17c478bd9Sstevel@tonic-gate /* 27c64d375Smp * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate * 57c478bd9Sstevel@tonic-gate * All rights reserved. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may require 87c478bd9Sstevel@tonic-gate * a specific license from the United States Government. It is the 97c478bd9Sstevel@tonic-gate * responsibility of any person or organization contemplating export to 107c478bd9Sstevel@tonic-gate * obtain such a license before exporting. 117c478bd9Sstevel@tonic-gate * 127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 177c478bd9Sstevel@tonic-gate * the name of FundsXpress. not be used in advertising or publicity pertaining 187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 197c478bd9Sstevel@tonic-gate * permission. FundsXpress makes no representations about the suitability of 207c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 217c478bd9Sstevel@tonic-gate * or implied warranty. 227c478bd9Sstevel@tonic-gate * 237c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 247c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 257c478bd9Sstevel@tonic-gate * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * slave/kpropd.c 317c478bd9Sstevel@tonic-gate * 327c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 337c478bd9Sstevel@tonic-gate * All Rights Reserved. 347c478bd9Sstevel@tonic-gate * 357c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 367c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 377c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 387c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 397c478bd9Sstevel@tonic-gate * 407c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 417c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 427c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 437c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 447c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 457c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 467c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 477c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 487c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 497c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 507c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 517c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 527c478bd9Sstevel@tonic-gate * or implied warranty. 537c478bd9Sstevel@tonic-gate * 547c478bd9Sstevel@tonic-gate * 557c478bd9Sstevel@tonic-gate * XXX We need to modify the protocol so that an acknowledge is set 567c478bd9Sstevel@tonic-gate * after each block, instead after the entire series is sent over. 577c478bd9Sstevel@tonic-gate * The reason for this is so that error packets can get interpreted 587c478bd9Sstevel@tonic-gate * right away. If you don't do this, the sender may never get the 597c478bd9Sstevel@tonic-gate * error packet, because it will die an EPIPE trying to complete the 607c478bd9Sstevel@tonic-gate * write... 617c478bd9Sstevel@tonic-gate */ 627c478bd9Sstevel@tonic-gate 6356a424ccSmp 647c478bd9Sstevel@tonic-gate #include <stdio.h> 657c478bd9Sstevel@tonic-gate #include <ctype.h> 667c478bd9Sstevel@tonic-gate #include <sys/file.h> 677c478bd9Sstevel@tonic-gate #include <signal.h> 687c478bd9Sstevel@tonic-gate #include <string.h> 697c478bd9Sstevel@tonic-gate #include <fcntl.h> 707c478bd9Sstevel@tonic-gate #include <sys/types.h> 717c478bd9Sstevel@tonic-gate #include <sys/time.h> 727c478bd9Sstevel@tonic-gate #include <sys/stat.h> 737c478bd9Sstevel@tonic-gate #include <sys/socket.h> 747c478bd9Sstevel@tonic-gate #include <sys/wait.h> 757c478bd9Sstevel@tonic-gate #include <netinet/in.h> 767c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 777c478bd9Sstevel@tonic-gate #include <sys/param.h> 787c478bd9Sstevel@tonic-gate #include <netdb.h> 797c478bd9Sstevel@tonic-gate #include <syslog.h> 807c478bd9Sstevel@tonic-gate #include <libintl.h> 817c478bd9Sstevel@tonic-gate #include <locale.h> 827c478bd9Sstevel@tonic-gate #include <k5-int.h> 837c478bd9Sstevel@tonic-gate #include <socket-utils.h> 847c478bd9Sstevel@tonic-gate #include "com_err.h" 857c478bd9Sstevel@tonic-gate #include <errno.h> 867c478bd9Sstevel@tonic-gate 877c478bd9Sstevel@tonic-gate #include "kprop.h" 887c478bd9Sstevel@tonic-gate #include <iprop_hdr.h> 897c478bd9Sstevel@tonic-gate #include "iprop.h" 907c478bd9Sstevel@tonic-gate #include <kadm5/admin.h> 917c478bd9Sstevel@tonic-gate #include <kdb/kdb_log.h> 927c478bd9Sstevel@tonic-gate 937c64d375Smp /* Solaris Kerberos */ 947c64d375Smp #include <libgen.h> 957c64d375Smp 967c478bd9Sstevel@tonic-gate #define SYSLOG_CLASS LOG_DAEMON 977c478bd9Sstevel@tonic-gate 987c478bd9Sstevel@tonic-gate char *poll_time = NULL; 997c478bd9Sstevel@tonic-gate char *def_realm = NULL; 1007c478bd9Sstevel@tonic-gate boolean_t runonce = B_FALSE; 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate /* 1037c478bd9Sstevel@tonic-gate * This struct simulates the use of _kadm5_server_handle_t 1047c478bd9Sstevel@tonic-gate */ 1057c478bd9Sstevel@tonic-gate typedef struct _kadm5_iprop_handle_t { 1067c478bd9Sstevel@tonic-gate krb5_ui_4 magic_number; 1077c478bd9Sstevel@tonic-gate krb5_ui_4 struct_version; 1087c478bd9Sstevel@tonic-gate krb5_ui_4 api_version; 1097c478bd9Sstevel@tonic-gate char *cache_name; 1107c478bd9Sstevel@tonic-gate int destroy_cache; 1117c478bd9Sstevel@tonic-gate CLIENT *clnt; 1127c478bd9Sstevel@tonic-gate krb5_context context; 1137c478bd9Sstevel@tonic-gate kadm5_config_params params; 1147c478bd9Sstevel@tonic-gate struct _kadm5_iprop_handle_t *lhandle; 1157c478bd9Sstevel@tonic-gate } *kadm5_iprop_handle_t; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION; 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate char *progname; 1207c478bd9Sstevel@tonic-gate int debug = 0; 1217c478bd9Sstevel@tonic-gate char *srvtab = 0; 1227c478bd9Sstevel@tonic-gate int standalone = 0; 1237c478bd9Sstevel@tonic-gate 1247c478bd9Sstevel@tonic-gate krb5_principal server; /* This is our server principal name */ 1257c478bd9Sstevel@tonic-gate krb5_principal client; /* This is who we're talking to */ 1267c478bd9Sstevel@tonic-gate krb5_context kpropd_context; 1277c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 1287c478bd9Sstevel@tonic-gate char *realm = NULL; /* Our realm */ 1297c478bd9Sstevel@tonic-gate char *file = KPROPD_DEFAULT_FILE; 1307c478bd9Sstevel@tonic-gate char *temp_file_name; 1317c478bd9Sstevel@tonic-gate char *kdb5_util = KPROPD_DEFAULT_KDB5_UTIL; 1327c478bd9Sstevel@tonic-gate char *kerb_database = NULL; 1337c478bd9Sstevel@tonic-gate char *acl_file_name = KPROPD_ACL_FILE; 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate krb5_address sender_addr; 1367c478bd9Sstevel@tonic-gate krb5_address receiver_addr; 1377c478bd9Sstevel@tonic-gate short port = 0; 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate void PRS 1407c478bd9Sstevel@tonic-gate (int, char**); 1417c478bd9Sstevel@tonic-gate int do_standalone 1427c478bd9Sstevel@tonic-gate (iprop_role iproprole); 1437c478bd9Sstevel@tonic-gate void doit 14456a424ccSmp (int); 1457c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx); 1467c478bd9Sstevel@tonic-gate 1477c478bd9Sstevel@tonic-gate void kerberos_authenticate 14856a424ccSmp (krb5_context, 1497c478bd9Sstevel@tonic-gate int, 1507c478bd9Sstevel@tonic-gate krb5_principal *, 1517c478bd9Sstevel@tonic-gate krb5_enctype *, 1527c478bd9Sstevel@tonic-gate struct sockaddr_storage); 1537c478bd9Sstevel@tonic-gate krb5_boolean authorized_principal 15456a424ccSmp (krb5_context, 1557c478bd9Sstevel@tonic-gate krb5_principal, 1567c478bd9Sstevel@tonic-gate krb5_enctype); 1577c478bd9Sstevel@tonic-gate void recv_database 15856a424ccSmp (krb5_context, 1597c478bd9Sstevel@tonic-gate int, 1607c478bd9Sstevel@tonic-gate int, 1617c478bd9Sstevel@tonic-gate krb5_data *); 1627c478bd9Sstevel@tonic-gate void load_database 16356a424ccSmp (krb5_context, 1647c478bd9Sstevel@tonic-gate char *, 1657c478bd9Sstevel@tonic-gate char *); 1667c478bd9Sstevel@tonic-gate void send_error 16756a424ccSmp (krb5_context, 1687c478bd9Sstevel@tonic-gate int, 1697c478bd9Sstevel@tonic-gate krb5_error_code, 1707c478bd9Sstevel@tonic-gate char *); 1717c478bd9Sstevel@tonic-gate void recv_error 17256a424ccSmp (krb5_context, 1737c478bd9Sstevel@tonic-gate krb5_data *); 1747c478bd9Sstevel@tonic-gate int convert_polltime 1757c478bd9Sstevel@tonic-gate (char *); 1767c478bd9Sstevel@tonic-gate unsigned int backoff_from_master 1777c478bd9Sstevel@tonic-gate (int *); 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate static void usage() 1807c478bd9Sstevel@tonic-gate { 1817c478bd9Sstevel@tonic-gate fprintf(stderr, 1827c478bd9Sstevel@tonic-gate gettext("\nUsage: %s\n"), /* progname may be a long pathname */ 1837c478bd9Sstevel@tonic-gate progname); 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate fprintf(stderr, 1867c478bd9Sstevel@tonic-gate gettext("\t[-r realm] [-s srvtab] [-dS] [-f slave_file]\n")); 1877c478bd9Sstevel@tonic-gate 1887c478bd9Sstevel@tonic-gate fprintf(stderr, 1897c478bd9Sstevel@tonic-gate gettext("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n")); 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("\t[-P port] [-a acl_file]\n")); 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate exit(1); 1947c478bd9Sstevel@tonic-gate } 1957c478bd9Sstevel@tonic-gate 1967c478bd9Sstevel@tonic-gate int 1977c478bd9Sstevel@tonic-gate main(argc, argv) 1987c478bd9Sstevel@tonic-gate int argc; 1997c478bd9Sstevel@tonic-gate char **argv; 2007c478bd9Sstevel@tonic-gate { 2017c478bd9Sstevel@tonic-gate krb5_error_code retval; 2027c478bd9Sstevel@tonic-gate int ret = 0; 2037c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 20454925bf6Swillf int iprop_supported; 2057c64d375Smp krb5_boolean is_master = FALSE; 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate PRS(argc, argv); 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 2107c478bd9Sstevel@tonic-gate 2117c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 2127c478bd9Sstevel@tonic-gate /* 2137c478bd9Sstevel@tonic-gate * We wanna do iprop ! 2147c478bd9Sstevel@tonic-gate */ 21554925bf6Swillf retval = krb5_db_supports_iprop(kpropd_context, 21654925bf6Swillf &iprop_supported); 21754925bf6Swillf if (retval) { 2187c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 21954925bf6Swillf com_err(progname, retval, 2207c64d375Smp gettext("while determining if dbmodule plugin " 2217c64d375Smp "supports iprop")); 22254925bf6Swillf exit(1); 22354925bf6Swillf } 22454925bf6Swillf if (!iprop_supported) { 2257c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 2267c64d375Smp com_err(progname, 0, 22754925bf6Swillf gettext("Current dbmodule plugin does not support " 2287c64d375Smp "iprop")); 2297c64d375Smp exit(1); 2307c64d375Smp } 2317c64d375Smp 2327c64d375Smp /* 2337c64d375Smp * Solaris Kerberos: 2347c64d375Smp * Ensure that kpropd is only run on a slave 2357c64d375Smp */ 2367c64d375Smp if (retval = kadm5_is_master(kpropd_context, def_realm, 2377c64d375Smp &is_master)) { 2387c64d375Smp com_err(progname, retval, 2397c64d375Smp gettext("while trying to determine whether host is " 2407c64d375Smp "master KDC for realm %s"), def_realm); 2417c64d375Smp exit(1); 2427c64d375Smp } 2437c64d375Smp 2447c64d375Smp if (is_master == TRUE) { 2457c64d375Smp char *master = NULL; 2467c64d375Smp kadm5_get_master(kpropd_context, def_realm, &master); 2477c64d375Smp 2487c64d375Smp com_err(progname, 0, 2497c64d375Smp gettext("%s is the master KDC for the realm %s. " 2507c64d375Smp "%s can only be run on a slave KDC"), 2517c64d375Smp master ? master : "unknown", def_realm, progname); 25254925bf6Swillf exit(1); 25354925bf6Swillf } 25454925bf6Swillf 2557c478bd9Sstevel@tonic-gate retval = do_iprop(log_ctx); 2567c478bd9Sstevel@tonic-gate if (retval) { 2577c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 2587c478bd9Sstevel@tonic-gate com_err(progname, retval, 2597c64d375Smp gettext("while doing iprop")); 2607c478bd9Sstevel@tonic-gate exit(1); 2617c478bd9Sstevel@tonic-gate } 2627c478bd9Sstevel@tonic-gate 2637c478bd9Sstevel@tonic-gate } else { 2647c64d375Smp 2657c64d375Smp /* 2667c64d375Smp * Solaris Kerberos: 2677c64d375Smp * Ensure that the kpropd.acl file exists and contains at least 2687c64d375Smp * 1 entry. 2697c64d375Smp */ 2707c64d375Smp FILE *tmp_acl_file; 2717c64d375Smp int seen_file = 0; 2727c64d375Smp char buf[1024]; 2737c64d375Smp 2747c64d375Smp tmp_acl_file = fopen(acl_file_name, "r"); 2757c64d375Smp if (!tmp_acl_file) { 2767c64d375Smp com_err(progname, errno, 2777c64d375Smp gettext("while opening acl file %s"), 2787c64d375Smp acl_file_name); 2797c64d375Smp exit(1); 2807c64d375Smp } 2817c64d375Smp 2827c64d375Smp while (!feof(tmp_acl_file) && !seen_file ) { 2837c64d375Smp if (!fgets(buf, sizeof(buf), tmp_acl_file)) 2847c64d375Smp break; 2857c64d375Smp 2867c64d375Smp if (buf[0] != '#' && !isspace(buf[0])) 2877c64d375Smp seen_file = 1; 2887c64d375Smp } 2897c64d375Smp if (!seen_file) { 2907c64d375Smp com_err(progname, 0, 2917c64d375Smp gettext("No entries found in %s. Can't " 2927c64d375Smp "authorize propagation requests"), acl_file_name); 2937c64d375Smp exit(1); 2947c64d375Smp } 2957c64d375Smp fclose(tmp_acl_file); 2967c64d375Smp 2977c478bd9Sstevel@tonic-gate if (standalone) 2987c478bd9Sstevel@tonic-gate ret = do_standalone(IPROP_NULL); 2997c478bd9Sstevel@tonic-gate else 3007c478bd9Sstevel@tonic-gate doit(0); 3017c478bd9Sstevel@tonic-gate } 3027c478bd9Sstevel@tonic-gate 3037c478bd9Sstevel@tonic-gate exit(ret); 3047c478bd9Sstevel@tonic-gate } 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate int do_standalone(iprop_role iproprole) 3077c478bd9Sstevel@tonic-gate { 3087c478bd9Sstevel@tonic-gate struct linger linger; 3097c478bd9Sstevel@tonic-gate struct servent *sp; 3107c478bd9Sstevel@tonic-gate int finet, fromlen, s; 3117c478bd9Sstevel@tonic-gate int on = 1; 3127c478bd9Sstevel@tonic-gate int ret, status = 0; 3137c478bd9Sstevel@tonic-gate struct sockaddr_in6 sin6 = { AF_INET6 }; 3147c478bd9Sstevel@tonic-gate int sin6_size = sizeof (sin6); 3157c478bd9Sstevel@tonic-gate 3167c478bd9Sstevel@tonic-gate /* listen for either ipv4 or ipv6 */ 3177c478bd9Sstevel@tonic-gate finet = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); 3187c478bd9Sstevel@tonic-gate if (finet < 0 ) { 3197c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while obtaining socket")); 3207c478bd9Sstevel@tonic-gate exit(1); 3217c478bd9Sstevel@tonic-gate } 3227c478bd9Sstevel@tonic-gate 3237c478bd9Sstevel@tonic-gate if(!port) { 3247c478bd9Sstevel@tonic-gate sp = getservbyname(KPROP_SERVICE, "tcp"); 3257c478bd9Sstevel@tonic-gate if (sp == NULL) { 3267c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("%s/tcp: unknown service"), 3277c478bd9Sstevel@tonic-gate KPROP_SERVICE); 3287c478bd9Sstevel@tonic-gate exit(1); 3297c478bd9Sstevel@tonic-gate } 3307c478bd9Sstevel@tonic-gate sin6.sin6_port = sp->s_port; 3317c478bd9Sstevel@tonic-gate } else 3327c478bd9Sstevel@tonic-gate sin6.sin6_port = port; 3337c478bd9Sstevel@tonic-gate 3347c478bd9Sstevel@tonic-gate /* 3357c478bd9Sstevel@tonic-gate * We need to close the socket immediately if iprop is enabled, 3367c478bd9Sstevel@tonic-gate * since back-to-back full resyncs are possible, so we do not 3377c478bd9Sstevel@tonic-gate * linger around for too long 3387c478bd9Sstevel@tonic-gate */ 3397c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) { 3407c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 3417c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) 3427c478bd9Sstevel@tonic-gate com_err(progname, errno, 3437c64d375Smp gettext("while setting socket option (SO_REUSEADDR)")); 3447c478bd9Sstevel@tonic-gate linger.l_onoff = 1; 3457c478bd9Sstevel@tonic-gate linger.l_linger = 2; 3467c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_LINGER, 3477c478bd9Sstevel@tonic-gate (void *)&linger, sizeof(linger)) < 0) 3487c478bd9Sstevel@tonic-gate com_err(progname, errno, 3497c64d375Smp gettext("while setting socket option (SO_LINGER)")); 3507c478bd9Sstevel@tonic-gate } 3517c478bd9Sstevel@tonic-gate if ((ret = bind(finet, (struct sockaddr *)&sin6, sizeof(sin6))) < 0) { 3527c478bd9Sstevel@tonic-gate if (debug) { 3537c478bd9Sstevel@tonic-gate on = 1; 3547c478bd9Sstevel@tonic-gate fprintf(stderr, 3557c478bd9Sstevel@tonic-gate gettext("%s: attempting to rebind socket " 3567c478bd9Sstevel@tonic-gate "with SO_REUSEADDR\n"), progname); 3577c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 3587c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) { 3597c478bd9Sstevel@tonic-gate com_err(progname, errno, 3607c64d375Smp gettext("while setting socket option (SO_REUSEADDR)")); 3617c478bd9Sstevel@tonic-gate } 3627c478bd9Sstevel@tonic-gate ret = bind(finet, (struct sockaddr *) &sin6, sizeof(sin6)); 36356a424ccSmp } 3647c478bd9Sstevel@tonic-gate 36556a424ccSmp if (ret < 0) { 3667c64d375Smp /* 3677c64d375Smp * Solaris Kerberos: 3687c64d375Smp * com_err will print the err msg associated with errno 3697c64d375Smp */ 3707c64d375Smp #if 0 37156a424ccSmp perror(gettext("bind")); 3727c64d375Smp #endif 37356a424ccSmp com_err(progname, errno, 3747c478bd9Sstevel@tonic-gate gettext("while binding listener socket")); 37556a424ccSmp exit(1); 37656a424ccSmp } 3777c478bd9Sstevel@tonic-gate } 3787c64d375Smp if (!debug && (iproprole != IPROP_SLAVE)) { 3797c64d375Smp /* Solaris Kerberos: Indicate where further messages will be sent */ 3807c64d375Smp fprintf(stderr, 3817c64d375Smp gettext("%s: Logging to SYSLOG with LOG_DAEMON facility\n"), 3827c64d375Smp progname); 3837c64d375Smp if (daemon(1, 0)) { 3847c64d375Smp com_err(progname, errno, gettext("while daemonizing")); 3857c64d375Smp exit(1); 3867c64d375Smp } 3877c64d375Smp rem_default_com_err_hook(); 3887c64d375Smp } 3897c64d375Smp 3907c478bd9Sstevel@tonic-gate #ifdef PID_FILE 39156a424ccSmp if ((pidfile = fopen(PID_FILE, "w")) != NULL) { 39256a424ccSmp fprintf(pidfile, gettext("%d\n"), getpid()); 39356a424ccSmp fclose(pidfile); 39456a424ccSmp } else 39556a424ccSmp com_err(progname, errno, 3967c478bd9Sstevel@tonic-gate gettext("while opening pid file %s for writing"), 3977c478bd9Sstevel@tonic-gate PID_FILE); 3987c478bd9Sstevel@tonic-gate #endif 39956a424ccSmp if (listen(finet, 5) < 0) { 4007c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 4017c64d375Smp com_err(progname, errno, gettext("while listening on socket")); 40256a424ccSmp exit(1); 4037c478bd9Sstevel@tonic-gate } 40456a424ccSmp while (1) { 40556a424ccSmp int child_pid; 4067c478bd9Sstevel@tonic-gate 40756a424ccSmp s = accept(finet, (struct sockaddr *) &sin6, &sin6_size); 4087c478bd9Sstevel@tonic-gate 40956a424ccSmp if (s < 0) { 4107c64d375Smp if (errno != EINTR) { 4117c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 41256a424ccSmp com_err(progname, errno, 4137c64d375Smp gettext("while accepting connection")); 4147c64d375Smp } 41556a424ccSmp continue; 41656a424ccSmp } 41756a424ccSmp if (debug && (iproprole != IPROP_SLAVE)) 41856a424ccSmp child_pid = 0; 41956a424ccSmp else 42056a424ccSmp child_pid = fork(); 42156a424ccSmp switch (child_pid) { 42256a424ccSmp case -1: 42356a424ccSmp com_err(progname, errno, gettext("while forking")); 42456a424ccSmp exit(1); 4257c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 42656a424ccSmp case 0: 4277c478bd9Sstevel@tonic-gate /* child */ 42856a424ccSmp (void) close(finet); 42956a424ccSmp 43056a424ccSmp doit(s); 43156a424ccSmp close(s); 43256a424ccSmp _exit(0); 4337c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 43456a424ccSmp default: 4357c478bd9Sstevel@tonic-gate /* parent */ 4367c478bd9Sstevel@tonic-gate if (wait(&status) < 0) { 4377c478bd9Sstevel@tonic-gate com_err(progname, errno, 4387c478bd9Sstevel@tonic-gate gettext("while waiting to receive database")); 4397c478bd9Sstevel@tonic-gate exit(1); 4407c478bd9Sstevel@tonic-gate } 4417c478bd9Sstevel@tonic-gate 4427c478bd9Sstevel@tonic-gate close(s); 4437c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 4447c478bd9Sstevel@tonic-gate close(finet); 4457c478bd9Sstevel@tonic-gate 4467c478bd9Sstevel@tonic-gate if ((ret = WEXITSTATUS(status)) != 0) 4477c478bd9Sstevel@tonic-gate return (ret); 4487c478bd9Sstevel@tonic-gate } 4497c478bd9Sstevel@tonic-gate 4507c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 4517c478bd9Sstevel@tonic-gate break; 4527c478bd9Sstevel@tonic-gate } 4537c478bd9Sstevel@tonic-gate 4547c478bd9Sstevel@tonic-gate return (0); 4557c478bd9Sstevel@tonic-gate } 4567c478bd9Sstevel@tonic-gate 4577c478bd9Sstevel@tonic-gate void doit(fd) 4587c478bd9Sstevel@tonic-gate int fd; 4597c478bd9Sstevel@tonic-gate { 4607c478bd9Sstevel@tonic-gate struct sockaddr_storage from; 4617c478bd9Sstevel@tonic-gate socklen_t fromlen; 4627c478bd9Sstevel@tonic-gate int on = 1; 4637c478bd9Sstevel@tonic-gate struct hostent *hp; 4647c478bd9Sstevel@tonic-gate krb5_error_code retval; 4657c478bd9Sstevel@tonic-gate krb5_data confmsg; 4667c478bd9Sstevel@tonic-gate int lock_fd; 46756a424ccSmp mode_t omask; 4687c478bd9Sstevel@tonic-gate krb5_enctype etype; 46956a424ccSmp int database_fd; 4707c478bd9Sstevel@tonic-gate char ntop[NI_MAXHOST] = ""; 4717c478bd9Sstevel@tonic-gate krb5_context doit_context; 4727c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 4737c478bd9Sstevel@tonic-gate 4747c478bd9Sstevel@tonic-gate retval = krb5_init_context(&doit_context); 4757c478bd9Sstevel@tonic-gate if (retval) { 4767c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing krb5")); 4777c478bd9Sstevel@tonic-gate exit(1); 4787c478bd9Sstevel@tonic-gate } 4797c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 4807c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) 4817c478bd9Sstevel@tonic-gate ulog_set_role(doit_context, IPROP_SLAVE); 4827c478bd9Sstevel@tonic-gate 4837c478bd9Sstevel@tonic-gate fromlen = (socklen_t)sizeof (from); 4847c478bd9Sstevel@tonic-gate if (getpeername(fd, (struct sockaddr *) &from, &fromlen) < 0) { 4857c478bd9Sstevel@tonic-gate fprintf(stderr, "%s: ", progname); 4867c478bd9Sstevel@tonic-gate perror(gettext("getpeername")); 4877c478bd9Sstevel@tonic-gate exit(1); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (caddr_t) &on, 4907c478bd9Sstevel@tonic-gate sizeof (on)) < 0) { 4917c478bd9Sstevel@tonic-gate com_err(progname, errno, 4927c478bd9Sstevel@tonic-gate gettext("while attempting setsockopt (SO_KEEPALIVE)")); 4937c478bd9Sstevel@tonic-gate } 4947c478bd9Sstevel@tonic-gate 4957c478bd9Sstevel@tonic-gate if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop), 4967c478bd9Sstevel@tonic-gate NULL, 0, NI_NUMERICHOST) != 0) { 4977c478bd9Sstevel@tonic-gate 4987c478bd9Sstevel@tonic-gate /* getnameifo failed so use inet_ntop() to get printable addresses */ 4997c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET) { 5007c478bd9Sstevel@tonic-gate 5017c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, 5027c478bd9Sstevel@tonic-gate (const void *)&ss2sin(&from)->sin_addr, 5037c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 5047c478bd9Sstevel@tonic-gate 5057c478bd9Sstevel@tonic-gate } else if (from.ss_family == AF_INET6 && 5067c478bd9Sstevel@tonic-gate ! IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 5077c478bd9Sstevel@tonic-gate 5087c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 5097c478bd9Sstevel@tonic-gate 5107c478bd9Sstevel@tonic-gate inet_ntop(AF_INET6, 5117c478bd9Sstevel@tonic-gate (const void *)&ss2sin6(&from)->sin6_addr, ntop, 5127c478bd9Sstevel@tonic-gate sizeof(ntop)); 5137c478bd9Sstevel@tonic-gate } 5147c478bd9Sstevel@tonic-gate /* ipv4 mapped ipv6 addrs handled later */ 5157c478bd9Sstevel@tonic-gate } 5167c478bd9Sstevel@tonic-gate 5177c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET || from.ss_family == AF_INET6) { 5187c478bd9Sstevel@tonic-gate 5197c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET6 && 5207c478bd9Sstevel@tonic-gate IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 5217c478bd9Sstevel@tonic-gate 5227c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 5237c478bd9Sstevel@tonic-gate 5247c478bd9Sstevel@tonic-gate /* coerce ipv4 mapped ipv6 addr to normal ipv4 addr */ 5257c478bd9Sstevel@tonic-gate IN6_V4MAPPED_TO_IPADDR(&(ss2sin6(&from)->sin6_addr), 5267c478bd9Sstevel@tonic-gate v4addr); 5277c478bd9Sstevel@tonic-gate 5287c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, (const void *) &v4addr, 5297c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 5307c478bd9Sstevel@tonic-gate } 5317c478bd9Sstevel@tonic-gate 5327c478bd9Sstevel@tonic-gate syslog(LOG_INFO, gettext("Connection from %s"), ntop); 5337c478bd9Sstevel@tonic-gate 5347c478bd9Sstevel@tonic-gate if (debug) 5357c478bd9Sstevel@tonic-gate printf("Connection from %s\n", ntop); 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate } else { 5387c478bd9Sstevel@tonic-gate /* address family isn't either AF_INET || AF_INET6 */ 5397c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 5407c478bd9Sstevel@tonic-gate gettext("Connection from unknown address family:%d"), 5417c478bd9Sstevel@tonic-gate from.ss_family); 5427c478bd9Sstevel@tonic-gate 5437c478bd9Sstevel@tonic-gate if (debug) { 5447c478bd9Sstevel@tonic-gate printf(gettext("Connection from unknown address family:%d"), 5457c478bd9Sstevel@tonic-gate from.ss_family); 5467c478bd9Sstevel@tonic-gate } 5477c478bd9Sstevel@tonic-gate } 5487c478bd9Sstevel@tonic-gate 5497c478bd9Sstevel@tonic-gate /* 5507c478bd9Sstevel@tonic-gate * Now do the authentication 5517c478bd9Sstevel@tonic-gate */ 5527c478bd9Sstevel@tonic-gate kerberos_authenticate(doit_context, fd, &client, &etype, from); 5537c478bd9Sstevel@tonic-gate 5547c478bd9Sstevel@tonic-gate if (!authorized_principal(doit_context, client, etype)) { 55556a424ccSmp char *name; 5567c478bd9Sstevel@tonic-gate 55756a424ccSmp retval = krb5_unparse_name(doit_context, client, &name); 55856a424ccSmp if (retval) { 5597c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 56056a424ccSmp com_err(progname, retval, 5617c64d375Smp gettext("while unparsing client name")); 56256a424ccSmp exit(1); 56356a424ccSmp } 56456a424ccSmp syslog(LOG_WARNING, 5657c478bd9Sstevel@tonic-gate gettext("Rejected connection from unauthorized principal %s"), 56656a424ccSmp name); 56756a424ccSmp free(name); 56856a424ccSmp exit(1); 5697c478bd9Sstevel@tonic-gate } 5707c478bd9Sstevel@tonic-gate omask = umask(077); 5717c478bd9Sstevel@tonic-gate lock_fd = open(temp_file_name, O_RDWR|O_CREAT, 0600); 5727c478bd9Sstevel@tonic-gate (void) umask(omask); 5737c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, 5747c478bd9Sstevel@tonic-gate KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK); 5757c478bd9Sstevel@tonic-gate if (retval) { 5767c478bd9Sstevel@tonic-gate com_err(progname, retval, 5777c478bd9Sstevel@tonic-gate gettext("while trying to lock '%s'"), 5787c478bd9Sstevel@tonic-gate temp_file_name); 5797c478bd9Sstevel@tonic-gate exit(1); 5807c478bd9Sstevel@tonic-gate } 5817c478bd9Sstevel@tonic-gate if ((database_fd = open(temp_file_name, 5827c478bd9Sstevel@tonic-gate O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) { 5837c478bd9Sstevel@tonic-gate com_err(progname, errno, 5847c478bd9Sstevel@tonic-gate gettext("while opening database file, '%s'"), 5857c478bd9Sstevel@tonic-gate temp_file_name); 5867c478bd9Sstevel@tonic-gate exit(1); 5877c478bd9Sstevel@tonic-gate } 5887c478bd9Sstevel@tonic-gate recv_database(doit_context, fd, database_fd, &confmsg); 5897c478bd9Sstevel@tonic-gate if (rename(temp_file_name, file)) { 5907c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 5917c478bd9Sstevel@tonic-gate com_err(progname, errno, 5927c64d375Smp gettext("while renaming %s to %s"), 5937c478bd9Sstevel@tonic-gate temp_file_name, file); 5947c478bd9Sstevel@tonic-gate exit(1); 5957c478bd9Sstevel@tonic-gate } 5967c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_SHARED); 5977c478bd9Sstevel@tonic-gate if (retval) { 5987c478bd9Sstevel@tonic-gate com_err(progname, retval, 5997c478bd9Sstevel@tonic-gate gettext("while downgrading lock on '%s'"), 6007c478bd9Sstevel@tonic-gate temp_file_name); 6017c478bd9Sstevel@tonic-gate exit(1); 6027c478bd9Sstevel@tonic-gate } 6037c478bd9Sstevel@tonic-gate load_database(doit_context, kdb5_util, file); 6047c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_UNLOCK); 6057c478bd9Sstevel@tonic-gate if (retval) { 6067c478bd9Sstevel@tonic-gate com_err(progname, retval, 6077c478bd9Sstevel@tonic-gate gettext("while unlocking '%s'"), temp_file_name); 6087c478bd9Sstevel@tonic-gate exit(1); 6097c478bd9Sstevel@tonic-gate } 6107c478bd9Sstevel@tonic-gate (void)close(lock_fd); 6117c478bd9Sstevel@tonic-gate 6127c478bd9Sstevel@tonic-gate /* 6137c478bd9Sstevel@tonic-gate * Send the acknowledgement message generated in 6147c478bd9Sstevel@tonic-gate * recv_database, then close the socket. 6157c478bd9Sstevel@tonic-gate */ 61656a424ccSmp retval = krb5_write_message(doit_context, (void *) &fd, &confmsg); 61756a424ccSmp if (retval) { 6187c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 6197c478bd9Sstevel@tonic-gate com_err(progname, retval, 6207c478bd9Sstevel@tonic-gate gettext("while sending # of received bytes")); 6217c478bd9Sstevel@tonic-gate exit(1); 6227c478bd9Sstevel@tonic-gate } 6237c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 6247c478bd9Sstevel@tonic-gate if (close(fd) < 0) { 6257c478bd9Sstevel@tonic-gate com_err(progname, errno, 6267c478bd9Sstevel@tonic-gate gettext("while trying to close database file")); 6277c478bd9Sstevel@tonic-gate exit(1); 6287c478bd9Sstevel@tonic-gate } 62956a424ccSmp 6307c478bd9Sstevel@tonic-gate exit(0); 6317c478bd9Sstevel@tonic-gate } 6327c478bd9Sstevel@tonic-gate 6337c478bd9Sstevel@tonic-gate 6347c478bd9Sstevel@tonic-gate /* 6357c478bd9Sstevel@tonic-gate * Routine to handle incremental update transfer(s) from master KDC 6367c478bd9Sstevel@tonic-gate */ 6377c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx) { 6387c478bd9Sstevel@tonic-gate CLIENT *cl; 6397c478bd9Sstevel@tonic-gate kadm5_ret_t retval; 6407c478bd9Sstevel@tonic-gate kadm5_config_params params; 6417c478bd9Sstevel@tonic-gate krb5_ccache cc; 6427c478bd9Sstevel@tonic-gate krb5_principal iprop_svc_principal; 6437c478bd9Sstevel@tonic-gate void *server_handle = NULL; 6447c478bd9Sstevel@tonic-gate char *iprop_svc_princstr = NULL; 6457c478bd9Sstevel@tonic-gate char *master_svc_princstr = NULL; 6467c478bd9Sstevel@tonic-gate char *admin_server = NULL; 6477c478bd9Sstevel@tonic-gate char *keytab_name = NULL; 6487c478bd9Sstevel@tonic-gate unsigned int pollin, backoff_time; 6497c478bd9Sstevel@tonic-gate int backoff_cnt = 0; 6507c478bd9Sstevel@tonic-gate int reinit_cnt = 0; 6517c478bd9Sstevel@tonic-gate int ret; 6527c478bd9Sstevel@tonic-gate boolean_t frdone = B_FALSE; 6537c478bd9Sstevel@tonic-gate 6547c478bd9Sstevel@tonic-gate kdb_incr_result_t *incr_ret; 6557c478bd9Sstevel@tonic-gate static kdb_last_t mylast; 6567c478bd9Sstevel@tonic-gate 6577c478bd9Sstevel@tonic-gate kdb_fullresync_result_t *full_ret; 6587c478bd9Sstevel@tonic-gate char *full_resync_arg = NULL; 6597c478bd9Sstevel@tonic-gate 6607c478bd9Sstevel@tonic-gate kadm5_iprop_handle_t handle; 6617c478bd9Sstevel@tonic-gate kdb_hlog_t *ulog; 6627c478bd9Sstevel@tonic-gate 6637c64d375Smp krb5_keytab kt; 6647c64d375Smp krb5_keytab_entry entry; 6657c64d375Smp char kt_name[MAX_KEYTAB_NAME_LEN]; 6667c64d375Smp 6677c64d375Smp /* 6687c64d375Smp * Solaris Kerberos: 6697c64d375Smp * Delay daemonizing until some basic configuration checks have been 6707c64d375Smp * performed 6717c64d375Smp */ 6727c64d375Smp #if 0 6737c478bd9Sstevel@tonic-gate if (!debug) 6747c478bd9Sstevel@tonic-gate daemon(0, 0); 6757c64d375Smp #endif 6767c478bd9Sstevel@tonic-gate pollin = (unsigned int)0; 6777c478bd9Sstevel@tonic-gate (void) memset((char *)¶ms, 0, sizeof (params)); 6787c478bd9Sstevel@tonic-gate ulog = log_ctx->ulog; 6797c478bd9Sstevel@tonic-gate 6807c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 6817c478bd9Sstevel@tonic-gate params.realm = def_realm; 6827c478bd9Sstevel@tonic-gate 6837c478bd9Sstevel@tonic-gate if (master_svc_princstr == NULL) { 6847c478bd9Sstevel@tonic-gate if (retval = kadm5_get_kiprop_host_srv_name(kpropd_context, 6857c478bd9Sstevel@tonic-gate def_realm, &master_svc_princstr)) { 6867c64d375Smp /* Solaris Kerberos: keep error messages consistent */ 6877c478bd9Sstevel@tonic-gate com_err(progname, retval, 6887c64d375Smp gettext("while getting kiprop host based " 6897c64d375Smp "service name for realm %s"), def_realm); 6907c478bd9Sstevel@tonic-gate exit(1); 6917c478bd9Sstevel@tonic-gate } 6927c478bd9Sstevel@tonic-gate } 6937c478bd9Sstevel@tonic-gate 6947c478bd9Sstevel@tonic-gate /* 6957c478bd9Sstevel@tonic-gate * Set cc to the default credentials cache 6967c478bd9Sstevel@tonic-gate */ 6977c478bd9Sstevel@tonic-gate if (retval = krb5_cc_default(kpropd_context, &cc)) { 6987c478bd9Sstevel@tonic-gate com_err(progname, retval, 6997c478bd9Sstevel@tonic-gate gettext("while opening default " 7007c478bd9Sstevel@tonic-gate "credentials cache")); 7017c478bd9Sstevel@tonic-gate exit(1); 7027c478bd9Sstevel@tonic-gate } 7037c478bd9Sstevel@tonic-gate 7047c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, NULL, KIPROP_SVC_NAME, 7057c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &iprop_svc_principal); 7067c478bd9Sstevel@tonic-gate if (retval) { 7077c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to construct " 7087c478bd9Sstevel@tonic-gate "host service principal")); 7097c478bd9Sstevel@tonic-gate exit(1); 7107c478bd9Sstevel@tonic-gate } 7117c478bd9Sstevel@tonic-gate 712*159d09a2SMark Phalan /* Solaris Kerberos */ 713*159d09a2SMark Phalan if (krb5_is_referral_realm(krb5_princ_realm(kpropd_context, 714*159d09a2SMark Phalan iprop_svc_principal))) { 715*159d09a2SMark Phalan krb5_data *r = krb5_princ_realm(kpropd_context, 716*159d09a2SMark Phalan iprop_svc_principal); 717*159d09a2SMark Phalan assert(def_realm != NULL); 718*159d09a2SMark Phalan r->length = strlen(def_realm); 719*159d09a2SMark Phalan r->data = strdup(def_realm); 720*159d09a2SMark Phalan if (r->data == NULL) { 721*159d09a2SMark Phalan com_err(progname, retval, 722*159d09a2SMark Phalan ("while determining local service principal name")); 723*159d09a2SMark Phalan exit(1); 724*159d09a2SMark Phalan } 725*159d09a2SMark Phalan } 726*159d09a2SMark Phalan 7277c478bd9Sstevel@tonic-gate if (retval = krb5_unparse_name(kpropd_context, iprop_svc_principal, 7287c478bd9Sstevel@tonic-gate &iprop_svc_princstr)) { 7297c478bd9Sstevel@tonic-gate com_err(progname, retval, 7307c478bd9Sstevel@tonic-gate gettext("while canonicalizing " 7317c478bd9Sstevel@tonic-gate "principal name")); 7327c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 7337c478bd9Sstevel@tonic-gate exit(1); 7347c478bd9Sstevel@tonic-gate } 7357c64d375Smp 7367c64d375Smp /* 7377c64d375Smp * Solaris Kerberos: 7387c64d375Smp * Check to see if kiprop/<fqdn>@REALM is in the keytab 7397c64d375Smp */ 7407c64d375Smp kt_name[0] = '\0'; 7417c64d375Smp if (retval = krb5_kt_default_name(kpropd_context, kt_name, 7427c64d375Smp MAX_KEYTAB_NAME_LEN)){ 7437c64d375Smp com_err(progname, retval, gettext ("while resolving the " 7447c64d375Smp "name of the default keytab")); 7457c64d375Smp } 7467c64d375Smp 7477c64d375Smp if (retval = krb5_kt_default(kpropd_context, &kt)) { 7487c64d375Smp com_err(progname, retval, gettext ("while resolving default " 7497c64d375Smp "keytab")); 7507c64d375Smp krb5_free_principal(kpropd_context, iprop_svc_principal); 7517c64d375Smp exit(1); 7527c64d375Smp } 7537c64d375Smp 7547c64d375Smp if (retval = krb5_kt_get_entry(kpropd_context, kt, iprop_svc_principal, 7557c64d375Smp 0, 0, &entry)) { 7567c64d375Smp com_err(progname, retval, gettext("while retrieving entry %s " 7577c64d375Smp "from %s"), iprop_svc_princstr, 7587c64d375Smp kt_name[0] ? kt_name : "default keytab"); 7597c64d375Smp krb5_kt_close(kpropd_context,kt); 7607c64d375Smp krb5_free_principal(kpropd_context, iprop_svc_principal); 7617c64d375Smp exit(1); 7627c64d375Smp } 7637c64d375Smp 7647c64d375Smp krb5_kt_close(kpropd_context,kt); 7657c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 7667c478bd9Sstevel@tonic-gate 7677c64d375Smp if (!debug) { 7687c64d375Smp /* Solaris Kerberos: Indicate where further messages will be sent */ 7697c64d375Smp fprintf(stderr, gettext("%s: Logging to SYSLOG\n"), progname); 7707c64d375Smp if (daemon(0, 0)) { 7717c64d375Smp com_err(progname, errno, gettext("while daemonizing")); 7727c64d375Smp exit(1); 7737c64d375Smp } 7747c64d375Smp rem_default_com_err_hook(); 7757c64d375Smp } 7767c64d375Smp 7777c478bd9Sstevel@tonic-gate reinit: 7787c478bd9Sstevel@tonic-gate /* 7797c478bd9Sstevel@tonic-gate * Authentication, initialize rpcsec_gss handle etc. 7807c478bd9Sstevel@tonic-gate */ 7817c478bd9Sstevel@tonic-gate retval = kadm5_init_with_skey(iprop_svc_princstr, keytab_name, 7827c478bd9Sstevel@tonic-gate master_svc_princstr, 7837c478bd9Sstevel@tonic-gate ¶ms, 7847c478bd9Sstevel@tonic-gate KADM5_STRUCT_VERSION, 7857c478bd9Sstevel@tonic-gate KADM5_API_VERSION_2, 78654925bf6Swillf NULL, 7877c478bd9Sstevel@tonic-gate &server_handle); 7887c478bd9Sstevel@tonic-gate 7897c478bd9Sstevel@tonic-gate if (retval) { 7907c478bd9Sstevel@tonic-gate if (retval == KADM5_RPC_ERROR) { 7917c478bd9Sstevel@tonic-gate reinit_cnt++; 7927c478bd9Sstevel@tonic-gate if (server_handle) 7937c478bd9Sstevel@tonic-gate kadm5_destroy((void *) server_handle); 7947c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 7957c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 7967c478bd9Sstevel@tonic-gate 7977c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext( 7987c478bd9Sstevel@tonic-gate "while attempting to connect" 7997c478bd9Sstevel@tonic-gate " to master KDC ... retrying")); 8007c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&reinit_cnt); 8017c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 8027c478bd9Sstevel@tonic-gate goto reinit; 8037c478bd9Sstevel@tonic-gate } else { 8047c64d375Smp /* Solaris Kerberos: Be more verbose */ 8057c478bd9Sstevel@tonic-gate com_err(progname, retval, 8067c64d375Smp gettext("while initializing %s interface for " 8077c64d375Smp "%s"), progname, iprop_svc_princstr); 8087c478bd9Sstevel@tonic-gate if (retval == KADM5_BAD_CLIENT_PARAMS || 8097c478bd9Sstevel@tonic-gate retval == KADM5_BAD_SERVER_PARAMS) 8107c478bd9Sstevel@tonic-gate usage(); 8117c478bd9Sstevel@tonic-gate exit(1); 8127c478bd9Sstevel@tonic-gate } 8137c478bd9Sstevel@tonic-gate } 8147c478bd9Sstevel@tonic-gate 8157c478bd9Sstevel@tonic-gate /* 8167c478bd9Sstevel@tonic-gate * Reset re-initialization count to zero now. 8177c478bd9Sstevel@tonic-gate */ 8187c478bd9Sstevel@tonic-gate reinit_cnt = backoff_time = 0; 8197c478bd9Sstevel@tonic-gate 8207c478bd9Sstevel@tonic-gate /* 8217c478bd9Sstevel@tonic-gate * Reset the handle to the correct type for the RPC call 8227c478bd9Sstevel@tonic-gate */ 8237c478bd9Sstevel@tonic-gate handle = server_handle; 8247c478bd9Sstevel@tonic-gate 8257c478bd9Sstevel@tonic-gate /* 8267c478bd9Sstevel@tonic-gate * If we have reached this far, we have succesfully established 8277c478bd9Sstevel@tonic-gate * a RPCSEC_GSS connection; we now start polling for updates 8287c478bd9Sstevel@tonic-gate */ 8297c478bd9Sstevel@tonic-gate if (poll_time == NULL) { 8307c478bd9Sstevel@tonic-gate if ((poll_time = (char *)strdup("2m")) == NULL) { 8317c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 8327c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 8337c64d375Smp gettext("while allocating poll_time")); 8347c478bd9Sstevel@tonic-gate exit(1); 8357c478bd9Sstevel@tonic-gate } 8367c478bd9Sstevel@tonic-gate } 8377c478bd9Sstevel@tonic-gate 8387c478bd9Sstevel@tonic-gate if (pollin == (unsigned int)0) 8397c478bd9Sstevel@tonic-gate pollin = convert_polltime(poll_time); 8407c478bd9Sstevel@tonic-gate 8417c478bd9Sstevel@tonic-gate for (;;) { 8427c478bd9Sstevel@tonic-gate incr_ret = NULL; 8437c478bd9Sstevel@tonic-gate full_ret = NULL; 8447c478bd9Sstevel@tonic-gate 8457c478bd9Sstevel@tonic-gate /* 8467c478bd9Sstevel@tonic-gate * Get the most recent ulog entry sno + ts, which 8477c478bd9Sstevel@tonic-gate * we package in the request to the master KDC 8487c478bd9Sstevel@tonic-gate */ 8497c478bd9Sstevel@tonic-gate mylast.last_sno = ulog->kdb_last_sno; 8507c478bd9Sstevel@tonic-gate mylast.last_time = ulog->kdb_last_time; 8517c478bd9Sstevel@tonic-gate 8527c478bd9Sstevel@tonic-gate /* 8537c478bd9Sstevel@tonic-gate * Loop continuously on an iprop_get_updates_1(), 8547c478bd9Sstevel@tonic-gate * so that we can keep probing the master for updates 8557c478bd9Sstevel@tonic-gate * or (if needed) do a full resync of the krb5 db. 8567c478bd9Sstevel@tonic-gate */ 8577c478bd9Sstevel@tonic-gate 8587c478bd9Sstevel@tonic-gate incr_ret = iprop_get_updates_1(&mylast, handle->clnt); 8597c478bd9Sstevel@tonic-gate if (incr_ret == (kdb_incr_result_t *)NULL) { 8607c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 8617c478bd9Sstevel@tonic-gate "iprop_get_updates call failed"); 8627c478bd9Sstevel@tonic-gate if (server_handle) 8637c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 8647c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 8657c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 8667c478bd9Sstevel@tonic-gate goto reinit; 8677c478bd9Sstevel@tonic-gate } 8687c478bd9Sstevel@tonic-gate 8697c478bd9Sstevel@tonic-gate switch (incr_ret->ret) { 8707c478bd9Sstevel@tonic-gate 8717c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 8727c478bd9Sstevel@tonic-gate /* 8737c478bd9Sstevel@tonic-gate * We dont do a full resync again, if the last 8747c478bd9Sstevel@tonic-gate * X'fer was a resync and if the master sno is 8757c478bd9Sstevel@tonic-gate * still "0", i.e. no updates so far. 8767c478bd9Sstevel@tonic-gate */ 8777c478bd9Sstevel@tonic-gate if ((frdone == B_TRUE) && (incr_ret->lastentry.last_sno 8787c478bd9Sstevel@tonic-gate == 0)) { 8797c478bd9Sstevel@tonic-gate break; 8807c478bd9Sstevel@tonic-gate } else { 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate full_ret = iprop_full_resync_1((void *) 8837c478bd9Sstevel@tonic-gate &full_resync_arg, handle->clnt); 8847c478bd9Sstevel@tonic-gate 8857c478bd9Sstevel@tonic-gate if (full_ret == (kdb_fullresync_result_t *) 8867c478bd9Sstevel@tonic-gate NULL) { 8877c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 8887c478bd9Sstevel@tonic-gate "iprop_full_resync call failed"); 8897c478bd9Sstevel@tonic-gate if (server_handle) 8907c478bd9Sstevel@tonic-gate kadm5_destroy((void *) 8917c478bd9Sstevel@tonic-gate server_handle); 8927c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 8937c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 8947c478bd9Sstevel@tonic-gate goto reinit; 8957c478bd9Sstevel@tonic-gate } 8967c478bd9Sstevel@tonic-gate } 8977c478bd9Sstevel@tonic-gate 8987c478bd9Sstevel@tonic-gate switch (full_ret->ret) { 8997c478bd9Sstevel@tonic-gate case UPDATE_OK: 9007c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9017c478bd9Sstevel@tonic-gate /* 9027c478bd9Sstevel@tonic-gate * We now listen on the kprop port for 9037c478bd9Sstevel@tonic-gate * the full dump 9047c478bd9Sstevel@tonic-gate */ 9057c478bd9Sstevel@tonic-gate ret = do_standalone(log_ctx->iproprole); 9067c478bd9Sstevel@tonic-gate if (ret) 9077c478bd9Sstevel@tonic-gate syslog(LOG_WARNING, 9087c478bd9Sstevel@tonic-gate gettext("kpropd: Full resync, " 9097c478bd9Sstevel@tonic-gate "invalid return.")); 9107c478bd9Sstevel@tonic-gate if (debug) 9117c478bd9Sstevel@tonic-gate if (ret) 9127c478bd9Sstevel@tonic-gate fprintf(stderr, 9137c478bd9Sstevel@tonic-gate gettext("Full resync " 9147c478bd9Sstevel@tonic-gate "was unsuccessful\n")); 9157c478bd9Sstevel@tonic-gate else 9167c478bd9Sstevel@tonic-gate fprintf(stderr, 9177c478bd9Sstevel@tonic-gate gettext("Full resync " 9187c478bd9Sstevel@tonic-gate "was successful\n")); 9197c478bd9Sstevel@tonic-gate frdone = B_TRUE; 9207c478bd9Sstevel@tonic-gate break; 9217c478bd9Sstevel@tonic-gate 9227c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 9237c478bd9Sstevel@tonic-gate /* 9247c478bd9Sstevel@tonic-gate * Exponential backoff 9257c478bd9Sstevel@tonic-gate */ 9267c478bd9Sstevel@tonic-gate backoff_cnt++; 9277c478bd9Sstevel@tonic-gate break; 9287c478bd9Sstevel@tonic-gate 9297c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 9307c478bd9Sstevel@tonic-gate case UPDATE_NIL: 9317c478bd9Sstevel@tonic-gate default: 9327c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9337c478bd9Sstevel@tonic-gate frdone = B_FALSE; 9347c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9357c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 9367c478bd9Sstevel@tonic-gate break; 9377c478bd9Sstevel@tonic-gate 9387c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 9397c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9407c478bd9Sstevel@tonic-gate " permission denied.")); 9417c478bd9Sstevel@tonic-gate goto error; 9427c478bd9Sstevel@tonic-gate 9437c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 9447c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9457c478bd9Sstevel@tonic-gate " error returned from master KDC.")); 9467c478bd9Sstevel@tonic-gate goto error; 9477c478bd9Sstevel@tonic-gate } 9487c478bd9Sstevel@tonic-gate break; 9497c478bd9Sstevel@tonic-gate 9507c478bd9Sstevel@tonic-gate case UPDATE_OK: 9517c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9527c478bd9Sstevel@tonic-gate frdone = B_FALSE; 9537c478bd9Sstevel@tonic-gate 9547c478bd9Sstevel@tonic-gate /* 9557c478bd9Sstevel@tonic-gate * ulog_replay() will convert the ulog updates to db 9567c478bd9Sstevel@tonic-gate * entries using the kdb conv api and will commit 9577c478bd9Sstevel@tonic-gate * the entries to the slave kdc database 9587c478bd9Sstevel@tonic-gate */ 9597c478bd9Sstevel@tonic-gate retval = ulog_replay(kpropd_context, incr_ret); 9607c478bd9Sstevel@tonic-gate 9617c478bd9Sstevel@tonic-gate if (retval) { 9627c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ulog_replay" 9637c478bd9Sstevel@tonic-gate " failed, updates not registered.")); 9647c478bd9Sstevel@tonic-gate break; 9657c478bd9Sstevel@tonic-gate } 9667c478bd9Sstevel@tonic-gate 9677c478bd9Sstevel@tonic-gate if (debug) 9687c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Update transfer " 9697c478bd9Sstevel@tonic-gate "from master was OK\n")); 9707c478bd9Sstevel@tonic-gate break; 9717c478bd9Sstevel@tonic-gate 9727c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 9737c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 9747c478bd9Sstevel@tonic-gate " permission denied.")); 9757c478bd9Sstevel@tonic-gate goto error; 9767c478bd9Sstevel@tonic-gate 9777c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 9787c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates, error " 9797c478bd9Sstevel@tonic-gate "returned from master KDC.")); 9807c478bd9Sstevel@tonic-gate goto error; 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 9837c478bd9Sstevel@tonic-gate /* 9847c478bd9Sstevel@tonic-gate * Exponential backoff 9857c478bd9Sstevel@tonic-gate */ 9867c478bd9Sstevel@tonic-gate backoff_cnt++; 9877c478bd9Sstevel@tonic-gate break; 9887c478bd9Sstevel@tonic-gate 9897c478bd9Sstevel@tonic-gate case UPDATE_NIL: 9907c478bd9Sstevel@tonic-gate /* 9917c478bd9Sstevel@tonic-gate * Master-slave are in sync 9927c478bd9Sstevel@tonic-gate */ 9937c478bd9Sstevel@tonic-gate if (debug) 9947c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Master, slave KDC's " 9957c478bd9Sstevel@tonic-gate "are in-sync, no updates\n")); 9967c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9977c478bd9Sstevel@tonic-gate frdone = B_FALSE; 9987c478bd9Sstevel@tonic-gate break; 9997c478bd9Sstevel@tonic-gate 10007c478bd9Sstevel@tonic-gate default: 10017c478bd9Sstevel@tonic-gate backoff_cnt = 0; 10027c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 10037c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 10047c478bd9Sstevel@tonic-gate break; 10057c478bd9Sstevel@tonic-gate } 10067c478bd9Sstevel@tonic-gate 10077c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 10087c478bd9Sstevel@tonic-gate goto done; 10097c478bd9Sstevel@tonic-gate 10107c478bd9Sstevel@tonic-gate /* 10117c478bd9Sstevel@tonic-gate * Sleep for the specified poll interval (Default is 2 mts), 10127c478bd9Sstevel@tonic-gate * or do a binary exponential backoff if we get an 10137c478bd9Sstevel@tonic-gate * UPDATE_BUSY signal 10147c478bd9Sstevel@tonic-gate */ 10157c478bd9Sstevel@tonic-gate if (backoff_cnt > 0) { 10167c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&backoff_cnt); 10177c478bd9Sstevel@tonic-gate if (debug) 10187c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Busy signal received " 10197c478bd9Sstevel@tonic-gate "from master, backoff for %d secs\n"), 10207c478bd9Sstevel@tonic-gate backoff_time); 10217c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 10227c478bd9Sstevel@tonic-gate } 10237c478bd9Sstevel@tonic-gate else 10247c478bd9Sstevel@tonic-gate (void) sleep(pollin); 10257c478bd9Sstevel@tonic-gate 10267c478bd9Sstevel@tonic-gate } 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate 10297c478bd9Sstevel@tonic-gate error: 10307c478bd9Sstevel@tonic-gate if (debug) 10317c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("ERROR returned by master, bailing\n")); 10327c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ERROR returned by master KDC," 10337c478bd9Sstevel@tonic-gate " bailing.\n")); 10347c478bd9Sstevel@tonic-gate done: 10357c478bd9Sstevel@tonic-gate if (poll_time) 10367c478bd9Sstevel@tonic-gate free(poll_time); 10377c478bd9Sstevel@tonic-gate if(iprop_svc_princstr) 10387c478bd9Sstevel@tonic-gate free(iprop_svc_princstr); 10397c478bd9Sstevel@tonic-gate if (master_svc_princstr) 10407c478bd9Sstevel@tonic-gate free(master_svc_princstr); 10417c478bd9Sstevel@tonic-gate if (retval = krb5_cc_close(kpropd_context, cc)) { 10427c478bd9Sstevel@tonic-gate com_err(progname, retval, 10437c478bd9Sstevel@tonic-gate gettext("while closing default ccache")); 10447c478bd9Sstevel@tonic-gate exit(1); 10457c478bd9Sstevel@tonic-gate } 10467c478bd9Sstevel@tonic-gate if (def_realm) 10477c478bd9Sstevel@tonic-gate free(def_realm); 10487c478bd9Sstevel@tonic-gate if (server_handle) 10497c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 10507c478bd9Sstevel@tonic-gate if (kpropd_context) 10517c478bd9Sstevel@tonic-gate krb5_free_context(kpropd_context); 10527c478bd9Sstevel@tonic-gate 10537c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 10547c478bd9Sstevel@tonic-gate return (0); 10557c478bd9Sstevel@tonic-gate else 10567c478bd9Sstevel@tonic-gate exit(1); 10577c478bd9Sstevel@tonic-gate } 10587c478bd9Sstevel@tonic-gate 10597c478bd9Sstevel@tonic-gate 10607c478bd9Sstevel@tonic-gate /* 10617c478bd9Sstevel@tonic-gate * Do exponential backoff, since master KDC is BUSY or down 10627c478bd9Sstevel@tonic-gate */ 10637c478bd9Sstevel@tonic-gate unsigned int backoff_from_master(int *cnt) { 10647c478bd9Sstevel@tonic-gate unsigned int btime; 10657c478bd9Sstevel@tonic-gate 10667c478bd9Sstevel@tonic-gate btime = (unsigned int)(2<<(*cnt)); 10677c478bd9Sstevel@tonic-gate if (btime > MAX_BACKOFF) { 10687c478bd9Sstevel@tonic-gate btime = MAX_BACKOFF; 10697c478bd9Sstevel@tonic-gate *cnt--; 10707c478bd9Sstevel@tonic-gate } 10717c478bd9Sstevel@tonic-gate 10727c478bd9Sstevel@tonic-gate return (btime); 10737c478bd9Sstevel@tonic-gate } 10747c478bd9Sstevel@tonic-gate 10757c478bd9Sstevel@tonic-gate 10767c478bd9Sstevel@tonic-gate /* 10777c478bd9Sstevel@tonic-gate * Routine to convert the `pollstr' string to seconds 10787c478bd9Sstevel@tonic-gate */ 10797c478bd9Sstevel@tonic-gate int convert_polltime(char *pollstr) { 10807c478bd9Sstevel@tonic-gate char *tokenptr = NULL; 10817c478bd9Sstevel@tonic-gate int len, polltime; 10827c478bd9Sstevel@tonic-gate 10837c478bd9Sstevel@tonic-gate len = polltime = 0; 10847c478bd9Sstevel@tonic-gate 10857c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "s")) < strlen(pollstr)) { 10867c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 10877c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 10887c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr); 10897c478bd9Sstevel@tonic-gate } 10907c478bd9Sstevel@tonic-gate 10917c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "m")) < strlen(pollstr)) { 10927c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 10937c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 10947c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 60; 10957c478bd9Sstevel@tonic-gate } 10967c478bd9Sstevel@tonic-gate 10977c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "h")) < strlen(pollstr)) { 10987c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 10997c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 11007c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 3600; 11017c478bd9Sstevel@tonic-gate } 11027c478bd9Sstevel@tonic-gate 11037c478bd9Sstevel@tonic-gate if (tokenptr != NULL) 11047c478bd9Sstevel@tonic-gate free(tokenptr); 11057c478bd9Sstevel@tonic-gate /* 11067c478bd9Sstevel@tonic-gate * If we have a bogus pollstr value, set polltime to the 11077c478bd9Sstevel@tonic-gate * default of 2 mts (120 seconds). 11087c478bd9Sstevel@tonic-gate */ 11097c478bd9Sstevel@tonic-gate if (polltime == 0) 11107c478bd9Sstevel@tonic-gate polltime = 120; 11117c478bd9Sstevel@tonic-gate return (polltime); 11127c478bd9Sstevel@tonic-gate } 11137c478bd9Sstevel@tonic-gate 11147c478bd9Sstevel@tonic-gate static void 11157c478bd9Sstevel@tonic-gate kpropd_com_err_proc(whoami, code, fmt, args) 11167c478bd9Sstevel@tonic-gate const char *whoami; 11177c478bd9Sstevel@tonic-gate long code; 11187c478bd9Sstevel@tonic-gate const char *fmt; 11197c478bd9Sstevel@tonic-gate va_list args; 11207c478bd9Sstevel@tonic-gate { 11217c478bd9Sstevel@tonic-gate char error_buf[8096]; 11227c478bd9Sstevel@tonic-gate 11237c478bd9Sstevel@tonic-gate error_buf[0] = '\0'; 11247c478bd9Sstevel@tonic-gate if (fmt) 11257c478bd9Sstevel@tonic-gate vsprintf(error_buf, fmt, args); 11267c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "%s%s%s%s%s", whoami ? whoami : "", whoami ? ": " : "", 11277c478bd9Sstevel@tonic-gate code ? error_message(code) : "", code ? " " : "", error_buf); 11287c478bd9Sstevel@tonic-gate } 11297c478bd9Sstevel@tonic-gate 11307c478bd9Sstevel@tonic-gate void PRS(argc,argv) 11317c478bd9Sstevel@tonic-gate int argc; 11327c478bd9Sstevel@tonic-gate char **argv; 11337c478bd9Sstevel@tonic-gate { 11347c478bd9Sstevel@tonic-gate register char *word, ch; 11357c478bd9Sstevel@tonic-gate char *cp; 11367c478bd9Sstevel@tonic-gate int c; 11377c478bd9Sstevel@tonic-gate struct hostent *hp; 11387c478bd9Sstevel@tonic-gate char my_host_name[MAXHOSTNAMELEN], buf[BUFSIZ]; 11397c478bd9Sstevel@tonic-gate krb5_error_code retval; 11407c478bd9Sstevel@tonic-gate static const char tmp[] = ".temp"; 11417c478bd9Sstevel@tonic-gate kadm5_config_params params; 11427c478bd9Sstevel@tonic-gate 11437c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 11447c478bd9Sstevel@tonic-gate 11457c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 11467c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KPROPD_TEST" /* Use this only if it weren't */ 11477c478bd9Sstevel@tonic-gate #endif 11487c478bd9Sstevel@tonic-gate 11497c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 11507c478bd9Sstevel@tonic-gate 11517c478bd9Sstevel@tonic-gate (void) memset((char *) ¶ms, 0, sizeof (params)); 11527c478bd9Sstevel@tonic-gate 11537c478bd9Sstevel@tonic-gate retval = krb5_init_context(&kpropd_context); 11547c478bd9Sstevel@tonic-gate if (retval) { 11557c478bd9Sstevel@tonic-gate com_err(argv[0], retval, 11567c478bd9Sstevel@tonic-gate gettext("while initializing krb5")); 11577c478bd9Sstevel@tonic-gate exit(1); 11587c478bd9Sstevel@tonic-gate } 11597c64d375Smp 11607c64d375Smp /* Solaris Kerberos: Sanitize progname */ 11617c64d375Smp progname = basename(argv[0]); 11627c64d375Smp 11637c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, "dtf:F:p:P:r:s:Sa:")) != EOF){ 11647c478bd9Sstevel@tonic-gate switch (c) { 11657c478bd9Sstevel@tonic-gate case 'd': 11667c478bd9Sstevel@tonic-gate debug++; 11677c478bd9Sstevel@tonic-gate break; 11687c478bd9Sstevel@tonic-gate case 't': 11697c478bd9Sstevel@tonic-gate /* 11707c478bd9Sstevel@tonic-gate * Undocumented option - for testing only. 11717c478bd9Sstevel@tonic-gate * 11727c478bd9Sstevel@tonic-gate * Option to run the kpropd server exactly 11737c478bd9Sstevel@tonic-gate * once (this is true only if iprop is enabled). 11747c478bd9Sstevel@tonic-gate */ 11757c478bd9Sstevel@tonic-gate runonce = B_TRUE; 11767c478bd9Sstevel@tonic-gate break; 11777c478bd9Sstevel@tonic-gate 11787c478bd9Sstevel@tonic-gate case 'f': 11797c478bd9Sstevel@tonic-gate file = optarg; 11807c478bd9Sstevel@tonic-gate if (!file) 11817c478bd9Sstevel@tonic-gate usage(); 11827c478bd9Sstevel@tonic-gate break; 11837c478bd9Sstevel@tonic-gate case 'F': 11847c478bd9Sstevel@tonic-gate kerb_database = optarg; 11857c478bd9Sstevel@tonic-gate if (!kerb_database) 11867c478bd9Sstevel@tonic-gate usage(); 11877c478bd9Sstevel@tonic-gate break; 11887c478bd9Sstevel@tonic-gate case 'p': 11897c478bd9Sstevel@tonic-gate kdb5_util = optarg; 11907c478bd9Sstevel@tonic-gate if (!kdb5_util) 11917c478bd9Sstevel@tonic-gate usage(); 11927c478bd9Sstevel@tonic-gate break; 11937c478bd9Sstevel@tonic-gate case 'P': 11947c478bd9Sstevel@tonic-gate port = htons(atoi(optarg)); 11957c478bd9Sstevel@tonic-gate if (!port) 11967c478bd9Sstevel@tonic-gate usage(); 11977c478bd9Sstevel@tonic-gate break; 11987c478bd9Sstevel@tonic-gate case 'r': 11997c478bd9Sstevel@tonic-gate realm = optarg; 12007c478bd9Sstevel@tonic-gate if (!realm) 12017c478bd9Sstevel@tonic-gate usage(); 12027c478bd9Sstevel@tonic-gate params.realm = realm; 12037c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 12047c478bd9Sstevel@tonic-gate break; 12057c478bd9Sstevel@tonic-gate case 's': 12067c478bd9Sstevel@tonic-gate srvtab = optarg; 12077c478bd9Sstevel@tonic-gate if (!srvtab) 12087c478bd9Sstevel@tonic-gate usage(); 12097c478bd9Sstevel@tonic-gate break; 12107c478bd9Sstevel@tonic-gate case 'S': 12117c478bd9Sstevel@tonic-gate standalone++; 12127c478bd9Sstevel@tonic-gate break; 12137c478bd9Sstevel@tonic-gate case 'a': 12147c478bd9Sstevel@tonic-gate acl_file_name = optarg; 12157c478bd9Sstevel@tonic-gate if (!acl_file_name) 12167c478bd9Sstevel@tonic-gate usage(); 12177c478bd9Sstevel@tonic-gate break; 12187c478bd9Sstevel@tonic-gate case '?': 12197c478bd9Sstevel@tonic-gate default: 12207c478bd9Sstevel@tonic-gate usage(); 12217c478bd9Sstevel@tonic-gate } 12227c478bd9Sstevel@tonic-gate 12237c478bd9Sstevel@tonic-gate } 12247c478bd9Sstevel@tonic-gate /* 12257c478bd9Sstevel@tonic-gate * If not in debug mode, switch com_err reporting to syslog 12267c478bd9Sstevel@tonic-gate */ 12277c478bd9Sstevel@tonic-gate if (! debug) { 12287c478bd9Sstevel@tonic-gate openlog("kpropd", LOG_PID | LOG_ODELAY, SYSLOG_CLASS); 12297c64d375Smp /* 12307c64d375Smp * Solaris Kerberos: 12317c64d375Smp * Don't replace default logging. Add a new logging channel. 12327c64d375Smp * Stop logging to stderr when daemonizing 12337c64d375Smp */ 12347c64d375Smp add_com_err_hook(kpropd_com_err_proc); 12357c478bd9Sstevel@tonic-gate } 12367c478bd9Sstevel@tonic-gate /* 12377c478bd9Sstevel@tonic-gate * Get my hostname, so we can construct my service name 12387c478bd9Sstevel@tonic-gate */ 12397c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, 12407c478bd9Sstevel@tonic-gate NULL, KPROP_SERVICE_NAME, 12417c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &server); 12427c478bd9Sstevel@tonic-gate if (retval) { 12437c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12447c478bd9Sstevel@tonic-gate com_err(progname, retval, 12457c64d375Smp gettext("while trying to construct my service name")); 12467c478bd9Sstevel@tonic-gate exit(1); 12477c478bd9Sstevel@tonic-gate } 12487c478bd9Sstevel@tonic-gate if (realm) { 124956a424ccSmp retval = krb5_set_principal_realm(kpropd_context, server, realm); 125056a424ccSmp if (retval) { 125156a424ccSmp com_err(progname, errno, 125256a424ccSmp gettext("while constructing my service realm")); 125356a424ccSmp exit(1); 125456a424ccSmp } 12557c478bd9Sstevel@tonic-gate } 12567c478bd9Sstevel@tonic-gate /* 12577c478bd9Sstevel@tonic-gate * Construct the name of the temporary file. 12587c478bd9Sstevel@tonic-gate */ 12597c478bd9Sstevel@tonic-gate if ((temp_file_name = (char *) malloc(strlen(file) + 12607c478bd9Sstevel@tonic-gate strlen(tmp) + 1)) == NULL) { 12617c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 12627c478bd9Sstevel@tonic-gate gettext("while allocating filename for temp file")); 12637c478bd9Sstevel@tonic-gate exit(1); 12647c478bd9Sstevel@tonic-gate } 12657c478bd9Sstevel@tonic-gate strcpy(temp_file_name, file); 12667c478bd9Sstevel@tonic-gate strcat(temp_file_name, tmp); 12677c478bd9Sstevel@tonic-gate 1268*159d09a2SMark Phalan retval = kadm5_get_config_params(kpropd_context, 1, NULL, ¶ms, 12697c478bd9Sstevel@tonic-gate ¶ms); 12707c478bd9Sstevel@tonic-gate if (retval) { 12717c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing")); 12727c478bd9Sstevel@tonic-gate exit(1); 12737c478bd9Sstevel@tonic-gate } 12747c478bd9Sstevel@tonic-gate if (params.iprop_enabled == TRUE) { 12757c478bd9Sstevel@tonic-gate ulog_set_role(kpropd_context, IPROP_SLAVE); 12767c478bd9Sstevel@tonic-gate poll_time = params.iprop_polltime; 12777c478bd9Sstevel@tonic-gate 12787c478bd9Sstevel@tonic-gate if (ulog_map(kpropd_context, ¶ms, FKPROPD)) { 12797c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12807c478bd9Sstevel@tonic-gate com_err(progname, errno, 12817c64d375Smp gettext("while mapping log")); 12827c478bd9Sstevel@tonic-gate exit(1); 12837c478bd9Sstevel@tonic-gate } 12847c478bd9Sstevel@tonic-gate } 12857c478bd9Sstevel@tonic-gate 12867c478bd9Sstevel@tonic-gate /* 12877c478bd9Sstevel@tonic-gate * Grab the realm info and check if iprop is enabled. 12887c478bd9Sstevel@tonic-gate */ 12897c478bd9Sstevel@tonic-gate if (def_realm == NULL) { 12907c478bd9Sstevel@tonic-gate retval = krb5_get_default_realm(kpropd_context, &def_realm); 12917c478bd9Sstevel@tonic-gate if (retval) { 12927c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12937c478bd9Sstevel@tonic-gate com_err(progname, retval, 12947c64d375Smp gettext("while retrieving default realm")); 12957c478bd9Sstevel@tonic-gate exit(1); 12967c478bd9Sstevel@tonic-gate } 12977c478bd9Sstevel@tonic-gate } 12987c478bd9Sstevel@tonic-gate } 12997c478bd9Sstevel@tonic-gate 13007c478bd9Sstevel@tonic-gate /* 13017c478bd9Sstevel@tonic-gate * Figure out who's calling on the other end of the connection.... 13027c478bd9Sstevel@tonic-gate */ 13037c478bd9Sstevel@tonic-gate void 13047c478bd9Sstevel@tonic-gate kerberos_authenticate(context, fd, clientp, etype, ss) 13057c478bd9Sstevel@tonic-gate krb5_context context; 13067c478bd9Sstevel@tonic-gate int fd; 13077c478bd9Sstevel@tonic-gate krb5_principal * clientp; 13087c478bd9Sstevel@tonic-gate krb5_enctype * etype; 13097c478bd9Sstevel@tonic-gate struct sockaddr_storage ss; 13107c478bd9Sstevel@tonic-gate { 13117c478bd9Sstevel@tonic-gate krb5_error_code retval; 13127c478bd9Sstevel@tonic-gate krb5_ticket * ticket; 13137c478bd9Sstevel@tonic-gate struct sockaddr_storage r_ss; 13147c478bd9Sstevel@tonic-gate int ss_length; 13157c478bd9Sstevel@tonic-gate krb5_keytab keytab = NULL; 13167c478bd9Sstevel@tonic-gate 13177c478bd9Sstevel@tonic-gate /* 13187c478bd9Sstevel@tonic-gate * Set recv_addr and send_addr 13197c478bd9Sstevel@tonic-gate */ 13207c478bd9Sstevel@tonic-gate if (cvtkaddr(&ss, &sender_addr) == NULL) { 13217c478bd9Sstevel@tonic-gate com_err(progname, errno, 13227c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 13237c478bd9Sstevel@tonic-gate exit(1); 13247c478bd9Sstevel@tonic-gate } 13257c478bd9Sstevel@tonic-gate 13267c478bd9Sstevel@tonic-gate ss_length = sizeof (r_ss); 13277c478bd9Sstevel@tonic-gate if (getsockname(fd, (struct sockaddr *) &r_ss, &ss_length)) { 13287c478bd9Sstevel@tonic-gate com_err(progname, errno, 13297c478bd9Sstevel@tonic-gate gettext("while getting local socket address")); 13307c478bd9Sstevel@tonic-gate exit(1); 13317c478bd9Sstevel@tonic-gate } 13327c478bd9Sstevel@tonic-gate 13337c478bd9Sstevel@tonic-gate if (cvtkaddr(&r_ss, &receiver_addr) == NULL) { 13347c478bd9Sstevel@tonic-gate com_err(progname, errno, 13357c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 13367c478bd9Sstevel@tonic-gate exit(1); 13377c478bd9Sstevel@tonic-gate } 13387c478bd9Sstevel@tonic-gate 13397c478bd9Sstevel@tonic-gate if (debug) { 13407c478bd9Sstevel@tonic-gate char *name; 134156a424ccSmp 134256a424ccSmp retval = krb5_unparse_name(context, server, &name); 134356a424ccSmp if (retval) { 13447c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 13457c64d375Smp com_err(progname, retval, gettext("while unparsing server name")); 13467c478bd9Sstevel@tonic-gate exit(1); 13477c478bd9Sstevel@tonic-gate } 13487c478bd9Sstevel@tonic-gate printf(gettext("krb5_recvauth(%d, %s, %s, ...)\n"), fd, kprop_version, 13497c478bd9Sstevel@tonic-gate name); 13507c478bd9Sstevel@tonic-gate free(name); 13517c478bd9Sstevel@tonic-gate } 13527c478bd9Sstevel@tonic-gate 135356a424ccSmp retval = krb5_auth_con_init(context, &auth_context); 135456a424ccSmp if (retval) { 13557c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_init: %s"), 135656a424ccSmp error_message(retval)); 13577c478bd9Sstevel@tonic-gate exit(1); 13587c478bd9Sstevel@tonic-gate } 13597c478bd9Sstevel@tonic-gate 136056a424ccSmp retval = krb5_auth_con_setflags(context, auth_context, 136156a424ccSmp KRB5_AUTH_CONTEXT_DO_SEQUENCE); 136256a424ccSmp if (retval) { 13637c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setflags: %s"), 13647c478bd9Sstevel@tonic-gate error_message(retval)); 13657c478bd9Sstevel@tonic-gate exit(1); 13667c478bd9Sstevel@tonic-gate } 13677c478bd9Sstevel@tonic-gate 136856a424ccSmp retval = krb5_auth_con_setaddrs(context, auth_context, &receiver_addr, 136956a424ccSmp &sender_addr); 137056a424ccSmp if (retval) { 13717c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setaddrs: %s"), 13727c478bd9Sstevel@tonic-gate error_message(retval)); 13737c478bd9Sstevel@tonic-gate exit(1); 13747c478bd9Sstevel@tonic-gate } 13757c478bd9Sstevel@tonic-gate 13767c478bd9Sstevel@tonic-gate if (srvtab) { 137756a424ccSmp retval = krb5_kt_resolve(context, srvtab, &keytab); 137856a424ccSmp if (retval) { 13797c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_kt_resolve: %s"), error_message(retval)); 13807c478bd9Sstevel@tonic-gate exit(1); 13817c478bd9Sstevel@tonic-gate } 13827c478bd9Sstevel@tonic-gate } 13837c478bd9Sstevel@tonic-gate 138456a424ccSmp retval = krb5_recvauth(context, &auth_context, (void *) &fd, 138556a424ccSmp kprop_version, server, 0, keytab, &ticket); 138656a424ccSmp if (retval) { 138756a424ccSmp syslog(LOG_ERR, gettext("Error in krb5_recvauth: %s"), error_message(retval)); 13887c478bd9Sstevel@tonic-gate exit(1); 13897c478bd9Sstevel@tonic-gate } 13907c478bd9Sstevel@tonic-gate 139156a424ccSmp retval = krb5_copy_principal(context, ticket->enc_part2->client, clientp); 139256a424ccSmp if (retval) { 13937c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_copy_prinicpal: %s"), 13947c478bd9Sstevel@tonic-gate error_message(retval)); 13957c478bd9Sstevel@tonic-gate exit(1); 13967c478bd9Sstevel@tonic-gate } 13977c478bd9Sstevel@tonic-gate 13987c478bd9Sstevel@tonic-gate *etype = ticket->enc_part.enctype; 13997c478bd9Sstevel@tonic-gate 14007c478bd9Sstevel@tonic-gate if (debug) { 14017c478bd9Sstevel@tonic-gate char * name; 14027c478bd9Sstevel@tonic-gate char etypebuf[100]; 14037c478bd9Sstevel@tonic-gate 140456a424ccSmp retval = krb5_unparse_name(context, *clientp, &name); 140556a424ccSmp if (retval) { 14067c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 14077c478bd9Sstevel@tonic-gate com_err(progname, retval, 14087c64d375Smp gettext("while unparsing client name")); 14097c478bd9Sstevel@tonic-gate exit(1); 14107c478bd9Sstevel@tonic-gate } 14117c478bd9Sstevel@tonic-gate 141256a424ccSmp retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf)); 141356a424ccSmp if (retval) { 14147c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 14157c64d375Smp com_err(progname, retval, gettext("while unparsing ticket etype")); 14167c478bd9Sstevel@tonic-gate exit(1); 14177c478bd9Sstevel@tonic-gate } 14187c478bd9Sstevel@tonic-gate 14197c478bd9Sstevel@tonic-gate printf("authenticated client: %s (etype == %s)\n", name, etypebuf); 14207c478bd9Sstevel@tonic-gate free(name); 14217c478bd9Sstevel@tonic-gate } 14227c478bd9Sstevel@tonic-gate 14237c478bd9Sstevel@tonic-gate krb5_free_ticket(context, ticket); 14247c478bd9Sstevel@tonic-gate } 14257c478bd9Sstevel@tonic-gate 14267c478bd9Sstevel@tonic-gate krb5_boolean 14277c478bd9Sstevel@tonic-gate authorized_principal(context, p, auth_etype) 14287c478bd9Sstevel@tonic-gate krb5_context context; 14297c478bd9Sstevel@tonic-gate krb5_principal p; 14307c478bd9Sstevel@tonic-gate krb5_enctype auth_etype; 14317c478bd9Sstevel@tonic-gate { 14327c478bd9Sstevel@tonic-gate char *name, *ptr; 14337c478bd9Sstevel@tonic-gate char buf[1024]; 14347c478bd9Sstevel@tonic-gate krb5_error_code retval; 14357c478bd9Sstevel@tonic-gate FILE *acl_file; 14367c478bd9Sstevel@tonic-gate int end; 14377c478bd9Sstevel@tonic-gate krb5_enctype acl_etype; 14387c478bd9Sstevel@tonic-gate 14397c478bd9Sstevel@tonic-gate retval = krb5_unparse_name(context, p, &name); 14407c478bd9Sstevel@tonic-gate if (retval) 14417c478bd9Sstevel@tonic-gate return FALSE; 14427c478bd9Sstevel@tonic-gate 14437c478bd9Sstevel@tonic-gate acl_file = fopen(acl_file_name, "r"); 14447c478bd9Sstevel@tonic-gate if (!acl_file) 14457c478bd9Sstevel@tonic-gate return FALSE; 14467c478bd9Sstevel@tonic-gate 14477c478bd9Sstevel@tonic-gate while (!feof(acl_file)) { 14487c478bd9Sstevel@tonic-gate if (!fgets(buf, sizeof(buf), acl_file)) 14497c478bd9Sstevel@tonic-gate break; 14507c478bd9Sstevel@tonic-gate end = strlen(buf) - 1; 14517c478bd9Sstevel@tonic-gate if (buf[end] == '\n') 14527c478bd9Sstevel@tonic-gate buf[end] = '\0'; 14537c478bd9Sstevel@tonic-gate if (!strncmp(name, buf, strlen(name))) { 14547c478bd9Sstevel@tonic-gate ptr = buf+strlen(name); 14557c478bd9Sstevel@tonic-gate 14567c478bd9Sstevel@tonic-gate /* if the next character is not whitespace or nul, then 14577c478bd9Sstevel@tonic-gate the match is only partial. continue on to new lines. */ 145856a424ccSmp if (*ptr && !isspace((int) *ptr)) 14597c478bd9Sstevel@tonic-gate continue; 14607c478bd9Sstevel@tonic-gate 14617c478bd9Sstevel@tonic-gate /* otherwise, skip trailing whitespace */ 146256a424ccSmp for (; *ptr && isspace((int) *ptr); ptr++) ; 14637c478bd9Sstevel@tonic-gate 14647c478bd9Sstevel@tonic-gate /* now, look for an etype string. if there isn't one, 14657c478bd9Sstevel@tonic-gate return true. if there is an invalid string, continue. 14667c478bd9Sstevel@tonic-gate If there is a valid string, return true only if it 14677c478bd9Sstevel@tonic-gate matches the etype passed in, otherwise continue */ 14687c478bd9Sstevel@tonic-gate 14697c478bd9Sstevel@tonic-gate if ((*ptr) && 14707c478bd9Sstevel@tonic-gate ((retval = krb5_string_to_enctype(ptr, &acl_etype)) || 14717c478bd9Sstevel@tonic-gate (acl_etype != auth_etype))) 14727c478bd9Sstevel@tonic-gate continue; 14737c478bd9Sstevel@tonic-gate 14747c478bd9Sstevel@tonic-gate free(name); 14757c478bd9Sstevel@tonic-gate fclose(acl_file); 14767c478bd9Sstevel@tonic-gate return TRUE; 14777c478bd9Sstevel@tonic-gate } 14787c478bd9Sstevel@tonic-gate } 14797c478bd9Sstevel@tonic-gate free(name); 14807c478bd9Sstevel@tonic-gate fclose(acl_file); 14817c478bd9Sstevel@tonic-gate return FALSE; 14827c478bd9Sstevel@tonic-gate } 14837c478bd9Sstevel@tonic-gate 14847c478bd9Sstevel@tonic-gate void 14857c478bd9Sstevel@tonic-gate recv_database(context, fd, database_fd, confmsg) 14867c478bd9Sstevel@tonic-gate krb5_context context; 14877c478bd9Sstevel@tonic-gate int fd; 14887c478bd9Sstevel@tonic-gate int database_fd; 14897c478bd9Sstevel@tonic-gate krb5_data *confmsg; 14907c478bd9Sstevel@tonic-gate { 149156a424ccSmp krb5_ui_4 database_size; /* This must be 4 bytes */ 14927c478bd9Sstevel@tonic-gate int received_size, n; 14937c478bd9Sstevel@tonic-gate char buf[1024]; 14947c478bd9Sstevel@tonic-gate krb5_data inbuf, outbuf; 14957c478bd9Sstevel@tonic-gate krb5_error_code retval; 14967c478bd9Sstevel@tonic-gate 14977c478bd9Sstevel@tonic-gate /* 14987c478bd9Sstevel@tonic-gate * Receive and decode size from client 14997c478bd9Sstevel@tonic-gate */ 150056a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 150156a424ccSmp if (retval) { 15027c478bd9Sstevel@tonic-gate send_error(context, fd, retval, gettext("while reading database size")); 15037c478bd9Sstevel@tonic-gate com_err(progname, retval, 15047c478bd9Sstevel@tonic-gate gettext("while reading size of database from client")); 15057c478bd9Sstevel@tonic-gate exit(1); 15067c478bd9Sstevel@tonic-gate } 15077c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 15087c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 150956a424ccSmp retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL); 151056a424ccSmp if (retval) { 151156a424ccSmp send_error(context, fd, retval, gettext( 151256a424ccSmp "while decoding database size")); 15137c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15147c478bd9Sstevel@tonic-gate com_err(progname, retval, 15157c478bd9Sstevel@tonic-gate gettext("while decoding database size from client")); 15167c478bd9Sstevel@tonic-gate exit(1); 15177c478bd9Sstevel@tonic-gate } 15187c478bd9Sstevel@tonic-gate memcpy((char *) &database_size, outbuf.data, sizeof(database_size)); 15197c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15207c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 15217c478bd9Sstevel@tonic-gate database_size = ntohl(database_size); 15227c478bd9Sstevel@tonic-gate 152356a424ccSmp /* 152456a424ccSmp * Initialize the initial vector. 152556a424ccSmp */ 152656a424ccSmp retval = krb5_auth_con_initivector(context, auth_context); 152756a424ccSmp if (retval) { 152856a424ccSmp send_error(context, fd, retval, gettext( 152956a424ccSmp "failed while initializing i_vector")); 153056a424ccSmp com_err(progname, retval, gettext("while initializing i_vector")); 153156a424ccSmp exit(1); 153256a424ccSmp } 15337c478bd9Sstevel@tonic-gate 15347c478bd9Sstevel@tonic-gate /* 15357c478bd9Sstevel@tonic-gate * Now start receiving the database from the net 15367c478bd9Sstevel@tonic-gate */ 15377c478bd9Sstevel@tonic-gate received_size = 0; 15387c478bd9Sstevel@tonic-gate while (received_size < database_size) { 153956a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 154056a424ccSmp if (retval) { 15417c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15427c478bd9Sstevel@tonic-gate gettext("while reading database block starting at offset %d"), 15437c478bd9Sstevel@tonic-gate received_size); 15447c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 15457c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 15467c478bd9Sstevel@tonic-gate exit(1); 15477c478bd9Sstevel@tonic-gate } 15487c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 15497c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 155056a424ccSmp retval = krb5_rd_priv(context, auth_context, &inbuf, 155156a424ccSmp &outbuf, NULL); 155256a424ccSmp if (retval) { 15537c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15547c478bd9Sstevel@tonic-gate gettext("while decoding database block starting at offset %d"), 15557c478bd9Sstevel@tonic-gate received_size); 15567c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 15577c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 15587c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15597c478bd9Sstevel@tonic-gate exit(1); 15607c478bd9Sstevel@tonic-gate } 15617c478bd9Sstevel@tonic-gate n = write(database_fd, outbuf.data, outbuf.length); 15627c478bd9Sstevel@tonic-gate if (n < 0) { 15637c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15647c478bd9Sstevel@tonic-gate gettext( 15657c478bd9Sstevel@tonic-gate "while writing database block starting at offset %d"), 15667c478bd9Sstevel@tonic-gate received_size); 15677c478bd9Sstevel@tonic-gate send_error(context, fd, errno, buf); 15687c478bd9Sstevel@tonic-gate } else if (n != outbuf.length) { 15697c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15707c478bd9Sstevel@tonic-gate gettext( 15717c478bd9Sstevel@tonic-gate "incomplete write while writing database block starting at\n" 15727c478bd9Sstevel@tonic-gate "offset %d (%d written, %d expected)"), 15737c478bd9Sstevel@tonic-gate received_size, n, outbuf.length); 15747c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 15757c478bd9Sstevel@tonic-gate } 15767c478bd9Sstevel@tonic-gate received_size += outbuf.length; 15777c478bd9Sstevel@tonic-gate /* SUNWresync121: our krb5...contents sets length to 0 */ 15787c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15797c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 158056a424ccSmp 15817c478bd9Sstevel@tonic-gate } 15827c478bd9Sstevel@tonic-gate /* 15837c478bd9Sstevel@tonic-gate * OK, we've seen the entire file. Did we get too many bytes? 15847c478bd9Sstevel@tonic-gate */ 15857c478bd9Sstevel@tonic-gate if (received_size > database_size) { 15867c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15877c478bd9Sstevel@tonic-gate gettext("Received %d bytes, expected %d bytes for database file"), 15887c478bd9Sstevel@tonic-gate received_size, database_size); 15897c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 15907c478bd9Sstevel@tonic-gate } 15917c478bd9Sstevel@tonic-gate /* 15927c478bd9Sstevel@tonic-gate * Create message acknowledging number of bytes received, but 15937c478bd9Sstevel@tonic-gate * don't send it until kdb5_util returns successfully. 15947c478bd9Sstevel@tonic-gate */ 15957c478bd9Sstevel@tonic-gate database_size = htonl(database_size); 15967c478bd9Sstevel@tonic-gate inbuf.data = (char *) &database_size; 15977c478bd9Sstevel@tonic-gate inbuf.length = sizeof(database_size); 159856a424ccSmp retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); 159956a424ccSmp if (retval) { 16007c478bd9Sstevel@tonic-gate com_err(progname, retval, 16017c478bd9Sstevel@tonic-gate gettext("while encoding # of receieved bytes")); 16027c478bd9Sstevel@tonic-gate send_error(context, fd, retval, 16037c478bd9Sstevel@tonic-gate gettext("while encoding # of received bytes")); 16047c478bd9Sstevel@tonic-gate exit(1); 16057c478bd9Sstevel@tonic-gate } 16067c478bd9Sstevel@tonic-gate } 16077c478bd9Sstevel@tonic-gate 16087c478bd9Sstevel@tonic-gate 16097c478bd9Sstevel@tonic-gate void 16107c478bd9Sstevel@tonic-gate send_error(context, fd, err_code, err_text) 16117c478bd9Sstevel@tonic-gate krb5_context context; 16127c478bd9Sstevel@tonic-gate int fd; 16137c478bd9Sstevel@tonic-gate krb5_error_code err_code; 16147c478bd9Sstevel@tonic-gate char *err_text; 16157c478bd9Sstevel@tonic-gate { 16167c478bd9Sstevel@tonic-gate krb5_error error; 16177c478bd9Sstevel@tonic-gate const char *text; 16187c478bd9Sstevel@tonic-gate krb5_data outbuf; 16197c478bd9Sstevel@tonic-gate char buf[1024]; 16207c478bd9Sstevel@tonic-gate 16217c478bd9Sstevel@tonic-gate memset((char *)&error, 0, sizeof(error)); 16227c478bd9Sstevel@tonic-gate krb5_us_timeofday(context, &error.stime, &error.susec); 16237c478bd9Sstevel@tonic-gate error.server = server; 16247c478bd9Sstevel@tonic-gate error.client = client; 16257c478bd9Sstevel@tonic-gate 16267c478bd9Sstevel@tonic-gate if (err_text) 16277c478bd9Sstevel@tonic-gate text = err_text; 16287c478bd9Sstevel@tonic-gate else 16297c478bd9Sstevel@tonic-gate text = error_message(err_code); 16307c478bd9Sstevel@tonic-gate 16317c478bd9Sstevel@tonic-gate error.error = err_code - ERROR_TABLE_BASE_krb5; 16327c478bd9Sstevel@tonic-gate if (error.error > 127) { 16337c478bd9Sstevel@tonic-gate error.error = KRB_ERR_GENERIC; 16347c478bd9Sstevel@tonic-gate if (err_text) { 16357c478bd9Sstevel@tonic-gate sprintf(buf, "%s %s", error_message(err_code), 16367c478bd9Sstevel@tonic-gate err_text); 16377c478bd9Sstevel@tonic-gate text = buf; 16387c478bd9Sstevel@tonic-gate } 16397c478bd9Sstevel@tonic-gate } 16407c478bd9Sstevel@tonic-gate error.text.length = strlen(text) + 1; 164156a424ccSmp error.text.data = malloc(error.text.length); 164256a424ccSmp if (error.text.data) { 16437c478bd9Sstevel@tonic-gate strcpy(error.text.data, text); 16447c478bd9Sstevel@tonic-gate if (!krb5_mk_error(context, &error, &outbuf)) { 16457c478bd9Sstevel@tonic-gate (void) krb5_write_message(context, (void *)&fd,&outbuf); 16467c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 16477c478bd9Sstevel@tonic-gate } 16487c478bd9Sstevel@tonic-gate free(error.text.data); 16497c478bd9Sstevel@tonic-gate } 16507c478bd9Sstevel@tonic-gate } 16517c478bd9Sstevel@tonic-gate 16527c478bd9Sstevel@tonic-gate void 16537c478bd9Sstevel@tonic-gate recv_error(context, inbuf) 16547c478bd9Sstevel@tonic-gate krb5_context context; 16557c478bd9Sstevel@tonic-gate krb5_data *inbuf; 16567c478bd9Sstevel@tonic-gate { 16577c478bd9Sstevel@tonic-gate krb5_error *error; 16587c478bd9Sstevel@tonic-gate krb5_error_code retval; 16597c478bd9Sstevel@tonic-gate 166056a424ccSmp retval = krb5_rd_error(context, inbuf, &error); 166156a424ccSmp if (retval) { 16627c478bd9Sstevel@tonic-gate com_err(progname, retval, 16637c478bd9Sstevel@tonic-gate gettext("while decoding error packet from client")); 16647c478bd9Sstevel@tonic-gate exit(1); 16657c478bd9Sstevel@tonic-gate } 16667c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 16677c478bd9Sstevel@tonic-gate if (error->text.data) 16687c478bd9Sstevel@tonic-gate fprintf(stderr, 16697c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 16707c478bd9Sstevel@tonic-gate error->text.data); 16717c478bd9Sstevel@tonic-gate } else if (error->error) { 16727c478bd9Sstevel@tonic-gate com_err(progname, error->error + ERROR_TABLE_BASE_krb5, 16737c478bd9Sstevel@tonic-gate gettext("signalled from server")); 16747c478bd9Sstevel@tonic-gate if (error->text.data) 16757c478bd9Sstevel@tonic-gate fprintf(stderr, 16767c478bd9Sstevel@tonic-gate gettext("Error text from client: %s\n"), 16777c478bd9Sstevel@tonic-gate error->text.data); 16787c478bd9Sstevel@tonic-gate } 16797c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 16807c478bd9Sstevel@tonic-gate exit(1); 16817c478bd9Sstevel@tonic-gate } 16827c478bd9Sstevel@tonic-gate 16837c478bd9Sstevel@tonic-gate void 168456a424ccSmp load_database(context, kdb_util, database_file_name) 16857c478bd9Sstevel@tonic-gate krb5_context context; 168656a424ccSmp char *kdb_util; 16877c478bd9Sstevel@tonic-gate char *database_file_name; 16887c478bd9Sstevel@tonic-gate { 16897c478bd9Sstevel@tonic-gate static char *edit_av[10]; 169056a424ccSmp int error_ret, save_stderr = -1; 16917c478bd9Sstevel@tonic-gate int child_pid; 16927c478bd9Sstevel@tonic-gate int count; 169356a424ccSmp 169456a424ccSmp /* <sys/param.h> has been included, so BSD will be defined on 169556a424ccSmp BSD systems */ 169656a424ccSmp #if BSD > 0 && BSD <= 43 169756a424ccSmp #ifndef WEXITSTATUS 169856a424ccSmp #define WEXITSTATUS(w) (w).w_retcode 169956a424ccSmp #endif 170056a424ccSmp union wait waitb; 170156a424ccSmp #else 17027c478bd9Sstevel@tonic-gate int waitb; 170356a424ccSmp #endif 17047c478bd9Sstevel@tonic-gate krb5_error_code retval; 17057c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 17067c478bd9Sstevel@tonic-gate 17077c478bd9Sstevel@tonic-gate if (debug) 170856a424ccSmp printf(gettext("calling kdb_util to load database\n")); 17097c478bd9Sstevel@tonic-gate 17107c478bd9Sstevel@tonic-gate log_ctx = context->kdblog_context; 17117c478bd9Sstevel@tonic-gate 171256a424ccSmp edit_av[0] = kdb_util; 17137c478bd9Sstevel@tonic-gate count = 1; 17147c478bd9Sstevel@tonic-gate if (realm) { 17157c478bd9Sstevel@tonic-gate edit_av[count++] = "-r"; 17167c478bd9Sstevel@tonic-gate edit_av[count++] = realm; 17177c478bd9Sstevel@tonic-gate } 17187c478bd9Sstevel@tonic-gate edit_av[count++] = "load"; 17197c478bd9Sstevel@tonic-gate if (kerb_database) { 17207c478bd9Sstevel@tonic-gate edit_av[count++] = "-d"; 17217c478bd9Sstevel@tonic-gate edit_av[count++] = kerb_database; 17227c478bd9Sstevel@tonic-gate } 17237c478bd9Sstevel@tonic-gate 17247c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 17257c478bd9Sstevel@tonic-gate edit_av[count++] = "-i"; 17267c478bd9Sstevel@tonic-gate } 17277c478bd9Sstevel@tonic-gate edit_av[count++] = database_file_name; 17287c478bd9Sstevel@tonic-gate edit_av[count++] = NULL; 17297c478bd9Sstevel@tonic-gate 17307c478bd9Sstevel@tonic-gate switch(child_pid = fork()) { 17317c478bd9Sstevel@tonic-gate case -1: 17327c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to fork %s"), 173356a424ccSmp kdb_util); 17347c478bd9Sstevel@tonic-gate exit(1); 17357c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 17367c478bd9Sstevel@tonic-gate case 0: 17377c478bd9Sstevel@tonic-gate if (!debug) { 17387c478bd9Sstevel@tonic-gate save_stderr = dup(2); 17397c478bd9Sstevel@tonic-gate close(0); 17407c478bd9Sstevel@tonic-gate close(1); 17417c478bd9Sstevel@tonic-gate close(2); 17427c478bd9Sstevel@tonic-gate open("/dev/null", O_RDWR); 17437c478bd9Sstevel@tonic-gate dup(0); 17447c478bd9Sstevel@tonic-gate dup(0); 17457c478bd9Sstevel@tonic-gate } 17467c478bd9Sstevel@tonic-gate 174756a424ccSmp execv(kdb_util, edit_av); 17487c478bd9Sstevel@tonic-gate retval = errno; 17497c478bd9Sstevel@tonic-gate if (!debug) 17507c478bd9Sstevel@tonic-gate dup2(save_stderr, 2); 17517c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to exec %s"), 175256a424ccSmp kdb_util); 17537c478bd9Sstevel@tonic-gate _exit(1); 17547c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 17557c478bd9Sstevel@tonic-gate default: 17567c478bd9Sstevel@tonic-gate if (debug) 17577c478bd9Sstevel@tonic-gate printf(gettext("Child PID is %d\n"), child_pid); 17587c478bd9Sstevel@tonic-gate if (wait(&waitb) < 0) { 17597c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while waiting for %s"), 176056a424ccSmp kdb_util); 17617c478bd9Sstevel@tonic-gate exit(1); 17627c478bd9Sstevel@tonic-gate } 17637c478bd9Sstevel@tonic-gate } 17647c478bd9Sstevel@tonic-gate 176556a424ccSmp error_ret = WEXITSTATUS(waitb); 176656a424ccSmp if (error_ret) { 17677c478bd9Sstevel@tonic-gate com_err(progname, 0, 176856a424ccSmp gettext("%s returned a bad exit status (%d)"), 176956a424ccSmp kdb_util, error_ret); 17707c478bd9Sstevel@tonic-gate exit(1); 17717c478bd9Sstevel@tonic-gate } 17727c478bd9Sstevel@tonic-gate return; 17737c478bd9Sstevel@tonic-gate } 1774