xref: /titanic_54/usr/src/cmd/krb5/slave/kprop.c (revision 7c478bd95313f5f23a4c958a745db2134aa03244)
1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
3*7c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
4*7c478bd9Sstevel@tonic-gate  */
5*7c478bd9Sstevel@tonic-gate 
6*7c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
7*7c478bd9Sstevel@tonic-gate 
8*7c478bd9Sstevel@tonic-gate /*
9*7c478bd9Sstevel@tonic-gate  * slave/kprop.c
10*7c478bd9Sstevel@tonic-gate  *
11*7c478bd9Sstevel@tonic-gate  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
12*7c478bd9Sstevel@tonic-gate  * All Rights Reserved.
13*7c478bd9Sstevel@tonic-gate  *
14*7c478bd9Sstevel@tonic-gate  * Export of this software from the United States of America may
15*7c478bd9Sstevel@tonic-gate  *   require a specific license from the United States Government.
16*7c478bd9Sstevel@tonic-gate  *   It is the responsibility of any person or organization contemplating
17*7c478bd9Sstevel@tonic-gate  *   export to obtain such a license before exporting.
18*7c478bd9Sstevel@tonic-gate  *
19*7c478bd9Sstevel@tonic-gate  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
20*7c478bd9Sstevel@tonic-gate  * distribute this software and its documentation for any purpose and
21*7c478bd9Sstevel@tonic-gate  * without fee is hereby granted, provided that the above copyright
22*7c478bd9Sstevel@tonic-gate  * notice appear in all copies and that both that copyright notice and
23*7c478bd9Sstevel@tonic-gate  * this permission notice appear in supporting documentation, and that
24*7c478bd9Sstevel@tonic-gate  * the name of M.I.T. not be used in advertising or publicity pertaining
25*7c478bd9Sstevel@tonic-gate  * to distribution of the software without specific, written prior
26*7c478bd9Sstevel@tonic-gate  * permission.  Furthermore if you modify this software you must label
27*7c478bd9Sstevel@tonic-gate  * your software as modified software and not distribute it in such a
28*7c478bd9Sstevel@tonic-gate  * fashion that it might be confused with the original M.I.T. software.
29*7c478bd9Sstevel@tonic-gate  * M.I.T. makes no representations about the suitability of
30*7c478bd9Sstevel@tonic-gate  * this software for any purpose.  It is provided "as is" without express
31*7c478bd9Sstevel@tonic-gate  * or implied warranty.
32*7c478bd9Sstevel@tonic-gate  *
33*7c478bd9Sstevel@tonic-gate  *
34*7c478bd9Sstevel@tonic-gate  */
35*7c478bd9Sstevel@tonic-gate 
36*7c478bd9Sstevel@tonic-gate 
37*7c478bd9Sstevel@tonic-gate #include <errno.h>
38*7c478bd9Sstevel@tonic-gate #include <stdio.h>
39*7c478bd9Sstevel@tonic-gate #include <stdlib.h>
40*7c478bd9Sstevel@tonic-gate #include <ctype.h>
41*7c478bd9Sstevel@tonic-gate #include <sys/file.h>
42*7c478bd9Sstevel@tonic-gate #include <signal.h>
43*7c478bd9Sstevel@tonic-gate #include <string.h>
44*7c478bd9Sstevel@tonic-gate #include <sys/types.h>
45*7c478bd9Sstevel@tonic-gate #include <sys/time.h>
46*7c478bd9Sstevel@tonic-gate #include <sys/stat.h>
47*7c478bd9Sstevel@tonic-gate #include <sys/socket.h>
48*7c478bd9Sstevel@tonic-gate #include <netinet/in.h>
49*7c478bd9Sstevel@tonic-gate #include <sys/param.h>
50*7c478bd9Sstevel@tonic-gate #include <netdb.h>
51*7c478bd9Sstevel@tonic-gate #include <fcntl.h>
52*7c478bd9Sstevel@tonic-gate #include <libintl.h>
53*7c478bd9Sstevel@tonic-gate #include <locale.h>
54*7c478bd9Sstevel@tonic-gate #include <k5-int.h>
55*7c478bd9Sstevel@tonic-gate #include "com_err.h"
56*7c478bd9Sstevel@tonic-gate #include "kprop.h"
57*7c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION;
58*7c478bd9Sstevel@tonic-gate 
59*7c478bd9Sstevel@tonic-gate char	*progname = 0;
60*7c478bd9Sstevel@tonic-gate int     debug = 0;
61*7c478bd9Sstevel@tonic-gate char	*srvtab = 0;
62*7c478bd9Sstevel@tonic-gate char	*slave_host;
63*7c478bd9Sstevel@tonic-gate char	*realm = 0;
64*7c478bd9Sstevel@tonic-gate char	*file = KPROP_DEFAULT_FILE;
65*7c478bd9Sstevel@tonic-gate short	port = 0;
66*7c478bd9Sstevel@tonic-gate 
67*7c478bd9Sstevel@tonic-gate krb5_principal	my_principal;		/* The Kerberos principal we'll be */
68*7c478bd9Sstevel@tonic-gate 				/* running under, initialized in */
69*7c478bd9Sstevel@tonic-gate 				/* get_tickets() */
70*7c478bd9Sstevel@tonic-gate krb5_ccache	ccache;		/* Credentials cache which we'll be using */
71*7c478bd9Sstevel@tonic-gate /* krb5_creds 	my_creds;	/* My credentials */
72*7c478bd9Sstevel@tonic-gate krb5_creds	creds;
73*7c478bd9Sstevel@tonic-gate krb5_address	sender_addr;
74*7c478bd9Sstevel@tonic-gate krb5_address	receiver_addr;
75*7c478bd9Sstevel@tonic-gate 
76*7c478bd9Sstevel@tonic-gate void	PRS
77*7c478bd9Sstevel@tonic-gate 	 (int, char **);
78*7c478bd9Sstevel@tonic-gate void	get_tickets
79*7c478bd9Sstevel@tonic-gate 	 (krb5_context);
80*7c478bd9Sstevel@tonic-gate static void usage
81*7c478bd9Sstevel@tonic-gate 	 (void);
82*7c478bd9Sstevel@tonic-gate krb5_error_code open_connection
83*7c478bd9Sstevel@tonic-gate 	(char *, int *, char *, int);
84*7c478bd9Sstevel@tonic-gate void	kerberos_authenticate
85*7c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context *,
86*7c478bd9Sstevel@tonic-gate 		   int, krb5_principal, krb5_creds **);
87*7c478bd9Sstevel@tonic-gate int	open_database
88*7c478bd9Sstevel@tonic-gate 	 (krb5_context, char *, int *);
89*7c478bd9Sstevel@tonic-gate void	close_database
90*7c478bd9Sstevel@tonic-gate 	 (krb5_context, int);
91*7c478bd9Sstevel@tonic-gate void	xmit_database
92*7c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context, krb5_creds *,
93*7c478bd9Sstevel@tonic-gate 		   int, int, int);
94*7c478bd9Sstevel@tonic-gate void	send_error
95*7c478bd9Sstevel@tonic-gate 	 (krb5_context, krb5_creds *, int, char *, krb5_error_code);
96*7c478bd9Sstevel@tonic-gate void	update_last_prop_file
97*7c478bd9Sstevel@tonic-gate 	 (char *, char *);
98*7c478bd9Sstevel@tonic-gate 
99*7c478bd9Sstevel@tonic-gate static void usage()
100*7c478bd9Sstevel@tonic-gate {
101*7c478bd9Sstevel@tonic-gate 	fprintf(stderr,
102*7c478bd9Sstevel@tonic-gate 		gettext
103*7c478bd9Sstevel@tonic-gate 		("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"),
104*7c478bd9Sstevel@tonic-gate 		progname);
105*7c478bd9Sstevel@tonic-gate 	exit(1);
106*7c478bd9Sstevel@tonic-gate }
107*7c478bd9Sstevel@tonic-gate 
108*7c478bd9Sstevel@tonic-gate int
109*7c478bd9Sstevel@tonic-gate main(argc, argv)
110*7c478bd9Sstevel@tonic-gate 	int	argc;
111*7c478bd9Sstevel@tonic-gate 	char	**argv;
112*7c478bd9Sstevel@tonic-gate {
113*7c478bd9Sstevel@tonic-gate 	int	fd, database_fd, database_size;
114*7c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
115*7c478bd9Sstevel@tonic-gate 	krb5_context context;
116*7c478bd9Sstevel@tonic-gate 	krb5_creds *my_creds;
117*7c478bd9Sstevel@tonic-gate 	krb5_auth_context auth_context;
118*7c478bd9Sstevel@tonic-gate #define	ERRMSGSIZ	256
119*7c478bd9Sstevel@tonic-gate 	char	Errmsg[ERRMSGSIZ];
120*7c478bd9Sstevel@tonic-gate 
121*7c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
122*7c478bd9Sstevel@tonic-gate 
123*7c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
124*7c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN	"KPROP_TEST"	/* Use this only if it weren't */
125*7c478bd9Sstevel@tonic-gate #endif
126*7c478bd9Sstevel@tonic-gate 
127*7c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
128*7c478bd9Sstevel@tonic-gate 
129*7c478bd9Sstevel@tonic-gate 	retval = krb5_init_context(&context);
130*7c478bd9Sstevel@tonic-gate 	if (retval) {
131*7c478bd9Sstevel@tonic-gate 		com_err(argv[0], retval, gettext("while initializing krb5"));
132*7c478bd9Sstevel@tonic-gate 		exit(1);
133*7c478bd9Sstevel@tonic-gate 	}
134*7c478bd9Sstevel@tonic-gate 	PRS(argc, argv);
135*7c478bd9Sstevel@tonic-gate 	get_tickets(context);
136*7c478bd9Sstevel@tonic-gate 
137*7c478bd9Sstevel@tonic-gate 	database_fd = open_database(context, file, &database_size);
138*7c478bd9Sstevel@tonic-gate 	if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) {
139*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("%s while opening connection to %s"),
140*7c478bd9Sstevel@tonic-gate 			Errmsg, slave_host);
141*7c478bd9Sstevel@tonic-gate 		exit(1);
142*7c478bd9Sstevel@tonic-gate 	}
143*7c478bd9Sstevel@tonic-gate 	if (fd < 0) {
144*7c478bd9Sstevel@tonic-gate 		fprintf(stderr,
145*7c478bd9Sstevel@tonic-gate 			gettext("%s: %s while opening connection to %s\n"),
146*7c478bd9Sstevel@tonic-gate 			progname, Errmsg, slave_host);
147*7c478bd9Sstevel@tonic-gate 		exit(1);
148*7c478bd9Sstevel@tonic-gate 	}
149*7c478bd9Sstevel@tonic-gate 	kerberos_authenticate(context, &auth_context, fd, my_principal,
150*7c478bd9Sstevel@tonic-gate 			      &my_creds);
151*7c478bd9Sstevel@tonic-gate 	xmit_database(context, auth_context, my_creds, fd, database_fd,
152*7c478bd9Sstevel@tonic-gate 		      database_size);
153*7c478bd9Sstevel@tonic-gate 	update_last_prop_file(slave_host, file);
154*7c478bd9Sstevel@tonic-gate 	printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host);
155*7c478bd9Sstevel@tonic-gate 	krb5_free_cred_contents(context, my_creds);
156*7c478bd9Sstevel@tonic-gate 	close_database(context, database_fd);
157*7c478bd9Sstevel@tonic-gate 	exit(0);
158*7c478bd9Sstevel@tonic-gate }
159*7c478bd9Sstevel@tonic-gate void PRS(argc, argv)
160*7c478bd9Sstevel@tonic-gate 	int	argc;
161*7c478bd9Sstevel@tonic-gate 	char	**argv;
162*7c478bd9Sstevel@tonic-gate {
163*7c478bd9Sstevel@tonic-gate 	int c;
164*7c478bd9Sstevel@tonic-gate 	register char	*word, ch;
165*7c478bd9Sstevel@tonic-gate 	extern int optind;
166*7c478bd9Sstevel@tonic-gate 	extern char *optarg;
167*7c478bd9Sstevel@tonic-gate 
168*7c478bd9Sstevel@tonic-gate 	progname = argv[0];
169*7c478bd9Sstevel@tonic-gate 	while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) {
170*7c478bd9Sstevel@tonic-gate 		switch (c) {
171*7c478bd9Sstevel@tonic-gate 				case 'r':
172*7c478bd9Sstevel@tonic-gate 			realm = optarg;
173*7c478bd9Sstevel@tonic-gate 					if (!realm)
174*7c478bd9Sstevel@tonic-gate 						usage();
175*7c478bd9Sstevel@tonic-gate 					break;
176*7c478bd9Sstevel@tonic-gate 				case 'f':
177*7c478bd9Sstevel@tonic-gate 			file = optarg;
178*7c478bd9Sstevel@tonic-gate 					if (!file)
179*7c478bd9Sstevel@tonic-gate 						usage();
180*7c478bd9Sstevel@tonic-gate 					break;
181*7c478bd9Sstevel@tonic-gate 				case 'd':
182*7c478bd9Sstevel@tonic-gate 					debug++;
183*7c478bd9Sstevel@tonic-gate 					break;
184*7c478bd9Sstevel@tonic-gate 				case 'P':
185*7c478bd9Sstevel@tonic-gate 			port = htons(atoi(optarg));
186*7c478bd9Sstevel@tonic-gate 					if (!port)
187*7c478bd9Sstevel@tonic-gate 						usage();
188*7c478bd9Sstevel@tonic-gate 					break;
189*7c478bd9Sstevel@tonic-gate 				case 's':
190*7c478bd9Sstevel@tonic-gate 			srvtab = optarg;
191*7c478bd9Sstevel@tonic-gate 					if (!srvtab)
192*7c478bd9Sstevel@tonic-gate 						usage();
193*7c478bd9Sstevel@tonic-gate 					break;
194*7c478bd9Sstevel@tonic-gate 		case '?':
195*7c478bd9Sstevel@tonic-gate 				default:
196*7c478bd9Sstevel@tonic-gate 			printf (gettext("Error \n"));
197*7c478bd9Sstevel@tonic-gate 					usage();
198*7c478bd9Sstevel@tonic-gate 				}
199*7c478bd9Sstevel@tonic-gate 			}
200*7c478bd9Sstevel@tonic-gate 	argc -= optind;
201*7c478bd9Sstevel@tonic-gate 	argv = &argv[optind];
202*7c478bd9Sstevel@tonic-gate 	if (*argv)
203*7c478bd9Sstevel@tonic-gate 		slave_host = *argv;
204*7c478bd9Sstevel@tonic-gate 			else
205*7c478bd9Sstevel@tonic-gate 		usage();
206*7c478bd9Sstevel@tonic-gate 
207*7c478bd9Sstevel@tonic-gate }
208*7c478bd9Sstevel@tonic-gate 
209*7c478bd9Sstevel@tonic-gate void get_tickets(context)
210*7c478bd9Sstevel@tonic-gate     krb5_context context;
211*7c478bd9Sstevel@tonic-gate {
212*7c478bd9Sstevel@tonic-gate 	char   my_host_name[MAXHOSTNAMELEN];
213*7c478bd9Sstevel@tonic-gate 	char   buf[BUFSIZ];
214*7c478bd9Sstevel@tonic-gate 	char   *cp;
215*7c478bd9Sstevel@tonic-gate 	struct hostent *hp;
216*7c478bd9Sstevel@tonic-gate 	krb5_error_code retval;
217*7c478bd9Sstevel@tonic-gate 	static char tkstring[] = "/tmp/kproptktXXXXXX";
218*7c478bd9Sstevel@tonic-gate 	krb5_keytab keytab = NULL;
219*7c478bd9Sstevel@tonic-gate 	krb5_get_init_creds_opt opt;
220*7c478bd9Sstevel@tonic-gate 	char *svcname = NULL;
221*7c478bd9Sstevel@tonic-gate 	char *def_realm = NULL;
222*7c478bd9Sstevel@tonic-gate 	char *master_host = NULL;
223*7c478bd9Sstevel@tonic-gate 
224*7c478bd9Sstevel@tonic-gate 
225*7c478bd9Sstevel@tonic-gate 	/*
226*7c478bd9Sstevel@tonic-gate 	 * Figure out what tickets we'll be using to send stuff
227*7c478bd9Sstevel@tonic-gate 	 */
228*7c478bd9Sstevel@tonic-gate 	if (realm) {
229*7c478bd9Sstevel@tonic-gate 	    if ((def_realm = strdup(realm)) == NULL) {
230*7c478bd9Sstevel@tonic-gate 	      com_err(progname, ENOMEM,
231*7c478bd9Sstevel@tonic-gate 		      gettext("while allocating default realm name '%s'"),
232*7c478bd9Sstevel@tonic-gate 		      realm);
233*7c478bd9Sstevel@tonic-gate 	      exit(1);
234*7c478bd9Sstevel@tonic-gate 	    }
235*7c478bd9Sstevel@tonic-gate 	} else {
236*7c478bd9Sstevel@tonic-gate 	    retval = krb5_get_default_realm(context, &def_realm);
237*7c478bd9Sstevel@tonic-gate 	    if (retval) {
238*7c478bd9Sstevel@tonic-gate 	        com_err(progname, retval,
239*7c478bd9Sstevel@tonic-gate 			gettext("while getting default realm"));
240*7c478bd9Sstevel@tonic-gate 	        exit(1);
241*7c478bd9Sstevel@tonic-gate 	    }
242*7c478bd9Sstevel@tonic-gate 	}
243*7c478bd9Sstevel@tonic-gate 
244*7c478bd9Sstevel@tonic-gate 	/*
245*7c478bd9Sstevel@tonic-gate 	 * Always pick up the master hostname from krb5.conf, as
246*7c478bd9Sstevel@tonic-gate 	 * opposed to picking up the localhost, so we do not get bit
247*7c478bd9Sstevel@tonic-gate 	 * if the master KDC is HA and hence points to a logicalhost.
248*7c478bd9Sstevel@tonic-gate 	 */
249*7c478bd9Sstevel@tonic-gate 	retval = kadm5_get_master(context, def_realm, &master_host);
250*7c478bd9Sstevel@tonic-gate 	if (retval) {
251*7c478bd9Sstevel@tonic-gate 	    free(def_realm);
252*7c478bd9Sstevel@tonic-gate 	    com_err(progname, retval,
253*7c478bd9Sstevel@tonic-gate 		gettext("while getting admin server fqdn"));
254*7c478bd9Sstevel@tonic-gate 	    exit(1);
255*7c478bd9Sstevel@tonic-gate 	}
256*7c478bd9Sstevel@tonic-gate 
257*7c478bd9Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context, master_host, NULL,
258*7c478bd9Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &my_principal);
259*7c478bd9Sstevel@tonic-gate 
260*7c478bd9Sstevel@tonic-gate 	free(def_realm);
261*7c478bd9Sstevel@tonic-gate 	free(master_host);
262*7c478bd9Sstevel@tonic-gate 	if (retval) {
263*7c478bd9Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting client principal name"));
264*7c478bd9Sstevel@tonic-gate 	    exit(1);
265*7c478bd9Sstevel@tonic-gate 	}
266*7c478bd9Sstevel@tonic-gate 
267*7c478bd9Sstevel@tonic-gate 	if (realm) {
268*7c478bd9Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data);
269*7c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, my_principal, strlen(realm));
270*7c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, my_principal, strdup(realm));
271*7c478bd9Sstevel@tonic-gate 	}
272*7c478bd9Sstevel@tonic-gate #if 0
273*7c478bd9Sstevel@tonic-gate 	krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL;
274*7c478bd9Sstevel@tonic-gate #endif
275*7c478bd9Sstevel@tonic-gate 
276*7c478bd9Sstevel@tonic-gate 	/*
277*7c478bd9Sstevel@tonic-gate 	 * Initialize cache file which we're going to be using
278*7c478bd9Sstevel@tonic-gate 	 */
279*7c478bd9Sstevel@tonic-gate 	(void) mktemp(tkstring);
280*7c478bd9Sstevel@tonic-gate 	snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring);
281*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_resolve(context, buf, &ccache)) {
282*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while opening credential cache %s"),
283*7c478bd9Sstevel@tonic-gate 			buf);
284*7c478bd9Sstevel@tonic-gate 		exit(1);
285*7c478bd9Sstevel@tonic-gate 	}
286*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_initialize(context, ccache, my_principal)) {
287*7c478bd9Sstevel@tonic-gate 		com_err (progname, retval, gettext("when initializing cache %s"),
288*7c478bd9Sstevel@tonic-gate 			 buf);
289*7c478bd9Sstevel@tonic-gate 		exit(1);
290*7c478bd9Sstevel@tonic-gate 	}
291*7c478bd9Sstevel@tonic-gate 
292*7c478bd9Sstevel@tonic-gate 	/*
293*7c478bd9Sstevel@tonic-gate 	 * Get the tickets we'll need.
294*7c478bd9Sstevel@tonic-gate 	 *
295*7c478bd9Sstevel@tonic-gate 	 * Construct the principal name for the slave host.
296*7c478bd9Sstevel@tonic-gate 	 */
297*7c478bd9Sstevel@tonic-gate 	memset((char *)&creds, 0, sizeof(creds));
298*7c478bd9Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context,
299*7c478bd9Sstevel@tonic-gate 					 slave_host, KPROP_SERVICE_NAME,
300*7c478bd9Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &creds.server);
301*7c478bd9Sstevel@tonic-gate 	if (retval) {
302*7c478bd9Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting server principal name"));
303*7c478bd9Sstevel@tonic-gate 	    (void) krb5_cc_destroy(context, ccache);
304*7c478bd9Sstevel@tonic-gate 	    exit(1);
305*7c478bd9Sstevel@tonic-gate 	}
306*7c478bd9Sstevel@tonic-gate 	if (realm) {
307*7c478bd9Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data);
308*7c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, creds.server, strlen(realm));
309*7c478bd9Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, creds.server, strdup(realm));
310*7c478bd9Sstevel@tonic-gate 	}
311*7c478bd9Sstevel@tonic-gate 
312*7c478bd9Sstevel@tonic-gate 	/*
313*7c478bd9Sstevel@tonic-gate 	 * Now fill in the client....
314*7c478bd9Sstevel@tonic-gate 	 */
315*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_copy_principal(context, my_principal, &creds.client)) {
316*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("While copying client principal"));
317*7c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
318*7c478bd9Sstevel@tonic-gate 		exit(1);
319*7c478bd9Sstevel@tonic-gate 	}
320*7c478bd9Sstevel@tonic-gate 	if (srvtab) {
321*7c478bd9Sstevel@tonic-gate 		if (retval = krb5_kt_resolve(context, srvtab, &keytab)) {
322*7c478bd9Sstevel@tonic-gate 			com_err(progname, retval, gettext("while resolving keytab"));
323*7c478bd9Sstevel@tonic-gate 			(void) krb5_cc_destroy(context, ccache);
324*7c478bd9Sstevel@tonic-gate 			exit(1);
325*7c478bd9Sstevel@tonic-gate 		}
326*7c478bd9Sstevel@tonic-gate 	}
327*7c478bd9Sstevel@tonic-gate 	(void) memset(&opt, 0, sizeof (opt));
328*7c478bd9Sstevel@tonic-gate 	krb5_get_init_creds_opt_init(&opt);
329*7c478bd9Sstevel@tonic-gate 	retval = krb5_unparse_name(context,  creds.server, &svcname);
330*7c478bd9Sstevel@tonic-gate 	if (retval) {
331*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while parsing svc principal name"));
332*7c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
333*7c478bd9Sstevel@tonic-gate 		exit (1);
334*7c478bd9Sstevel@tonic-gate 	}
335*7c478bd9Sstevel@tonic-gate 	retval = krb5_get_init_creds_keytab(context, &creds, creds.client,
336*7c478bd9Sstevel@tonic-gate 				keytab,  0, svcname, &opt);
337*7c478bd9Sstevel@tonic-gate 
338*7c478bd9Sstevel@tonic-gate 	if (svcname)
339*7c478bd9Sstevel@tonic-gate 		free(svcname);
340*7c478bd9Sstevel@tonic-gate 
341*7c478bd9Sstevel@tonic-gate 	if (retval) {
342*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while getting initial ticket\n"));
343*7c478bd9Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
344*7c478bd9Sstevel@tonic-gate 		exit(1);
345*7c478bd9Sstevel@tonic-gate 	}
346*7c478bd9Sstevel@tonic-gate 
347*7c478bd9Sstevel@tonic-gate 	if (keytab)
348*7c478bd9Sstevel@tonic-gate 	    (void) krb5_kt_close(context, keytab);
349*7c478bd9Sstevel@tonic-gate 
350*7c478bd9Sstevel@tonic-gate 	/*
351*7c478bd9Sstevel@tonic-gate 	 * Now destroy the cache right away --- the credentials we
352*7c478bd9Sstevel@tonic-gate 	 * need will be in my_creds.
353*7c478bd9Sstevel@tonic-gate 	 */
354*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_cc_destroy(context, ccache)) {
355*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while destroying ticket cache"));
356*7c478bd9Sstevel@tonic-gate 		exit(1);
357*7c478bd9Sstevel@tonic-gate 	}
358*7c478bd9Sstevel@tonic-gate }
359*7c478bd9Sstevel@tonic-gate 
360*7c478bd9Sstevel@tonic-gate krb5_error_code
361*7c478bd9Sstevel@tonic-gate open_connection(host, fd, Errmsg, ErrmsgSz)
362*7c478bd9Sstevel@tonic-gate 	char	*host;
363*7c478bd9Sstevel@tonic-gate 	int	*fd;
364*7c478bd9Sstevel@tonic-gate 	char	*Errmsg;
365*7c478bd9Sstevel@tonic-gate 	int	 ErrmsgSz;
366*7c478bd9Sstevel@tonic-gate {
367*7c478bd9Sstevel@tonic-gate 	int	s;
368*7c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
369*7c478bd9Sstevel@tonic-gate 
370*7c478bd9Sstevel@tonic-gate 	int	socket_length;
371*7c478bd9Sstevel@tonic-gate 	struct addrinfo hints, *ai, *aitop;
372*7c478bd9Sstevel@tonic-gate 	struct sockaddr_storage	  ss;
373*7c478bd9Sstevel@tonic-gate 	char serv_or_port[NI_MAXSERV];
374*7c478bd9Sstevel@tonic-gate 	enum err_types {SOCKET, CONNECT};
375*7c478bd9Sstevel@tonic-gate 	int which_err;
376*7c478bd9Sstevel@tonic-gate 
377*7c478bd9Sstevel@tonic-gate 	memset(&hints, 0, sizeof(hints));
378*7c478bd9Sstevel@tonic-gate 	hints.ai_family = AF_UNSPEC;    /* go for either IPv4 or v6 */
379*7c478bd9Sstevel@tonic-gate 	hints.ai_socktype = SOCK_STREAM;
380*7c478bd9Sstevel@tonic-gate 
381*7c478bd9Sstevel@tonic-gate 	if (port != 0)
382*7c478bd9Sstevel@tonic-gate 		(void) snprintf(serv_or_port, sizeof(serv_or_port), ("%d"),
383*7c478bd9Sstevel@tonic-gate 				port);
384*7c478bd9Sstevel@tonic-gate 	else
385*7c478bd9Sstevel@tonic-gate 		strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port));
386*7c478bd9Sstevel@tonic-gate 
387*7c478bd9Sstevel@tonic-gate 	if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) {
388*7c478bd9Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"),
389*7c478bd9Sstevel@tonic-gate 				host);
390*7c478bd9Sstevel@tonic-gate 		*fd = -1;
391*7c478bd9Sstevel@tonic-gate 		return(0);
392*7c478bd9Sstevel@tonic-gate 	}
393*7c478bd9Sstevel@tonic-gate 
394*7c478bd9Sstevel@tonic-gate 	for (ai = aitop; ai; ai = ai->ai_next) {
395*7c478bd9Sstevel@tonic-gate 		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
396*7c478bd9Sstevel@tonic-gate 			continue;
397*7c478bd9Sstevel@tonic-gate 
398*7c478bd9Sstevel@tonic-gate 		s = socket(ai->ai_family, SOCK_STREAM, 0);
399*7c478bd9Sstevel@tonic-gate 		if (s < 0) {
400*7c478bd9Sstevel@tonic-gate 			which_err = SOCKET;
401*7c478bd9Sstevel@tonic-gate 			retval = errno;
402*7c478bd9Sstevel@tonic-gate 			continue;
403*7c478bd9Sstevel@tonic-gate 		}
404*7c478bd9Sstevel@tonic-gate 
405*7c478bd9Sstevel@tonic-gate 		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
406*7c478bd9Sstevel@tonic-gate 		    errno != EINPROGRESS) {
407*7c478bd9Sstevel@tonic-gate 			which_err = CONNECT;
408*7c478bd9Sstevel@tonic-gate 			retval = errno;
409*7c478bd9Sstevel@tonic-gate 			close(s);
410*7c478bd9Sstevel@tonic-gate 			continue;	/* fail -- try next */
411*7c478bd9Sstevel@tonic-gate 		}
412*7c478bd9Sstevel@tonic-gate 
413*7c478bd9Sstevel@tonic-gate 		break; /* success */
414*7c478bd9Sstevel@tonic-gate 	}
415*7c478bd9Sstevel@tonic-gate 
416*7c478bd9Sstevel@tonic-gate 	if (ai == NULL) {
417*7c478bd9Sstevel@tonic-gate 		switch (which_err) {
418*7c478bd9Sstevel@tonic-gate 			case SOCKET:
419*7c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
420*7c478bd9Sstevel@tonic-gate 						gettext("in call to socket"));
421*7c478bd9Sstevel@tonic-gate 				break;
422*7c478bd9Sstevel@tonic-gate 			case CONNECT:
423*7c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
424*7c478bd9Sstevel@tonic-gate 						gettext("in call to connect"));
425*7c478bd9Sstevel@tonic-gate 				break;
426*7c478bd9Sstevel@tonic-gate 			default :
427*7c478bd9Sstevel@tonic-gate 				retval = -1; /* generic error */
428*7c478bd9Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
429*7c478bd9Sstevel@tonic-gate 					gettext("could not setup network"));
430*7c478bd9Sstevel@tonic-gate 				break;
431*7c478bd9Sstevel@tonic-gate 		}
432*7c478bd9Sstevel@tonic-gate 		if (aitop != NULL)
433*7c478bd9Sstevel@tonic-gate 			freeaddrinfo(aitop);
434*7c478bd9Sstevel@tonic-gate 		return(retval);
435*7c478bd9Sstevel@tonic-gate 	}
436*7c478bd9Sstevel@tonic-gate 
437*7c478bd9Sstevel@tonic-gate 	*fd = s;
438*7c478bd9Sstevel@tonic-gate 
439*7c478bd9Sstevel@tonic-gate 	/*
440*7c478bd9Sstevel@tonic-gate 	 * Set receiver_addr and sender_addr.
441*7c478bd9Sstevel@tonic-gate 	 */
442*7c478bd9Sstevel@tonic-gate 	if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr)
443*7c478bd9Sstevel@tonic-gate 			== NULL) {
444*7c478bd9Sstevel@tonic-gate 		retval = errno;
445*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
446*7c478bd9Sstevel@tonic-gate 			gettext("while converting socket address"));
447*7c478bd9Sstevel@tonic-gate 		if (aitop != NULL)
448*7c478bd9Sstevel@tonic-gate 			freeaddrinfo(aitop);
449*7c478bd9Sstevel@tonic-gate 		return(retval);
450*7c478bd9Sstevel@tonic-gate 	}
451*7c478bd9Sstevel@tonic-gate 	if (aitop != NULL)
452*7c478bd9Sstevel@tonic-gate 		freeaddrinfo(aitop);
453*7c478bd9Sstevel@tonic-gate 
454*7c478bd9Sstevel@tonic-gate 	socket_length = sizeof(ss);
455*7c478bd9Sstevel@tonic-gate 	if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) {
456*7c478bd9Sstevel@tonic-gate 		retval = errno;
457*7c478bd9Sstevel@tonic-gate 		close(s);
458*7c478bd9Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ,
459*7c478bd9Sstevel@tonic-gate 				gettext("in call to getsockname"));
460*7c478bd9Sstevel@tonic-gate 		return(retval);
461*7c478bd9Sstevel@tonic-gate 	}
462*7c478bd9Sstevel@tonic-gate 
463*7c478bd9Sstevel@tonic-gate 	if (cvtkaddr(&ss, &sender_addr) == NULL) {
464*7c478bd9Sstevel@tonic-gate 		retval = errno;
465*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
466*7c478bd9Sstevel@tonic-gate 			gettext("while converting socket address"));
467*7c478bd9Sstevel@tonic-gate 		return(retval);
468*7c478bd9Sstevel@tonic-gate 	}
469*7c478bd9Sstevel@tonic-gate 
470*7c478bd9Sstevel@tonic-gate 	return(0);
471*7c478bd9Sstevel@tonic-gate }
472*7c478bd9Sstevel@tonic-gate 
473*7c478bd9Sstevel@tonic-gate 
474*7c478bd9Sstevel@tonic-gate void kerberos_authenticate(context, auth_context, fd, me, new_creds)
475*7c478bd9Sstevel@tonic-gate     krb5_context context;
476*7c478bd9Sstevel@tonic-gate     krb5_auth_context *auth_context;
477*7c478bd9Sstevel@tonic-gate     int	fd;
478*7c478bd9Sstevel@tonic-gate     krb5_principal me;
479*7c478bd9Sstevel@tonic-gate     krb5_creds ** new_creds;
480*7c478bd9Sstevel@tonic-gate {
481*7c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
482*7c478bd9Sstevel@tonic-gate 	krb5_error	*error = NULL;
483*7c478bd9Sstevel@tonic-gate 	krb5_ap_rep_enc_part	*rep_result;
484*7c478bd9Sstevel@tonic-gate 
485*7c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_init(context, auth_context))
486*7c478bd9Sstevel@tonic-gate 	exit(1);
487*7c478bd9Sstevel@tonic-gate 
488*7c478bd9Sstevel@tonic-gate     krb5_auth_con_setflags(context, *auth_context,
489*7c478bd9Sstevel@tonic-gate 			   KRB5_AUTH_CONTEXT_DO_SEQUENCE);
490*7c478bd9Sstevel@tonic-gate 
491*7c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr,
492*7c478bd9Sstevel@tonic-gate 				        &receiver_addr)) {
493*7c478bd9Sstevel@tonic-gate 	com_err(progname, retval, gettext("in krb5_auth_con_setaddrs"));
494*7c478bd9Sstevel@tonic-gate 	exit(1);
495*7c478bd9Sstevel@tonic-gate     }
496*7c478bd9Sstevel@tonic-gate 
497*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_sendauth(context, auth_context, (void *)&fd,
498*7c478bd9Sstevel@tonic-gate 				   kprop_version, me, creds.server,
499*7c478bd9Sstevel@tonic-gate 				   AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
500*7c478bd9Sstevel@tonic-gate 				   &error, &rep_result, new_creds)) {
501*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while authenticating to server"));
502*7c478bd9Sstevel@tonic-gate 		if (error) {
503*7c478bd9Sstevel@tonic-gate 			if (error->error == KRB_ERR_GENERIC) {
504*7c478bd9Sstevel@tonic-gate 				if (error->text.data)
505*7c478bd9Sstevel@tonic-gate 					fprintf(stderr,
506*7c478bd9Sstevel@tonic-gate 						gettext("Generic remote error: %s\n"),
507*7c478bd9Sstevel@tonic-gate 						error->text.data);
508*7c478bd9Sstevel@tonic-gate 			} else if (error->error) {
509*7c478bd9Sstevel@tonic-gate 				com_err(progname,
510*7c478bd9Sstevel@tonic-gate 					error->error + ERROR_TABLE_BASE_krb5,
511*7c478bd9Sstevel@tonic-gate 					gettext("signalled from server"));
512*7c478bd9Sstevel@tonic-gate 				if (error->text.data)
513*7c478bd9Sstevel@tonic-gate 					fprintf(stderr,
514*7c478bd9Sstevel@tonic-gate 					gettext("Error text from server: %s\n"),
515*7c478bd9Sstevel@tonic-gate 						error->text.data);
516*7c478bd9Sstevel@tonic-gate 			}
517*7c478bd9Sstevel@tonic-gate 			krb5_free_error(context, error);
518*7c478bd9Sstevel@tonic-gate 		}
519*7c478bd9Sstevel@tonic-gate 		exit(1);
520*7c478bd9Sstevel@tonic-gate 	}
521*7c478bd9Sstevel@tonic-gate 	krb5_free_ap_rep_enc_part(context, rep_result);
522*7c478bd9Sstevel@tonic-gate }
523*7c478bd9Sstevel@tonic-gate 
524*7c478bd9Sstevel@tonic-gate char * dbpathname;
525*7c478bd9Sstevel@tonic-gate /*
526*7c478bd9Sstevel@tonic-gate  * Open the Kerberos database dump file.  Takes care of locking it
527*7c478bd9Sstevel@tonic-gate  * and making sure that the .ok file is more recent that the database
528*7c478bd9Sstevel@tonic-gate  * dump file itself.
529*7c478bd9Sstevel@tonic-gate  *
530*7c478bd9Sstevel@tonic-gate  * Returns the file descriptor of the database dump file.  Also fills
531*7c478bd9Sstevel@tonic-gate  * in the size of the database file.
532*7c478bd9Sstevel@tonic-gate  */
533*7c478bd9Sstevel@tonic-gate int
534*7c478bd9Sstevel@tonic-gate open_database(context, data_fn, size)
535*7c478bd9Sstevel@tonic-gate     krb5_context context;
536*7c478bd9Sstevel@tonic-gate     char *data_fn;
537*7c478bd9Sstevel@tonic-gate     int	*size;
538*7c478bd9Sstevel@tonic-gate {
539*7c478bd9Sstevel@tonic-gate 	int		fd;
540*7c478bd9Sstevel@tonic-gate 	int		err;
541*7c478bd9Sstevel@tonic-gate 	struct stat 	stbuf, stbuf_ok;
542*7c478bd9Sstevel@tonic-gate 	char		*data_ok_fn;
543*7c478bd9Sstevel@tonic-gate 	static char ok[] = ".dump_ok";
544*7c478bd9Sstevel@tonic-gate 
545*7c478bd9Sstevel@tonic-gate 	dbpathname = strdup(data_fn);
546*7c478bd9Sstevel@tonic-gate 	if (!dbpathname) {
547*7c478bd9Sstevel@tonic-gate  	    com_err(progname, ENOMEM, gettext("allocating database file name '%s'"),
548*7c478bd9Sstevel@tonic-gate  		    data_fn);
549*7c478bd9Sstevel@tonic-gate  	    exit(1);
550*7c478bd9Sstevel@tonic-gate  	}
551*7c478bd9Sstevel@tonic-gate 	if ((fd = open(dbpathname, O_RDONLY)) < 0) {
552*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to open %s"),
553*7c478bd9Sstevel@tonic-gate 			dbpathname);
554*7c478bd9Sstevel@tonic-gate 		exit(1);
555*7c478bd9Sstevel@tonic-gate 	}
556*7c478bd9Sstevel@tonic-gate 
557*7c478bd9Sstevel@tonic-gate 	err = krb5_lock_file(context, fd,
558*7c478bd9Sstevel@tonic-gate 			     KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
559*7c478bd9Sstevel@tonic-gate 	if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
560*7c478bd9Sstevel@tonic-gate 	    com_err(progname, 0, gettext("database locked"));
561*7c478bd9Sstevel@tonic-gate 	    exit(1);
562*7c478bd9Sstevel@tonic-gate 	} else if (err) {
563*7c478bd9Sstevel@tonic-gate 	    com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname);
564*7c478bd9Sstevel@tonic-gate 	    exit(1);
565*7c478bd9Sstevel@tonic-gate 	}
566*7c478bd9Sstevel@tonic-gate 	if (fstat(fd, &stbuf)) {
567*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
568*7c478bd9Sstevel@tonic-gate 			data_fn);
569*7c478bd9Sstevel@tonic-gate 		exit(1);
570*7c478bd9Sstevel@tonic-gate 	}
571*7c478bd9Sstevel@tonic-gate 	if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1))
572*7c478bd9Sstevel@tonic-gate 	    == NULL) {
573*7c478bd9Sstevel@tonic-gate 		com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn"));
574*7c478bd9Sstevel@tonic-gate 		exit(1);
575*7c478bd9Sstevel@tonic-gate 	}
576*7c478bd9Sstevel@tonic-gate 	strcpy(data_ok_fn, data_fn);
577*7c478bd9Sstevel@tonic-gate 	strcat(data_ok_fn, ok);
578*7c478bd9Sstevel@tonic-gate 	if (stat(data_ok_fn, &stbuf_ok)) {
579*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
580*7c478bd9Sstevel@tonic-gate 			data_ok_fn);
581*7c478bd9Sstevel@tonic-gate 		free(data_ok_fn);
582*7c478bd9Sstevel@tonic-gate 		exit(1);
583*7c478bd9Sstevel@tonic-gate 	}
584*7c478bd9Sstevel@tonic-gate 	free(data_ok_fn);
585*7c478bd9Sstevel@tonic-gate 	if (stbuf.st_mtime > stbuf_ok.st_mtime) {
586*7c478bd9Sstevel@tonic-gate 		com_err(progname, 0, gettext("'%s' more recent than '%s'."),
587*7c478bd9Sstevel@tonic-gate 			data_fn, data_ok_fn);
588*7c478bd9Sstevel@tonic-gate 		exit(1);
589*7c478bd9Sstevel@tonic-gate 	}
590*7c478bd9Sstevel@tonic-gate 	*size = stbuf.st_size;
591*7c478bd9Sstevel@tonic-gate 	return(fd);
592*7c478bd9Sstevel@tonic-gate }
593*7c478bd9Sstevel@tonic-gate 
594*7c478bd9Sstevel@tonic-gate void
595*7c478bd9Sstevel@tonic-gate close_database(context, fd)
596*7c478bd9Sstevel@tonic-gate     krb5_context context;
597*7c478bd9Sstevel@tonic-gate     int fd;
598*7c478bd9Sstevel@tonic-gate {
599*7c478bd9Sstevel@tonic-gate     int err;
600*7c478bd9Sstevel@tonic-gate     if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK))
601*7c478bd9Sstevel@tonic-gate 	com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname);
602*7c478bd9Sstevel@tonic-gate     free(dbpathname);
603*7c478bd9Sstevel@tonic-gate     (void)close(fd);
604*7c478bd9Sstevel@tonic-gate     return;
605*7c478bd9Sstevel@tonic-gate }
606*7c478bd9Sstevel@tonic-gate 
607*7c478bd9Sstevel@tonic-gate /*
608*7c478bd9Sstevel@tonic-gate  * Now we send over the database.  We use the following protocol:
609*7c478bd9Sstevel@tonic-gate  * Send over a KRB_SAFE message with the size.  Then we send over the
610*7c478bd9Sstevel@tonic-gate  * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV.
611*7c478bd9Sstevel@tonic-gate  * Then we expect to see a KRB_SAFE message with the size sent back.
612*7c478bd9Sstevel@tonic-gate  *
613*7c478bd9Sstevel@tonic-gate  * At any point in the protocol, we may send a KRB_ERROR message; this
614*7c478bd9Sstevel@tonic-gate  * will abort the entire operation.
615*7c478bd9Sstevel@tonic-gate  */
616*7c478bd9Sstevel@tonic-gate void
617*7c478bd9Sstevel@tonic-gate xmit_database(context, auth_context, my_creds, fd, database_fd, database_size)
618*7c478bd9Sstevel@tonic-gate     krb5_context context;
619*7c478bd9Sstevel@tonic-gate     krb5_auth_context auth_context;
620*7c478bd9Sstevel@tonic-gate     krb5_creds *my_creds;
621*7c478bd9Sstevel@tonic-gate     int	fd;
622*7c478bd9Sstevel@tonic-gate     int	database_fd;
623*7c478bd9Sstevel@tonic-gate     int	database_size;
624*7c478bd9Sstevel@tonic-gate {
625*7c478bd9Sstevel@tonic-gate 	krb5_int32	send_size, sent_size, n;
626*7c478bd9Sstevel@tonic-gate 	krb5_data	inbuf, outbuf;
627*7c478bd9Sstevel@tonic-gate 	char		buf[KPROP_BUFSIZ];
628*7c478bd9Sstevel@tonic-gate 	krb5_error_code	retval;
629*7c478bd9Sstevel@tonic-gate 	krb5_error	*error;
630*7c478bd9Sstevel@tonic-gate 
631*7c478bd9Sstevel@tonic-gate 	/*
632*7c478bd9Sstevel@tonic-gate 	 * Send over the size
633*7c478bd9Sstevel@tonic-gate 	 */
634*7c478bd9Sstevel@tonic-gate 	send_size = htonl(database_size);
635*7c478bd9Sstevel@tonic-gate 	inbuf.data = (char *) &send_size;
636*7c478bd9Sstevel@tonic-gate 	inbuf.length = sizeof(send_size); /* must be 4, really */
637*7c478bd9Sstevel@tonic-gate 	/* KPROP_CKSUMTYPE */
638*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_mk_safe(context, auth_context, &inbuf,
639*7c478bd9Sstevel@tonic-gate 				  &outbuf, NULL)) {
640*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while encoding database size"));
641*7c478bd9Sstevel@tonic-gate 		send_error(context, my_creds, fd, gettext("while encoding database size"), retval);
642*7c478bd9Sstevel@tonic-gate 		exit(1);
643*7c478bd9Sstevel@tonic-gate 	}
644*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) {
645*7c478bd9Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
646*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval, gettext("while sending database size"));
647*7c478bd9Sstevel@tonic-gate 		exit(1);
648*7c478bd9Sstevel@tonic-gate 	}
649*7c478bd9Sstevel@tonic-gate 	krb5_free_data_contents(context, &outbuf);
650*7c478bd9Sstevel@tonic-gate     /*
651*7c478bd9Sstevel@tonic-gate      * Initialize the initial vector.
652*7c478bd9Sstevel@tonic-gate      */
653*7c478bd9Sstevel@tonic-gate     if (retval = krb5_auth_con_initivector(context, auth_context)) {
654*7c478bd9Sstevel@tonic-gate 	send_error(context, my_creds, fd,
655*7c478bd9Sstevel@tonic-gate 		   gettext("failed while initializing i_vector"), retval);
656*7c478bd9Sstevel@tonic-gate 	com_err(progname, retval, gettext("while allocating i_vector"));
657*7c478bd9Sstevel@tonic-gate 	exit(1);
658*7c478bd9Sstevel@tonic-gate     }
659*7c478bd9Sstevel@tonic-gate 	/*
660*7c478bd9Sstevel@tonic-gate 	 * Send over the file, block by block....
661*7c478bd9Sstevel@tonic-gate 	 */
662*7c478bd9Sstevel@tonic-gate 	inbuf.data = buf;
663*7c478bd9Sstevel@tonic-gate 	sent_size = 0;
664*7c478bd9Sstevel@tonic-gate 	while (n = read(database_fd, buf, sizeof(buf))) {
665*7c478bd9Sstevel@tonic-gate 		inbuf.length = n;
666*7c478bd9Sstevel@tonic-gate 		if (retval = krb5_mk_priv(context, auth_context, &inbuf,
667*7c478bd9Sstevel@tonic-gate 					  &outbuf, NULL)) {
668*7c478bd9Sstevel@tonic-gate 			snprintf(buf, sizeof (buf),
669*7c478bd9Sstevel@tonic-gate 				gettext("while encoding database block starting at %d"),
670*7c478bd9Sstevel@tonic-gate 				sent_size);
671*7c478bd9Sstevel@tonic-gate 			com_err(progname, retval, buf);
672*7c478bd9Sstevel@tonic-gate 			send_error(context, my_creds, fd, buf, retval);
673*7c478bd9Sstevel@tonic-gate 			exit(1);
674*7c478bd9Sstevel@tonic-gate 		}
675*7c478bd9Sstevel@tonic-gate 		if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) {
676*7c478bd9Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
677*7c478bd9Sstevel@tonic-gate 			com_err(progname, retval,
678*7c478bd9Sstevel@tonic-gate 				gettext("while sending database block starting at %d"),
679*7c478bd9Sstevel@tonic-gate 				sent_size);
680*7c478bd9Sstevel@tonic-gate 			exit(1);
681*7c478bd9Sstevel@tonic-gate 		}
682*7c478bd9Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
683*7c478bd9Sstevel@tonic-gate 		sent_size += n;
684*7c478bd9Sstevel@tonic-gate 		if (debug)
685*7c478bd9Sstevel@tonic-gate 			printf(gettext("%d bytes sent.\n"), sent_size);
686*7c478bd9Sstevel@tonic-gate 	}
687*7c478bd9Sstevel@tonic-gate 	if (sent_size != database_size) {
688*7c478bd9Sstevel@tonic-gate 		com_err(progname, 0, gettext("Premature EOF found for database file!"));
689*7c478bd9Sstevel@tonic-gate 		send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"),
690*7c478bd9Sstevel@tonic-gate 			   KRB5KRB_ERR_GENERIC);
691*7c478bd9Sstevel@tonic-gate 		exit(1);
692*7c478bd9Sstevel@tonic-gate 	}
693*7c478bd9Sstevel@tonic-gate 	/*
694*7c478bd9Sstevel@tonic-gate 	 * OK, we've sent the database; now let's wait for a success
695*7c478bd9Sstevel@tonic-gate 	 * indication from the remote end.
696*7c478bd9Sstevel@tonic-gate 	 */
697*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) {
698*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval,
699*7c478bd9Sstevel@tonic-gate 			gettext("while reading response from server"));
700*7c478bd9Sstevel@tonic-gate 		exit(1);
701*7c478bd9Sstevel@tonic-gate 	}
702*7c478bd9Sstevel@tonic-gate 	/*
703*7c478bd9Sstevel@tonic-gate 	 * If we got an error response back from the server, display
704*7c478bd9Sstevel@tonic-gate 	 * the error message
705*7c478bd9Sstevel@tonic-gate 	 */
706*7c478bd9Sstevel@tonic-gate 	if (krb5_is_krb_error(&inbuf)) {
707*7c478bd9Sstevel@tonic-gate 		if (retval = krb5_rd_error(context, &inbuf, &error)) {
708*7c478bd9Sstevel@tonic-gate 			com_err(progname, retval,
709*7c478bd9Sstevel@tonic-gate 				gettext("while decoding error response from server"));
710*7c478bd9Sstevel@tonic-gate 			exit(1);
711*7c478bd9Sstevel@tonic-gate 		}
712*7c478bd9Sstevel@tonic-gate 		if (error->error == KRB_ERR_GENERIC) {
713*7c478bd9Sstevel@tonic-gate 			if (error->text.data)
714*7c478bd9Sstevel@tonic-gate 				fprintf(stderr,
715*7c478bd9Sstevel@tonic-gate 				gettext("Generic remote error: %s\n"),
716*7c478bd9Sstevel@tonic-gate 					error->text.data);
717*7c478bd9Sstevel@tonic-gate 		} else if (error->error) {
718*7c478bd9Sstevel@tonic-gate 			com_err(progname, error->error + ERROR_TABLE_BASE_krb5,
719*7c478bd9Sstevel@tonic-gate 				gettext("signalled from server"));
720*7c478bd9Sstevel@tonic-gate 			if (error->text.data)
721*7c478bd9Sstevel@tonic-gate 				fprintf(stderr,
722*7c478bd9Sstevel@tonic-gate 				gettext("Error text from server: %s\n"),
723*7c478bd9Sstevel@tonic-gate 					error->text.data);
724*7c478bd9Sstevel@tonic-gate 		}
725*7c478bd9Sstevel@tonic-gate 		krb5_free_error(context, error);
726*7c478bd9Sstevel@tonic-gate 		exit(1);
727*7c478bd9Sstevel@tonic-gate 	}
728*7c478bd9Sstevel@tonic-gate 	if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) {
729*7c478bd9Sstevel@tonic-gate 		com_err(progname, retval,
730*7c478bd9Sstevel@tonic-gate 			gettext("while decoding final size packet from server"));
731*7c478bd9Sstevel@tonic-gate 		exit(1);
732*7c478bd9Sstevel@tonic-gate 	}
733*7c478bd9Sstevel@tonic-gate 	memcpy((char *)&send_size, outbuf.data, sizeof(send_size));
734*7c478bd9Sstevel@tonic-gate 	send_size = ntohl(send_size);
735*7c478bd9Sstevel@tonic-gate 	if (send_size != database_size) {
736*7c478bd9Sstevel@tonic-gate 		com_err(progname, 0,
737*7c478bd9Sstevel@tonic-gate 			gettext("Kpropd sent database size %d, expecting %d"),
738*7c478bd9Sstevel@tonic-gate 			send_size, database_size);
739*7c478bd9Sstevel@tonic-gate 		exit(1);
740*7c478bd9Sstevel@tonic-gate 	}
741*7c478bd9Sstevel@tonic-gate 	free(outbuf.data);
742*7c478bd9Sstevel@tonic-gate 	free(inbuf.data);
743*7c478bd9Sstevel@tonic-gate }
744*7c478bd9Sstevel@tonic-gate 
745*7c478bd9Sstevel@tonic-gate void
746*7c478bd9Sstevel@tonic-gate send_error(context, my_creds, fd, err_text, err_code)
747*7c478bd9Sstevel@tonic-gate     krb5_context context;
748*7c478bd9Sstevel@tonic-gate     krb5_creds *my_creds;
749*7c478bd9Sstevel@tonic-gate     int	fd;
750*7c478bd9Sstevel@tonic-gate     char	*err_text;
751*7c478bd9Sstevel@tonic-gate     krb5_error_code	err_code;
752*7c478bd9Sstevel@tonic-gate {
753*7c478bd9Sstevel@tonic-gate 	krb5_error	error;
754*7c478bd9Sstevel@tonic-gate 	const char	*text;
755*7c478bd9Sstevel@tonic-gate 	krb5_data	outbuf;
756*7c478bd9Sstevel@tonic-gate 
757*7c478bd9Sstevel@tonic-gate 	memset((char *)&error, 0, sizeof(error));
758*7c478bd9Sstevel@tonic-gate 	krb5_us_timeofday(context, &error.ctime, &error.cusec);
759*7c478bd9Sstevel@tonic-gate 	error.server = my_creds->server;
760*7c478bd9Sstevel@tonic-gate 	error.client = my_principal;
761*7c478bd9Sstevel@tonic-gate 	error.error = err_code - ERROR_TABLE_BASE_krb5;
762*7c478bd9Sstevel@tonic-gate 	if (error.error > 127)
763*7c478bd9Sstevel@tonic-gate 		error.error = KRB_ERR_GENERIC;
764*7c478bd9Sstevel@tonic-gate 	if (err_text)
765*7c478bd9Sstevel@tonic-gate 		text = err_text;
766*7c478bd9Sstevel@tonic-gate 	else
767*7c478bd9Sstevel@tonic-gate 		text = error_message(err_code);
768*7c478bd9Sstevel@tonic-gate 	error.text.length = strlen(text) + 1;
769*7c478bd9Sstevel@tonic-gate 	if (error.text.data = malloc(error.text.length)) {
770*7c478bd9Sstevel@tonic-gate 		strcpy(error.text.data, text);
771*7c478bd9Sstevel@tonic-gate 		if (!krb5_mk_error(context, &error, &outbuf)) {
772*7c478bd9Sstevel@tonic-gate 			(void) krb5_write_message(context, (void *)&fd,&outbuf);
773*7c478bd9Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
774*7c478bd9Sstevel@tonic-gate 		}
775*7c478bd9Sstevel@tonic-gate 		free(error.text.data);
776*7c478bd9Sstevel@tonic-gate 	}
777*7c478bd9Sstevel@tonic-gate }
778*7c478bd9Sstevel@tonic-gate 
779*7c478bd9Sstevel@tonic-gate void update_last_prop_file(hostname, file_name)
780*7c478bd9Sstevel@tonic-gate 	char *hostname;
781*7c478bd9Sstevel@tonic-gate 	char *file_name;
782*7c478bd9Sstevel@tonic-gate {
783*7c478bd9Sstevel@tonic-gate 	/* handle slave locking/failure stuff */
784*7c478bd9Sstevel@tonic-gate 	char *file_last_prop;
785*7c478bd9Sstevel@tonic-gate 	int fd;
786*7c478bd9Sstevel@tonic-gate 	static char last_prop[]=".last_prop";
787*7c478bd9Sstevel@tonic-gate 
788*7c478bd9Sstevel@tonic-gate 	if ((file_last_prop = (char *)malloc(strlen(file_name) +
789*7c478bd9Sstevel@tonic-gate 					     strlen(hostname) + 1 +
790*7c478bd9Sstevel@tonic-gate 					     strlen(last_prop) + 1)) == NULL) {
791*7c478bd9Sstevel@tonic-gate 		com_err(progname, ENOMEM,
792*7c478bd9Sstevel@tonic-gate 			gettext("while allocating filename for update_last_prop_file"));
793*7c478bd9Sstevel@tonic-gate 		return;
794*7c478bd9Sstevel@tonic-gate 	}
795*7c478bd9Sstevel@tonic-gate 	strcpy(file_last_prop, file_name);
796*7c478bd9Sstevel@tonic-gate 
797*7c478bd9Sstevel@tonic-gate 	/*
798*7c478bd9Sstevel@tonic-gate 	 * If a nondefault file name was specified then we should not add an
799*7c478bd9Sstevel@tonic-gate 	 * extraneous host name to the file name given that a file name could
800*7c478bd9Sstevel@tonic-gate 	 * have already specified a host name and therefore would be redundant.
801*7c478bd9Sstevel@tonic-gate 	 */
802*7c478bd9Sstevel@tonic-gate 	if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) {
803*7c478bd9Sstevel@tonic-gate 		strcat(file_last_prop, ".");
804*7c478bd9Sstevel@tonic-gate 		strcat(file_last_prop, hostname);
805*7c478bd9Sstevel@tonic-gate 	}
806*7c478bd9Sstevel@tonic-gate 	strcat(file_last_prop, last_prop);
807*7c478bd9Sstevel@tonic-gate 	if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
808*7c478bd9Sstevel@tonic-gate 		com_err(progname, errno,
809*7c478bd9Sstevel@tonic-gate 			gettext("while creating 'last_prop' file, '%s'"),
810*7c478bd9Sstevel@tonic-gate 			file_last_prop);
811*7c478bd9Sstevel@tonic-gate 		free(file_last_prop);
812*7c478bd9Sstevel@tonic-gate 		return;
813*7c478bd9Sstevel@tonic-gate 	}
814*7c478bd9Sstevel@tonic-gate 	write(fd, "", 1);
815*7c478bd9Sstevel@tonic-gate 	free(file_last_prop);
816*7c478bd9Sstevel@tonic-gate 	close(fd);
817*7c478bd9Sstevel@tonic-gate 	return;
818*7c478bd9Sstevel@tonic-gate }
819