 			 buf);
2897c478bd9Sstevel@tonic-gate 		exit(1);
2907c478bd9Sstevel@tonic-gate 	}
2917c478bd9Sstevel@tonic-gate 
2927c478bd9Sstevel@tonic-gate 	/*
2937c478bd9Sstevel@tonic-gate 	 * Get the tickets we'll need.
2947c478bd9Sstevel@tonic-gate 	 *
2957c478bd9Sstevel@tonic-gate 	 * Construct the principal name for the slave host.
2967c478bd9Sstevel@tonic-gate 	 */
2977c478bd9Sstevel@tonic-gate 	memset((char *)&creds, 0, sizeof(creds));
2987c478bd9Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context,
2997c478bd9Sstevel@tonic-gate 					 slave_host, KPROP_SERVICE_NAME,
3007c478bd9Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &creds.server);
3017c478bd9Sstevel@tonic-gate 	if (retval) {
3027c478bd9Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting server principal name"));
3037c478bd9Sstevel@tonic-gate 	    (void) krb5_cc_destroy(context, ccache);
3047c478bd9Sstevel@tonic-gate 	    exit(1);
3057c478bd9Sstevel@tonic-gate 	}
3067c478bd9Sstevel@tonic-gate 	if (realm) {
3077c478bd9Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data);
3087c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, creds.server, strlen(realm));
3097c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, creds.server, strdup(realm));
3107c478bd9Sstevel@tonic-gate 	}
3117c478bd9Sstevel@tonic-gate 
3127c478bd9Sstevel@tonic-gate 	/*
3137c478bd9Sstevel@tonic-gate 	 * Now fill in the client....
3147c478bd9Sstevel@tonic-gate 	 */
3157c478bd9Sstevel@tonic-gate 	if (retval = krb5_copy_principal(context, my_principal, &creds.client)) {
3167c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("While copying client principal"));
3177c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3187c478bd9Sstevel@tonic-gate 		exit(1);
3197c478bd9Sstevel@tonic-gate 	}
3207c478bd9Sstevel@tonic-gate 	if (srvtab) {
3217c478bd9Sstevel@tonic-gate 		if (retval = krb5_kt_resolve(context, srvtab, &keytab)) {
3227c478bd9Sstevel@tonic-gate 			com_err(progname, retval, gettext("while resolving keytab"));
3237c478bd9Sstevel@tonic-gate 			(void) krb5_cc_destroy(context, ccache);
3247c478bd9Sstevel@tonic-gate 			exit(1);
3257c478bd9Sstevel@tonic-gate 		}
3267c478bd9Sstevel@tonic-gate 	}
3277c478bd9Sstevel@tonic-gate 	(void) memset(&opt, 0, sizeof (opt));
3287c478bd9Sstevel@tonic-gate 	krb5_get_init_creds_opt_init(&opt);
3297c478bd9Sstevel@tonic-gate 	retval = krb5_unparse_name(context,  creds.server, &svcname);
3307c478bd9Sstevel@tonic-gate 	if (retval) {
3317c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while parsing svc principal name"));
3327c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3337c478bd9Sstevel@tonic-gate 		exit (1);
3347c478bd9Sstevel@tonic-gate 	}
3357c478bd9Sstevel@tonic-gate 	retval = krb5_get_init_creds_keytab(context, &creds, creds.client,
3367c478bd9Sstevel@tonic-gate 				keytab,  0, svcname, &opt);
3377c478bd9Sstevel@tonic-gate 
3387c478bd9Sstevel@tonic-gate 	if (svcname)
3397c478bd9Sstevel@tonic-gate 		free(svcname);
3407c478bd9Sstevel@tonic-gate 
3417c478bd9Sstevel@tonic-gate 	if (retval) {
3427c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while getting initial ticket\n"));
3437c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3447c478bd9Sstevel@tonic-gate 		exit(1);
3457c478bd9Sstevel@tonic-gate 	}
3467c478bd9Sstevel@tonic-gate 
3477c478bd9Sstevel@tonic-gate 	if (keytab)
3487c478bd9Sstevel@tonic-gate 	    (void) krb5_kt_close(context, keytab);
3497c478bd9Sstevel@tonic-gate 
3507c478bd9Sstevel@tonic-gate 	/*
3517c478bd9Sstevel@tonic-gate 	 * Now destroy the cache right away --- the credentials we
3527c478bd9Sstevel@tonic-gate 	 * need will be in my_creds.
3537c478bd9Sstevel@tonic-gate 	 */
3547c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_destroy(context, ccache)) {
3557c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while destroying ticket cache"));
3567c478bd9Sstevel@tonic-gate 		exit(1);
3577c478bd9Sstevel@tonic-gate 	}
3587c478bd9Sstevel@tonic-gate }
3597c478bd9Sstevel@tonic-gate 
3607c478bd9Sstevel@tonic-gate krb5_error_code
3617c478bd9Sstevel@tonic-gate open_connection(host, fd, Errmsg, ErrmsgSz)
3627c478bd9Sstevel@tonic-gate 	char	*host;
3637c478bd9Sstevel@tonic-gate 	int	*fd;
3647c478bd9Sstevel@tonic-gate 	char	*Errmsg;
3657c478bd9Sstevel@tonic-gate 	int	 ErrmsgSz;
3667c478bd9Sstevel@tonic-gate {
3677c478bd9Sstevel@tonic-gate 	int	s;
3687c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
3697c478bd9Sstevel@tonic-gate 
3707c478bd9Sstevel@tonic-gate 	int	socket_length;
3717c478bd9Sstevel@tonic-gate 	struct addrinfo hints, *ai, *aitop;
3727c478bd9Sstevel@tonic-gate 	struct sockaddr_storage	  ss;
3737c478bd9Sstevel@tonic-gate 	char serv_or_port[NI_MAXSERV];
3747c478bd9Sstevel@tonic-gate 	enum err_types {SOCKET, CONNECT};
3757c478bd9Sstevel@tonic-gate 	int which_err;
3767c478bd9Sstevel@tonic-gate 
3777c478bd9Sstevel@tonic-gate 	memset(&hints, 0, sizeof(hints));
3787c478bd9Sstevel@tonic-gate 	hints.ai_family = AF_UNSPEC;    /* go for either IPv4 or v6 */
3797c478bd9Sstevel@tonic-gate 	hints.ai_socktype = SOCK_STREAM;
3807c478bd9Sstevel@tonic-gate 
3817c478bd9Sstevel@tonic-gate 	if (port != 0)
382*45526e97Ssemery 		(void) snprintf(serv_or_port, sizeof(serv_or_port), ("%hu"),
3837c478bd9Sstevel@tonic-gate 				port);
3847c478bd9Sstevel@tonic-gate 	else
3857c478bd9Sstevel@tonic-gate 		strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port));
3867c478bd9Sstevel@tonic-gate 
3877c478bd9Sstevel@tonic-gate 	if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) {
3887c478bd9Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"),
3897c478bd9Sstevel@tonic-gate 				host);
3907c478bd9Sstevel@tonic-gate 		*fd = -1;
3917c478bd9Sstevel@tonic-gate 		return(0);
3927c478bd9Sstevel@tonic-gate 	}
3937c478bd9Sstevel@tonic-gate 
3947c478bd9Sstevel@tonic-gate 	for (ai = aitop; ai; ai = ai->ai_next) {
3957c478bd9Sstevel@tonic-gate 		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
3967c478bd9Sstevel@tonic-gate 			continue;
3977c478bd9Sstevel@tonic-gate 
3987c478bd9Sstevel@tonic-gate 		s = socket(ai->ai_family, SOCK_STREAM, 0);
3997c478bd9Sstevel@tonic-gate 		if (s < 0) {
4007c478bd9Sstevel@tonic-gate 			which_err = SOCKET;
4017c478bd9Sstevel@tonic-gate 			retval = errno;
4027c478bd9Sstevel@tonic-gate 			continue;
4037c478bd9Sstevel@tonic-gate 		}
4047c478bd9Sstevel@tonic-gate 
4057c478bd9Sstevel@tonic-gate 		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
4067c478bd9Sstevel@tonic-gate 		    errno != EINPROGRESS) {
4077c478bd9Sstevel@tonic-gate 			which_err = CONNECT;
4087c478bd9Sstevel@tonic-gate 			retval = errno;
4097c478bd9Sstevel@tonic-gate 			close(s);
4107c478bd9Sstevel@tonic-gate 			continue;	/* fail -- try next */
4117c478bd9Sstevel@tonic-gate 		}
4127c478bd9Sstevel@tonic-gate 
4137c478bd9Sstevel@tonic-gate 		break; /* success */
4147c478bd9Sstevel@tonic-gate 	}
4157c478bd9Sstevel@tonic-gate 
4167c478bd9Sstevel@tonic-gate 	if (ai == NULL) {
4177c478bd9Sstevel@tonic-gate 		switch (which_err) {
4187c478bd9Sstevel@tonic-gate 			case SOCKET:
4197c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4207c478bd9Sstevel@tonic-gate 						gettext("in call to socket"));
4217c478bd9Sstevel@tonic-gate 				break;
4227c478bd9Sstevel@tonic-gate 			case CONNECT:
4237c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4247c478bd9Sstevel@tonic-gate 						gettext("in call to connect"));
4257c478bd9Sstevel@tonic-gate 				break;
4267c478bd9Sstevel@tonic-gate 			default :
4277c478bd9Sstevel@tonic-gate 				retval = -1; /* generic error */
4287c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4297c478bd9Sstevel@tonic-gate 					gettext("could not setup network"));
4307c478bd9Sstevel@tonic-gate 				break;
4317c478bd9Sstevel@tonic-gate 		}
4327c478bd9Sstevel@tonic-gate 		if (aitop != NULL)
4337c478bd9Sstevel@tonic-gate 			freeaddrinfo(aitop);
4347c478bd9Sstevel@tonic-gate 		return(retval);
4357c478bd9Sstevel@tonic-gate 	}
4367c478bd9Sstevel@tonic-gate 
4377c478bd9Sstevel@tonic-gate 	*fd = s;
4387c478bd9Sstevel@tonic-gate 
4397c478bd9Sstevel@tonic-gate 	/*
4407c478bd9Sstevel@tonic-gate 	 * Set receiver_addr and sender_addr.
4417c478bd9Sstevel@tonic-gate 	 */
4427c478bd9Sstevel@tonic-gate 	if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr)
4437c478bd9Sstevel@tonic-gate 			== NULL) {
4447c478bd9Sstevel@tonic-gate 		retval = errno;
4457c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
4467c478bd9Sstevel@tonic-gate 			gettext("while converting socket address"));
4477c478bd9Sstevel@tonic-gate 		if (aitop != NULL)
4487c478bd9Sstevel@tonic-gate 			freeaddrinfo(aitop);
4497c478bd9Sstevel@tonic-gate 		return(retval);
4507c478bd9Sstevel@tonic-gate 	}
4517c478bd9Sstevel@tonic-gate 	if (aitop != NULL)
4527c478bd9Sstevel@tonic-gate 		freeaddrinfo(aitop);
4537c478bd9Sstevel@tonic-gate 
4547c478bd9Sstevel@tonic-gate 	socket_length = sizeof(ss);
4557c478bd9Sstevel@tonic-gate 	if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) {
4567c478bd9Sstevel@tonic-gate 		retval = errno;
4577c478bd9Sstevel@tonic-gate 		close(s);
4587c478bd9Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ,
4597c478bd9Sstevel@tonic-gate 				gettext("in call to getsockname"));
4607c478bd9Sstevel@tonic-gate 		return(retval);
4617c478bd9Sstevel@tonic-gate 	}
4627c478bd9Sstevel@tonic-gate 
4637c478bd9Sstevel@tonic-gate 	if (cvtkaddr(&ss, &sender_addr) == NULL) {
4647c478bd9Sstevel@tonic-gate 		retval = errno;
4657c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
4667c478bd9Sstevel@tonic-gate 			gettext("while converting socket address"));
4677c478bd9Sstevel@tonic-gate 		return(retval);
4687c478bd9Sstevel@tonic-gate 	}
4697c478bd9Sstevel@tonic-gate 
4707c478bd9Sstevel@tonic-gate 	return(0);
4717c478bd9Sstevel@tonic-gate }
4727c478bd9Sstevel@tonic-gate 
4737c478bd9Sstevel@tonic-gate 
4747c478bd9Sstevel@tonic-gate void kerberos_authenticate(context, auth_context, fd, me, new_creds)
4757c478bd9Sstevel@tonic-gate     krb5_context context;
4767c478bd9Sstevel@tonic-gate     krb5_auth_context *auth_context;
4777c478bd9Sstevel@tonic-gate     int	fd;
4787c478bd9Sstevel@tonic-gate     krb5_principal me;
4797c478bd9Sstevel@tonic-gate     krb5_creds ** new_creds;
4807c478bd9Sstevel@tonic-gate {
4817c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
4827c478bd9Sstevel@tonic-gate 	krb5_error	*error = NULL;
4837c478bd9Sstevel@tonic-gate 	krb5_ap_rep_enc_part	*rep_result;
4847c478bd9Sstevel@tonic-gate 
4857c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_init(context, auth_context))
4867c478bd9Sstevel@tonic-gate 	exit(1);
4877c478bd9Sstevel@tonic-gate 
4887c478bd9Sstevel@tonic-gate     krb5_auth_con_setflags(context, *auth_context,
4897c478bd9Sstevel@tonic-gate 			   KRB5_AUTH_CONTEXT_DO_SEQUENCE);
4907c478bd9Sstevel@tonic-gate 
4917c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr,
4927c478bd9Sstevel@tonic-gate 				        &receiver_addr)) {
4937c478bd9Sstevel@tonic-gate 	com_err(progname, retval, gettext("in krb5_auth_con_setaddrs"));
4947c478bd9Sstevel@tonic-gate 	exit(1);
4957c478bd9Sstevel@tonic-gate     }
4967c478bd9Sstevel@tonic-gate 
4977c478bd9Sstevel@tonic-gate 	if (retval = krb5_sendauth(context, auth_context, (void *)&fd,
4987c478bd9Sstevel@tonic-gate 				   kprop_version, me, creds.server,
4997c478bd9Sstevel@tonic-gate 				   AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
5007c478bd9Sstevel@tonic-gate 				   &error, &rep_result, new_creds)) {
5017c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while authenticating to server"));
5027c478bd9Sstevel@tonic-gate 		if (error) {
5037c478bd9Sstevel@tonic-gate 			if (error->error == KRB_ERR_GENERIC) {
5047c478bd9Sstevel@tonic-gate 				if (error->text.data)
5057c478bd9Sstevel@tonic-gate 					fprintf(stderr,
5067c478bd9Sstevel@tonic-gate 						gettext("Generic remote error: %s\n"),
5077c478bd9Sstevel@tonic-gate 						error->text.data);
5087c478bd9Sstevel@tonic-gate 			} else if (error->error) {
5097c478bd9Sstevel@tonic-gate 				com_err(progname,
5107c478bd9Sstevel@tonic-gate 					error->error + ERROR_TABLE_BASE_krb5,
5117c478bd9Sstevel@tonic-gate 					gettext("signalled from server"));
5127c478bd9Sstevel@tonic-gate 				if (error->text.data)
5137c478bd9Sstevel@tonic-gate 					fprintf(stderr,
5147c478bd9Sstevel@tonic-gate 					gettext("Error text from server: %s\n"),
5157c478bd9Sstevel@tonic-gate 						error->text.data);
5167c478bd9Sstevel@tonic-gate 			}
5177c478bd9Sstevel@tonic-gate 			krb5_free_error(context, error);
5187c478bd9Sstevel@tonic-gate 		}
5197c478bd9Sstevel@tonic-gate 		exit(1);
5207c478bd9Sstevel@tonic-gate 	}
5217c478bd9Sstevel@tonic-gate 	krb5_free_ap_rep_enc_part(context, rep_result);
5227c478bd9Sstevel@tonic-gate }
5237c478bd9Sstevel@tonic-gate 
5247c478bd9Sstevel@tonic-gate char * dbpathname;
5257c478bd9Sstevel@tonic-gate /*
5267c478bd9Sstevel@tonic-gate  * Open the Kerberos database dump file.  Takes care of locking it
5277c478bd9Sstevel@tonic-gate  * and making sure that the .ok file is more recent that the database
5287c478bd9Sstevel@tonic-gate  * dump file itself.
5297c478bd9Sstevel@tonic-gate  *
5307c478bd9Sstevel@tonic-gate  * Returns the file descriptor of the database dump file.  Also fills
5317c478bd9Sstevel@tonic-gate  * in the size of the database file.
5327c478bd9Sstevel@tonic-gate  */
5337c478bd9Sstevel@tonic-gate int
5347c478bd9Sstevel@tonic-gate open_database(context, data_fn, size)
5357c478bd9Sstevel@tonic-gate     krb5_context context;
5367c478bd9Sstevel@tonic-gate     char *data_fn;
5377c478bd9Sstevel@tonic-gate     int	*size;
5387c478bd9Sstevel@tonic-gate {
5397c478bd9Sstevel@tonic-gate 	int		fd;
5407c478bd9Sstevel@tonic-gate 	int		err;
5417c478bd9Sstevel@tonic-gate 	struct stat 	stbuf, stbuf_ok;
5427c478bd9Sstevel@tonic-gate 	char		*data_ok_fn;
5437c478bd9Sstevel@tonic-gate 	static char ok[] = ".dump_ok";
5447c478bd9Sstevel@tonic-gate 
5457c478bd9Sstevel@tonic-gate 	dbpathname = strdup(data_fn);
5467c478bd9Sstevel@tonic-gate 	if (!dbpathname) {
5477c478bd9Sstevel@tonic-gate  	    com_err(progname, ENOMEM, gettext("allocating database file name '%s'"),
5487c478bd9Sstevel@tonic-gate  		    data_fn);
5497c478bd9Sstevel@tonic-gate  	    exit(1);
5507c478bd9Sstevel@tonic-gate  	}
5517c478bd9Sstevel@tonic-gate 	if ((fd = open(dbpathname, O_RDONLY)) < 0) {
5527c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to open %s"),
5537c478bd9Sstevel@tonic-gate 			dbpathname);
5547c478bd9Sstevel@tonic-gate 		exit(1);
5557c478bd9Sstevel@tonic-gate 	}
5567c478bd9Sstevel@tonic-gate 
5577c478bd9Sstevel@tonic-gate 	err = krb5_lock_file(context, fd,
5587c478bd9Sstevel@tonic-gate 			     KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
5597c478bd9Sstevel@tonic-gate 	if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
5607c478bd9Sstevel@tonic-gate 	    com_err(progname, 0, gettext("database locked"));
5617c478bd9Sstevel@tonic-gate 	    exit(1);
5627c478bd9Sstevel@tonic-gate 	} else if (err) {
5637c478bd9Sstevel@tonic-gate 	    com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname);
5647c478bd9Sstevel@tonic-gate 	    exit(1);
5657c478bd9Sstevel@tonic-gate 	}
5667c478bd9Sstevel@tonic-gate 	if (fstat(fd, &stbuf)) {
5677c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
5687c478bd9Sstevel@tonic-gate 			data_fn);
5697c478bd9Sstevel@tonic-gate 		exit(1);
5707c478bd9Sstevel@tonic-gate 	}
5717c478bd9Sstevel@tonic-gate 	if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1))
5727c478bd9Sstevel@tonic-gate 	    == NULL) {
5737c478bd9Sstevel@tonic-gate 		com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn"));
5747c478bd9Sstevel@tonic-gate 		exit(1);
5757c478bd9Sstevel@tonic-gate 	}
5767c478bd9Sstevel@tonic-gate 	strcpy(data_ok_fn, data_fn);
5777c478bd9Sstevel@tonic-gate 	strcat(data_ok_fn, ok);
5787c478bd9Sstevel@tonic-gate 	if (stat(data_ok_fn, &stbuf_ok)) {
5797c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
5807c478bd9Sstevel@tonic-gate 			data_ok_fn);
5817c478bd9Sstevel@tonic-gate 		free(data_ok_fn);
5827c478bd9Sstevel@tonic-gate 		exit(1);
5837c478bd9Sstevel@tonic-gate 	}
5847c478bd9Sstevel@tonic-gate 	free(data_ok_fn);
5857c478bd9Sstevel@tonic-gate 	if (stbuf.st_mtime > stbuf_ok.st_mtime) {
5867c478bd9Sstevel@tonic-gate 		com_err(progname, 0, gettext("'%s' more recent than '%s'."),
5877c478bd9Sstevel@tonic-gate 			data_fn, data_ok_fn);
5887c478bd9Sstevel@tonic-gate 		exit(1);
5897c478bd9Sstevel@tonic-gate 	}
5907c478bd9Sstevel@tonic-gate 	*size = stbuf.st_size;
5917c478bd9Sstevel@tonic-gate 	return(fd);
5927c478bd9Sstevel@tonic-gate }
5937c478bd9Sstevel@tonic-gate 
5947c478bd9Sstevel@tonic-gate void
5957c478bd9Sstevel@tonic-gate close_database(context, fd)
5967c478bd9Sstevel@tonic-gate     krb5_context context;
5977c478bd9Sstevel@tonic-gate     int fd;
5987c478bd9Sstevel@tonic-gate {
5997c478bd9Sstevel@tonic-gate     int err;
6007c478bd9Sstevel@tonic-gate     if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK))
6017c478bd9Sstevel@tonic-gate 	com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname);
6027c478bd9Sstevel@tonic-gate     free(dbpathname);
6037c478bd9Sstevel@tonic-gate     (void)close(fd);
6047c478bd9Sstevel@tonic-gate     return;
6057c478bd9Sstevel@tonic-gate }
6067c478bd9Sstevel@tonic-gate 
6077c478bd9Sstevel@tonic-gate /*
6087c478bd9Sstevel@tonic-gate  * Now we send over the database.  We use the following protocol:
6097c478bd9Sstevel@tonic-gate  * Send over a KRB_SAFE message with the size.  Then we send over the
6107c478bd9Sstevel@tonic-gate  * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV.
6117c478bd9Sstevel@tonic-gate  * Then we expect to see a KRB_SAFE message with the size sent back.
6127c478bd9Sstevel@tonic-gate  *
6137c478bd9Sstevel@tonic-gate  * At any point in the protocol, we may send a KRB_ERROR message; this
6147c478bd9Sstevel@tonic-gate  * will abort the entire operation.
6157c478bd9Sstevel@tonic-gate  */
6167c478bd9Sstevel@tonic-gate void
6177c478bd9Sstevel@tonic-gate xmit_database(context, auth_context, my_creds, fd, database_fd, database_size)
6187c478bd9Sstevel@tonic-gate     krb5_context context;
6197c478bd9Sstevel@tonic-gate     krb5_auth_context auth_context;
6207c478bd9Sstevel@tonic-gate     krb5_creds *my_creds;
6217c478bd9Sstevel@tonic-gate     int	fd;
6227c478bd9Sstevel@tonic-gate     int	database_fd;
6237c478bd9Sstevel@tonic-gate     int	database_size;
6247c478bd9Sstevel@tonic-gate {
6257c478bd9Sstevel@tonic-gate 	krb5_int32	send_size, sent_size, n;
6267c478bd9Sstevel@tonic-gate 	krb5_data	inbuf, outbuf;
6277c478bd9Sstevel@tonic-gate 	char		buf[KPROP_BUFSIZ];
6287c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
6297c478bd9Sstevel@tonic-gate 	krb5_error	*error;
6307c478bd9Sstevel@tonic-gate 
6317c478bd9Sstevel@tonic-gate 	/*
6327c478bd9Sstevel@tonic-gate 	 * Send over the size
6337c478bd9Sstevel@tonic-gate 	 */
6347c478bd9Sstevel@tonic-gate 	send_size = htonl(database_size);
6357c478bd9Sstevel@tonic-gate 	inbuf.data = (char *) &send_size;
6367c478bd9Sstevel@tonic-gate 	inbuf.length = sizeof(send_size); /* must be 4, really */
6377c478bd9Sstevel@tonic-gate 	/* KPROP_CKSUMTYPE */
6387c478bd9Sstevel@tonic-gate 	if (retval = krb5_mk_safe(context, auth_context, &inbuf,
6397c478bd9Sstevel@tonic-gate 				  &outbuf, NULL)) {
6407c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while encoding database size"));
6417c478bd9Sstevel@tonic-gate 		send_error(context, my_creds, fd, gettext("while encoding database size"), retval);
6427c478bd9Sstevel@tonic-gate 		exit(1);
6437c478bd9Sstevel@tonic-gate 	}
6447c478bd9Sstevel@tonic-gate 	if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) {
6457c478bd9Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
6467c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while sending database size"));
6477c478bd9Sstevel@tonic-gate 		exit(1);
6487c478bd9Sstevel@tonic-gate 	}
6497c478bd9Sstevel@tonic-gate 	krb5_free_data_contents(context, &outbuf);
6507c478bd9Sstevel@tonic-gate     /*
6517c478bd9Sstevel@tonic-gate      * Initialize the initial vector.
6527c478bd9Sstevel@tonic-gate      */
6537c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_initivector(context, auth_context)) {
6547c478bd9Sstevel@tonic-gate 	send_error(context, my_creds, fd,
6557c478bd9Sstevel@tonic-gate 		   gettext("failed while initializing i_vector"), retval);
6567c478bd9Sstevel@tonic-gate 	com_err(progname, retval, gettext("while allocating i_vector"));
6577c478bd9Sstevel@tonic-gate 	exit(1);
6587c478bd9Sstevel@tonic-gate     }
6597c478bd9Sstevel@tonic-gate 	/*
6607c478bd9Sstevel@tonic-gate 	 * Send over the file, block by block....
6617c478bd9Sstevel@tonic-gate 	 */
6627c478bd9Sstevel@tonic-gate 	inbuf.data = buf;
6637c478bd9Sstevel@tonic-gate 	sent_size = 0;
6647c478bd9Sstevel@tonic-gate 	while (n = read(database_fd, buf, sizeof(buf))) {
6657c478bd9Sstevel@tonic-gate 		inbuf.length = n;
6667c478bd9Sstevel@tonic-gate 		if (retval = krb5_mk_priv(context, auth_context, &inbuf,
6677c478bd9Sstevel@tonic-gate 					  &outbuf, NULL)) {
6687c478bd9Sstevel@tonic-gate 			snprintf(buf, sizeof (buf),
6697c478bd9Sstevel@tonic-gate 				gettext("while encoding database block starting at %d"),
6707c478bd9Sstevel@tonic-gate 				sent_size);
6717c478bd9Sstevel@tonic-gate 			com_err(progname, retval, buf);
6727c478bd9Sstevel@tonic-gate 			send_error(context, my_creds, fd, buf, retval);
6737c478bd9Sstevel@tonic-gate 			exit(1);
6747c478bd9Sstevel@tonic-gate 		}
6757c478bd9Sstevel@tonic-gate 		if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) {
6767c478bd9Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
6777c478bd9Sstevel@tonic-gate 			com_err(progname, retval,
6787c478bd9Sstevel@tonic-gate 				gettext("while sending database block starting at %d"),
6797c478bd9Sstevel@tonic-gate 				sent_size);
6807c478bd9Sstevel@tonic-gate 			exit(1);
6817c478bd9Sstevel@tonic-gate 		}
6827c478bd9Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
6837c478bd9Sstevel@tonic-gate 		sent_size += n;
6847c478bd9Sstevel@tonic-gate 		if (debug)
6857c478bd9Sstevel@tonic-gate 			printf(gettext("%d bytes sent.\n"), sent_size);
6867c478bd9Sstevel@tonic-gate 	}
6877c478bd9Sstevel@tonic-gate 	if (sent_size != database_size) {
6887c478bd9Sstevel@tonic-gate 		com_err(progname, 0, gettext("Premature EOF found for database file!"));
6897c478bd9Sstevel@tonic-gate 		send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"),
6907c478bd9Sstevel@tonic-gate 			   KRB5KRB_ERR_GENERIC);
6917c478bd9Sstevel@tonic-gate 		exit(1);
6927c478bd9Sstevel@tonic-gate 	}
6937c478bd9Sstevel@tonic-gate 	/*
6947c478bd9Sstevel@tonic-gate 	 * OK, we've sent the database; now let's wait for a success
6957c478bd9Sstevel@tonic-gate 	 * indication from the remote end.
6967c478bd9Sstevel@tonic-gate 	 */
6977c478bd9Sstevel@tonic-gate 	if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) {
6987c478bd9Sstevel@tonic-gate 		com_err(progname, retval,
6997c478bd9Sstevel@tonic-gate 			gettext("while reading response from server"));
7007c478bd9Sstevel@tonic-gate 		exit(1);
7017c478bd9Sstevel@tonic-gate 	}
7027c478bd9Sstevel@tonic-gate 	/*
7037c478bd9Sstevel@tonic-gate 	 * If we got an error response back from the server, display
7047c478bd9Sstevel@tonic-gate 	 * the error message
7057c478bd9Sstevel@tonic-gate 	 */
7067c478bd9Sstevel@tonic-gate 	if (krb5_is_krb_error(&inbuf)) {
7077c478bd9Sstevel@tonic-gate 		if (retval = krb5_rd_error(context, &inbuf, &error)) {
7087c478bd9Sstevel@tonic-gate 			com_err(progname, retval,
7097c478bd9Sstevel@tonic-gate 				gettext("while decoding error response from server"));
7107c478bd9Sstevel@tonic-gate 			exit(1);
7117c478bd9Sstevel@tonic-gate 		}
7127c478bd9Sstevel@tonic-gate 		if (error->error == KRB_ERR_GENERIC) {
7137c478bd9Sstevel@tonic-gate 			if (error->text.data)
7147c478bd9Sstevel@tonic-gate 				fprintf(stderr,
7157c478bd9Sstevel@tonic-gate 				gettext("Generic remote error: %s\n"),
7167c478bd9Sstevel@tonic-gate 					error->text.data);
7177c478bd9Sstevel@tonic-gate 		} else if (error->error) {
7187c478bd9Sstevel@tonic-gate 			com_err(progname, error->error + ERROR_TABLE_BASE_krb5,
7197c478bd9Sstevel@tonic-gate 				gettext("signalled from server"));
7207c478bd9Sstevel@tonic-gate 			if (error->text.data)
7217c478bd9Sstevel@tonic-gate 				fprintf(stderr,
7227c478bd9Sstevel@tonic-gate 				gettext("Error text from server: %s\n"),
7237c478bd9Sstevel@tonic-gate 					error->text.data);
7247c478bd9Sstevel@tonic-gate 		}
7257c478bd9Sstevel@tonic-gate 		krb5_free_error(context, error);
7267c478bd9Sstevel@tonic-gate 		exit(1);
7277c478bd9Sstevel@tonic-gate 	}
7287c478bd9Sstevel@tonic-gate 	if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) {
7297c478bd9Sstevel@tonic-gate 		com_err(progname, retval,
7307c478bd9Sstevel@tonic-gate 			gettext("while decoding final size packet from server"));
7317c478bd9Sstevel@tonic-gate 		exit(1);
7327c478bd9Sstevel@tonic-gate 	}
7337c478bd9Sstevel@tonic-gate 	memcpy((char *)&send_size, outbuf.data, sizeof(send_size));
7347c478bd9Sstevel@tonic-gate 	send_size = ntohl(send_size);
7357c478bd9Sstevel@tonic-gate 	if (send_size != database_size) {
7367c478bd9Sstevel@tonic-gate 		com_err(progname, 0,
7377c478bd9Sstevel@tonic-gate 			gettext("Kpropd sent database size %d, expecting %d"),
7387c478bd9Sstevel@tonic-gate 			send_size, database_size);
7397c478bd9Sstevel@tonic-gate 		exit(1);
7407c478bd9Sstevel@tonic-gate 	}
7417c478bd9Sstevel@tonic-gate 	free(outbuf.data);
7427c478bd9Sstevel@tonic-gate 	free(inbuf.data);
7437c478bd9Sstevel@tonic-gate }
7447c478bd9Sstevel@tonic-gate 
7457c478bd9Sstevel@tonic-gate void
7467c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, err_text, err_code)
7477c478bd9Sstevel@tonic-gate     krb5_context context;
7487c478bd9Sstevel@tonic-gate     krb5_creds *my_creds;
7497c478bd9Sstevel@tonic-gate     int	fd;
7507c478bd9Sstevel@tonic-gate     char	*err_text;
7517c478bd9Sstevel@tonic-gate     krb5_error_code	err_code;
7527c478bd9Sstevel@tonic-gate {
7537c478bd9Sstevel@tonic-gate 	krb5_error	error;
7547c478bd9Sstevel@tonic-gate 	const char	*text;
7557c478bd9Sstevel@tonic-gate 	krb5_data	outbuf;
7567c478bd9Sstevel@tonic-gate 
7577c478bd9Sstevel@tonic-gate 	memset((char *)&error, 0, sizeof(error));
7587c478bd9Sstevel@tonic-gate 	krb5_us_timeofday(context, &error.ctime, &error.cusec);
7597c478bd9Sstevel@tonic-gate 	error.server = my_creds->server;
7607c478bd9Sstevel@tonic-gate 	error.client = my_principal;
7617c478bd9Sstevel@tonic-gate 	error.error = err_code - ERROR_TABLE_BASE_krb5;
7627c478bd9Sstevel@tonic-gate 	if (error.error > 127)
7637c478bd9Sstevel@tonic-gate 		error.error = KRB_ERR_GENERIC;
7647c478bd9Sstevel@tonic-gate 	if (err_text)
7657c478bd9Sstevel@tonic-gate 		text = err_text;
7667c478bd9Sstevel@tonic-gate 	else
7677c478bd9Sstevel@tonic-gate 		text = error_message(err_code);
7687c478bd9Sstevel@tonic-gate 	error.text.length = strlen(text) + 1;
7697c478bd9Sstevel@tonic-gate 	if (error.text.data = malloc(error.text.length)) {
7707c478bd9Sstevel@tonic-gate 		strcpy(error.text.data, text);
7717c478bd9Sstevel@tonic-gate 		if (!krb5_mk_error(context, &error, &outbuf)) {
7727c478bd9Sstevel@tonic-gate 			(void) krb5_write_message(context, (void *)&fd,&outbuf);
7737c478bd9Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
7747c478bd9Sstevel@tonic-gate 		}
7757c478bd9Sstevel@tonic-gate 		free(error.text.data);
7767c478bd9Sstevel@tonic-gate 	}
7777c478bd9Sstevel@tonic-gate }
7787c478bd9Sstevel@tonic-gate 
7797c478bd9Sstevel@tonic-gate void update_last_prop_file(hostname, file_name)
7807c478bd9Sstevel@tonic-gate 	char *hostname;
7817c478bd9Sstevel@tonic-gate 	char *file_name;
7827c478bd9Sstevel@tonic-gate {
7837c478bd9Sstevel@tonic-gate 	/* handle slave locking/failure stuff */
7847c478bd9Sstevel@tonic-gate 	char *file_last_prop;
7857c478bd9Sstevel@tonic-gate 	int fd;
7867c478bd9Sstevel@tonic-gate 	static char last_prop[]=".last_prop";
7877c478bd9Sstevel@tonic-gate 
7887c478bd9Sstevel@tonic-gate 	if ((file_last_prop = (char *)malloc(strlen(file_name) +
7897c478bd9Sstevel@tonic-gate 					     strlen(hostname) + 1 +
7907c478bd9Sstevel@tonic-gate 					     strlen(last_prop) + 1)) == NULL) {
7917c478bd9Sstevel@tonic-gate 		com_err(progname, ENOMEM,
7927c478bd9Sstevel@tonic-gate 			gettext("while allocating filename for update_last_prop_file"));
7937c478bd9Sstevel@tonic-gate 		return;
7947c478bd9Sstevel@tonic-gate 	}
7957c478bd9Sstevel@tonic-gate 	strcpy(file_last_prop, file_name);
7967c478bd9Sstevel@tonic-gate 
7977c478bd9Sstevel@tonic-gate 	/*
7987c478bd9Sstevel@tonic-gate 	 * If a nondefault file name was specified then we should not add an
7997c478bd9Sstevel@tonic-gate 	 * extraneous host name to the file name given that a file name could
8007c478bd9Sstevel@tonic-gate 	 * have already specified a host name and therefore would be redundant.
8017c478bd9Sstevel@tonic-gate 	 */
8027c478bd9Sstevel@tonic-gate 	if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) {
8037c478bd9Sstevel@tonic-gate 		strcat(file_last_prop, ".");
8047c478bd9Sstevel@tonic-gate 		strcat(file_last_prop, hostname);
8057c478bd9Sstevel@tonic-gate 	}
8067c478bd9Sstevel@tonic-gate 	strcat(file_last_prop, last_prop);
8077c478bd9Sstevel@tonic-gate 	if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
8087c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
8097c478bd9Sstevel@tonic-gate 			gettext("while creating 'last_prop' file, '%s'"),
8107c478bd9Sstevel@tonic-gate 			file_last_prop);
8117c478bd9Sstevel@tonic-gate 		free(file_last_prop);
8127c478bd9Sstevel@tonic-gate 		return;
8137c478bd9Sstevel@tonic-gate 	}
8147c478bd9Sstevel@tonic-gate 	write(fd, "", 1);
8157c478bd9Sstevel@tonic-gate 	free(file_last_prop);
8167c478bd9Sstevel@tonic-gate 	close(fd);
8177c478bd9Sstevel@tonic-gate 	return;
8187c478bd9Sstevel@tonic-gate }
819