1*7c478bd9Sstevel@tonic-gate /* 2*7c478bd9Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*7c478bd9Sstevel@tonic-gate * Use is subject to license terms. 4*7c478bd9Sstevel@tonic-gate */ 5*7c478bd9Sstevel@tonic-gate 6*7c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*7c478bd9Sstevel@tonic-gate 8*7c478bd9Sstevel@tonic-gate /* 9*7c478bd9Sstevel@tonic-gate * slave/kprop.c 10*7c478bd9Sstevel@tonic-gate * 11*7c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 12*7c478bd9Sstevel@tonic-gate * All Rights Reserved. 13*7c478bd9Sstevel@tonic-gate * 14*7c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 15*7c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 16*7c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 17*7c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 18*7c478bd9Sstevel@tonic-gate * 19*7c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 20*7c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 21*7c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 22*7c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 23*7c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 24*7c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 25*7c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 26*7c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 27*7c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 28*7c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 29*7c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 30*7c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 31*7c478bd9Sstevel@tonic-gate * or implied warranty. 32*7c478bd9Sstevel@tonic-gate * 33*7c478bd9Sstevel@tonic-gate * 34*7c478bd9Sstevel@tonic-gate */ 35*7c478bd9Sstevel@tonic-gate 36*7c478bd9Sstevel@tonic-gate 37*7c478bd9Sstevel@tonic-gate #include <errno.h> 38*7c478bd9Sstevel@tonic-gate #include <stdio.h> 39*7c478bd9Sstevel@tonic-gate #include <stdlib.h> 40*7c478bd9Sstevel@tonic-gate #include <ctype.h> 41*7c478bd9Sstevel@tonic-gate #include <sys/file.h> 42*7c478bd9Sstevel@tonic-gate #include <signal.h> 43*7c478bd9Sstevel@tonic-gate #include <string.h> 44*7c478bd9Sstevel@tonic-gate #include <sys/types.h> 45*7c478bd9Sstevel@tonic-gate #include <sys/time.h> 46*7c478bd9Sstevel@tonic-gate #include <sys/stat.h> 47*7c478bd9Sstevel@tonic-gate #include <sys/socket.h> 48*7c478bd9Sstevel@tonic-gate #include <netinet/in.h> 49*7c478bd9Sstevel@tonic-gate #include <sys/param.h> 50*7c478bd9Sstevel@tonic-gate #include <netdb.h> 51*7c478bd9Sstevel@tonic-gate #include <fcntl.h> 52*7c478bd9Sstevel@tonic-gate #include <libintl.h> 53*7c478bd9Sstevel@tonic-gate #include <locale.h> 54*7c478bd9Sstevel@tonic-gate #include <k5-int.h> 55*7c478bd9Sstevel@tonic-gate #include "com_err.h" 56*7c478bd9Sstevel@tonic-gate #include "kprop.h" 57*7c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION; 58*7c478bd9Sstevel@tonic-gate 59*7c478bd9Sstevel@tonic-gate char *progname = 0; 60*7c478bd9Sstevel@tonic-gate int debug = 0; 61*7c478bd9Sstevel@tonic-gate char *srvtab = 0; 62*7c478bd9Sstevel@tonic-gate char *slave_host; 63*7c478bd9Sstevel@tonic-gate char *realm = 0; 64*7c478bd9Sstevel@tonic-gate char *file = KPROP_DEFAULT_FILE; 65*7c478bd9Sstevel@tonic-gate short port = 0; 66*7c478bd9Sstevel@tonic-gate 67*7c478bd9Sstevel@tonic-gate krb5_principal my_principal; /* The Kerberos principal we'll be */ 68*7c478bd9Sstevel@tonic-gate /* running under, initialized in */ 69*7c478bd9Sstevel@tonic-gate /* get_tickets() */ 70*7c478bd9Sstevel@tonic-gate krb5_ccache ccache; /* Credentials cache which we'll be using */ 71*7c478bd9Sstevel@tonic-gate /* krb5_creds my_creds; /* My credentials */ 72*7c478bd9Sstevel@tonic-gate krb5_creds creds; 73*7c478bd9Sstevel@tonic-gate krb5_address sender_addr; 74*7c478bd9Sstevel@tonic-gate krb5_address receiver_addr; 75*7c478bd9Sstevel@tonic-gate 76*7c478bd9Sstevel@tonic-gate void PRS 77*7c478bd9Sstevel@tonic-gate (int, char **); 78*7c478bd9Sstevel@tonic-gate void get_tickets 79*7c478bd9Sstevel@tonic-gate (krb5_context); 80*7c478bd9Sstevel@tonic-gate static void usage 81*7c478bd9Sstevel@tonic-gate (void); 82*7c478bd9Sstevel@tonic-gate krb5_error_code open_connection 83*7c478bd9Sstevel@tonic-gate (char *, int *, char *, int); 84*7c478bd9Sstevel@tonic-gate void kerberos_authenticate 85*7c478bd9Sstevel@tonic-gate (krb5_context, krb5_auth_context *, 86*7c478bd9Sstevel@tonic-gate int, krb5_principal, krb5_creds **); 87*7c478bd9Sstevel@tonic-gate int open_database 88*7c478bd9Sstevel@tonic-gate (krb5_context, char *, int *); 89*7c478bd9Sstevel@tonic-gate void close_database 90*7c478bd9Sstevel@tonic-gate (krb5_context, int); 91*7c478bd9Sstevel@tonic-gate void xmit_database 92*7c478bd9Sstevel@tonic-gate (krb5_context, krb5_auth_context, krb5_creds *, 93*7c478bd9Sstevel@tonic-gate int, int, int); 94*7c478bd9Sstevel@tonic-gate void send_error 95*7c478bd9Sstevel@tonic-gate (krb5_context, krb5_creds *, int, char *, krb5_error_code); 96*7c478bd9Sstevel@tonic-gate void update_last_prop_file 97*7c478bd9Sstevel@tonic-gate (char *, char *); 98*7c478bd9Sstevel@tonic-gate 99*7c478bd9Sstevel@tonic-gate static void usage() 100*7c478bd9Sstevel@tonic-gate { 101*7c478bd9Sstevel@tonic-gate fprintf(stderr, 102*7c478bd9Sstevel@tonic-gate gettext 103*7c478bd9Sstevel@tonic-gate ("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"), 104*7c478bd9Sstevel@tonic-gate progname); 105*7c478bd9Sstevel@tonic-gate exit(1); 106*7c478bd9Sstevel@tonic-gate } 107*7c478bd9Sstevel@tonic-gate 108*7c478bd9Sstevel@tonic-gate int 109*7c478bd9Sstevel@tonic-gate main(argc, argv) 110*7c478bd9Sstevel@tonic-gate int argc; 111*7c478bd9Sstevel@tonic-gate char **argv; 112*7c478bd9Sstevel@tonic-gate { 113*7c478bd9Sstevel@tonic-gate int fd, database_fd, database_size; 114*7c478bd9Sstevel@tonic-gate krb5_error_code retval; 115*7c478bd9Sstevel@tonic-gate krb5_context context; 116*7c478bd9Sstevel@tonic-gate krb5_creds *my_creds; 117*7c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 118*7c478bd9Sstevel@tonic-gate #define ERRMSGSIZ 256 119*7c478bd9Sstevel@tonic-gate char Errmsg[ERRMSGSIZ]; 120*7c478bd9Sstevel@tonic-gate 121*7c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 122*7c478bd9Sstevel@tonic-gate 123*7c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 124*7c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KPROP_TEST" /* Use this only if it weren't */ 125*7c478bd9Sstevel@tonic-gate #endif 126*7c478bd9Sstevel@tonic-gate 127*7c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 128*7c478bd9Sstevel@tonic-gate 129*7c478bd9Sstevel@tonic-gate retval = krb5_init_context(&context); 130*7c478bd9Sstevel@tonic-gate if (retval) { 131*7c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing krb5")); 132*7c478bd9Sstevel@tonic-gate exit(1); 133*7c478bd9Sstevel@tonic-gate } 134*7c478bd9Sstevel@tonic-gate PRS(argc, argv); 135*7c478bd9Sstevel@tonic-gate get_tickets(context); 136*7c478bd9Sstevel@tonic-gate 137*7c478bd9Sstevel@tonic-gate database_fd = open_database(context, file, &database_size); 138*7c478bd9Sstevel@tonic-gate if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) { 139*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("%s while opening connection to %s"), 140*7c478bd9Sstevel@tonic-gate Errmsg, slave_host); 141*7c478bd9Sstevel@tonic-gate exit(1); 142*7c478bd9Sstevel@tonic-gate } 143*7c478bd9Sstevel@tonic-gate if (fd < 0) { 144*7c478bd9Sstevel@tonic-gate fprintf(stderr, 145*7c478bd9Sstevel@tonic-gate gettext("%s: %s while opening connection to %s\n"), 146*7c478bd9Sstevel@tonic-gate progname, Errmsg, slave_host); 147*7c478bd9Sstevel@tonic-gate exit(1); 148*7c478bd9Sstevel@tonic-gate } 149*7c478bd9Sstevel@tonic-gate kerberos_authenticate(context, &auth_context, fd, my_principal, 150*7c478bd9Sstevel@tonic-gate &my_creds); 151*7c478bd9Sstevel@tonic-gate xmit_database(context, auth_context, my_creds, fd, database_fd, 152*7c478bd9Sstevel@tonic-gate database_size); 153*7c478bd9Sstevel@tonic-gate update_last_prop_file(slave_host, file); 154*7c478bd9Sstevel@tonic-gate printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host); 155*7c478bd9Sstevel@tonic-gate krb5_free_cred_contents(context, my_creds); 156*7c478bd9Sstevel@tonic-gate close_database(context, database_fd); 157*7c478bd9Sstevel@tonic-gate exit(0); 158*7c478bd9Sstevel@tonic-gate } 159*7c478bd9Sstevel@tonic-gate void PRS(argc, argv) 160*7c478bd9Sstevel@tonic-gate int argc; 161*7c478bd9Sstevel@tonic-gate char **argv; 162*7c478bd9Sstevel@tonic-gate { 163*7c478bd9Sstevel@tonic-gate int c; 164*7c478bd9Sstevel@tonic-gate register char *word, ch; 165*7c478bd9Sstevel@tonic-gate extern int optind; 166*7c478bd9Sstevel@tonic-gate extern char *optarg; 167*7c478bd9Sstevel@tonic-gate 168*7c478bd9Sstevel@tonic-gate progname = argv[0]; 169*7c478bd9Sstevel@tonic-gate while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) { 170*7c478bd9Sstevel@tonic-gate switch (c) { 171*7c478bd9Sstevel@tonic-gate case 'r': 172*7c478bd9Sstevel@tonic-gate realm = optarg; 173*7c478bd9Sstevel@tonic-gate if (!realm) 174*7c478bd9Sstevel@tonic-gate usage(); 175*7c478bd9Sstevel@tonic-gate break; 176*7c478bd9Sstevel@tonic-gate case 'f': 177*7c478bd9Sstevel@tonic-gate file = optarg; 178*7c478bd9Sstevel@tonic-gate if (!file) 179*7c478bd9Sstevel@tonic-gate usage(); 180*7c478bd9Sstevel@tonic-gate break; 181*7c478bd9Sstevel@tonic-gate case 'd': 182*7c478bd9Sstevel@tonic-gate debug++; 183*7c478bd9Sstevel@tonic-gate break; 184*7c478bd9Sstevel@tonic-gate case 'P': 185*7c478bd9Sstevel@tonic-gate port = htons(atoi(optarg)); 186*7c478bd9Sstevel@tonic-gate if (!port) 187*7c478bd9Sstevel@tonic-gate usage(); 188*7c478bd9Sstevel@tonic-gate break; 189*7c478bd9Sstevel@tonic-gate case 's': 190*7c478bd9Sstevel@tonic-gate srvtab = optarg; 191*7c478bd9Sstevel@tonic-gate if (!srvtab) 192*7c478bd9Sstevel@tonic-gate usage(); 193*7c478bd9Sstevel@tonic-gate break; 194*7c478bd9Sstevel@tonic-gate case '?': 195*7c478bd9Sstevel@tonic-gate default: 196*7c478bd9Sstevel@tonic-gate printf (gettext("Error \n")); 197*7c478bd9Sstevel@tonic-gate usage(); 198*7c478bd9Sstevel@tonic-gate } 199*7c478bd9Sstevel@tonic-gate } 200*7c478bd9Sstevel@tonic-gate argc -= optind; 201*7c478bd9Sstevel@tonic-gate argv = &argv[optind]; 202*7c478bd9Sstevel@tonic-gate if (*argv) 203*7c478bd9Sstevel@tonic-gate slave_host = *argv; 204*7c478bd9Sstevel@tonic-gate else 205*7c478bd9Sstevel@tonic-gate usage(); 206*7c478bd9Sstevel@tonic-gate 207*7c478bd9Sstevel@tonic-gate } 208*7c478bd9Sstevel@tonic-gate 209*7c478bd9Sstevel@tonic-gate void get_tickets(context) 210*7c478bd9Sstevel@tonic-gate krb5_context context; 211*7c478bd9Sstevel@tonic-gate { 212*7c478bd9Sstevel@tonic-gate char my_host_name[MAXHOSTNAMELEN]; 213*7c478bd9Sstevel@tonic-gate char buf[BUFSIZ]; 214*7c478bd9Sstevel@tonic-gate char *cp; 215*7c478bd9Sstevel@tonic-gate struct hostent *hp; 216*7c478bd9Sstevel@tonic-gate krb5_error_code retval; 217*7c478bd9Sstevel@tonic-gate static char tkstring[] = "/tmp/kproptktXXXXXX"; 218*7c478bd9Sstevel@tonic-gate krb5_keytab keytab = NULL; 219*7c478bd9Sstevel@tonic-gate krb5_get_init_creds_opt opt; 220*7c478bd9Sstevel@tonic-gate char *svcname = NULL; 221*7c478bd9Sstevel@tonic-gate char *def_realm = NULL; 222*7c478bd9Sstevel@tonic-gate char *master_host = NULL; 223*7c478bd9Sstevel@tonic-gate 224*7c478bd9Sstevel@tonic-gate 225*7c478bd9Sstevel@tonic-gate /* 226*7c478bd9Sstevel@tonic-gate * Figure out what tickets we'll be using to send stuff 227*7c478bd9Sstevel@tonic-gate */ 228*7c478bd9Sstevel@tonic-gate if (realm) { 229*7c478bd9Sstevel@tonic-gate if ((def_realm = strdup(realm)) == NULL) { 230*7c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 231*7c478bd9Sstevel@tonic-gate gettext("while allocating default realm name '%s'"), 232*7c478bd9Sstevel@tonic-gate realm); 233*7c478bd9Sstevel@tonic-gate exit(1); 234*7c478bd9Sstevel@tonic-gate } 235*7c478bd9Sstevel@tonic-gate } else { 236*7c478bd9Sstevel@tonic-gate retval = krb5_get_default_realm(context, &def_realm); 237*7c478bd9Sstevel@tonic-gate if (retval) { 238*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 239*7c478bd9Sstevel@tonic-gate gettext("while getting default realm")); 240*7c478bd9Sstevel@tonic-gate exit(1); 241*7c478bd9Sstevel@tonic-gate } 242*7c478bd9Sstevel@tonic-gate } 243*7c478bd9Sstevel@tonic-gate 244*7c478bd9Sstevel@tonic-gate /* 245*7c478bd9Sstevel@tonic-gate * Always pick up the master hostname from krb5.conf, as 246*7c478bd9Sstevel@tonic-gate * opposed to picking up the localhost, so we do not get bit 247*7c478bd9Sstevel@tonic-gate * if the master KDC is HA and hence points to a logicalhost. 248*7c478bd9Sstevel@tonic-gate */ 249*7c478bd9Sstevel@tonic-gate retval = kadm5_get_master(context, def_realm, &master_host); 250*7c478bd9Sstevel@tonic-gate if (retval) { 251*7c478bd9Sstevel@tonic-gate free(def_realm); 252*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 253*7c478bd9Sstevel@tonic-gate gettext("while getting admin server fqdn")); 254*7c478bd9Sstevel@tonic-gate exit(1); 255*7c478bd9Sstevel@tonic-gate } 256*7c478bd9Sstevel@tonic-gate 257*7c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(context, master_host, NULL, 258*7c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &my_principal); 259*7c478bd9Sstevel@tonic-gate 260*7c478bd9Sstevel@tonic-gate free(def_realm); 261*7c478bd9Sstevel@tonic-gate free(master_host); 262*7c478bd9Sstevel@tonic-gate if (retval) { 263*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while setting client principal name")); 264*7c478bd9Sstevel@tonic-gate exit(1); 265*7c478bd9Sstevel@tonic-gate } 266*7c478bd9Sstevel@tonic-gate 267*7c478bd9Sstevel@tonic-gate if (realm) { 268*7c478bd9Sstevel@tonic-gate (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data); 269*7c478bd9Sstevel@tonic-gate krb5_princ_set_realm_length(context, my_principal, strlen(realm)); 270*7c478bd9Sstevel@tonic-gate krb5_princ_set_realm_data(context, my_principal, strdup(realm)); 271*7c478bd9Sstevel@tonic-gate } 272*7c478bd9Sstevel@tonic-gate #if 0 273*7c478bd9Sstevel@tonic-gate krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL; 274*7c478bd9Sstevel@tonic-gate #endif 275*7c478bd9Sstevel@tonic-gate 276*7c478bd9Sstevel@tonic-gate /* 277*7c478bd9Sstevel@tonic-gate * Initialize cache file which we're going to be using 278*7c478bd9Sstevel@tonic-gate */ 279*7c478bd9Sstevel@tonic-gate (void) mktemp(tkstring); 280*7c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring); 281*7c478bd9Sstevel@tonic-gate if (retval = krb5_cc_resolve(context, buf, &ccache)) { 282*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while opening credential cache %s"), 283*7c478bd9Sstevel@tonic-gate buf); 284*7c478bd9Sstevel@tonic-gate exit(1); 285*7c478bd9Sstevel@tonic-gate } 286*7c478bd9Sstevel@tonic-gate if (retval = krb5_cc_initialize(context, ccache, my_principal)) { 287*7c478bd9Sstevel@tonic-gate com_err (progname, retval, gettext("when initializing cache %s"), 288*7c478bd9Sstevel@tonic-gate buf); 289*7c478bd9Sstevel@tonic-gate exit(1); 290*7c478bd9Sstevel@tonic-gate } 291*7c478bd9Sstevel@tonic-gate 292*7c478bd9Sstevel@tonic-gate /* 293*7c478bd9Sstevel@tonic-gate * Get the tickets we'll need. 294*7c478bd9Sstevel@tonic-gate * 295*7c478bd9Sstevel@tonic-gate * Construct the principal name for the slave host. 296*7c478bd9Sstevel@tonic-gate */ 297*7c478bd9Sstevel@tonic-gate memset((char *)&creds, 0, sizeof(creds)); 298*7c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(context, 299*7c478bd9Sstevel@tonic-gate slave_host, KPROP_SERVICE_NAME, 300*7c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &creds.server); 301*7c478bd9Sstevel@tonic-gate if (retval) { 302*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while setting server principal name")); 303*7c478bd9Sstevel@tonic-gate (void) krb5_cc_destroy(context, ccache); 304*7c478bd9Sstevel@tonic-gate exit(1); 305*7c478bd9Sstevel@tonic-gate } 306*7c478bd9Sstevel@tonic-gate if (realm) { 307*7c478bd9Sstevel@tonic-gate (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data); 308*7c478bd9Sstevel@tonic-gate krb5_princ_set_realm_length(context, creds.server, strlen(realm)); 309*7c478bd9Sstevel@tonic-gate krb5_princ_set_realm_data(context, creds.server, strdup(realm)); 310*7c478bd9Sstevel@tonic-gate } 311*7c478bd9Sstevel@tonic-gate 312*7c478bd9Sstevel@tonic-gate /* 313*7c478bd9Sstevel@tonic-gate * Now fill in the client.... 314*7c478bd9Sstevel@tonic-gate */ 315*7c478bd9Sstevel@tonic-gate if (retval = krb5_copy_principal(context, my_principal, &creds.client)) { 316*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("While copying client principal")); 317*7c478bd9Sstevel@tonic-gate (void) krb5_cc_destroy(context, ccache); 318*7c478bd9Sstevel@tonic-gate exit(1); 319*7c478bd9Sstevel@tonic-gate } 320*7c478bd9Sstevel@tonic-gate if (srvtab) { 321*7c478bd9Sstevel@tonic-gate if (retval = krb5_kt_resolve(context, srvtab, &keytab)) { 322*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while resolving keytab")); 323*7c478bd9Sstevel@tonic-gate (void) krb5_cc_destroy(context, ccache); 324*7c478bd9Sstevel@tonic-gate exit(1); 325*7c478bd9Sstevel@tonic-gate } 326*7c478bd9Sstevel@tonic-gate } 327*7c478bd9Sstevel@tonic-gate (void) memset(&opt, 0, sizeof (opt)); 328*7c478bd9Sstevel@tonic-gate krb5_get_init_creds_opt_init(&opt); 329*7c478bd9Sstevel@tonic-gate retval = krb5_unparse_name(context, creds.server, &svcname); 330*7c478bd9Sstevel@tonic-gate if (retval) { 331*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while parsing svc principal name")); 332*7c478bd9Sstevel@tonic-gate (void) krb5_cc_destroy(context, ccache); 333*7c478bd9Sstevel@tonic-gate exit (1); 334*7c478bd9Sstevel@tonic-gate } 335*7c478bd9Sstevel@tonic-gate retval = krb5_get_init_creds_keytab(context, &creds, creds.client, 336*7c478bd9Sstevel@tonic-gate keytab, 0, svcname, &opt); 337*7c478bd9Sstevel@tonic-gate 338*7c478bd9Sstevel@tonic-gate if (svcname) 339*7c478bd9Sstevel@tonic-gate free(svcname); 340*7c478bd9Sstevel@tonic-gate 341*7c478bd9Sstevel@tonic-gate if (retval) { 342*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while getting initial ticket\n")); 343*7c478bd9Sstevel@tonic-gate (void) krb5_cc_destroy(context, ccache); 344*7c478bd9Sstevel@tonic-gate exit(1); 345*7c478bd9Sstevel@tonic-gate } 346*7c478bd9Sstevel@tonic-gate 347*7c478bd9Sstevel@tonic-gate if (keytab) 348*7c478bd9Sstevel@tonic-gate (void) krb5_kt_close(context, keytab); 349*7c478bd9Sstevel@tonic-gate 350*7c478bd9Sstevel@tonic-gate /* 351*7c478bd9Sstevel@tonic-gate * Now destroy the cache right away --- the credentials we 352*7c478bd9Sstevel@tonic-gate * need will be in my_creds. 353*7c478bd9Sstevel@tonic-gate */ 354*7c478bd9Sstevel@tonic-gate if (retval = krb5_cc_destroy(context, ccache)) { 355*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while destroying ticket cache")); 356*7c478bd9Sstevel@tonic-gate exit(1); 357*7c478bd9Sstevel@tonic-gate } 358*7c478bd9Sstevel@tonic-gate } 359*7c478bd9Sstevel@tonic-gate 360*7c478bd9Sstevel@tonic-gate krb5_error_code 361*7c478bd9Sstevel@tonic-gate open_connection(host, fd, Errmsg, ErrmsgSz) 362*7c478bd9Sstevel@tonic-gate char *host; 363*7c478bd9Sstevel@tonic-gate int *fd; 364*7c478bd9Sstevel@tonic-gate char *Errmsg; 365*7c478bd9Sstevel@tonic-gate int ErrmsgSz; 366*7c478bd9Sstevel@tonic-gate { 367*7c478bd9Sstevel@tonic-gate int s; 368*7c478bd9Sstevel@tonic-gate krb5_error_code retval; 369*7c478bd9Sstevel@tonic-gate 370*7c478bd9Sstevel@tonic-gate int socket_length; 371*7c478bd9Sstevel@tonic-gate struct addrinfo hints, *ai, *aitop; 372*7c478bd9Sstevel@tonic-gate struct sockaddr_storage ss; 373*7c478bd9Sstevel@tonic-gate char serv_or_port[NI_MAXSERV]; 374*7c478bd9Sstevel@tonic-gate enum err_types {SOCKET, CONNECT}; 375*7c478bd9Sstevel@tonic-gate int which_err; 376*7c478bd9Sstevel@tonic-gate 377*7c478bd9Sstevel@tonic-gate memset(&hints, 0, sizeof(hints)); 378*7c478bd9Sstevel@tonic-gate hints.ai_family = AF_UNSPEC; /* go for either IPv4 or v6 */ 379*7c478bd9Sstevel@tonic-gate hints.ai_socktype = SOCK_STREAM; 380*7c478bd9Sstevel@tonic-gate 381*7c478bd9Sstevel@tonic-gate if (port != 0) 382*7c478bd9Sstevel@tonic-gate (void) snprintf(serv_or_port, sizeof(serv_or_port), ("%d"), 383*7c478bd9Sstevel@tonic-gate port); 384*7c478bd9Sstevel@tonic-gate else 385*7c478bd9Sstevel@tonic-gate strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port)); 386*7c478bd9Sstevel@tonic-gate 387*7c478bd9Sstevel@tonic-gate if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) { 388*7c478bd9Sstevel@tonic-gate (void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"), 389*7c478bd9Sstevel@tonic-gate host); 390*7c478bd9Sstevel@tonic-gate *fd = -1; 391*7c478bd9Sstevel@tonic-gate return(0); 392*7c478bd9Sstevel@tonic-gate } 393*7c478bd9Sstevel@tonic-gate 394*7c478bd9Sstevel@tonic-gate for (ai = aitop; ai; ai = ai->ai_next) { 395*7c478bd9Sstevel@tonic-gate if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 396*7c478bd9Sstevel@tonic-gate continue; 397*7c478bd9Sstevel@tonic-gate 398*7c478bd9Sstevel@tonic-gate s = socket(ai->ai_family, SOCK_STREAM, 0); 399*7c478bd9Sstevel@tonic-gate if (s < 0) { 400*7c478bd9Sstevel@tonic-gate which_err = SOCKET; 401*7c478bd9Sstevel@tonic-gate retval = errno; 402*7c478bd9Sstevel@tonic-gate continue; 403*7c478bd9Sstevel@tonic-gate } 404*7c478bd9Sstevel@tonic-gate 405*7c478bd9Sstevel@tonic-gate if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 && 406*7c478bd9Sstevel@tonic-gate errno != EINPROGRESS) { 407*7c478bd9Sstevel@tonic-gate which_err = CONNECT; 408*7c478bd9Sstevel@tonic-gate retval = errno; 409*7c478bd9Sstevel@tonic-gate close(s); 410*7c478bd9Sstevel@tonic-gate continue; /* fail -- try next */ 411*7c478bd9Sstevel@tonic-gate } 412*7c478bd9Sstevel@tonic-gate 413*7c478bd9Sstevel@tonic-gate break; /* success */ 414*7c478bd9Sstevel@tonic-gate } 415*7c478bd9Sstevel@tonic-gate 416*7c478bd9Sstevel@tonic-gate if (ai == NULL) { 417*7c478bd9Sstevel@tonic-gate switch (which_err) { 418*7c478bd9Sstevel@tonic-gate case SOCKET: 419*7c478bd9Sstevel@tonic-gate (void) snprintf(Errmsg, ERRMSGSIZ, 420*7c478bd9Sstevel@tonic-gate gettext("in call to socket")); 421*7c478bd9Sstevel@tonic-gate break; 422*7c478bd9Sstevel@tonic-gate case CONNECT: 423*7c478bd9Sstevel@tonic-gate (void) snprintf(Errmsg, ERRMSGSIZ, 424*7c478bd9Sstevel@tonic-gate gettext("in call to connect")); 425*7c478bd9Sstevel@tonic-gate break; 426*7c478bd9Sstevel@tonic-gate default : 427*7c478bd9Sstevel@tonic-gate retval = -1; /* generic error */ 428*7c478bd9Sstevel@tonic-gate (void) snprintf(Errmsg, ERRMSGSIZ, 429*7c478bd9Sstevel@tonic-gate gettext("could not setup network")); 430*7c478bd9Sstevel@tonic-gate break; 431*7c478bd9Sstevel@tonic-gate } 432*7c478bd9Sstevel@tonic-gate if (aitop != NULL) 433*7c478bd9Sstevel@tonic-gate freeaddrinfo(aitop); 434*7c478bd9Sstevel@tonic-gate return(retval); 435*7c478bd9Sstevel@tonic-gate } 436*7c478bd9Sstevel@tonic-gate 437*7c478bd9Sstevel@tonic-gate *fd = s; 438*7c478bd9Sstevel@tonic-gate 439*7c478bd9Sstevel@tonic-gate /* 440*7c478bd9Sstevel@tonic-gate * Set receiver_addr and sender_addr. 441*7c478bd9Sstevel@tonic-gate */ 442*7c478bd9Sstevel@tonic-gate if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr) 443*7c478bd9Sstevel@tonic-gate == NULL) { 444*7c478bd9Sstevel@tonic-gate retval = errno; 445*7c478bd9Sstevel@tonic-gate com_err(progname, errno, 446*7c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 447*7c478bd9Sstevel@tonic-gate if (aitop != NULL) 448*7c478bd9Sstevel@tonic-gate freeaddrinfo(aitop); 449*7c478bd9Sstevel@tonic-gate return(retval); 450*7c478bd9Sstevel@tonic-gate } 451*7c478bd9Sstevel@tonic-gate if (aitop != NULL) 452*7c478bd9Sstevel@tonic-gate freeaddrinfo(aitop); 453*7c478bd9Sstevel@tonic-gate 454*7c478bd9Sstevel@tonic-gate socket_length = sizeof(ss); 455*7c478bd9Sstevel@tonic-gate if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) { 456*7c478bd9Sstevel@tonic-gate retval = errno; 457*7c478bd9Sstevel@tonic-gate close(s); 458*7c478bd9Sstevel@tonic-gate (void) snprintf(Errmsg, ERRMSGSIZ, 459*7c478bd9Sstevel@tonic-gate gettext("in call to getsockname")); 460*7c478bd9Sstevel@tonic-gate return(retval); 461*7c478bd9Sstevel@tonic-gate } 462*7c478bd9Sstevel@tonic-gate 463*7c478bd9Sstevel@tonic-gate if (cvtkaddr(&ss, &sender_addr) == NULL) { 464*7c478bd9Sstevel@tonic-gate retval = errno; 465*7c478bd9Sstevel@tonic-gate com_err(progname, errno, 466*7c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 467*7c478bd9Sstevel@tonic-gate return(retval); 468*7c478bd9Sstevel@tonic-gate } 469*7c478bd9Sstevel@tonic-gate 470*7c478bd9Sstevel@tonic-gate return(0); 471*7c478bd9Sstevel@tonic-gate } 472*7c478bd9Sstevel@tonic-gate 473*7c478bd9Sstevel@tonic-gate 474*7c478bd9Sstevel@tonic-gate void kerberos_authenticate(context, auth_context, fd, me, new_creds) 475*7c478bd9Sstevel@tonic-gate krb5_context context; 476*7c478bd9Sstevel@tonic-gate krb5_auth_context *auth_context; 477*7c478bd9Sstevel@tonic-gate int fd; 478*7c478bd9Sstevel@tonic-gate krb5_principal me; 479*7c478bd9Sstevel@tonic-gate krb5_creds ** new_creds; 480*7c478bd9Sstevel@tonic-gate { 481*7c478bd9Sstevel@tonic-gate krb5_error_code retval; 482*7c478bd9Sstevel@tonic-gate krb5_error *error = NULL; 483*7c478bd9Sstevel@tonic-gate krb5_ap_rep_enc_part *rep_result; 484*7c478bd9Sstevel@tonic-gate 485*7c478bd9Sstevel@tonic-gate if (retval = krb5_auth_con_init(context, auth_context)) 486*7c478bd9Sstevel@tonic-gate exit(1); 487*7c478bd9Sstevel@tonic-gate 488*7c478bd9Sstevel@tonic-gate krb5_auth_con_setflags(context, *auth_context, 489*7c478bd9Sstevel@tonic-gate KRB5_AUTH_CONTEXT_DO_SEQUENCE); 490*7c478bd9Sstevel@tonic-gate 491*7c478bd9Sstevel@tonic-gate if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr, 492*7c478bd9Sstevel@tonic-gate &receiver_addr)) { 493*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("in krb5_auth_con_setaddrs")); 494*7c478bd9Sstevel@tonic-gate exit(1); 495*7c478bd9Sstevel@tonic-gate } 496*7c478bd9Sstevel@tonic-gate 497*7c478bd9Sstevel@tonic-gate if (retval = krb5_sendauth(context, auth_context, (void *)&fd, 498*7c478bd9Sstevel@tonic-gate kprop_version, me, creds.server, 499*7c478bd9Sstevel@tonic-gate AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL, 500*7c478bd9Sstevel@tonic-gate &error, &rep_result, new_creds)) { 501*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while authenticating to server")); 502*7c478bd9Sstevel@tonic-gate if (error) { 503*7c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 504*7c478bd9Sstevel@tonic-gate if (error->text.data) 505*7c478bd9Sstevel@tonic-gate fprintf(stderr, 506*7c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 507*7c478bd9Sstevel@tonic-gate error->text.data); 508*7c478bd9Sstevel@tonic-gate } else if (error->error) { 509*7c478bd9Sstevel@tonic-gate com_err(progname, 510*7c478bd9Sstevel@tonic-gate error->error + ERROR_TABLE_BASE_krb5, 511*7c478bd9Sstevel@tonic-gate gettext("signalled from server")); 512*7c478bd9Sstevel@tonic-gate if (error->text.data) 513*7c478bd9Sstevel@tonic-gate fprintf(stderr, 514*7c478bd9Sstevel@tonic-gate gettext("Error text from server: %s\n"), 515*7c478bd9Sstevel@tonic-gate error->text.data); 516*7c478bd9Sstevel@tonic-gate } 517*7c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 518*7c478bd9Sstevel@tonic-gate } 519*7c478bd9Sstevel@tonic-gate exit(1); 520*7c478bd9Sstevel@tonic-gate } 521*7c478bd9Sstevel@tonic-gate krb5_free_ap_rep_enc_part(context, rep_result); 522*7c478bd9Sstevel@tonic-gate } 523*7c478bd9Sstevel@tonic-gate 524*7c478bd9Sstevel@tonic-gate char * dbpathname; 525*7c478bd9Sstevel@tonic-gate /* 526*7c478bd9Sstevel@tonic-gate * Open the Kerberos database dump file. Takes care of locking it 527*7c478bd9Sstevel@tonic-gate * and making sure that the .ok file is more recent that the database 528*7c478bd9Sstevel@tonic-gate * dump file itself. 529*7c478bd9Sstevel@tonic-gate * 530*7c478bd9Sstevel@tonic-gate * Returns the file descriptor of the database dump file. Also fills 531*7c478bd9Sstevel@tonic-gate * in the size of the database file. 532*7c478bd9Sstevel@tonic-gate */ 533*7c478bd9Sstevel@tonic-gate int 534*7c478bd9Sstevel@tonic-gate open_database(context, data_fn, size) 535*7c478bd9Sstevel@tonic-gate krb5_context context; 536*7c478bd9Sstevel@tonic-gate char *data_fn; 537*7c478bd9Sstevel@tonic-gate int *size; 538*7c478bd9Sstevel@tonic-gate { 539*7c478bd9Sstevel@tonic-gate int fd; 540*7c478bd9Sstevel@tonic-gate int err; 541*7c478bd9Sstevel@tonic-gate struct stat stbuf, stbuf_ok; 542*7c478bd9Sstevel@tonic-gate char *data_ok_fn; 543*7c478bd9Sstevel@tonic-gate static char ok[] = ".dump_ok"; 544*7c478bd9Sstevel@tonic-gate 545*7c478bd9Sstevel@tonic-gate dbpathname = strdup(data_fn); 546*7c478bd9Sstevel@tonic-gate if (!dbpathname) { 547*7c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, gettext("allocating database file name '%s'"), 548*7c478bd9Sstevel@tonic-gate data_fn); 549*7c478bd9Sstevel@tonic-gate exit(1); 550*7c478bd9Sstevel@tonic-gate } 551*7c478bd9Sstevel@tonic-gate if ((fd = open(dbpathname, O_RDONLY)) < 0) { 552*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to open %s"), 553*7c478bd9Sstevel@tonic-gate dbpathname); 554*7c478bd9Sstevel@tonic-gate exit(1); 555*7c478bd9Sstevel@tonic-gate } 556*7c478bd9Sstevel@tonic-gate 557*7c478bd9Sstevel@tonic-gate err = krb5_lock_file(context, fd, 558*7c478bd9Sstevel@tonic-gate KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK); 559*7c478bd9Sstevel@tonic-gate if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) { 560*7c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("database locked")); 561*7c478bd9Sstevel@tonic-gate exit(1); 562*7c478bd9Sstevel@tonic-gate } else if (err) { 563*7c478bd9Sstevel@tonic-gate com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname); 564*7c478bd9Sstevel@tonic-gate exit(1); 565*7c478bd9Sstevel@tonic-gate } 566*7c478bd9Sstevel@tonic-gate if (fstat(fd, &stbuf)) { 567*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to stat %s"), 568*7c478bd9Sstevel@tonic-gate data_fn); 569*7c478bd9Sstevel@tonic-gate exit(1); 570*7c478bd9Sstevel@tonic-gate } 571*7c478bd9Sstevel@tonic-gate if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1)) 572*7c478bd9Sstevel@tonic-gate == NULL) { 573*7c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn")); 574*7c478bd9Sstevel@tonic-gate exit(1); 575*7c478bd9Sstevel@tonic-gate } 576*7c478bd9Sstevel@tonic-gate strcpy(data_ok_fn, data_fn); 577*7c478bd9Sstevel@tonic-gate strcat(data_ok_fn, ok); 578*7c478bd9Sstevel@tonic-gate if (stat(data_ok_fn, &stbuf_ok)) { 579*7c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to stat %s"), 580*7c478bd9Sstevel@tonic-gate data_ok_fn); 581*7c478bd9Sstevel@tonic-gate free(data_ok_fn); 582*7c478bd9Sstevel@tonic-gate exit(1); 583*7c478bd9Sstevel@tonic-gate } 584*7c478bd9Sstevel@tonic-gate free(data_ok_fn); 585*7c478bd9Sstevel@tonic-gate if (stbuf.st_mtime > stbuf_ok.st_mtime) { 586*7c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("'%s' more recent than '%s'."), 587*7c478bd9Sstevel@tonic-gate data_fn, data_ok_fn); 588*7c478bd9Sstevel@tonic-gate exit(1); 589*7c478bd9Sstevel@tonic-gate } 590*7c478bd9Sstevel@tonic-gate *size = stbuf.st_size; 591*7c478bd9Sstevel@tonic-gate return(fd); 592*7c478bd9Sstevel@tonic-gate } 593*7c478bd9Sstevel@tonic-gate 594*7c478bd9Sstevel@tonic-gate void 595*7c478bd9Sstevel@tonic-gate close_database(context, fd) 596*7c478bd9Sstevel@tonic-gate krb5_context context; 597*7c478bd9Sstevel@tonic-gate int fd; 598*7c478bd9Sstevel@tonic-gate { 599*7c478bd9Sstevel@tonic-gate int err; 600*7c478bd9Sstevel@tonic-gate if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK)) 601*7c478bd9Sstevel@tonic-gate com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname); 602*7c478bd9Sstevel@tonic-gate free(dbpathname); 603*7c478bd9Sstevel@tonic-gate (void)close(fd); 604*7c478bd9Sstevel@tonic-gate return; 605*7c478bd9Sstevel@tonic-gate } 606*7c478bd9Sstevel@tonic-gate 607*7c478bd9Sstevel@tonic-gate /* 608*7c478bd9Sstevel@tonic-gate * Now we send over the database. We use the following protocol: 609*7c478bd9Sstevel@tonic-gate * Send over a KRB_SAFE message with the size. Then we send over the 610*7c478bd9Sstevel@tonic-gate * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV. 611*7c478bd9Sstevel@tonic-gate * Then we expect to see a KRB_SAFE message with the size sent back. 612*7c478bd9Sstevel@tonic-gate * 613*7c478bd9Sstevel@tonic-gate * At any point in the protocol, we may send a KRB_ERROR message; this 614*7c478bd9Sstevel@tonic-gate * will abort the entire operation. 615*7c478bd9Sstevel@tonic-gate */ 616*7c478bd9Sstevel@tonic-gate void 617*7c478bd9Sstevel@tonic-gate xmit_database(context, auth_context, my_creds, fd, database_fd, database_size) 618*7c478bd9Sstevel@tonic-gate krb5_context context; 619*7c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 620*7c478bd9Sstevel@tonic-gate krb5_creds *my_creds; 621*7c478bd9Sstevel@tonic-gate int fd; 622*7c478bd9Sstevel@tonic-gate int database_fd; 623*7c478bd9Sstevel@tonic-gate int database_size; 624*7c478bd9Sstevel@tonic-gate { 625*7c478bd9Sstevel@tonic-gate krb5_int32 send_size, sent_size, n; 626*7c478bd9Sstevel@tonic-gate krb5_data inbuf, outbuf; 627*7c478bd9Sstevel@tonic-gate char buf[KPROP_BUFSIZ]; 628*7c478bd9Sstevel@tonic-gate krb5_error_code retval; 629*7c478bd9Sstevel@tonic-gate krb5_error *error; 630*7c478bd9Sstevel@tonic-gate 631*7c478bd9Sstevel@tonic-gate /* 632*7c478bd9Sstevel@tonic-gate * Send over the size 633*7c478bd9Sstevel@tonic-gate */ 634*7c478bd9Sstevel@tonic-gate send_size = htonl(database_size); 635*7c478bd9Sstevel@tonic-gate inbuf.data = (char *) &send_size; 636*7c478bd9Sstevel@tonic-gate inbuf.length = sizeof(send_size); /* must be 4, really */ 637*7c478bd9Sstevel@tonic-gate /* KPROP_CKSUMTYPE */ 638*7c478bd9Sstevel@tonic-gate if (retval = krb5_mk_safe(context, auth_context, &inbuf, 639*7c478bd9Sstevel@tonic-gate &outbuf, NULL)) { 640*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while encoding database size")); 641*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, gettext("while encoding database size"), retval); 642*7c478bd9Sstevel@tonic-gate exit(1); 643*7c478bd9Sstevel@tonic-gate } 644*7c478bd9Sstevel@tonic-gate if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) { 645*7c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 646*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while sending database size")); 647*7c478bd9Sstevel@tonic-gate exit(1); 648*7c478bd9Sstevel@tonic-gate } 649*7c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 650*7c478bd9Sstevel@tonic-gate /* 651*7c478bd9Sstevel@tonic-gate * Initialize the initial vector. 652*7c478bd9Sstevel@tonic-gate */ 653*7c478bd9Sstevel@tonic-gate if (retval = krb5_auth_con_initivector(context, auth_context)) { 654*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, 655*7c478bd9Sstevel@tonic-gate gettext("failed while initializing i_vector"), retval); 656*7c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while allocating i_vector")); 657*7c478bd9Sstevel@tonic-gate exit(1); 658*7c478bd9Sstevel@tonic-gate } 659*7c478bd9Sstevel@tonic-gate /* 660*7c478bd9Sstevel@tonic-gate * Send over the file, block by block.... 661*7c478bd9Sstevel@tonic-gate */ 662*7c478bd9Sstevel@tonic-gate inbuf.data = buf; 663*7c478bd9Sstevel@tonic-gate sent_size = 0; 664*7c478bd9Sstevel@tonic-gate while (n = read(database_fd, buf, sizeof(buf))) { 665*7c478bd9Sstevel@tonic-gate inbuf.length = n; 666*7c478bd9Sstevel@tonic-gate if (retval = krb5_mk_priv(context, auth_context, &inbuf, 667*7c478bd9Sstevel@tonic-gate &outbuf, NULL)) { 668*7c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 669*7c478bd9Sstevel@tonic-gate gettext("while encoding database block starting at %d"), 670*7c478bd9Sstevel@tonic-gate sent_size); 671*7c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 672*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, buf, retval); 673*7c478bd9Sstevel@tonic-gate exit(1); 674*7c478bd9Sstevel@tonic-gate } 675*7c478bd9Sstevel@tonic-gate if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) { 676*7c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 677*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 678*7c478bd9Sstevel@tonic-gate gettext("while sending database block starting at %d"), 679*7c478bd9Sstevel@tonic-gate sent_size); 680*7c478bd9Sstevel@tonic-gate exit(1); 681*7c478bd9Sstevel@tonic-gate } 682*7c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 683*7c478bd9Sstevel@tonic-gate sent_size += n; 684*7c478bd9Sstevel@tonic-gate if (debug) 685*7c478bd9Sstevel@tonic-gate printf(gettext("%d bytes sent.\n"), sent_size); 686*7c478bd9Sstevel@tonic-gate } 687*7c478bd9Sstevel@tonic-gate if (sent_size != database_size) { 688*7c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("Premature EOF found for database file!")); 689*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"), 690*7c478bd9Sstevel@tonic-gate KRB5KRB_ERR_GENERIC); 691*7c478bd9Sstevel@tonic-gate exit(1); 692*7c478bd9Sstevel@tonic-gate } 693*7c478bd9Sstevel@tonic-gate /* 694*7c478bd9Sstevel@tonic-gate * OK, we've sent the database; now let's wait for a success 695*7c478bd9Sstevel@tonic-gate * indication from the remote end. 696*7c478bd9Sstevel@tonic-gate */ 697*7c478bd9Sstevel@tonic-gate if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) { 698*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 699*7c478bd9Sstevel@tonic-gate gettext("while reading response from server")); 700*7c478bd9Sstevel@tonic-gate exit(1); 701*7c478bd9Sstevel@tonic-gate } 702*7c478bd9Sstevel@tonic-gate /* 703*7c478bd9Sstevel@tonic-gate * If we got an error response back from the server, display 704*7c478bd9Sstevel@tonic-gate * the error message 705*7c478bd9Sstevel@tonic-gate */ 706*7c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) { 707*7c478bd9Sstevel@tonic-gate if (retval = krb5_rd_error(context, &inbuf, &error)) { 708*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 709*7c478bd9Sstevel@tonic-gate gettext("while decoding error response from server")); 710*7c478bd9Sstevel@tonic-gate exit(1); 711*7c478bd9Sstevel@tonic-gate } 712*7c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 713*7c478bd9Sstevel@tonic-gate if (error->text.data) 714*7c478bd9Sstevel@tonic-gate fprintf(stderr, 715*7c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 716*7c478bd9Sstevel@tonic-gate error->text.data); 717*7c478bd9Sstevel@tonic-gate } else if (error->error) { 718*7c478bd9Sstevel@tonic-gate com_err(progname, error->error + ERROR_TABLE_BASE_krb5, 719*7c478bd9Sstevel@tonic-gate gettext("signalled from server")); 720*7c478bd9Sstevel@tonic-gate if (error->text.data) 721*7c478bd9Sstevel@tonic-gate fprintf(stderr, 722*7c478bd9Sstevel@tonic-gate gettext("Error text from server: %s\n"), 723*7c478bd9Sstevel@tonic-gate error->text.data); 724*7c478bd9Sstevel@tonic-gate } 725*7c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 726*7c478bd9Sstevel@tonic-gate exit(1); 727*7c478bd9Sstevel@tonic-gate } 728*7c478bd9Sstevel@tonic-gate if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) { 729*7c478bd9Sstevel@tonic-gate com_err(progname, retval, 730*7c478bd9Sstevel@tonic-gate gettext("while decoding final size packet from server")); 731*7c478bd9Sstevel@tonic-gate exit(1); 732*7c478bd9Sstevel@tonic-gate } 733*7c478bd9Sstevel@tonic-gate memcpy((char *)&send_size, outbuf.data, sizeof(send_size)); 734*7c478bd9Sstevel@tonic-gate send_size = ntohl(send_size); 735*7c478bd9Sstevel@tonic-gate if (send_size != database_size) { 736*7c478bd9Sstevel@tonic-gate com_err(progname, 0, 737*7c478bd9Sstevel@tonic-gate gettext("Kpropd sent database size %d, expecting %d"), 738*7c478bd9Sstevel@tonic-gate send_size, database_size); 739*7c478bd9Sstevel@tonic-gate exit(1); 740*7c478bd9Sstevel@tonic-gate } 741*7c478bd9Sstevel@tonic-gate free(outbuf.data); 742*7c478bd9Sstevel@tonic-gate free(inbuf.data); 743*7c478bd9Sstevel@tonic-gate } 744*7c478bd9Sstevel@tonic-gate 745*7c478bd9Sstevel@tonic-gate void 746*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, err_text, err_code) 747*7c478bd9Sstevel@tonic-gate krb5_context context; 748*7c478bd9Sstevel@tonic-gate krb5_creds *my_creds; 749*7c478bd9Sstevel@tonic-gate int fd; 750*7c478bd9Sstevel@tonic-gate char *err_text; 751*7c478bd9Sstevel@tonic-gate krb5_error_code err_code; 752*7c478bd9Sstevel@tonic-gate { 753*7c478bd9Sstevel@tonic-gate krb5_error error; 754*7c478bd9Sstevel@tonic-gate const char *text; 755*7c478bd9Sstevel@tonic-gate krb5_data outbuf; 756*7c478bd9Sstevel@tonic-gate 757*7c478bd9Sstevel@tonic-gate memset((char *)&error, 0, sizeof(error)); 758*7c478bd9Sstevel@tonic-gate krb5_us_timeofday(context, &error.ctime, &error.cusec); 759*7c478bd9Sstevel@tonic-gate error.server = my_creds->server; 760*7c478bd9Sstevel@tonic-gate error.client = my_principal; 761*7c478bd9Sstevel@tonic-gate error.error = err_code - ERROR_TABLE_BASE_krb5; 762*7c478bd9Sstevel@tonic-gate if (error.error > 127) 763*7c478bd9Sstevel@tonic-gate error.error = KRB_ERR_GENERIC; 764*7c478bd9Sstevel@tonic-gate if (err_text) 765*7c478bd9Sstevel@tonic-gate text = err_text; 766*7c478bd9Sstevel@tonic-gate else 767*7c478bd9Sstevel@tonic-gate text = error_message(err_code); 768*7c478bd9Sstevel@tonic-gate error.text.length = strlen(text) + 1; 769*7c478bd9Sstevel@tonic-gate if (error.text.data = malloc(error.text.length)) { 770*7c478bd9Sstevel@tonic-gate strcpy(error.text.data, text); 771*7c478bd9Sstevel@tonic-gate if (!krb5_mk_error(context, &error, &outbuf)) { 772*7c478bd9Sstevel@tonic-gate (void) krb5_write_message(context, (void *)&fd,&outbuf); 773*7c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 774*7c478bd9Sstevel@tonic-gate } 775*7c478bd9Sstevel@tonic-gate free(error.text.data); 776*7c478bd9Sstevel@tonic-gate } 777*7c478bd9Sstevel@tonic-gate } 778*7c478bd9Sstevel@tonic-gate 779*7c478bd9Sstevel@tonic-gate void update_last_prop_file(hostname, file_name) 780*7c478bd9Sstevel@tonic-gate char *hostname; 781*7c478bd9Sstevel@tonic-gate char *file_name; 782*7c478bd9Sstevel@tonic-gate { 783*7c478bd9Sstevel@tonic-gate /* handle slave locking/failure stuff */ 784*7c478bd9Sstevel@tonic-gate char *file_last_prop; 785*7c478bd9Sstevel@tonic-gate int fd; 786*7c478bd9Sstevel@tonic-gate static char last_prop[]=".last_prop"; 787*7c478bd9Sstevel@tonic-gate 788*7c478bd9Sstevel@tonic-gate if ((file_last_prop = (char *)malloc(strlen(file_name) + 789*7c478bd9Sstevel@tonic-gate strlen(hostname) + 1 + 790*7c478bd9Sstevel@tonic-gate strlen(last_prop) + 1)) == NULL) { 791*7c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 792*7c478bd9Sstevel@tonic-gate gettext("while allocating filename for update_last_prop_file")); 793*7c478bd9Sstevel@tonic-gate return; 794*7c478bd9Sstevel@tonic-gate } 795*7c478bd9Sstevel@tonic-gate strcpy(file_last_prop, file_name); 796*7c478bd9Sstevel@tonic-gate 797*7c478bd9Sstevel@tonic-gate /* 798*7c478bd9Sstevel@tonic-gate * If a nondefault file name was specified then we should not add an 799*7c478bd9Sstevel@tonic-gate * extraneous host name to the file name given that a file name could 800*7c478bd9Sstevel@tonic-gate * have already specified a host name and therefore would be redundant. 801*7c478bd9Sstevel@tonic-gate */ 802*7c478bd9Sstevel@tonic-gate if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) { 803*7c478bd9Sstevel@tonic-gate strcat(file_last_prop, "."); 804*7c478bd9Sstevel@tonic-gate strcat(file_last_prop, hostname); 805*7c478bd9Sstevel@tonic-gate } 806*7c478bd9Sstevel@tonic-gate strcat(file_last_prop, last_prop); 807*7c478bd9Sstevel@tonic-gate if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) { 808*7c478bd9Sstevel@tonic-gate com_err(progname, errno, 809*7c478bd9Sstevel@tonic-gate gettext("while creating 'last_prop' file, '%s'"), 810*7c478bd9Sstevel@tonic-gate file_last_prop); 811*7c478bd9Sstevel@tonic-gate free(file_last_prop); 812*7c478bd9Sstevel@tonic-gate return; 813*7c478bd9Sstevel@tonic-gate } 814*7c478bd9Sstevel@tonic-gate write(fd, "", 1); 815*7c478bd9Sstevel@tonic-gate free(file_last_prop); 816*7c478bd9Sstevel@tonic-gate close(fd); 817*7c478bd9Sstevel@tonic-gate return; 818*7c478bd9Sstevel@tonic-gate } 819