17c478bd9Sstevel@tonic-gate /*
27c64d375Smp * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate
77c478bd9Sstevel@tonic-gate /*
87c478bd9Sstevel@tonic-gate * kdc/main.c
97c478bd9Sstevel@tonic-gate *
107c478bd9Sstevel@tonic-gate * Copyright 1990,2001 by the Massachusetts Institute of Technology.
117c478bd9Sstevel@tonic-gate *
127c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
137c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
147c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
157c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
16*55fea89dSDan Cross *
177c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
187c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
197c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
207c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
217c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
227c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
237c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
247c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
257c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
267c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
277c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
287c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
297c478bd9Sstevel@tonic-gate * or implied warranty.
30*55fea89dSDan Cross *
317c478bd9Sstevel@tonic-gate *
327c478bd9Sstevel@tonic-gate * Main procedure body for the KDC server process.
337c478bd9Sstevel@tonic-gate */
347c478bd9Sstevel@tonic-gate
357c478bd9Sstevel@tonic-gate #include <stdio.h>
367c478bd9Sstevel@tonic-gate #include <syslog.h>
377c478bd9Sstevel@tonic-gate #include <signal.h>
387c478bd9Sstevel@tonic-gate #include <errno.h>
397c478bd9Sstevel@tonic-gate #include <netdb.h>
407c478bd9Sstevel@tonic-gate
417c478bd9Sstevel@tonic-gate #include "k5-int.h"
427c478bd9Sstevel@tonic-gate #include "com_err.h"
437c478bd9Sstevel@tonic-gate #include "adm.h"
447c478bd9Sstevel@tonic-gate #include "adm_proto.h"
457c478bd9Sstevel@tonic-gate #include "kdc_util.h"
467c478bd9Sstevel@tonic-gate #include "extern.h"
477c478bd9Sstevel@tonic-gate #include "kdc5_err.h"
487c478bd9Sstevel@tonic-gate #include <libintl.h>
497c478bd9Sstevel@tonic-gate #include <locale.h>
507c478bd9Sstevel@tonic-gate
517c478bd9Sstevel@tonic-gate #ifdef HAVE_NETINET_IN_H
527c478bd9Sstevel@tonic-gate #include <netinet/in.h>
537c478bd9Sstevel@tonic-gate #endif
547c478bd9Sstevel@tonic-gate
5556a424ccSmp #ifdef KRB5_KRB4_COMPAT
5656a424ccSmp #include <des.h>
5756a424ccSmp #endif
5856a424ccSmp
5956a424ccSmp #if defined(NEED_DAEMON_PROTO)
6056a424ccSmp extern int daemon(int, int);
6156a424ccSmp #endif
627c478bd9Sstevel@tonic-gate
63505d05c7Sgtb void usage (char *);
647c478bd9Sstevel@tonic-gate
65505d05c7Sgtb krb5_sigtype request_exit (int);
66505d05c7Sgtb krb5_sigtype request_hup (int);
677c478bd9Sstevel@tonic-gate
68505d05c7Sgtb void setup_signal_handlers (void);
697c478bd9Sstevel@tonic-gate
70505d05c7Sgtb krb5_error_code setup_sam (void);
717c478bd9Sstevel@tonic-gate
72505d05c7Sgtb void initialize_realms (krb5_context, int, char **);
737c478bd9Sstevel@tonic-gate
74505d05c7Sgtb void finish_realms (char *);
757c478bd9Sstevel@tonic-gate
767c478bd9Sstevel@tonic-gate static int nofork = 0;
777c478bd9Sstevel@tonic-gate static int rkey_init_done = 0;
787c478bd9Sstevel@tonic-gate
797c478bd9Sstevel@tonic-gate /* Solaris Kerberos: global here that other functions access */
807c478bd9Sstevel@tonic-gate int max_tcp_data_connections;
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate #ifdef POSIX_SIGNALS
837c478bd9Sstevel@tonic-gate static struct sigaction s_action;
847c478bd9Sstevel@tonic-gate #endif /* POSIX_SIGNALS */
857c478bd9Sstevel@tonic-gate
867c478bd9Sstevel@tonic-gate #define KRB5_KDC_MAX_REALMS 32
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate /*
897c478bd9Sstevel@tonic-gate * Find the realm entry for a given realm.
907c478bd9Sstevel@tonic-gate */
917c478bd9Sstevel@tonic-gate kdc_realm_t *
find_realm_data(char * rname,krb5_ui_4 rsize)9256a424ccSmp find_realm_data(char *rname, krb5_ui_4 rsize)
937c478bd9Sstevel@tonic-gate {
947c478bd9Sstevel@tonic-gate int i;
957c478bd9Sstevel@tonic-gate for (i=0; i<kdc_numrealms; i++) {
967c478bd9Sstevel@tonic-gate if ((rsize == strlen(kdc_realmlist[i]->realm_name)) &&
977c478bd9Sstevel@tonic-gate !strncmp(rname, kdc_realmlist[i]->realm_name, rsize))
987c478bd9Sstevel@tonic-gate return(kdc_realmlist[i]);
997c478bd9Sstevel@tonic-gate }
1007c478bd9Sstevel@tonic-gate return((kdc_realm_t *) NULL);
1017c478bd9Sstevel@tonic-gate }
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate krb5_error_code
setup_server_realm(krb5_principal sprinc)10456a424ccSmp setup_server_realm(krb5_principal sprinc)
1057c478bd9Sstevel@tonic-gate {
1067c478bd9Sstevel@tonic-gate krb5_error_code kret;
1077c478bd9Sstevel@tonic-gate kdc_realm_t *newrealm;
1087c478bd9Sstevel@tonic-gate
1097c478bd9Sstevel@tonic-gate kret = 0;
1107c478bd9Sstevel@tonic-gate if (kdc_numrealms > 1) {
1117c478bd9Sstevel@tonic-gate if (!(newrealm = find_realm_data(sprinc->realm.data,
1127c478bd9Sstevel@tonic-gate (krb5_ui_4) sprinc->realm.length)))
1137c478bd9Sstevel@tonic-gate kret = ENOENT;
1147c478bd9Sstevel@tonic-gate else
1157c478bd9Sstevel@tonic-gate kdc_active_realm = newrealm;
1167c478bd9Sstevel@tonic-gate }
1177c478bd9Sstevel@tonic-gate else
1187c478bd9Sstevel@tonic-gate kdc_active_realm = kdc_realmlist[0];
1197c478bd9Sstevel@tonic-gate return(kret);
1207c478bd9Sstevel@tonic-gate }
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate static void
finish_realm(kdc_realm_t * rdp)12356a424ccSmp finish_realm(kdc_realm_t *rdp)
1247c478bd9Sstevel@tonic-gate {
1257c478bd9Sstevel@tonic-gate if (rdp->realm_dbname)
1267c478bd9Sstevel@tonic-gate free(rdp->realm_dbname);
1277c478bd9Sstevel@tonic-gate if (rdp->realm_mpname)
1287c478bd9Sstevel@tonic-gate free(rdp->realm_mpname);
1297c478bd9Sstevel@tonic-gate if (rdp->realm_stash)
1307c478bd9Sstevel@tonic-gate free(rdp->realm_stash);
1317c478bd9Sstevel@tonic-gate if (rdp->realm_ports)
1327c478bd9Sstevel@tonic-gate free(rdp->realm_ports);
1337c478bd9Sstevel@tonic-gate if (rdp->realm_tcp_ports)
1347c478bd9Sstevel@tonic-gate free(rdp->realm_tcp_ports);
1357c478bd9Sstevel@tonic-gate if (rdp->realm_keytab)
1367c478bd9Sstevel@tonic-gate krb5_kt_close(rdp->realm_context, rdp->realm_keytab);
1377c478bd9Sstevel@tonic-gate if (rdp->realm_context) {
1387c478bd9Sstevel@tonic-gate if (rdp->realm_mprinc)
1397c478bd9Sstevel@tonic-gate krb5_free_principal(rdp->realm_context, rdp->realm_mprinc);
1407c478bd9Sstevel@tonic-gate if (rdp->realm_mkey.length && rdp->realm_mkey.contents) {
1417c478bd9Sstevel@tonic-gate memset(rdp->realm_mkey.contents, 0, rdp->realm_mkey.length);
1427c478bd9Sstevel@tonic-gate free(rdp->realm_mkey.contents);
1437c478bd9Sstevel@tonic-gate }
1447c478bd9Sstevel@tonic-gate krb5_db_fini(rdp->realm_context);
1457c478bd9Sstevel@tonic-gate if (rdp->realm_tgsprinc)
1467c478bd9Sstevel@tonic-gate krb5_free_principal(rdp->realm_context, rdp->realm_tgsprinc);
1477c478bd9Sstevel@tonic-gate krb5_free_context(rdp->realm_context);
1487c478bd9Sstevel@tonic-gate }
14956a424ccSmp memset((char *) rdp, 0, sizeof(*rdp));
1507c478bd9Sstevel@tonic-gate free(rdp);
1517c478bd9Sstevel@tonic-gate }
1527c478bd9Sstevel@tonic-gate
1537c478bd9Sstevel@tonic-gate /*
1547c478bd9Sstevel@tonic-gate * Initialize a realm control structure from the alternate profile or from
1557c478bd9Sstevel@tonic-gate * the specified defaults.
1567c478bd9Sstevel@tonic-gate *
1577c478bd9Sstevel@tonic-gate * After we're complete here, the essence of the realm is embodied in the
1587c478bd9Sstevel@tonic-gate * realm data and we should be all set to begin operation for that realm.
1597c478bd9Sstevel@tonic-gate */
1607c478bd9Sstevel@tonic-gate static krb5_error_code
init_realm(krb5_context kcontext,char * progname,kdc_realm_t * rdp,char * realm,char * def_mpname,krb5_enctype def_enctype,char * def_udp_ports,char * def_tcp_ports,krb5_boolean def_manual,char ** db_args)1617c64d375Smp init_realm(krb5_context kcontext, char *progname, kdc_realm_t *rdp, char *realm,
16256a424ccSmp char *def_mpname, krb5_enctype def_enctype, char *def_udp_ports,
16354925bf6Swillf char *def_tcp_ports, krb5_boolean def_manual, char **db_args)
1647c478bd9Sstevel@tonic-gate {
1657c478bd9Sstevel@tonic-gate krb5_error_code kret;
1667c478bd9Sstevel@tonic-gate krb5_boolean manual;
1677c478bd9Sstevel@tonic-gate krb5_realm_params *rparams;
1687c478bd9Sstevel@tonic-gate
1697c478bd9Sstevel@tonic-gate memset((char *) rdp, 0, sizeof(kdc_realm_t));
1707c478bd9Sstevel@tonic-gate if (!realm) {
1717c478bd9Sstevel@tonic-gate kret = EINVAL;
1727c478bd9Sstevel@tonic-gate goto whoops;
1737c478bd9Sstevel@tonic-gate }
174*55fea89dSDan Cross
1757c478bd9Sstevel@tonic-gate rdp->realm_name = realm;
17654925bf6Swillf kret = krb5int_init_context_kdc(&rdp->realm_context);
1777c478bd9Sstevel@tonic-gate if (kret) {
1787c478bd9Sstevel@tonic-gate com_err(progname, kret, gettext("while getting context for realm %s"),
1797c478bd9Sstevel@tonic-gate realm);
1807c478bd9Sstevel@tonic-gate goto whoops;
1817c478bd9Sstevel@tonic-gate }
1827c478bd9Sstevel@tonic-gate
1837c64d375Smp /*
1847c64d375Smp * Solaris Kerberos:
1857c64d375Smp * Set the current context to that of the realm being init'ed
1867c64d375Smp */
1877c64d375Smp krb5_klog_set_context(rdp->realm_context);
1887c64d375Smp
1897c478bd9Sstevel@tonic-gate kret = krb5_read_realm_params(rdp->realm_context, rdp->realm_name,
190159d09a2SMark Phalan &rparams);
1917c478bd9Sstevel@tonic-gate if (kret) {
1927c478bd9Sstevel@tonic-gate com_err(progname, kret, gettext("while reading realm parameters"));
1937c478bd9Sstevel@tonic-gate goto whoops;
1947c478bd9Sstevel@tonic-gate }
195*55fea89dSDan Cross
1967c478bd9Sstevel@tonic-gate /* Handle profile file name */
1977c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_profile)
1987c478bd9Sstevel@tonic-gate rdp->realm_profile = strdup(rparams->realm_profile);
1997c478bd9Sstevel@tonic-gate
2007c478bd9Sstevel@tonic-gate /* Handle master key name */
2017c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_mkey_name)
2027c478bd9Sstevel@tonic-gate rdp->realm_mpname = strdup(rparams->realm_mkey_name);
2037c478bd9Sstevel@tonic-gate else
2047c478bd9Sstevel@tonic-gate rdp->realm_mpname = (def_mpname) ? strdup(def_mpname) :
2057c478bd9Sstevel@tonic-gate strdup(KRB5_KDB_M_NAME);
2067c478bd9Sstevel@tonic-gate
2077c478bd9Sstevel@tonic-gate /* Handle KDC ports */
2087c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_kdc_ports)
2097c478bd9Sstevel@tonic-gate rdp->realm_ports = strdup(rparams->realm_kdc_ports);
2107c478bd9Sstevel@tonic-gate else
2117c478bd9Sstevel@tonic-gate rdp->realm_ports = strdup(def_udp_ports);
2127c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_kdc_tcp_ports)
2137c478bd9Sstevel@tonic-gate rdp->realm_tcp_ports = strdup(rparams->realm_kdc_tcp_ports);
2147c478bd9Sstevel@tonic-gate else
2157c478bd9Sstevel@tonic-gate rdp->realm_tcp_ports = strdup(def_tcp_ports);
2167c478bd9Sstevel@tonic-gate
2177c478bd9Sstevel@tonic-gate /* Handle stash file */
2187c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_stash_file) {
2197c478bd9Sstevel@tonic-gate rdp->realm_stash = strdup(rparams->realm_stash_file);
2207c478bd9Sstevel@tonic-gate manual = FALSE;
2217c478bd9Sstevel@tonic-gate } else
2227c478bd9Sstevel@tonic-gate manual = def_manual;
2237c478bd9Sstevel@tonic-gate
2247c478bd9Sstevel@tonic-gate /* Handle master key type */
2257c478bd9Sstevel@tonic-gate if (rparams && rparams->realm_enctype_valid)
2267c478bd9Sstevel@tonic-gate rdp->realm_mkey.enctype = (krb5_enctype) rparams->realm_enctype;
2277c478bd9Sstevel@tonic-gate else
2287c478bd9Sstevel@tonic-gate rdp->realm_mkey.enctype = manual ? def_enctype : ENCTYPE_UNKNOWN;
2297c478bd9Sstevel@tonic-gate
23056a424ccSmp /* Handle reject-bad-transit flag */
23156a424ccSmp if (rparams && rparams->realm_reject_bad_transit_valid)
23256a424ccSmp rdp->realm_reject_bad_transit = rparams->realm_reject_bad_transit;
2337c478bd9Sstevel@tonic-gate else
23456a424ccSmp rdp->realm_reject_bad_transit = 1;
23556a424ccSmp
23656a424ccSmp /* Handle ticket maximum life */
23756a424ccSmp rdp->realm_maxlife = (rparams && rparams->realm_max_life_valid) ?
23856a424ccSmp rparams->realm_max_life : KRB5_KDB_MAX_LIFE;
2397c478bd9Sstevel@tonic-gate
2407c478bd9Sstevel@tonic-gate /* Handle ticket renewable maximum life */
24156a424ccSmp rdp->realm_maxrlife = (rparams && rparams->realm_max_rlife_valid) ?
24256a424ccSmp rparams->realm_max_rlife : KRB5_KDB_MAX_RLIFE;
2437c478bd9Sstevel@tonic-gate
2447c478bd9Sstevel@tonic-gate if (rparams)
2457c478bd9Sstevel@tonic-gate krb5_free_realm_params(rdp->realm_context, rparams);
2467c478bd9Sstevel@tonic-gate
2477c478bd9Sstevel@tonic-gate /*
2487c478bd9Sstevel@tonic-gate * We've got our parameters, now go and setup our realm context.
2497c478bd9Sstevel@tonic-gate */
2507c478bd9Sstevel@tonic-gate
2517c478bd9Sstevel@tonic-gate /* Set the default realm of this context */
2527c478bd9Sstevel@tonic-gate if ((kret = krb5_set_default_realm(rdp->realm_context, realm))) {
2537c478bd9Sstevel@tonic-gate com_err(progname, kret, gettext("while setting default realm to %s"),
2547c478bd9Sstevel@tonic-gate realm);
2557c478bd9Sstevel@tonic-gate goto whoops;
2567c478bd9Sstevel@tonic-gate }
2577c478bd9Sstevel@tonic-gate
25854925bf6Swillf /* first open the database before doing anything */
259*55fea89dSDan Cross #ifdef KRBCONF_KDC_MODIFIES_KDB
260*55fea89dSDan Cross if ((kret = krb5_db_open(rdp->realm_context, db_args,
26154925bf6Swillf KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_KDC))) {
26254925bf6Swillf #else
263*55fea89dSDan Cross if ((kret = krb5_db_open(rdp->realm_context, db_args,
26454925bf6Swillf KRB5_KDB_OPEN_RO | KRB5_KDB_SRV_TYPE_KDC))) {
26554925bf6Swillf #endif
2667c64d375Smp /*
2677c64d375Smp * Solaris Kerberos:
2687c64d375Smp * Make sure that error messages are printed using gettext
2697c64d375Smp */
27054925bf6Swillf com_err(progname, kret,
2717c64d375Smp gettext("while initializing database for realm %s"), realm);
27254925bf6Swillf goto whoops;
27354925bf6Swillf }
27454925bf6Swillf
2757c478bd9Sstevel@tonic-gate /* Assemble and parse the master key name */
2767c478bd9Sstevel@tonic-gate if ((kret = krb5_db_setup_mkey_name(rdp->realm_context, rdp->realm_mpname,
2777c478bd9Sstevel@tonic-gate rdp->realm_name, (char **) NULL,
2787c478bd9Sstevel@tonic-gate &rdp->realm_mprinc))) {
2797c478bd9Sstevel@tonic-gate com_err(progname, kret,
2807c478bd9Sstevel@tonic-gate gettext("while setting up master key name %s for realm %s"),
2817c478bd9Sstevel@tonic-gate rdp->realm_mpname, realm);
2827c478bd9Sstevel@tonic-gate goto whoops;
2837c478bd9Sstevel@tonic-gate }
2847c478bd9Sstevel@tonic-gate
2857c478bd9Sstevel@tonic-gate /*
2867c478bd9Sstevel@tonic-gate * Get the master key.
2877c478bd9Sstevel@tonic-gate */
2887c478bd9Sstevel@tonic-gate if ((kret = krb5_db_fetch_mkey(rdp->realm_context, rdp->realm_mprinc,
2897c478bd9Sstevel@tonic-gate rdp->realm_mkey.enctype, manual,
2907c478bd9Sstevel@tonic-gate FALSE, rdp->realm_stash,
2917c478bd9Sstevel@tonic-gate 0, &rdp->realm_mkey))) {
2927c478bd9Sstevel@tonic-gate com_err(progname, kret,
2937c478bd9Sstevel@tonic-gate gettext("while fetching master key %s for realm %s"),
2947c478bd9Sstevel@tonic-gate rdp->realm_mpname, realm);
2957c478bd9Sstevel@tonic-gate goto whoops;
2967c478bd9Sstevel@tonic-gate }
2977c478bd9Sstevel@tonic-gate
2987c478bd9Sstevel@tonic-gate /* Verify the master key */
2997c478bd9Sstevel@tonic-gate if ((kret = krb5_db_verify_master_key(rdp->realm_context,
3007c478bd9Sstevel@tonic-gate rdp->realm_mprinc,
3017c478bd9Sstevel@tonic-gate &rdp->realm_mkey))) {
3027c478bd9Sstevel@tonic-gate com_err(progname, kret,
3037c478bd9Sstevel@tonic-gate gettext("while verifying master key for realm %s"),
3047c478bd9Sstevel@tonic-gate realm);
3057c478bd9Sstevel@tonic-gate goto whoops;
3067c478bd9Sstevel@tonic-gate }
3077c478bd9Sstevel@tonic-gate
3087c478bd9Sstevel@tonic-gate if ((kret = krb5_db_set_mkey(rdp->realm_context, &rdp->realm_mkey))) {
3097c478bd9Sstevel@tonic-gate com_err(progname, kret,
3107c478bd9Sstevel@tonic-gate gettext("while processing master key for realm %s"),
3117c478bd9Sstevel@tonic-gate realm);
3127c478bd9Sstevel@tonic-gate goto whoops;
3137c478bd9Sstevel@tonic-gate }
3147c478bd9Sstevel@tonic-gate
3157c478bd9Sstevel@tonic-gate /* Set up the keytab */
31656a424ccSmp if ((kret = krb5_ktkdb_resolve(rdp->realm_context, NULL,
3177c478bd9Sstevel@tonic-gate &rdp->realm_keytab))) {
3187c478bd9Sstevel@tonic-gate com_err(progname, kret,
3197c478bd9Sstevel@tonic-gate gettext("while resolving kdb keytab for realm %s"),
3207c478bd9Sstevel@tonic-gate realm);
3217c478bd9Sstevel@tonic-gate goto whoops;
3227c478bd9Sstevel@tonic-gate }
3237c478bd9Sstevel@tonic-gate
3247c478bd9Sstevel@tonic-gate /* Preformat the TGS name */
3257c478bd9Sstevel@tonic-gate if ((kret = krb5_build_principal(rdp->realm_context, &rdp->realm_tgsprinc,
3267c478bd9Sstevel@tonic-gate strlen(realm), realm, KRB5_TGS_NAME,
3277c478bd9Sstevel@tonic-gate realm, (char *) NULL))) {
3287c478bd9Sstevel@tonic-gate com_err(progname, kret,
3297c478bd9Sstevel@tonic-gate gettext("while building TGS name for realm %s"),
3307c478bd9Sstevel@tonic-gate realm);
3317c478bd9Sstevel@tonic-gate goto whoops;
3327c478bd9Sstevel@tonic-gate }
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate if (!rkey_init_done) {
3357c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
3367c478bd9Sstevel@tonic-gate krb5_keyblock temp_key;
3377c478bd9Sstevel@tonic-gate #endif
3387c478bd9Sstevel@tonic-gate /*
3397c478bd9Sstevel@tonic-gate * If all that worked, then initialize the random key
3407c478bd9Sstevel@tonic-gate * generators.
3417c478bd9Sstevel@tonic-gate */
3427c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
3437c478bd9Sstevel@tonic-gate if ((kret = krb5_c_make_random_key(rdp->realm_context,
3447c478bd9Sstevel@tonic-gate ENCTYPE_DES_CBC_CRC, &temp_key))) {
3457c478bd9Sstevel@tonic-gate com_err(progname, kret,
3467c478bd9Sstevel@tonic-gate "while initializing V4 random key generator");
3477c478bd9Sstevel@tonic-gate goto whoops;
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate
3507c478bd9Sstevel@tonic-gate (void) des_init_random_number_generator(temp_key.contents);
3517c478bd9Sstevel@tonic-gate krb5_free_keyblock_contents(rdp->realm_context, &temp_key);
3527c478bd9Sstevel@tonic-gate #endif
3537c478bd9Sstevel@tonic-gate rkey_init_done = 1;
3547c478bd9Sstevel@tonic-gate }
3557c478bd9Sstevel@tonic-gate whoops:
3567c478bd9Sstevel@tonic-gate /*
3577c478bd9Sstevel@tonic-gate * If we choked, then clean up any dirt we may have dropped on the floor.
3587c478bd9Sstevel@tonic-gate */
3597c478bd9Sstevel@tonic-gate if (kret) {
360*55fea89dSDan Cross
3617c478bd9Sstevel@tonic-gate finish_realm(rdp);
3627c478bd9Sstevel@tonic-gate }
3637c64d375Smp
3647c64d375Smp /*
3657c64d375Smp * Solaris Kerberos:
3667c64d375Smp * Set the current context back to the general context
3677c64d375Smp */
3687c64d375Smp krb5_klog_set_context(kcontext);
3697c64d375Smp
3707c478bd9Sstevel@tonic-gate return(kret);
3717c478bd9Sstevel@tonic-gate }
3727c478bd9Sstevel@tonic-gate
3737c478bd9Sstevel@tonic-gate krb5_sigtype
37456a424ccSmp request_exit(int signo)
3757c478bd9Sstevel@tonic-gate {
3767c478bd9Sstevel@tonic-gate signal_requests_exit = 1;
3777c478bd9Sstevel@tonic-gate
3787c478bd9Sstevel@tonic-gate #ifdef POSIX_SIGTYPE
3797c478bd9Sstevel@tonic-gate return;
3807c478bd9Sstevel@tonic-gate #else
3817c478bd9Sstevel@tonic-gate return(0);
3827c478bd9Sstevel@tonic-gate #endif
3837c478bd9Sstevel@tonic-gate }
3847c478bd9Sstevel@tonic-gate
3857c478bd9Sstevel@tonic-gate krb5_sigtype
38656a424ccSmp request_hup(int signo)
3877c478bd9Sstevel@tonic-gate {
3887c478bd9Sstevel@tonic-gate signal_requests_hup = 1;
3897c478bd9Sstevel@tonic-gate
3907c478bd9Sstevel@tonic-gate #ifdef POSIX_SIGTYPE
3917c478bd9Sstevel@tonic-gate return;
3927c478bd9Sstevel@tonic-gate #else
3937c478bd9Sstevel@tonic-gate return(0);
3947c478bd9Sstevel@tonic-gate #endif
3957c478bd9Sstevel@tonic-gate }
3967c478bd9Sstevel@tonic-gate
3977c478bd9Sstevel@tonic-gate void
39856a424ccSmp setup_signal_handlers(void)
3997c478bd9Sstevel@tonic-gate {
4007c478bd9Sstevel@tonic-gate #ifdef POSIX_SIGNALS
4017c478bd9Sstevel@tonic-gate (void) sigemptyset(&s_action.sa_mask);
4027c478bd9Sstevel@tonic-gate s_action.sa_flags = 0;
4037c478bd9Sstevel@tonic-gate s_action.sa_handler = request_exit;
4047c478bd9Sstevel@tonic-gate (void) sigaction(SIGINT, &s_action, (struct sigaction *) NULL);
4057c478bd9Sstevel@tonic-gate (void) sigaction(SIGTERM, &s_action, (struct sigaction *) NULL);
4067c478bd9Sstevel@tonic-gate s_action.sa_handler = request_hup;
4077c478bd9Sstevel@tonic-gate (void) sigaction(SIGHUP, &s_action, (struct sigaction *) NULL);
40854925bf6Swillf s_action.sa_handler = SIG_IGN;
40954925bf6Swillf (void) sigaction(SIGPIPE, &s_action, (struct sigaction *) NULL);
4107c478bd9Sstevel@tonic-gate #else /* POSIX_SIGNALS */
4117c478bd9Sstevel@tonic-gate signal(SIGINT, request_exit);
4127c478bd9Sstevel@tonic-gate signal(SIGTERM, request_exit);
4137c478bd9Sstevel@tonic-gate signal(SIGHUP, request_hup);
41454925bf6Swillf signal(SIGPIPE, SIG_IGN);
4157c478bd9Sstevel@tonic-gate #endif /* POSIX_SIGNALS */
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate return;
4187c478bd9Sstevel@tonic-gate }
4197c478bd9Sstevel@tonic-gate
4207c478bd9Sstevel@tonic-gate krb5_error_code
42156a424ccSmp setup_sam(void)
4227c478bd9Sstevel@tonic-gate {
4237c478bd9Sstevel@tonic-gate return krb5_c_make_random_key(kdc_context, ENCTYPE_DES_CBC_MD5, &psr_key);
4247c478bd9Sstevel@tonic-gate }
4257c478bd9Sstevel@tonic-gate
4267c478bd9Sstevel@tonic-gate void
42756a424ccSmp usage(char *name)
4287c478bd9Sstevel@tonic-gate {
4297c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-n]\n"), name);
43054925bf6Swillf fprintf(stderr, "usage: %s [-x db_args]* [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-X] [-n]\n"
43154925bf6Swillf "\nwhere,\n\t[-x db_args]* - any number of database specific arguments.\n"
43254925bf6Swillf "\t\t\tLook at each database documentation for supported arguments\n",
43354925bf6Swillf name);
4347c478bd9Sstevel@tonic-gate return;
4357c478bd9Sstevel@tonic-gate }
4367c478bd9Sstevel@tonic-gate
4377c478bd9Sstevel@tonic-gate void
43856a424ccSmp initialize_realms(krb5_context kcontext, int argc, char **argv)
4397c478bd9Sstevel@tonic-gate {
4407c478bd9Sstevel@tonic-gate int c;
4417c478bd9Sstevel@tonic-gate char *db_name = (char *) NULL;
4427c478bd9Sstevel@tonic-gate char *mkey_name = (char *) NULL;
4435026b7fcSToomas Soome char *rcname __unused;
4447c64d375Smp char *lrealm = NULL;
4457c478bd9Sstevel@tonic-gate krb5_error_code retval;
4467c478bd9Sstevel@tonic-gate krb5_enctype menctype = ENCTYPE_UNKNOWN;
4477c478bd9Sstevel@tonic-gate kdc_realm_t *rdatap;
4487c478bd9Sstevel@tonic-gate krb5_boolean manual = FALSE;
4497c478bd9Sstevel@tonic-gate char *default_udp_ports = 0;
4507c478bd9Sstevel@tonic-gate char *default_tcp_ports = 0;
4517c478bd9Sstevel@tonic-gate krb5_pointer aprof;
4527c478bd9Sstevel@tonic-gate const char *hierarchy[3];
45354925bf6Swillf char **db_args = NULL;
45454925bf6Swillf int db_args_size = 0;
45554925bf6Swillf
4567c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
4577c478bd9Sstevel@tonic-gate char *v4mode = 0;
4587c478bd9Sstevel@tonic-gate #endif
4597c478bd9Sstevel@tonic-gate extern char *optarg;
4607c478bd9Sstevel@tonic-gate
4615026b7fcSToomas Soome rcname = KDCRCACHE;
4625026b7fcSToomas Soome
4637c478bd9Sstevel@tonic-gate if (!krb5_aprof_init(DEFAULT_KDC_PROFILE, KDC_PROFILE_ENV, &aprof)) {
4647c478bd9Sstevel@tonic-gate hierarchy[0] = "kdcdefaults";
4657c478bd9Sstevel@tonic-gate hierarchy[1] = "kdc_ports";
4667c478bd9Sstevel@tonic-gate hierarchy[2] = (char *) NULL;
4677c478bd9Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_udp_ports))
4687c478bd9Sstevel@tonic-gate default_udp_ports = 0;
4697c478bd9Sstevel@tonic-gate hierarchy[1] = "kdc_tcp_ports";
4707c478bd9Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_tcp_ports))
4717c478bd9Sstevel@tonic-gate default_tcp_ports = 0;
4727c478bd9Sstevel@tonic-gate hierarchy[1] = "kdc_max_tcp_connections";
4737c478bd9Sstevel@tonic-gate if (krb5_aprof_get_int32(aprof, hierarchy, TRUE,
4747c478bd9Sstevel@tonic-gate &max_tcp_data_connections)) {
4757c478bd9Sstevel@tonic-gate max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS;
4767c478bd9Sstevel@tonic-gate } else if (max_tcp_data_connections < MIN_KDC_TCP_CONNECTIONS) {
4777c478bd9Sstevel@tonic-gate max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS;
4787c478bd9Sstevel@tonic-gate }
4797c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
4807c478bd9Sstevel@tonic-gate hierarchy[1] = "v4_mode";
4817c478bd9Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &v4mode))
4827c478bd9Sstevel@tonic-gate v4mode = 0;
4837c478bd9Sstevel@tonic-gate #endif
4847c478bd9Sstevel@tonic-gate /* aprof_init can return 0 with aprof == NULL */
4857c478bd9Sstevel@tonic-gate if (aprof)
4867c478bd9Sstevel@tonic-gate krb5_aprof_finish(aprof);
4877c478bd9Sstevel@tonic-gate }
4887c478bd9Sstevel@tonic-gate if (default_udp_ports == 0)
4897c478bd9Sstevel@tonic-gate default_udp_ports = strdup(DEFAULT_KDC_UDP_PORTLIST);
4907c478bd9Sstevel@tonic-gate if (default_tcp_ports == 0)
4917c478bd9Sstevel@tonic-gate default_tcp_ports = strdup(DEFAULT_KDC_TCP_PORTLIST);
4927c478bd9Sstevel@tonic-gate /*
4937c478bd9Sstevel@tonic-gate * Loop through the option list. Each time we encounter a realm name,
4947c478bd9Sstevel@tonic-gate * use the previously scanned options to fill in for defaults.
4957c478bd9Sstevel@tonic-gate */
49654925bf6Swillf while ((c = getopt(argc, argv, "x:r:d:mM:k:R:e:p:s:n4:X3")) != -1) {
4977c478bd9Sstevel@tonic-gate switch(c) {
49854925bf6Swillf case 'x':
49954925bf6Swillf db_args_size++;
50054925bf6Swillf {
50154925bf6Swillf char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
50254925bf6Swillf if( temp == NULL )
50354925bf6Swillf {
5047c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5057c64d375Smp com_err(argv[0], errno, gettext("while initializing KDC"));
50654925bf6Swillf exit(1);
50754925bf6Swillf }
50854925bf6Swillf
50954925bf6Swillf db_args = temp;
51054925bf6Swillf }
51154925bf6Swillf db_args[db_args_size-1] = optarg;
51254925bf6Swillf db_args[db_args_size] = NULL;
51354925bf6Swillf break;
51454925bf6Swillf
5157c478bd9Sstevel@tonic-gate case 'r': /* realm name for db */
5167c478bd9Sstevel@tonic-gate if (!find_realm_data(optarg, (krb5_ui_4) strlen(optarg))) {
5177c478bd9Sstevel@tonic-gate if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) {
518*55fea89dSDan Cross if ((retval = init_realm(kcontext, argv[0], rdatap, optarg,
5197c478bd9Sstevel@tonic-gate mkey_name, menctype,
5207c478bd9Sstevel@tonic-gate default_udp_ports,
52154925bf6Swillf default_tcp_ports, manual, db_args))) {
5227c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5237c64d375Smp com_err(argv[0], retval, gettext("while initializing realm %s"), optarg);
5247c478bd9Sstevel@tonic-gate exit(1);
5257c478bd9Sstevel@tonic-gate }
5267c478bd9Sstevel@tonic-gate kdc_realmlist[kdc_numrealms] = rdatap;
5277c478bd9Sstevel@tonic-gate kdc_numrealms++;
52854925bf6Swillf free(db_args), db_args=NULL, db_args_size = 0;
52954925bf6Swillf }
53054925bf6Swillf else
53154925bf6Swillf {
5327c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5337c64d375Smp com_err(argv[0], errno, gettext("while initializing realm %s"), optarg);
53454925bf6Swillf exit(1);
5357c478bd9Sstevel@tonic-gate }
5367c478bd9Sstevel@tonic-gate }
5377c478bd9Sstevel@tonic-gate break;
5387c478bd9Sstevel@tonic-gate case 'd': /* pathname for db */
53954925bf6Swillf /* now db_name is not a seperate argument. It has to be passed as part of the db_args */
54054925bf6Swillf if( db_name == NULL )
54154925bf6Swillf {
54254925bf6Swillf db_name = malloc(sizeof("dbname=") + strlen(optarg));
54354925bf6Swillf if( db_name == NULL )
54454925bf6Swillf {
5457c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5467c64d375Smp com_err(argv[0], errno, gettext("while initializing KDC"));
54754925bf6Swillf exit(1);
54854925bf6Swillf }
54954925bf6Swillf
55054925bf6Swillf sprintf( db_name, "dbname=%s", optarg);
55154925bf6Swillf }
55254925bf6Swillf
55354925bf6Swillf db_args_size++;
55454925bf6Swillf {
55554925bf6Swillf char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
55654925bf6Swillf if( temp == NULL )
55754925bf6Swillf {
5587c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5597c64d375Smp com_err(argv[0], errno, gettext("while initializing KDC"));
56054925bf6Swillf exit(1);
56154925bf6Swillf }
56254925bf6Swillf
56354925bf6Swillf db_args = temp;
56454925bf6Swillf }
56554925bf6Swillf db_args[db_args_size-1] = db_name;
56654925bf6Swillf db_args[db_args_size] = NULL;
5677c478bd9Sstevel@tonic-gate break;
5687c478bd9Sstevel@tonic-gate case 'm': /* manual type-in of master key */
5697c478bd9Sstevel@tonic-gate manual = TRUE;
5707c478bd9Sstevel@tonic-gate if (menctype == ENCTYPE_UNKNOWN)
5717c478bd9Sstevel@tonic-gate menctype = ENCTYPE_DES_CBC_CRC;
5727c478bd9Sstevel@tonic-gate break;
5737c478bd9Sstevel@tonic-gate case 'M': /* master key name in DB */
5747c478bd9Sstevel@tonic-gate mkey_name = optarg;
5757c478bd9Sstevel@tonic-gate break;
5767c478bd9Sstevel@tonic-gate case 'n':
5777c478bd9Sstevel@tonic-gate nofork++; /* don't detach from terminal */
5787c478bd9Sstevel@tonic-gate break;
5797c478bd9Sstevel@tonic-gate case 'k': /* enctype for master key */
5807c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
5817c64d375Smp if (retval = krb5_string_to_enctype(optarg, &menctype))
5827c64d375Smp com_err(argv[0], retval,
5837c64d375Smp gettext("while converting %s to an enctype"), optarg);
5847c478bd9Sstevel@tonic-gate break;
5857c478bd9Sstevel@tonic-gate case 'R':
5867c478bd9Sstevel@tonic-gate rcname = optarg;
5877c478bd9Sstevel@tonic-gate break;
5887c478bd9Sstevel@tonic-gate case 'p':
5897c478bd9Sstevel@tonic-gate if (default_udp_ports)
5907c478bd9Sstevel@tonic-gate free(default_udp_ports);
5917c478bd9Sstevel@tonic-gate default_udp_ports = strdup(optarg);
5927c478bd9Sstevel@tonic-gate
5937c478bd9Sstevel@tonic-gate if (default_tcp_ports)
5947c478bd9Sstevel@tonic-gate free(default_tcp_ports);
5957c478bd9Sstevel@tonic-gate default_tcp_ports = strdup(optarg);
5967c478bd9Sstevel@tonic-gate
5977c478bd9Sstevel@tonic-gate break;
5987c478bd9Sstevel@tonic-gate case '4':
5997c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
6007c478bd9Sstevel@tonic-gate if (v4mode)
6017c478bd9Sstevel@tonic-gate free(v4mode);
6027c478bd9Sstevel@tonic-gate v4mode = strdup(optarg);
6037c478bd9Sstevel@tonic-gate #endif
6047c478bd9Sstevel@tonic-gate break;
60556a424ccSmp case 'X':
60656a424ccSmp #ifdef KRB5_KRB4_COMPAT
60756a424ccSmp enable_v4_crossrealm(argv[0]);
6087c478bd9Sstevel@tonic-gate #endif
60956a424ccSmp break;
6107c478bd9Sstevel@tonic-gate case '?':
6117c478bd9Sstevel@tonic-gate default:
6127c478bd9Sstevel@tonic-gate usage(argv[0]);
6137c478bd9Sstevel@tonic-gate exit(1);
6147c478bd9Sstevel@tonic-gate }
6157c478bd9Sstevel@tonic-gate }
6167c478bd9Sstevel@tonic-gate
6177c478bd9Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT
6187c478bd9Sstevel@tonic-gate /*
619*55fea89dSDan Cross * Setup the v4 mode
6207c478bd9Sstevel@tonic-gate */
6217c478bd9Sstevel@tonic-gate process_v4_mode(argv[0], v4mode);
62254925bf6Swillf free(v4mode);
6237c478bd9Sstevel@tonic-gate #endif
6247c478bd9Sstevel@tonic-gate
6257c478bd9Sstevel@tonic-gate /*
6267c478bd9Sstevel@tonic-gate * Check to see if we processed any realms.
6277c478bd9Sstevel@tonic-gate */
6287c478bd9Sstevel@tonic-gate if (kdc_numrealms == 0) {
6297c478bd9Sstevel@tonic-gate /* no realm specified, use default realm */
6307c478bd9Sstevel@tonic-gate if ((retval = krb5_get_default_realm(kcontext, &lrealm))) {
6317c478bd9Sstevel@tonic-gate com_err(argv[0], retval,
6327c478bd9Sstevel@tonic-gate gettext("while attempting to retrieve default realm"));
6337c64d375Smp /* Solaris Kerberos: avoid double logging */
6347c64d375Smp #if 0
63556a424ccSmp fprintf (stderr, "%s: %s, %s", argv[0], error_message (retval),
6367c64d375Smp gettext("attempting to retrieve default realm\n"));
6377c64d375Smp #endif
6387c478bd9Sstevel@tonic-gate exit(1);
6397c478bd9Sstevel@tonic-gate }
6407c478bd9Sstevel@tonic-gate if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) {
641*55fea89dSDan Cross if ((retval = init_realm(kcontext, argv[0], rdatap, lrealm,
6427c478bd9Sstevel@tonic-gate mkey_name, menctype, default_udp_ports,
64354925bf6Swillf default_tcp_ports, manual, db_args))) {
6447c64d375Smp /* Solaris Kerberos: Keep error messages consistent */
6457c64d375Smp com_err(argv[0], retval, gettext("while initializing realm %s"), lrealm);
6467c478bd9Sstevel@tonic-gate exit(1);
6477c478bd9Sstevel@tonic-gate }
6487c478bd9Sstevel@tonic-gate kdc_realmlist[0] = rdatap;
6497c478bd9Sstevel@tonic-gate kdc_numrealms++;
650159d09a2SMark Phalan } else {
651159d09a2SMark Phalan if (lrealm)
652159d09a2SMark Phalan free(lrealm);
6537c478bd9Sstevel@tonic-gate }
6547c478bd9Sstevel@tonic-gate }
6557c478bd9Sstevel@tonic-gate
6567c478bd9Sstevel@tonic-gate #ifdef USE_RCACHE
6577c478bd9Sstevel@tonic-gate /*
6587c478bd9Sstevel@tonic-gate * Now handle the replay cache.
6597c478bd9Sstevel@tonic-gate */
6607c478bd9Sstevel@tonic-gate if ((retval = kdc_initialize_rcache(kcontext, rcname))) {
66156a424ccSmp com_err(argv[0], retval, gettext("while initializing KDC replay cache '%s'"),
66256a424ccSmp rcname);
6637c478bd9Sstevel@tonic-gate exit(1);
6647c478bd9Sstevel@tonic-gate }
6657c478bd9Sstevel@tonic-gate #endif
6667c478bd9Sstevel@tonic-gate
6677c478bd9Sstevel@tonic-gate /* Ensure that this is set for our first request. */
6687c478bd9Sstevel@tonic-gate kdc_active_realm = kdc_realmlist[0];
669159d09a2SMark Phalan
6707c478bd9Sstevel@tonic-gate if (default_udp_ports)
6717c478bd9Sstevel@tonic-gate free(default_udp_ports);
6727c478bd9Sstevel@tonic-gate if (default_tcp_ports)
6737c478bd9Sstevel@tonic-gate free(default_tcp_ports);
67454925bf6Swillf if (db_args)
67554925bf6Swillf free(db_args);
67654925bf6Swillf if (db_name)
67754925bf6Swillf free(db_name);
6787c478bd9Sstevel@tonic-gate
6797c478bd9Sstevel@tonic-gate return;
6807c478bd9Sstevel@tonic-gate }
6817c478bd9Sstevel@tonic-gate
6827c478bd9Sstevel@tonic-gate void
68356a424ccSmp finish_realms(char *prog)
6847c478bd9Sstevel@tonic-gate {
6857c478bd9Sstevel@tonic-gate int i;
6867c478bd9Sstevel@tonic-gate
6877c478bd9Sstevel@tonic-gate for (i = 0; i < kdc_numrealms; i++) {
6887c478bd9Sstevel@tonic-gate finish_realm(kdc_realmlist[i]);
6897c478bd9Sstevel@tonic-gate kdc_realmlist[i] = 0;
6907c478bd9Sstevel@tonic-gate }
6917c478bd9Sstevel@tonic-gate }
6927c478bd9Sstevel@tonic-gate
6937c478bd9Sstevel@tonic-gate /*
6947c478bd9Sstevel@tonic-gate outline:
6957c478bd9Sstevel@tonic-gate
6967c478bd9Sstevel@tonic-gate process args & setup
6977c478bd9Sstevel@tonic-gate
6987c478bd9Sstevel@tonic-gate initialize database access (fetch master key, open DB)
6997c478bd9Sstevel@tonic-gate
7007c478bd9Sstevel@tonic-gate initialize network
7017c478bd9Sstevel@tonic-gate
7027c478bd9Sstevel@tonic-gate loop:
7037c478bd9Sstevel@tonic-gate listen for packet
7047c478bd9Sstevel@tonic-gate
7057c478bd9Sstevel@tonic-gate determine packet type, dispatch to handling routine
7067c478bd9Sstevel@tonic-gate (AS or TGS (or V4?))
7077c478bd9Sstevel@tonic-gate
7087c478bd9Sstevel@tonic-gate reflect response
7097c478bd9Sstevel@tonic-gate
7107c478bd9Sstevel@tonic-gate exit on signal
7117c478bd9Sstevel@tonic-gate
7127c478bd9Sstevel@tonic-gate clean up secrets, close db
7137c478bd9Sstevel@tonic-gate
7147c478bd9Sstevel@tonic-gate shut down network
7157c478bd9Sstevel@tonic-gate
7167c478bd9Sstevel@tonic-gate exit
7177c478bd9Sstevel@tonic-gate */
7187c478bd9Sstevel@tonic-gate
71956a424ccSmp int main(int argc, char **argv)
7207c478bd9Sstevel@tonic-gate {
7217c478bd9Sstevel@tonic-gate krb5_error_code retval;
7227c478bd9Sstevel@tonic-gate krb5_context kcontext;
7237c478bd9Sstevel@tonic-gate int errout = 0;
7247c478bd9Sstevel@tonic-gate
7257c64d375Smp krb5_boolean log_stderr_set;
7267c64d375Smp
7277c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
7287c478bd9Sstevel@tonic-gate
7297c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
7307c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KRB5KDC_TEST" /* Use this only if it weren't */
7317c478bd9Sstevel@tonic-gate #endif
7327c478bd9Sstevel@tonic-gate
7337c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate if (strrchr(argv[0], '/'))
7367c478bd9Sstevel@tonic-gate argv[0] = strrchr(argv[0], '/')+1;
7377c478bd9Sstevel@tonic-gate
738*55fea89dSDan Cross if (!(kdc_realmlist = (kdc_realm_t **) malloc(sizeof(kdc_realm_t *) *
7397c478bd9Sstevel@tonic-gate KRB5_KDC_MAX_REALMS))) {
7407c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("%s: cannot get memory for realm list\n"), argv[0]);
7417c478bd9Sstevel@tonic-gate exit(1);
7427c478bd9Sstevel@tonic-gate }
7437c478bd9Sstevel@tonic-gate memset((char *) kdc_realmlist, 0,
7447c478bd9Sstevel@tonic-gate (size_t) (sizeof(kdc_realm_t *) * KRB5_KDC_MAX_REALMS));
7457c478bd9Sstevel@tonic-gate
7467c478bd9Sstevel@tonic-gate /*
7477c478bd9Sstevel@tonic-gate * A note about Kerberos contexts: This context, "kcontext", is used
7487c478bd9Sstevel@tonic-gate * for the KDC operations, i.e. setup, network connection and error
7497c478bd9Sstevel@tonic-gate * reporting. The per-realm operations use the "realm_context"
7507c478bd9Sstevel@tonic-gate * associated with each realm.
7517c478bd9Sstevel@tonic-gate */
75254925bf6Swillf retval = krb5int_init_context_kdc(&kcontext);
7537c478bd9Sstevel@tonic-gate if (retval) {
7547c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing krb5"));
7557c478bd9Sstevel@tonic-gate exit(1);
7567c478bd9Sstevel@tonic-gate }
7577c478bd9Sstevel@tonic-gate krb5_klog_init(kcontext, "kdc", argv[0], 1);
7587c64d375Smp
7597c64d375Smp /*
7607c64d375Smp * Solaris Kerberos:
7617c64d375Smp * In the early stages of krb5kdc it is desirable to log error messages
7627c64d375Smp * to stderr as well as any other logging locations specified in config
7637c64d375Smp * files.
7647c64d375Smp */
7657c64d375Smp log_stderr_set = krb5_klog_logging_to_stderr();
7667c64d375Smp if (log_stderr_set != TRUE) {
7677c64d375Smp krb5_klog_add_stderr();
7687c64d375Smp }
7697c64d375Smp
7707c478bd9Sstevel@tonic-gate /* initialize_kdc5_error_table(); SUNWresync121 XXX */
7717c478bd9Sstevel@tonic-gate
7727c478bd9Sstevel@tonic-gate /*
7737c478bd9Sstevel@tonic-gate * Scan through the argument list
7747c478bd9Sstevel@tonic-gate */
7757c478bd9Sstevel@tonic-gate initialize_realms(kcontext, argc, argv);
7767c478bd9Sstevel@tonic-gate
7777c478bd9Sstevel@tonic-gate setup_signal_handlers();
7787c478bd9Sstevel@tonic-gate
779159d09a2SMark Phalan load_preauth_plugins(kcontext);
780159d09a2SMark Phalan
78156a424ccSmp retval = setup_sam();
78256a424ccSmp if (retval) {
7837c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing SAM"));
7847c478bd9Sstevel@tonic-gate finish_realms(argv[0]);
7857c478bd9Sstevel@tonic-gate return 1;
7867c478bd9Sstevel@tonic-gate }
7877c478bd9Sstevel@tonic-gate
7887c478bd9Sstevel@tonic-gate if ((retval = setup_network(argv[0]))) {
7897c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing network"));
7907c478bd9Sstevel@tonic-gate finish_realms(argv[0]);
7917c478bd9Sstevel@tonic-gate return 1;
7927c478bd9Sstevel@tonic-gate }
7937c64d375Smp
7947c64d375Smp /* Solaris Kerberos: Remove the extra stderr logging */
7957c64d375Smp if (log_stderr_set != TRUE)
7967c64d375Smp krb5_klog_remove_stderr();
7977c64d375Smp
7987c64d375Smp /*
7997c64d375Smp * Solaris Kerberos:
8007c64d375Smp * List the logs (FILE, STDERR, etc) which are currently being
8017c64d375Smp * logged to and print that to stderr. Useful when trying to
8027c64d375Smp * track down a failure via SMF.
8037c64d375Smp */
8047c64d375Smp if (retval = krb5_klog_list_logs(argv[0])) {
8057c64d375Smp com_err(argv[0], retval, gettext("while listing logs"));
8067c64d375Smp if (log_stderr_set != TRUE) {
8077c64d375Smp fprintf(stderr, gettext("%s: %s while listing logs\n"),
8087c64d375Smp argv[0], error_message(retval));
8097c64d375Smp }
8107c64d375Smp }
8117c64d375Smp
8127c478bd9Sstevel@tonic-gate if (!nofork && daemon(0, 0)) {
8137c478bd9Sstevel@tonic-gate com_err(argv[0], errno, gettext("while detaching from tty"));
8147c64d375Smp if (log_stderr_set != TRUE) {
8157c64d375Smp fprintf(stderr, gettext("%s: %s while detaching from tty\n"),
8167c64d375Smp argv[0], strerror(errno));
8177c64d375Smp }
8187c478bd9Sstevel@tonic-gate finish_realms(argv[0]);
8197c478bd9Sstevel@tonic-gate return 1;
8207c478bd9Sstevel@tonic-gate }
8217c478bd9Sstevel@tonic-gate if (retval = krb5_klog_syslog(LOG_INFO, "commencing operation")) {
8227c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while logging message"));
8237c478bd9Sstevel@tonic-gate errout++;
8247c478bd9Sstevel@tonic-gate };
8257c64d375Smp
8267c478bd9Sstevel@tonic-gate if ((retval = listen_and_process(argv[0]))) {
8277c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while processing network requests"));
8287c478bd9Sstevel@tonic-gate errout++;
8297c478bd9Sstevel@tonic-gate }
8307c478bd9Sstevel@tonic-gate if ((retval = closedown_network(argv[0]))) {
8317c478bd9Sstevel@tonic-gate com_err(argv[0], retval, gettext("while shutting down network"));
8327c478bd9Sstevel@tonic-gate errout++;
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, "shutting down");
835159d09a2SMark Phalan unload_preauth_plugins(kcontext);
8367c478bd9Sstevel@tonic-gate krb5_klog_close(kdc_context);
8377c478bd9Sstevel@tonic-gate finish_realms(argv[0]);
838*55fea89dSDan Cross if (kdc_realmlist)
83956a424ccSmp free(kdc_realmlist);
84056a424ccSmp #ifdef USE_RCACHE
84156a424ccSmp (void) krb5_rc_close(kcontext, kdc_rcache);
84256a424ccSmp #endif
84356a424ccSmp #ifndef NOCACHE
84456a424ccSmp kdc_free_lookaside(kcontext);
84556a424ccSmp #endif
8467c478bd9Sstevel@tonic-gate krb5_free_context(kcontext);
8477c478bd9Sstevel@tonic-gate return errout;
8487c478bd9Sstevel@tonic-gate }
84956a424ccSmp
85056a424ccSmp
85156a424ccSmp
85256a424ccSmp
853