17c478bd9Sstevel@tonic-gate /* 2*54925bf6Swillf * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate * 57c478bd9Sstevel@tonic-gate * All rights reserved. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may require 87c478bd9Sstevel@tonic-gate * a specific license from the United States Government. It is the 97c478bd9Sstevel@tonic-gate * responsibility of any person or organization contemplating export to 107c478bd9Sstevel@tonic-gate * obtain such a license before exporting. 117c478bd9Sstevel@tonic-gate * 127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 177c478bd9Sstevel@tonic-gate * the name of FundsXpress. not be used in advertising or publicity pertaining 187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 197c478bd9Sstevel@tonic-gate * permission. FundsXpress makes no representations about the suitability of 207c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 217c478bd9Sstevel@tonic-gate * or implied warranty. 227c478bd9Sstevel@tonic-gate * 237c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 247c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 257c478bd9Sstevel@tonic-gate * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate /* 317c478bd9Sstevel@tonic-gate * slave/kpropd.c 327c478bd9Sstevel@tonic-gate * 337c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 347c478bd9Sstevel@tonic-gate * All Rights Reserved. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 377c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 387c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 397c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 407c478bd9Sstevel@tonic-gate * 417c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 427c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 437c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 447c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 457c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 467c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 477c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 487c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 497c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 507c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 517c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 527c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 537c478bd9Sstevel@tonic-gate * or implied warranty. 547c478bd9Sstevel@tonic-gate * 557c478bd9Sstevel@tonic-gate * 567c478bd9Sstevel@tonic-gate * XXX We need to modify the protocol so that an acknowledge is set 577c478bd9Sstevel@tonic-gate * after each block, instead after the entire series is sent over. 587c478bd9Sstevel@tonic-gate * The reason for this is so that error packets can get interpreted 597c478bd9Sstevel@tonic-gate * right away. If you don't do this, the sender may never get the 607c478bd9Sstevel@tonic-gate * error packet, because it will die an EPIPE trying to complete the 617c478bd9Sstevel@tonic-gate * write... 627c478bd9Sstevel@tonic-gate */ 637c478bd9Sstevel@tonic-gate 6456a424ccSmp 657c478bd9Sstevel@tonic-gate #include <stdio.h> 667c478bd9Sstevel@tonic-gate #include <ctype.h> 677c478bd9Sstevel@tonic-gate #include <sys/file.h> 687c478bd9Sstevel@tonic-gate #include <signal.h> 697c478bd9Sstevel@tonic-gate #include <string.h> 707c478bd9Sstevel@tonic-gate #include <fcntl.h> 717c478bd9Sstevel@tonic-gate #include <sys/types.h> 727c478bd9Sstevel@tonic-gate #include <sys/time.h> 737c478bd9Sstevel@tonic-gate #include <sys/stat.h> 747c478bd9Sstevel@tonic-gate #include <sys/socket.h> 757c478bd9Sstevel@tonic-gate #include <sys/wait.h> 767c478bd9Sstevel@tonic-gate #include <netinet/in.h> 777c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 787c478bd9Sstevel@tonic-gate #include <sys/param.h> 797c478bd9Sstevel@tonic-gate #include <netdb.h> 807c478bd9Sstevel@tonic-gate #include <syslog.h> 817c478bd9Sstevel@tonic-gate #include <libintl.h> 827c478bd9Sstevel@tonic-gate #include <locale.h> 837c478bd9Sstevel@tonic-gate #include <k5-int.h> 847c478bd9Sstevel@tonic-gate #include <socket-utils.h> 857c478bd9Sstevel@tonic-gate #include "com_err.h" 867c478bd9Sstevel@tonic-gate #include <errno.h> 877c478bd9Sstevel@tonic-gate 887c478bd9Sstevel@tonic-gate #include "kprop.h" 897c478bd9Sstevel@tonic-gate #include <iprop_hdr.h> 907c478bd9Sstevel@tonic-gate #include "iprop.h" 917c478bd9Sstevel@tonic-gate #include <kadm5/admin.h> 927c478bd9Sstevel@tonic-gate #include <kdb/kdb_log.h> 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate #define SYSLOG_CLASS LOG_DAEMON 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate char *poll_time = NULL; 977c478bd9Sstevel@tonic-gate char *def_realm = NULL; 987c478bd9Sstevel@tonic-gate boolean_t runonce = B_FALSE; 997c478bd9Sstevel@tonic-gate 1007c478bd9Sstevel@tonic-gate /* 1017c478bd9Sstevel@tonic-gate * This struct simulates the use of _kadm5_server_handle_t 1027c478bd9Sstevel@tonic-gate */ 1037c478bd9Sstevel@tonic-gate typedef struct _kadm5_iprop_handle_t { 1047c478bd9Sstevel@tonic-gate krb5_ui_4 magic_number; 1057c478bd9Sstevel@tonic-gate krb5_ui_4 struct_version; 1067c478bd9Sstevel@tonic-gate krb5_ui_4 api_version; 1077c478bd9Sstevel@tonic-gate char *cache_name; 1087c478bd9Sstevel@tonic-gate int destroy_cache; 1097c478bd9Sstevel@tonic-gate CLIENT *clnt; 1107c478bd9Sstevel@tonic-gate krb5_context context; 1117c478bd9Sstevel@tonic-gate kadm5_config_params params; 1127c478bd9Sstevel@tonic-gate struct _kadm5_iprop_handle_t *lhandle; 1137c478bd9Sstevel@tonic-gate } *kadm5_iprop_handle_t; 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate char *progname; 1187c478bd9Sstevel@tonic-gate int debug = 0; 1197c478bd9Sstevel@tonic-gate char *srvtab = 0; 1207c478bd9Sstevel@tonic-gate int standalone = 0; 1217c478bd9Sstevel@tonic-gate 1227c478bd9Sstevel@tonic-gate krb5_principal server; /* This is our server principal name */ 1237c478bd9Sstevel@tonic-gate krb5_principal client; /* This is who we're talking to */ 1247c478bd9Sstevel@tonic-gate krb5_context kpropd_context; 1257c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 1267c478bd9Sstevel@tonic-gate char *realm = NULL; /* Our realm */ 1277c478bd9Sstevel@tonic-gate char *file = KPROPD_DEFAULT_FILE; 1287c478bd9Sstevel@tonic-gate char *temp_file_name; 1297c478bd9Sstevel@tonic-gate char *kdb5_util = KPROPD_DEFAULT_KDB5_UTIL; 1307c478bd9Sstevel@tonic-gate char *kerb_database = NULL; 1317c478bd9Sstevel@tonic-gate char *acl_file_name = KPROPD_ACL_FILE; 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate krb5_address sender_addr; 1347c478bd9Sstevel@tonic-gate krb5_address receiver_addr; 1357c478bd9Sstevel@tonic-gate short port = 0; 1367c478bd9Sstevel@tonic-gate 1377c478bd9Sstevel@tonic-gate void PRS 1387c478bd9Sstevel@tonic-gate (int, char**); 1397c478bd9Sstevel@tonic-gate int do_standalone 1407c478bd9Sstevel@tonic-gate (iprop_role iproprole); 1417c478bd9Sstevel@tonic-gate void doit 14256a424ccSmp (int); 1437c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx); 1447c478bd9Sstevel@tonic-gate 1457c478bd9Sstevel@tonic-gate void kerberos_authenticate 14656a424ccSmp (krb5_context, 1477c478bd9Sstevel@tonic-gate int, 1487c478bd9Sstevel@tonic-gate krb5_principal *, 1497c478bd9Sstevel@tonic-gate krb5_enctype *, 1507c478bd9Sstevel@tonic-gate struct sockaddr_storage); 1517c478bd9Sstevel@tonic-gate krb5_boolean authorized_principal 15256a424ccSmp (krb5_context, 1537c478bd9Sstevel@tonic-gate krb5_principal, 1547c478bd9Sstevel@tonic-gate krb5_enctype); 1557c478bd9Sstevel@tonic-gate void recv_database 15656a424ccSmp (krb5_context, 1577c478bd9Sstevel@tonic-gate int, 1587c478bd9Sstevel@tonic-gate int, 1597c478bd9Sstevel@tonic-gate krb5_data *); 1607c478bd9Sstevel@tonic-gate void load_database 16156a424ccSmp (krb5_context, 1627c478bd9Sstevel@tonic-gate char *, 1637c478bd9Sstevel@tonic-gate char *); 1647c478bd9Sstevel@tonic-gate void send_error 16556a424ccSmp (krb5_context, 1667c478bd9Sstevel@tonic-gate int, 1677c478bd9Sstevel@tonic-gate krb5_error_code, 1687c478bd9Sstevel@tonic-gate char *); 1697c478bd9Sstevel@tonic-gate void recv_error 17056a424ccSmp (krb5_context, 1717c478bd9Sstevel@tonic-gate krb5_data *); 1727c478bd9Sstevel@tonic-gate int convert_polltime 1737c478bd9Sstevel@tonic-gate (char *); 1747c478bd9Sstevel@tonic-gate unsigned int backoff_from_master 1757c478bd9Sstevel@tonic-gate (int *); 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate static void usage() 1787c478bd9Sstevel@tonic-gate { 1797c478bd9Sstevel@tonic-gate fprintf(stderr, 1807c478bd9Sstevel@tonic-gate gettext("\nUsage: %s\n"), /* progname may be a long pathname */ 1817c478bd9Sstevel@tonic-gate progname); 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate fprintf(stderr, 1847c478bd9Sstevel@tonic-gate gettext("\t[-r realm] [-s srvtab] [-dS] [-f slave_file]\n")); 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate fprintf(stderr, 1877c478bd9Sstevel@tonic-gate gettext("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n")); 1887c478bd9Sstevel@tonic-gate 1897c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("\t[-P port] [-a acl_file]\n")); 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate exit(1); 1927c478bd9Sstevel@tonic-gate } 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate int 1957c478bd9Sstevel@tonic-gate main(argc, argv) 1967c478bd9Sstevel@tonic-gate int argc; 1977c478bd9Sstevel@tonic-gate char **argv; 1987c478bd9Sstevel@tonic-gate { 1997c478bd9Sstevel@tonic-gate krb5_error_code retval; 2007c478bd9Sstevel@tonic-gate int ret = 0; 2017c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 202*54925bf6Swillf int iprop_supported; 2037c478bd9Sstevel@tonic-gate 2047c478bd9Sstevel@tonic-gate PRS(argc, argv); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 2097c478bd9Sstevel@tonic-gate /* 2107c478bd9Sstevel@tonic-gate * We wanna do iprop ! 2117c478bd9Sstevel@tonic-gate */ 212*54925bf6Swillf retval = krb5_db_supports_iprop(kpropd_context, 213*54925bf6Swillf &iprop_supported); 214*54925bf6Swillf if (retval) { 215*54925bf6Swillf com_err(progname, retval, 216*54925bf6Swillf gettext("Can not determine if dbmodule plugin " 217*54925bf6Swillf "supports iprop.\n")); 218*54925bf6Swillf exit(1); 219*54925bf6Swillf } 220*54925bf6Swillf if (!iprop_supported) { 221*54925bf6Swillf com_err(progname, retval, 222*54925bf6Swillf gettext("Current dbmodule plugin does not support " 223*54925bf6Swillf "iprop.\n")); 224*54925bf6Swillf exit(1); 225*54925bf6Swillf } 226*54925bf6Swillf 2277c478bd9Sstevel@tonic-gate retval = do_iprop(log_ctx); 2287c478bd9Sstevel@tonic-gate if (retval) { 2297c478bd9Sstevel@tonic-gate com_err(progname, retval, 2307c478bd9Sstevel@tonic-gate gettext("do_iprop failed.\n")); 2317c478bd9Sstevel@tonic-gate exit(1); 2327c478bd9Sstevel@tonic-gate } 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate } else { 2357c478bd9Sstevel@tonic-gate if (standalone) 2367c478bd9Sstevel@tonic-gate ret = do_standalone(IPROP_NULL); 2377c478bd9Sstevel@tonic-gate else 2387c478bd9Sstevel@tonic-gate doit(0); 2397c478bd9Sstevel@tonic-gate } 2407c478bd9Sstevel@tonic-gate 2417c478bd9Sstevel@tonic-gate exit(ret); 2427c478bd9Sstevel@tonic-gate } 2437c478bd9Sstevel@tonic-gate 2447c478bd9Sstevel@tonic-gate int do_standalone(iprop_role iproprole) 2457c478bd9Sstevel@tonic-gate { 2467c478bd9Sstevel@tonic-gate struct linger linger; 2477c478bd9Sstevel@tonic-gate struct servent *sp; 2487c478bd9Sstevel@tonic-gate int finet, fromlen, s; 2497c478bd9Sstevel@tonic-gate int on = 1; 2507c478bd9Sstevel@tonic-gate int ret, status = 0; 2517c478bd9Sstevel@tonic-gate struct sockaddr_in6 sin6 = { AF_INET6 }; 2527c478bd9Sstevel@tonic-gate int sin6_size = sizeof (sin6); 2537c478bd9Sstevel@tonic-gate 2547c478bd9Sstevel@tonic-gate /* listen for either ipv4 or ipv6 */ 2557c478bd9Sstevel@tonic-gate finet = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); 2567c478bd9Sstevel@tonic-gate if (finet < 0 ) { 2577c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while obtaining socket")); 2587c478bd9Sstevel@tonic-gate exit(1); 2597c478bd9Sstevel@tonic-gate } 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate if(!port) { 2627c478bd9Sstevel@tonic-gate sp = getservbyname(KPROP_SERVICE, "tcp"); 2637c478bd9Sstevel@tonic-gate if (sp == NULL) { 2647c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("%s/tcp: unknown service"), 2657c478bd9Sstevel@tonic-gate KPROP_SERVICE); 2667c478bd9Sstevel@tonic-gate exit(1); 2677c478bd9Sstevel@tonic-gate } 2687c478bd9Sstevel@tonic-gate sin6.sin6_port = sp->s_port; 2697c478bd9Sstevel@tonic-gate } else 2707c478bd9Sstevel@tonic-gate sin6.sin6_port = port; 2717c478bd9Sstevel@tonic-gate 2727c478bd9Sstevel@tonic-gate /* 2737c478bd9Sstevel@tonic-gate * We need to close the socket immediately if iprop is enabled, 2747c478bd9Sstevel@tonic-gate * since back-to-back full resyncs are possible, so we do not 2757c478bd9Sstevel@tonic-gate * linger around for too long 2767c478bd9Sstevel@tonic-gate */ 2777c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) { 2787c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 2797c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) 2807c478bd9Sstevel@tonic-gate com_err(progname, errno, 2817c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_REUSEADDR)")); 2827c478bd9Sstevel@tonic-gate linger.l_onoff = 1; 2837c478bd9Sstevel@tonic-gate linger.l_linger = 2; 2847c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_LINGER, 2857c478bd9Sstevel@tonic-gate (void *)&linger, sizeof(linger)) < 0) 2867c478bd9Sstevel@tonic-gate com_err(progname, errno, 2877c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_LINGER)")); 2887c478bd9Sstevel@tonic-gate } 2897c478bd9Sstevel@tonic-gate if ((ret = bind(finet, (struct sockaddr *)&sin6, sizeof(sin6))) < 0) { 2907c478bd9Sstevel@tonic-gate if (debug) { 2917c478bd9Sstevel@tonic-gate on = 1; 2927c478bd9Sstevel@tonic-gate fprintf(stderr, 2937c478bd9Sstevel@tonic-gate gettext("%s: attempting to rebind socket " 2947c478bd9Sstevel@tonic-gate "with SO_REUSEADDR\n"), progname); 2957c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 2967c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) { 2977c478bd9Sstevel@tonic-gate com_err(progname, errno, 2987c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_REUSEADDR)")); 2997c478bd9Sstevel@tonic-gate } 3007c478bd9Sstevel@tonic-gate ret = bind(finet, (struct sockaddr *) &sin6, sizeof(sin6)); 30156a424ccSmp } 3027c478bd9Sstevel@tonic-gate 30356a424ccSmp if (ret < 0) { 30456a424ccSmp perror(gettext("bind")); 30556a424ccSmp com_err(progname, errno, 3067c478bd9Sstevel@tonic-gate gettext("while binding listener socket")); 30756a424ccSmp exit(1); 30856a424ccSmp } 3097c478bd9Sstevel@tonic-gate } 31056a424ccSmp if (!debug && (iproprole != IPROP_SLAVE)) 31156a424ccSmp daemon(1, 0); 3127c478bd9Sstevel@tonic-gate #ifdef PID_FILE 31356a424ccSmp if ((pidfile = fopen(PID_FILE, "w")) != NULL) { 31456a424ccSmp fprintf(pidfile, gettext("%d\n"), getpid()); 31556a424ccSmp fclose(pidfile); 31656a424ccSmp } else 31756a424ccSmp com_err(progname, errno, 3187c478bd9Sstevel@tonic-gate gettext("while opening pid file %s for writing"), 3197c478bd9Sstevel@tonic-gate PID_FILE); 3207c478bd9Sstevel@tonic-gate #endif 32156a424ccSmp if (listen(finet, 5) < 0) { 32256a424ccSmp com_err(progname, errno, gettext("in listen call")); 32356a424ccSmp exit(1); 3247c478bd9Sstevel@tonic-gate } 32556a424ccSmp while (1) { 32656a424ccSmp int child_pid; 3277c478bd9Sstevel@tonic-gate 32856a424ccSmp s = accept(finet, (struct sockaddr *) &sin6, &sin6_size); 3297c478bd9Sstevel@tonic-gate 33056a424ccSmp if (s < 0) { 33156a424ccSmp if (errno != EINTR) 33256a424ccSmp com_err(progname, errno, 33356a424ccSmp gettext("from accept system call")); 33456a424ccSmp continue; 33556a424ccSmp } 33656a424ccSmp if (debug && (iproprole != IPROP_SLAVE)) 33756a424ccSmp child_pid = 0; 33856a424ccSmp else 33956a424ccSmp child_pid = fork(); 34056a424ccSmp switch (child_pid) { 34156a424ccSmp case -1: 34256a424ccSmp com_err(progname, errno, gettext("while forking")); 34356a424ccSmp exit(1); 3447c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 34556a424ccSmp case 0: 3467c478bd9Sstevel@tonic-gate /* child */ 34756a424ccSmp (void) close(finet); 34856a424ccSmp 34956a424ccSmp doit(s); 35056a424ccSmp close(s); 35156a424ccSmp _exit(0); 3527c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 35356a424ccSmp default: 3547c478bd9Sstevel@tonic-gate /* parent */ 3557c478bd9Sstevel@tonic-gate if (wait(&status) < 0) { 3567c478bd9Sstevel@tonic-gate com_err(progname, errno, 3577c478bd9Sstevel@tonic-gate gettext("while waiting to receive database")); 3587c478bd9Sstevel@tonic-gate exit(1); 3597c478bd9Sstevel@tonic-gate } 3607c478bd9Sstevel@tonic-gate 3617c478bd9Sstevel@tonic-gate close(s); 3627c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 3637c478bd9Sstevel@tonic-gate close(finet); 3647c478bd9Sstevel@tonic-gate 3657c478bd9Sstevel@tonic-gate if ((ret = WEXITSTATUS(status)) != 0) 3667c478bd9Sstevel@tonic-gate return (ret); 3677c478bd9Sstevel@tonic-gate } 3687c478bd9Sstevel@tonic-gate 3697c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 3707c478bd9Sstevel@tonic-gate break; 3717c478bd9Sstevel@tonic-gate } 3727c478bd9Sstevel@tonic-gate 3737c478bd9Sstevel@tonic-gate return (0); 3747c478bd9Sstevel@tonic-gate } 3757c478bd9Sstevel@tonic-gate 3767c478bd9Sstevel@tonic-gate void doit(fd) 3777c478bd9Sstevel@tonic-gate int fd; 3787c478bd9Sstevel@tonic-gate { 3797c478bd9Sstevel@tonic-gate struct sockaddr_storage from; 3807c478bd9Sstevel@tonic-gate socklen_t fromlen; 3817c478bd9Sstevel@tonic-gate int on = 1; 3827c478bd9Sstevel@tonic-gate struct hostent *hp; 3837c478bd9Sstevel@tonic-gate krb5_error_code retval; 3847c478bd9Sstevel@tonic-gate krb5_data confmsg; 3857c478bd9Sstevel@tonic-gate int lock_fd; 38656a424ccSmp mode_t omask; 3877c478bd9Sstevel@tonic-gate krb5_enctype etype; 38856a424ccSmp int database_fd; 3897c478bd9Sstevel@tonic-gate char ntop[NI_MAXHOST] = ""; 3907c478bd9Sstevel@tonic-gate krb5_context doit_context; 3917c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 3927c478bd9Sstevel@tonic-gate 3937c478bd9Sstevel@tonic-gate retval = krb5_init_context(&doit_context); 3947c478bd9Sstevel@tonic-gate if (retval) { 3957c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing krb5")); 3967c478bd9Sstevel@tonic-gate exit(1); 3977c478bd9Sstevel@tonic-gate } 3987c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 3997c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) 4007c478bd9Sstevel@tonic-gate ulog_set_role(doit_context, IPROP_SLAVE); 4017c478bd9Sstevel@tonic-gate 4027c478bd9Sstevel@tonic-gate fromlen = (socklen_t)sizeof (from); 4037c478bd9Sstevel@tonic-gate if (getpeername(fd, (struct sockaddr *) &from, &fromlen) < 0) { 4047c478bd9Sstevel@tonic-gate fprintf(stderr, "%s: ", progname); 4057c478bd9Sstevel@tonic-gate perror(gettext("getpeername")); 4067c478bd9Sstevel@tonic-gate exit(1); 4077c478bd9Sstevel@tonic-gate } 4087c478bd9Sstevel@tonic-gate if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (caddr_t) &on, 4097c478bd9Sstevel@tonic-gate sizeof (on)) < 0) { 4107c478bd9Sstevel@tonic-gate com_err(progname, errno, 4117c478bd9Sstevel@tonic-gate gettext("while attempting setsockopt (SO_KEEPALIVE)")); 4127c478bd9Sstevel@tonic-gate } 4137c478bd9Sstevel@tonic-gate 4147c478bd9Sstevel@tonic-gate if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop), 4157c478bd9Sstevel@tonic-gate NULL, 0, NI_NUMERICHOST) != 0) { 4167c478bd9Sstevel@tonic-gate 4177c478bd9Sstevel@tonic-gate /* getnameifo failed so use inet_ntop() to get printable addresses */ 4187c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET) { 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, 4217c478bd9Sstevel@tonic-gate (const void *)&ss2sin(&from)->sin_addr, 4227c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 4237c478bd9Sstevel@tonic-gate 4247c478bd9Sstevel@tonic-gate } else if (from.ss_family == AF_INET6 && 4257c478bd9Sstevel@tonic-gate ! IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 4267c478bd9Sstevel@tonic-gate 4277c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 4287c478bd9Sstevel@tonic-gate 4297c478bd9Sstevel@tonic-gate inet_ntop(AF_INET6, 4307c478bd9Sstevel@tonic-gate (const void *)&ss2sin6(&from)->sin6_addr, ntop, 4317c478bd9Sstevel@tonic-gate sizeof(ntop)); 4327c478bd9Sstevel@tonic-gate } 4337c478bd9Sstevel@tonic-gate /* ipv4 mapped ipv6 addrs handled later */ 4347c478bd9Sstevel@tonic-gate } 4357c478bd9Sstevel@tonic-gate 4367c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET || from.ss_family == AF_INET6) { 4377c478bd9Sstevel@tonic-gate 4387c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET6 && 4397c478bd9Sstevel@tonic-gate IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 4407c478bd9Sstevel@tonic-gate 4417c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate /* coerce ipv4 mapped ipv6 addr to normal ipv4 addr */ 4447c478bd9Sstevel@tonic-gate IN6_V4MAPPED_TO_IPADDR(&(ss2sin6(&from)->sin6_addr), 4457c478bd9Sstevel@tonic-gate v4addr); 4467c478bd9Sstevel@tonic-gate 4477c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, (const void *) &v4addr, 4487c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 4497c478bd9Sstevel@tonic-gate } 4507c478bd9Sstevel@tonic-gate 4517c478bd9Sstevel@tonic-gate syslog(LOG_INFO, gettext("Connection from %s"), ntop); 4527c478bd9Sstevel@tonic-gate 4537c478bd9Sstevel@tonic-gate if (debug) 4547c478bd9Sstevel@tonic-gate printf("Connection from %s\n", ntop); 4557c478bd9Sstevel@tonic-gate 4567c478bd9Sstevel@tonic-gate } else { 4577c478bd9Sstevel@tonic-gate /* address family isn't either AF_INET || AF_INET6 */ 4587c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 4597c478bd9Sstevel@tonic-gate gettext("Connection from unknown address family:%d"), 4607c478bd9Sstevel@tonic-gate from.ss_family); 4617c478bd9Sstevel@tonic-gate 4627c478bd9Sstevel@tonic-gate if (debug) { 4637c478bd9Sstevel@tonic-gate printf(gettext("Connection from unknown address family:%d"), 4647c478bd9Sstevel@tonic-gate from.ss_family); 4657c478bd9Sstevel@tonic-gate } 4667c478bd9Sstevel@tonic-gate } 4677c478bd9Sstevel@tonic-gate 4687c478bd9Sstevel@tonic-gate /* 4697c478bd9Sstevel@tonic-gate * Now do the authentication 4707c478bd9Sstevel@tonic-gate */ 4717c478bd9Sstevel@tonic-gate kerberos_authenticate(doit_context, fd, &client, &etype, from); 4727c478bd9Sstevel@tonic-gate 4737c478bd9Sstevel@tonic-gate if (!authorized_principal(doit_context, client, etype)) { 47456a424ccSmp char *name; 4757c478bd9Sstevel@tonic-gate 47656a424ccSmp retval = krb5_unparse_name(doit_context, client, &name); 47756a424ccSmp if (retval) { 47856a424ccSmp com_err(progname, retval, 4797c478bd9Sstevel@tonic-gate gettext("While unparsing client name")); 48056a424ccSmp exit(1); 48156a424ccSmp } 48256a424ccSmp syslog(LOG_WARNING, 4837c478bd9Sstevel@tonic-gate gettext("Rejected connection from unauthorized principal %s"), 48456a424ccSmp name); 48556a424ccSmp free(name); 48656a424ccSmp exit(1); 4877c478bd9Sstevel@tonic-gate } 4887c478bd9Sstevel@tonic-gate omask = umask(077); 4897c478bd9Sstevel@tonic-gate lock_fd = open(temp_file_name, O_RDWR|O_CREAT, 0600); 4907c478bd9Sstevel@tonic-gate (void) umask(omask); 4917c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, 4927c478bd9Sstevel@tonic-gate KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK); 4937c478bd9Sstevel@tonic-gate if (retval) { 4947c478bd9Sstevel@tonic-gate com_err(progname, retval, 4957c478bd9Sstevel@tonic-gate gettext("while trying to lock '%s'"), 4967c478bd9Sstevel@tonic-gate temp_file_name); 4977c478bd9Sstevel@tonic-gate exit(1); 4987c478bd9Sstevel@tonic-gate } 4997c478bd9Sstevel@tonic-gate if ((database_fd = open(temp_file_name, 5007c478bd9Sstevel@tonic-gate O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) { 5017c478bd9Sstevel@tonic-gate com_err(progname, errno, 5027c478bd9Sstevel@tonic-gate gettext("while opening database file, '%s'"), 5037c478bd9Sstevel@tonic-gate temp_file_name); 5047c478bd9Sstevel@tonic-gate exit(1); 5057c478bd9Sstevel@tonic-gate } 5067c478bd9Sstevel@tonic-gate recv_database(doit_context, fd, database_fd, &confmsg); 5077c478bd9Sstevel@tonic-gate if (rename(temp_file_name, file)) { 5087c478bd9Sstevel@tonic-gate com_err(progname, errno, 5097c478bd9Sstevel@tonic-gate gettext("While renaming %s to %s"), 5107c478bd9Sstevel@tonic-gate temp_file_name, file); 5117c478bd9Sstevel@tonic-gate exit(1); 5127c478bd9Sstevel@tonic-gate } 5137c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_SHARED); 5147c478bd9Sstevel@tonic-gate if (retval) { 5157c478bd9Sstevel@tonic-gate com_err(progname, retval, 5167c478bd9Sstevel@tonic-gate gettext("while downgrading lock on '%s'"), 5177c478bd9Sstevel@tonic-gate temp_file_name); 5187c478bd9Sstevel@tonic-gate exit(1); 5197c478bd9Sstevel@tonic-gate } 5207c478bd9Sstevel@tonic-gate load_database(doit_context, kdb5_util, file); 5217c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_UNLOCK); 5227c478bd9Sstevel@tonic-gate if (retval) { 5237c478bd9Sstevel@tonic-gate com_err(progname, retval, 5247c478bd9Sstevel@tonic-gate gettext("while unlocking '%s'"), temp_file_name); 5257c478bd9Sstevel@tonic-gate exit(1); 5267c478bd9Sstevel@tonic-gate } 5277c478bd9Sstevel@tonic-gate (void)close(lock_fd); 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate /* 5307c478bd9Sstevel@tonic-gate * Send the acknowledgement message generated in 5317c478bd9Sstevel@tonic-gate * recv_database, then close the socket. 5327c478bd9Sstevel@tonic-gate */ 53356a424ccSmp retval = krb5_write_message(doit_context, (void *) &fd, &confmsg); 53456a424ccSmp if (retval) { 5357c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 5367c478bd9Sstevel@tonic-gate com_err(progname, retval, 5377c478bd9Sstevel@tonic-gate gettext("while sending # of received bytes")); 5387c478bd9Sstevel@tonic-gate exit(1); 5397c478bd9Sstevel@tonic-gate } 5407c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 5417c478bd9Sstevel@tonic-gate if (close(fd) < 0) { 5427c478bd9Sstevel@tonic-gate com_err(progname, errno, 5437c478bd9Sstevel@tonic-gate gettext("while trying to close database file")); 5447c478bd9Sstevel@tonic-gate exit(1); 5457c478bd9Sstevel@tonic-gate } 54656a424ccSmp 5477c478bd9Sstevel@tonic-gate exit(0); 5487c478bd9Sstevel@tonic-gate } 5497c478bd9Sstevel@tonic-gate 5507c478bd9Sstevel@tonic-gate 5517c478bd9Sstevel@tonic-gate /* 5527c478bd9Sstevel@tonic-gate * Routine to handle incremental update transfer(s) from master KDC 5537c478bd9Sstevel@tonic-gate */ 5547c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx) { 5557c478bd9Sstevel@tonic-gate CLIENT *cl; 5567c478bd9Sstevel@tonic-gate kadm5_ret_t retval; 5577c478bd9Sstevel@tonic-gate kadm5_config_params params; 5587c478bd9Sstevel@tonic-gate krb5_ccache cc; 5597c478bd9Sstevel@tonic-gate krb5_principal iprop_svc_principal; 5607c478bd9Sstevel@tonic-gate void *server_handle = NULL; 5617c478bd9Sstevel@tonic-gate char *iprop_svc_princstr = NULL; 5627c478bd9Sstevel@tonic-gate char *master_svc_princstr = NULL; 5637c478bd9Sstevel@tonic-gate char *admin_server = NULL; 5647c478bd9Sstevel@tonic-gate char *keytab_name = NULL; 5657c478bd9Sstevel@tonic-gate unsigned int pollin, backoff_time; 5667c478bd9Sstevel@tonic-gate int backoff_cnt = 0; 5677c478bd9Sstevel@tonic-gate int reinit_cnt = 0; 5687c478bd9Sstevel@tonic-gate int ret; 5697c478bd9Sstevel@tonic-gate boolean_t frdone = B_FALSE; 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate kdb_incr_result_t *incr_ret; 5727c478bd9Sstevel@tonic-gate static kdb_last_t mylast; 5737c478bd9Sstevel@tonic-gate 5747c478bd9Sstevel@tonic-gate kdb_fullresync_result_t *full_ret; 5757c478bd9Sstevel@tonic-gate char *full_resync_arg = NULL; 5767c478bd9Sstevel@tonic-gate 5777c478bd9Sstevel@tonic-gate kadm5_iprop_handle_t handle; 5787c478bd9Sstevel@tonic-gate kdb_hlog_t *ulog; 5797c478bd9Sstevel@tonic-gate 5807c478bd9Sstevel@tonic-gate if (!debug) 5817c478bd9Sstevel@tonic-gate daemon(0, 0); 5827c478bd9Sstevel@tonic-gate 5837c478bd9Sstevel@tonic-gate pollin = (unsigned int)0; 5847c478bd9Sstevel@tonic-gate (void) memset((char *)¶ms, 0, sizeof (params)); 5857c478bd9Sstevel@tonic-gate ulog = log_ctx->ulog; 5867c478bd9Sstevel@tonic-gate 5877c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 5887c478bd9Sstevel@tonic-gate params.realm = def_realm; 5897c478bd9Sstevel@tonic-gate 5907c478bd9Sstevel@tonic-gate if (master_svc_princstr == NULL) { 5917c478bd9Sstevel@tonic-gate if (retval = kadm5_get_kiprop_host_srv_name(kpropd_context, 5927c478bd9Sstevel@tonic-gate def_realm, &master_svc_princstr)) { 5937c478bd9Sstevel@tonic-gate com_err(progname, retval, 5947c478bd9Sstevel@tonic-gate gettext("%s: unable to get kiprop host based " 5957c478bd9Sstevel@tonic-gate "service name for realm %s\n"), 5967c478bd9Sstevel@tonic-gate progname, def_realm); 5977c478bd9Sstevel@tonic-gate exit(1); 5987c478bd9Sstevel@tonic-gate } 5997c478bd9Sstevel@tonic-gate } 6007c478bd9Sstevel@tonic-gate 6017c478bd9Sstevel@tonic-gate /* 6027c478bd9Sstevel@tonic-gate * Set cc to the default credentials cache 6037c478bd9Sstevel@tonic-gate */ 6047c478bd9Sstevel@tonic-gate if (retval = krb5_cc_default(kpropd_context, &cc)) { 6057c478bd9Sstevel@tonic-gate com_err(progname, retval, 6067c478bd9Sstevel@tonic-gate gettext("while opening default " 6077c478bd9Sstevel@tonic-gate "credentials cache")); 6087c478bd9Sstevel@tonic-gate exit(1); 6097c478bd9Sstevel@tonic-gate } 6107c478bd9Sstevel@tonic-gate 6117c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, NULL, KIPROP_SVC_NAME, 6127c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &iprop_svc_principal); 6137c478bd9Sstevel@tonic-gate if (retval) { 6147c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to construct " 6157c478bd9Sstevel@tonic-gate "host service principal")); 6167c478bd9Sstevel@tonic-gate exit(1); 6177c478bd9Sstevel@tonic-gate } 6187c478bd9Sstevel@tonic-gate 6197c478bd9Sstevel@tonic-gate if (retval = krb5_unparse_name(kpropd_context, iprop_svc_principal, 6207c478bd9Sstevel@tonic-gate &iprop_svc_princstr)) { 6217c478bd9Sstevel@tonic-gate com_err(progname, retval, 6227c478bd9Sstevel@tonic-gate gettext("while canonicalizing " 6237c478bd9Sstevel@tonic-gate "principal name")); 6247c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 6257c478bd9Sstevel@tonic-gate exit(1); 6267c478bd9Sstevel@tonic-gate } 6277c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 6287c478bd9Sstevel@tonic-gate 6297c478bd9Sstevel@tonic-gate reinit: 6307c478bd9Sstevel@tonic-gate /* 6317c478bd9Sstevel@tonic-gate * Authentication, initialize rpcsec_gss handle etc. 6327c478bd9Sstevel@tonic-gate */ 6337c478bd9Sstevel@tonic-gate retval = kadm5_init_with_skey(iprop_svc_princstr, keytab_name, 6347c478bd9Sstevel@tonic-gate master_svc_princstr, 6357c478bd9Sstevel@tonic-gate ¶ms, 6367c478bd9Sstevel@tonic-gate KADM5_STRUCT_VERSION, 6377c478bd9Sstevel@tonic-gate KADM5_API_VERSION_2, 638*54925bf6Swillf NULL, 6397c478bd9Sstevel@tonic-gate &server_handle); 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate if (retval) { 6427c478bd9Sstevel@tonic-gate if (retval == KADM5_RPC_ERROR) { 6437c478bd9Sstevel@tonic-gate reinit_cnt++; 6447c478bd9Sstevel@tonic-gate if (server_handle) 6457c478bd9Sstevel@tonic-gate kadm5_destroy((void *) server_handle); 6467c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 6477c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 6487c478bd9Sstevel@tonic-gate 6497c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext( 6507c478bd9Sstevel@tonic-gate "while attempting to connect" 6517c478bd9Sstevel@tonic-gate " to master KDC ... retrying")); 6527c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&reinit_cnt); 6537c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 6547c478bd9Sstevel@tonic-gate goto reinit; 6557c478bd9Sstevel@tonic-gate } else { 6567c478bd9Sstevel@tonic-gate com_err(progname, retval, 6577c478bd9Sstevel@tonic-gate gettext("while initializing %s interface"), 6587c478bd9Sstevel@tonic-gate progname); 6597c478bd9Sstevel@tonic-gate if (retval == KADM5_BAD_CLIENT_PARAMS || 6607c478bd9Sstevel@tonic-gate retval == KADM5_BAD_SERVER_PARAMS) 6617c478bd9Sstevel@tonic-gate usage(); 6627c478bd9Sstevel@tonic-gate exit(1); 6637c478bd9Sstevel@tonic-gate } 6647c478bd9Sstevel@tonic-gate } 6657c478bd9Sstevel@tonic-gate 6667c478bd9Sstevel@tonic-gate /* 6677c478bd9Sstevel@tonic-gate * Reset re-initialization count to zero now. 6687c478bd9Sstevel@tonic-gate */ 6697c478bd9Sstevel@tonic-gate reinit_cnt = backoff_time = 0; 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate /* 6727c478bd9Sstevel@tonic-gate * Reset the handle to the correct type for the RPC call 6737c478bd9Sstevel@tonic-gate */ 6747c478bd9Sstevel@tonic-gate handle = server_handle; 6757c478bd9Sstevel@tonic-gate 6767c478bd9Sstevel@tonic-gate /* 6777c478bd9Sstevel@tonic-gate * If we have reached this far, we have succesfully established 6787c478bd9Sstevel@tonic-gate * a RPCSEC_GSS connection; we now start polling for updates 6797c478bd9Sstevel@tonic-gate */ 6807c478bd9Sstevel@tonic-gate if (poll_time == NULL) { 6817c478bd9Sstevel@tonic-gate if ((poll_time = (char *)strdup("2m")) == NULL) { 6827c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 6837c478bd9Sstevel@tonic-gate gettext("Unable to allocate poll_time")); 6847c478bd9Sstevel@tonic-gate exit(1); 6857c478bd9Sstevel@tonic-gate } 6867c478bd9Sstevel@tonic-gate } 6877c478bd9Sstevel@tonic-gate 6887c478bd9Sstevel@tonic-gate if (pollin == (unsigned int)0) 6897c478bd9Sstevel@tonic-gate pollin = convert_polltime(poll_time); 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate for (;;) { 6927c478bd9Sstevel@tonic-gate incr_ret = NULL; 6937c478bd9Sstevel@tonic-gate full_ret = NULL; 6947c478bd9Sstevel@tonic-gate 6957c478bd9Sstevel@tonic-gate /* 6967c478bd9Sstevel@tonic-gate * Get the most recent ulog entry sno + ts, which 6977c478bd9Sstevel@tonic-gate * we package in the request to the master KDC 6987c478bd9Sstevel@tonic-gate */ 6997c478bd9Sstevel@tonic-gate mylast.last_sno = ulog->kdb_last_sno; 7007c478bd9Sstevel@tonic-gate mylast.last_time = ulog->kdb_last_time; 7017c478bd9Sstevel@tonic-gate 7027c478bd9Sstevel@tonic-gate /* 7037c478bd9Sstevel@tonic-gate * Loop continuously on an iprop_get_updates_1(), 7047c478bd9Sstevel@tonic-gate * so that we can keep probing the master for updates 7057c478bd9Sstevel@tonic-gate * or (if needed) do a full resync of the krb5 db. 7067c478bd9Sstevel@tonic-gate */ 7077c478bd9Sstevel@tonic-gate 7087c478bd9Sstevel@tonic-gate incr_ret = iprop_get_updates_1(&mylast, handle->clnt); 7097c478bd9Sstevel@tonic-gate if (incr_ret == (kdb_incr_result_t *)NULL) { 7107c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 7117c478bd9Sstevel@tonic-gate "iprop_get_updates call failed"); 7127c478bd9Sstevel@tonic-gate if (server_handle) 7137c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 7147c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 7157c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 7167c478bd9Sstevel@tonic-gate goto reinit; 7177c478bd9Sstevel@tonic-gate } 7187c478bd9Sstevel@tonic-gate 7197c478bd9Sstevel@tonic-gate switch (incr_ret->ret) { 7207c478bd9Sstevel@tonic-gate 7217c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 7227c478bd9Sstevel@tonic-gate /* 7237c478bd9Sstevel@tonic-gate * We dont do a full resync again, if the last 7247c478bd9Sstevel@tonic-gate * X'fer was a resync and if the master sno is 7257c478bd9Sstevel@tonic-gate * still "0", i.e. no updates so far. 7267c478bd9Sstevel@tonic-gate */ 7277c478bd9Sstevel@tonic-gate if ((frdone == B_TRUE) && (incr_ret->lastentry.last_sno 7287c478bd9Sstevel@tonic-gate == 0)) { 7297c478bd9Sstevel@tonic-gate break; 7307c478bd9Sstevel@tonic-gate } else { 7317c478bd9Sstevel@tonic-gate 7327c478bd9Sstevel@tonic-gate full_ret = iprop_full_resync_1((void *) 7337c478bd9Sstevel@tonic-gate &full_resync_arg, handle->clnt); 7347c478bd9Sstevel@tonic-gate 7357c478bd9Sstevel@tonic-gate if (full_ret == (kdb_fullresync_result_t *) 7367c478bd9Sstevel@tonic-gate NULL) { 7377c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 7387c478bd9Sstevel@tonic-gate "iprop_full_resync call failed"); 7397c478bd9Sstevel@tonic-gate if (server_handle) 7407c478bd9Sstevel@tonic-gate kadm5_destroy((void *) 7417c478bd9Sstevel@tonic-gate server_handle); 7427c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 7437c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 7447c478bd9Sstevel@tonic-gate goto reinit; 7457c478bd9Sstevel@tonic-gate } 7467c478bd9Sstevel@tonic-gate } 7477c478bd9Sstevel@tonic-gate 7487c478bd9Sstevel@tonic-gate switch (full_ret->ret) { 7497c478bd9Sstevel@tonic-gate case UPDATE_OK: 7507c478bd9Sstevel@tonic-gate backoff_cnt = 0; 7517c478bd9Sstevel@tonic-gate /* 7527c478bd9Sstevel@tonic-gate * We now listen on the kprop port for 7537c478bd9Sstevel@tonic-gate * the full dump 7547c478bd9Sstevel@tonic-gate */ 7557c478bd9Sstevel@tonic-gate ret = do_standalone(log_ctx->iproprole); 7567c478bd9Sstevel@tonic-gate if (ret) 7577c478bd9Sstevel@tonic-gate syslog(LOG_WARNING, 7587c478bd9Sstevel@tonic-gate gettext("kpropd: Full resync, " 7597c478bd9Sstevel@tonic-gate "invalid return.")); 7607c478bd9Sstevel@tonic-gate if (debug) 7617c478bd9Sstevel@tonic-gate if (ret) 7627c478bd9Sstevel@tonic-gate fprintf(stderr, 7637c478bd9Sstevel@tonic-gate gettext("Full resync " 7647c478bd9Sstevel@tonic-gate "was unsuccessful\n")); 7657c478bd9Sstevel@tonic-gate else 7667c478bd9Sstevel@tonic-gate fprintf(stderr, 7677c478bd9Sstevel@tonic-gate gettext("Full resync " 7687c478bd9Sstevel@tonic-gate "was successful\n")); 7697c478bd9Sstevel@tonic-gate frdone = B_TRUE; 7707c478bd9Sstevel@tonic-gate break; 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 7737c478bd9Sstevel@tonic-gate /* 7747c478bd9Sstevel@tonic-gate * Exponential backoff 7757c478bd9Sstevel@tonic-gate */ 7767c478bd9Sstevel@tonic-gate backoff_cnt++; 7777c478bd9Sstevel@tonic-gate break; 7787c478bd9Sstevel@tonic-gate 7797c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 7807c478bd9Sstevel@tonic-gate case UPDATE_NIL: 7817c478bd9Sstevel@tonic-gate default: 7827c478bd9Sstevel@tonic-gate backoff_cnt = 0; 7837c478bd9Sstevel@tonic-gate frdone = B_FALSE; 7847c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7857c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 7867c478bd9Sstevel@tonic-gate break; 7877c478bd9Sstevel@tonic-gate 7887c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 7897c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7907c478bd9Sstevel@tonic-gate " permission denied.")); 7917c478bd9Sstevel@tonic-gate goto error; 7927c478bd9Sstevel@tonic-gate 7937c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 7947c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7957c478bd9Sstevel@tonic-gate " error returned from master KDC.")); 7967c478bd9Sstevel@tonic-gate goto error; 7977c478bd9Sstevel@tonic-gate } 7987c478bd9Sstevel@tonic-gate break; 7997c478bd9Sstevel@tonic-gate 8007c478bd9Sstevel@tonic-gate case UPDATE_OK: 8017c478bd9Sstevel@tonic-gate backoff_cnt = 0; 8027c478bd9Sstevel@tonic-gate frdone = B_FALSE; 8037c478bd9Sstevel@tonic-gate 8047c478bd9Sstevel@tonic-gate /* 8057c478bd9Sstevel@tonic-gate * ulog_replay() will convert the ulog updates to db 8067c478bd9Sstevel@tonic-gate * entries using the kdb conv api and will commit 8077c478bd9Sstevel@tonic-gate * the entries to the slave kdc database 8087c478bd9Sstevel@tonic-gate */ 8097c478bd9Sstevel@tonic-gate retval = ulog_replay(kpropd_context, incr_ret); 8107c478bd9Sstevel@tonic-gate 8117c478bd9Sstevel@tonic-gate if (retval) { 8127c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ulog_replay" 8137c478bd9Sstevel@tonic-gate " failed, updates not registered.")); 8147c478bd9Sstevel@tonic-gate break; 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate 8177c478bd9Sstevel@tonic-gate if (debug) 8187c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Update transfer " 8197c478bd9Sstevel@tonic-gate "from master was OK\n")); 8207c478bd9Sstevel@tonic-gate break; 8217c478bd9Sstevel@tonic-gate 8227c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 8237c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 8247c478bd9Sstevel@tonic-gate " permission denied.")); 8257c478bd9Sstevel@tonic-gate goto error; 8267c478bd9Sstevel@tonic-gate 8277c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 8287c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates, error " 8297c478bd9Sstevel@tonic-gate "returned from master KDC.")); 8307c478bd9Sstevel@tonic-gate goto error; 8317c478bd9Sstevel@tonic-gate 8327c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 8337c478bd9Sstevel@tonic-gate /* 8347c478bd9Sstevel@tonic-gate * Exponential backoff 8357c478bd9Sstevel@tonic-gate */ 8367c478bd9Sstevel@tonic-gate backoff_cnt++; 8377c478bd9Sstevel@tonic-gate break; 8387c478bd9Sstevel@tonic-gate 8397c478bd9Sstevel@tonic-gate case UPDATE_NIL: 8407c478bd9Sstevel@tonic-gate /* 8417c478bd9Sstevel@tonic-gate * Master-slave are in sync 8427c478bd9Sstevel@tonic-gate */ 8437c478bd9Sstevel@tonic-gate if (debug) 8447c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Master, slave KDC's " 8457c478bd9Sstevel@tonic-gate "are in-sync, no updates\n")); 8467c478bd9Sstevel@tonic-gate backoff_cnt = 0; 8477c478bd9Sstevel@tonic-gate frdone = B_FALSE; 8487c478bd9Sstevel@tonic-gate break; 8497c478bd9Sstevel@tonic-gate 8507c478bd9Sstevel@tonic-gate default: 8517c478bd9Sstevel@tonic-gate backoff_cnt = 0; 8527c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 8537c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 8547c478bd9Sstevel@tonic-gate break; 8557c478bd9Sstevel@tonic-gate } 8567c478bd9Sstevel@tonic-gate 8577c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 8587c478bd9Sstevel@tonic-gate goto done; 8597c478bd9Sstevel@tonic-gate 8607c478bd9Sstevel@tonic-gate /* 8617c478bd9Sstevel@tonic-gate * Sleep for the specified poll interval (Default is 2 mts), 8627c478bd9Sstevel@tonic-gate * or do a binary exponential backoff if we get an 8637c478bd9Sstevel@tonic-gate * UPDATE_BUSY signal 8647c478bd9Sstevel@tonic-gate */ 8657c478bd9Sstevel@tonic-gate if (backoff_cnt > 0) { 8667c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&backoff_cnt); 8677c478bd9Sstevel@tonic-gate if (debug) 8687c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Busy signal received " 8697c478bd9Sstevel@tonic-gate "from master, backoff for %d secs\n"), 8707c478bd9Sstevel@tonic-gate backoff_time); 8717c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 8727c478bd9Sstevel@tonic-gate } 8737c478bd9Sstevel@tonic-gate else 8747c478bd9Sstevel@tonic-gate (void) sleep(pollin); 8757c478bd9Sstevel@tonic-gate 8767c478bd9Sstevel@tonic-gate } 8777c478bd9Sstevel@tonic-gate 8787c478bd9Sstevel@tonic-gate 8797c478bd9Sstevel@tonic-gate error: 8807c478bd9Sstevel@tonic-gate if (debug) 8817c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("ERROR returned by master, bailing\n")); 8827c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ERROR returned by master KDC," 8837c478bd9Sstevel@tonic-gate " bailing.\n")); 8847c478bd9Sstevel@tonic-gate done: 8857c478bd9Sstevel@tonic-gate if (poll_time) 8867c478bd9Sstevel@tonic-gate free(poll_time); 8877c478bd9Sstevel@tonic-gate if(iprop_svc_princstr) 8887c478bd9Sstevel@tonic-gate free(iprop_svc_princstr); 8897c478bd9Sstevel@tonic-gate if (master_svc_princstr) 8907c478bd9Sstevel@tonic-gate free(master_svc_princstr); 8917c478bd9Sstevel@tonic-gate if (retval = krb5_cc_close(kpropd_context, cc)) { 8927c478bd9Sstevel@tonic-gate com_err(progname, retval, 8937c478bd9Sstevel@tonic-gate gettext("while closing default ccache")); 8947c478bd9Sstevel@tonic-gate exit(1); 8957c478bd9Sstevel@tonic-gate } 8967c478bd9Sstevel@tonic-gate if (def_realm) 8977c478bd9Sstevel@tonic-gate free(def_realm); 8987c478bd9Sstevel@tonic-gate if (server_handle) 8997c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 9007c478bd9Sstevel@tonic-gate if (kpropd_context) 9017c478bd9Sstevel@tonic-gate krb5_free_context(kpropd_context); 9027c478bd9Sstevel@tonic-gate 9037c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 9047c478bd9Sstevel@tonic-gate return (0); 9057c478bd9Sstevel@tonic-gate else 9067c478bd9Sstevel@tonic-gate exit(1); 9077c478bd9Sstevel@tonic-gate } 9087c478bd9Sstevel@tonic-gate 9097c478bd9Sstevel@tonic-gate 9107c478bd9Sstevel@tonic-gate /* 9117c478bd9Sstevel@tonic-gate * Do exponential backoff, since master KDC is BUSY or down 9127c478bd9Sstevel@tonic-gate */ 9137c478bd9Sstevel@tonic-gate unsigned int backoff_from_master(int *cnt) { 9147c478bd9Sstevel@tonic-gate unsigned int btime; 9157c478bd9Sstevel@tonic-gate 9167c478bd9Sstevel@tonic-gate btime = (unsigned int)(2<<(*cnt)); 9177c478bd9Sstevel@tonic-gate if (btime > MAX_BACKOFF) { 9187c478bd9Sstevel@tonic-gate btime = MAX_BACKOFF; 9197c478bd9Sstevel@tonic-gate *cnt--; 9207c478bd9Sstevel@tonic-gate } 9217c478bd9Sstevel@tonic-gate 9227c478bd9Sstevel@tonic-gate return (btime); 9237c478bd9Sstevel@tonic-gate } 9247c478bd9Sstevel@tonic-gate 9257c478bd9Sstevel@tonic-gate 9267c478bd9Sstevel@tonic-gate /* 9277c478bd9Sstevel@tonic-gate * Routine to convert the `pollstr' string to seconds 9287c478bd9Sstevel@tonic-gate */ 9297c478bd9Sstevel@tonic-gate int convert_polltime(char *pollstr) { 9307c478bd9Sstevel@tonic-gate char *tokenptr = NULL; 9317c478bd9Sstevel@tonic-gate int len, polltime; 9327c478bd9Sstevel@tonic-gate 9337c478bd9Sstevel@tonic-gate len = polltime = 0; 9347c478bd9Sstevel@tonic-gate 9357c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "s")) < strlen(pollstr)) { 9367c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9377c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9387c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr); 9397c478bd9Sstevel@tonic-gate } 9407c478bd9Sstevel@tonic-gate 9417c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "m")) < strlen(pollstr)) { 9427c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9437c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9447c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 60; 9457c478bd9Sstevel@tonic-gate } 9467c478bd9Sstevel@tonic-gate 9477c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "h")) < strlen(pollstr)) { 9487c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9497c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9507c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 3600; 9517c478bd9Sstevel@tonic-gate } 9527c478bd9Sstevel@tonic-gate 9537c478bd9Sstevel@tonic-gate if (tokenptr != NULL) 9547c478bd9Sstevel@tonic-gate free(tokenptr); 9557c478bd9Sstevel@tonic-gate /* 9567c478bd9Sstevel@tonic-gate * If we have a bogus pollstr value, set polltime to the 9577c478bd9Sstevel@tonic-gate * default of 2 mts (120 seconds). 9587c478bd9Sstevel@tonic-gate */ 9597c478bd9Sstevel@tonic-gate if (polltime == 0) 9607c478bd9Sstevel@tonic-gate polltime = 120; 9617c478bd9Sstevel@tonic-gate return (polltime); 9627c478bd9Sstevel@tonic-gate } 9637c478bd9Sstevel@tonic-gate 9647c478bd9Sstevel@tonic-gate static void 9657c478bd9Sstevel@tonic-gate kpropd_com_err_proc(whoami, code, fmt, args) 9667c478bd9Sstevel@tonic-gate const char *whoami; 9677c478bd9Sstevel@tonic-gate long code; 9687c478bd9Sstevel@tonic-gate const char *fmt; 9697c478bd9Sstevel@tonic-gate va_list args; 9707c478bd9Sstevel@tonic-gate { 9717c478bd9Sstevel@tonic-gate char error_buf[8096]; 9727c478bd9Sstevel@tonic-gate 9737c478bd9Sstevel@tonic-gate error_buf[0] = '\0'; 9747c478bd9Sstevel@tonic-gate if (fmt) 9757c478bd9Sstevel@tonic-gate vsprintf(error_buf, fmt, args); 9767c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "%s%s%s%s%s", whoami ? whoami : "", whoami ? ": " : "", 9777c478bd9Sstevel@tonic-gate code ? error_message(code) : "", code ? " " : "", error_buf); 9787c478bd9Sstevel@tonic-gate } 9797c478bd9Sstevel@tonic-gate 9807c478bd9Sstevel@tonic-gate void PRS(argc,argv) 9817c478bd9Sstevel@tonic-gate int argc; 9827c478bd9Sstevel@tonic-gate char **argv; 9837c478bd9Sstevel@tonic-gate { 9847c478bd9Sstevel@tonic-gate register char *word, ch; 9857c478bd9Sstevel@tonic-gate char *cp; 9867c478bd9Sstevel@tonic-gate int c; 9877c478bd9Sstevel@tonic-gate struct hostent *hp; 9887c478bd9Sstevel@tonic-gate char my_host_name[MAXHOSTNAMELEN], buf[BUFSIZ]; 9897c478bd9Sstevel@tonic-gate krb5_error_code retval; 9907c478bd9Sstevel@tonic-gate static const char tmp[] = ".temp"; 9917c478bd9Sstevel@tonic-gate kadm5_config_params params; 9927c478bd9Sstevel@tonic-gate 9937c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 9947c478bd9Sstevel@tonic-gate 9957c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 9967c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KPROPD_TEST" /* Use this only if it weren't */ 9977c478bd9Sstevel@tonic-gate #endif 9987c478bd9Sstevel@tonic-gate 9997c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate (void) memset((char *) ¶ms, 0, sizeof (params)); 10027c478bd9Sstevel@tonic-gate 10037c478bd9Sstevel@tonic-gate retval = krb5_init_context(&kpropd_context); 10047c478bd9Sstevel@tonic-gate if (retval) { 10057c478bd9Sstevel@tonic-gate com_err(argv[0], retval, 10067c478bd9Sstevel@tonic-gate gettext("while initializing krb5")); 10077c478bd9Sstevel@tonic-gate exit(1); 10087c478bd9Sstevel@tonic-gate } 10097c478bd9Sstevel@tonic-gate progname = argv[0]; 10107c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, "dtf:F:p:P:r:s:Sa:")) != EOF){ 10117c478bd9Sstevel@tonic-gate switch (c) { 10127c478bd9Sstevel@tonic-gate case 'd': 10137c478bd9Sstevel@tonic-gate debug++; 10147c478bd9Sstevel@tonic-gate break; 10157c478bd9Sstevel@tonic-gate case 't': 10167c478bd9Sstevel@tonic-gate /* 10177c478bd9Sstevel@tonic-gate * Undocumented option - for testing only. 10187c478bd9Sstevel@tonic-gate * 10197c478bd9Sstevel@tonic-gate * Option to run the kpropd server exactly 10207c478bd9Sstevel@tonic-gate * once (this is true only if iprop is enabled). 10217c478bd9Sstevel@tonic-gate */ 10227c478bd9Sstevel@tonic-gate runonce = B_TRUE; 10237c478bd9Sstevel@tonic-gate break; 10247c478bd9Sstevel@tonic-gate 10257c478bd9Sstevel@tonic-gate case 'f': 10267c478bd9Sstevel@tonic-gate file = optarg; 10277c478bd9Sstevel@tonic-gate if (!file) 10287c478bd9Sstevel@tonic-gate usage(); 10297c478bd9Sstevel@tonic-gate break; 10307c478bd9Sstevel@tonic-gate case 'F': 10317c478bd9Sstevel@tonic-gate kerb_database = optarg; 10327c478bd9Sstevel@tonic-gate if (!kerb_database) 10337c478bd9Sstevel@tonic-gate usage(); 10347c478bd9Sstevel@tonic-gate break; 10357c478bd9Sstevel@tonic-gate case 'p': 10367c478bd9Sstevel@tonic-gate kdb5_util = optarg; 10377c478bd9Sstevel@tonic-gate if (!kdb5_util) 10387c478bd9Sstevel@tonic-gate usage(); 10397c478bd9Sstevel@tonic-gate break; 10407c478bd9Sstevel@tonic-gate case 'P': 10417c478bd9Sstevel@tonic-gate port = htons(atoi(optarg)); 10427c478bd9Sstevel@tonic-gate if (!port) 10437c478bd9Sstevel@tonic-gate usage(); 10447c478bd9Sstevel@tonic-gate break; 10457c478bd9Sstevel@tonic-gate case 'r': 10467c478bd9Sstevel@tonic-gate realm = optarg; 10477c478bd9Sstevel@tonic-gate if (!realm) 10487c478bd9Sstevel@tonic-gate usage(); 10497c478bd9Sstevel@tonic-gate params.realm = realm; 10507c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 10517c478bd9Sstevel@tonic-gate break; 10527c478bd9Sstevel@tonic-gate case 's': 10537c478bd9Sstevel@tonic-gate srvtab = optarg; 10547c478bd9Sstevel@tonic-gate if (!srvtab) 10557c478bd9Sstevel@tonic-gate usage(); 10567c478bd9Sstevel@tonic-gate break; 10577c478bd9Sstevel@tonic-gate case 'S': 10587c478bd9Sstevel@tonic-gate standalone++; 10597c478bd9Sstevel@tonic-gate break; 10607c478bd9Sstevel@tonic-gate case 'a': 10617c478bd9Sstevel@tonic-gate acl_file_name = optarg; 10627c478bd9Sstevel@tonic-gate if (!acl_file_name) 10637c478bd9Sstevel@tonic-gate usage(); 10647c478bd9Sstevel@tonic-gate break; 10657c478bd9Sstevel@tonic-gate case '?': 10667c478bd9Sstevel@tonic-gate default: 10677c478bd9Sstevel@tonic-gate usage(); 10687c478bd9Sstevel@tonic-gate } 10697c478bd9Sstevel@tonic-gate 10707c478bd9Sstevel@tonic-gate } 10717c478bd9Sstevel@tonic-gate /* 10727c478bd9Sstevel@tonic-gate * If not in debug mode, switch com_err reporting to syslog 10737c478bd9Sstevel@tonic-gate */ 10747c478bd9Sstevel@tonic-gate if (! debug) { 10757c478bd9Sstevel@tonic-gate openlog("kpropd", LOG_PID | LOG_ODELAY, SYSLOG_CLASS); 10767c478bd9Sstevel@tonic-gate set_com_err_hook(kpropd_com_err_proc); 10777c478bd9Sstevel@tonic-gate } 10787c478bd9Sstevel@tonic-gate /* 10797c478bd9Sstevel@tonic-gate * Get my hostname, so we can construct my service name 10807c478bd9Sstevel@tonic-gate */ 10817c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, 10827c478bd9Sstevel@tonic-gate NULL, KPROP_SERVICE_NAME, 10837c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &server); 10847c478bd9Sstevel@tonic-gate if (retval) { 10857c478bd9Sstevel@tonic-gate com_err(progname, retval, 10867c478bd9Sstevel@tonic-gate gettext("While trying to construct my service name")); 10877c478bd9Sstevel@tonic-gate exit(1); 10887c478bd9Sstevel@tonic-gate } 10897c478bd9Sstevel@tonic-gate if (realm) { 109056a424ccSmp retval = krb5_set_principal_realm(kpropd_context, server, realm); 109156a424ccSmp if (retval) { 109256a424ccSmp com_err(progname, errno, 109356a424ccSmp gettext("while constructing my service realm")); 109456a424ccSmp exit(1); 109556a424ccSmp } 10967c478bd9Sstevel@tonic-gate } 10977c478bd9Sstevel@tonic-gate /* 10987c478bd9Sstevel@tonic-gate * Construct the name of the temporary file. 10997c478bd9Sstevel@tonic-gate */ 11007c478bd9Sstevel@tonic-gate if ((temp_file_name = (char *) malloc(strlen(file) + 11017c478bd9Sstevel@tonic-gate strlen(tmp) + 1)) == NULL) { 11027c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 11037c478bd9Sstevel@tonic-gate gettext("while allocating filename for temp file")); 11047c478bd9Sstevel@tonic-gate exit(1); 11057c478bd9Sstevel@tonic-gate } 11067c478bd9Sstevel@tonic-gate strcpy(temp_file_name, file); 11077c478bd9Sstevel@tonic-gate strcat(temp_file_name, tmp); 11087c478bd9Sstevel@tonic-gate 11097c478bd9Sstevel@tonic-gate retval = kadm5_get_config_params(kpropd_context, NULL, NULL, ¶ms, 11107c478bd9Sstevel@tonic-gate ¶ms); 11117c478bd9Sstevel@tonic-gate if (retval) { 11127c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing")); 11137c478bd9Sstevel@tonic-gate exit(1); 11147c478bd9Sstevel@tonic-gate } 11157c478bd9Sstevel@tonic-gate if (params.iprop_enabled == TRUE) { 11167c478bd9Sstevel@tonic-gate ulog_set_role(kpropd_context, IPROP_SLAVE); 11177c478bd9Sstevel@tonic-gate poll_time = params.iprop_polltime; 11187c478bd9Sstevel@tonic-gate 11197c478bd9Sstevel@tonic-gate if (ulog_map(kpropd_context, ¶ms, FKPROPD)) { 11207c478bd9Sstevel@tonic-gate com_err(progname, errno, 11217c478bd9Sstevel@tonic-gate gettext("Unable to map log!\n")); 11227c478bd9Sstevel@tonic-gate exit(1); 11237c478bd9Sstevel@tonic-gate } 11247c478bd9Sstevel@tonic-gate } 11257c478bd9Sstevel@tonic-gate 11267c478bd9Sstevel@tonic-gate /* 11277c478bd9Sstevel@tonic-gate * Grab the realm info and check if iprop is enabled. 11287c478bd9Sstevel@tonic-gate */ 11297c478bd9Sstevel@tonic-gate if (def_realm == NULL) { 11307c478bd9Sstevel@tonic-gate retval = krb5_get_default_realm(kpropd_context, &def_realm); 11317c478bd9Sstevel@tonic-gate if (retval) { 11327c478bd9Sstevel@tonic-gate com_err(progname, retval, 11337c478bd9Sstevel@tonic-gate gettext("Unable to get default realm")); 11347c478bd9Sstevel@tonic-gate exit(1); 11357c478bd9Sstevel@tonic-gate } 11367c478bd9Sstevel@tonic-gate } 11377c478bd9Sstevel@tonic-gate } 11387c478bd9Sstevel@tonic-gate 11397c478bd9Sstevel@tonic-gate /* 11407c478bd9Sstevel@tonic-gate * Figure out who's calling on the other end of the connection.... 11417c478bd9Sstevel@tonic-gate */ 11427c478bd9Sstevel@tonic-gate void 11437c478bd9Sstevel@tonic-gate kerberos_authenticate(context, fd, clientp, etype, ss) 11447c478bd9Sstevel@tonic-gate krb5_context context; 11457c478bd9Sstevel@tonic-gate int fd; 11467c478bd9Sstevel@tonic-gate krb5_principal * clientp; 11477c478bd9Sstevel@tonic-gate krb5_enctype * etype; 11487c478bd9Sstevel@tonic-gate struct sockaddr_storage ss; 11497c478bd9Sstevel@tonic-gate { 11507c478bd9Sstevel@tonic-gate krb5_error_code retval; 11517c478bd9Sstevel@tonic-gate krb5_ticket * ticket; 11527c478bd9Sstevel@tonic-gate struct sockaddr_storage r_ss; 11537c478bd9Sstevel@tonic-gate int ss_length; 11547c478bd9Sstevel@tonic-gate krb5_keytab keytab = NULL; 11557c478bd9Sstevel@tonic-gate 11567c478bd9Sstevel@tonic-gate /* 11577c478bd9Sstevel@tonic-gate * Set recv_addr and send_addr 11587c478bd9Sstevel@tonic-gate */ 11597c478bd9Sstevel@tonic-gate if (cvtkaddr(&ss, &sender_addr) == NULL) { 11607c478bd9Sstevel@tonic-gate com_err(progname, errno, 11617c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 11627c478bd9Sstevel@tonic-gate exit(1); 11637c478bd9Sstevel@tonic-gate } 11647c478bd9Sstevel@tonic-gate 11657c478bd9Sstevel@tonic-gate ss_length = sizeof (r_ss); 11667c478bd9Sstevel@tonic-gate if (getsockname(fd, (struct sockaddr *) &r_ss, &ss_length)) { 11677c478bd9Sstevel@tonic-gate com_err(progname, errno, 11687c478bd9Sstevel@tonic-gate gettext("while getting local socket address")); 11697c478bd9Sstevel@tonic-gate exit(1); 11707c478bd9Sstevel@tonic-gate } 11717c478bd9Sstevel@tonic-gate 11727c478bd9Sstevel@tonic-gate if (cvtkaddr(&r_ss, &receiver_addr) == NULL) { 11737c478bd9Sstevel@tonic-gate com_err(progname, errno, 11747c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 11757c478bd9Sstevel@tonic-gate exit(1); 11767c478bd9Sstevel@tonic-gate } 11777c478bd9Sstevel@tonic-gate 11787c478bd9Sstevel@tonic-gate if (debug) { 11797c478bd9Sstevel@tonic-gate char *name; 118056a424ccSmp 118156a424ccSmp retval = krb5_unparse_name(context, server, &name); 118256a424ccSmp if (retval) { 11837c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("While unparsing server name")); 11847c478bd9Sstevel@tonic-gate exit(1); 11857c478bd9Sstevel@tonic-gate } 11867c478bd9Sstevel@tonic-gate printf(gettext("krb5_recvauth(%d, %s, %s, ...)\n"), fd, kprop_version, 11877c478bd9Sstevel@tonic-gate name); 11887c478bd9Sstevel@tonic-gate free(name); 11897c478bd9Sstevel@tonic-gate } 11907c478bd9Sstevel@tonic-gate 119156a424ccSmp retval = krb5_auth_con_init(context, &auth_context); 119256a424ccSmp if (retval) { 11937c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_init: %s"), 119456a424ccSmp error_message(retval)); 11957c478bd9Sstevel@tonic-gate exit(1); 11967c478bd9Sstevel@tonic-gate } 11977c478bd9Sstevel@tonic-gate 119856a424ccSmp retval = krb5_auth_con_setflags(context, auth_context, 119956a424ccSmp KRB5_AUTH_CONTEXT_DO_SEQUENCE); 120056a424ccSmp if (retval) { 12017c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setflags: %s"), 12027c478bd9Sstevel@tonic-gate error_message(retval)); 12037c478bd9Sstevel@tonic-gate exit(1); 12047c478bd9Sstevel@tonic-gate } 12057c478bd9Sstevel@tonic-gate 120656a424ccSmp retval = krb5_auth_con_setaddrs(context, auth_context, &receiver_addr, 120756a424ccSmp &sender_addr); 120856a424ccSmp if (retval) { 12097c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setaddrs: %s"), 12107c478bd9Sstevel@tonic-gate error_message(retval)); 12117c478bd9Sstevel@tonic-gate exit(1); 12127c478bd9Sstevel@tonic-gate } 12137c478bd9Sstevel@tonic-gate 12147c478bd9Sstevel@tonic-gate if (srvtab) { 121556a424ccSmp retval = krb5_kt_resolve(context, srvtab, &keytab); 121656a424ccSmp if (retval) { 12177c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_kt_resolve: %s"), error_message(retval)); 12187c478bd9Sstevel@tonic-gate exit(1); 12197c478bd9Sstevel@tonic-gate } 12207c478bd9Sstevel@tonic-gate } 12217c478bd9Sstevel@tonic-gate 122256a424ccSmp retval = krb5_recvauth(context, &auth_context, (void *) &fd, 122356a424ccSmp kprop_version, server, 0, keytab, &ticket); 122456a424ccSmp if (retval) { 122556a424ccSmp syslog(LOG_ERR, gettext("Error in krb5_recvauth: %s"), error_message(retval)); 12267c478bd9Sstevel@tonic-gate exit(1); 12277c478bd9Sstevel@tonic-gate } 12287c478bd9Sstevel@tonic-gate 122956a424ccSmp retval = krb5_copy_principal(context, ticket->enc_part2->client, clientp); 123056a424ccSmp if (retval) { 12317c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_copy_prinicpal: %s"), 12327c478bd9Sstevel@tonic-gate error_message(retval)); 12337c478bd9Sstevel@tonic-gate exit(1); 12347c478bd9Sstevel@tonic-gate } 12357c478bd9Sstevel@tonic-gate 12367c478bd9Sstevel@tonic-gate *etype = ticket->enc_part.enctype; 12377c478bd9Sstevel@tonic-gate 12387c478bd9Sstevel@tonic-gate if (debug) { 12397c478bd9Sstevel@tonic-gate char * name; 12407c478bd9Sstevel@tonic-gate char etypebuf[100]; 12417c478bd9Sstevel@tonic-gate 124256a424ccSmp retval = krb5_unparse_name(context, *clientp, &name); 124356a424ccSmp if (retval) { 12447c478bd9Sstevel@tonic-gate com_err(progname, retval, 12457c478bd9Sstevel@tonic-gate gettext("While unparsing client name")); 12467c478bd9Sstevel@tonic-gate exit(1); 12477c478bd9Sstevel@tonic-gate } 12487c478bd9Sstevel@tonic-gate 124956a424ccSmp retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf)); 125056a424ccSmp if (retval) { 12517c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("While unparsing ticket etype")); 12527c478bd9Sstevel@tonic-gate exit(1); 12537c478bd9Sstevel@tonic-gate } 12547c478bd9Sstevel@tonic-gate 12557c478bd9Sstevel@tonic-gate printf("authenticated client: %s (etype == %s)\n", name, etypebuf); 12567c478bd9Sstevel@tonic-gate free(name); 12577c478bd9Sstevel@tonic-gate } 12587c478bd9Sstevel@tonic-gate 12597c478bd9Sstevel@tonic-gate krb5_free_ticket(context, ticket); 12607c478bd9Sstevel@tonic-gate } 12617c478bd9Sstevel@tonic-gate 12627c478bd9Sstevel@tonic-gate krb5_boolean 12637c478bd9Sstevel@tonic-gate authorized_principal(context, p, auth_etype) 12647c478bd9Sstevel@tonic-gate krb5_context context; 12657c478bd9Sstevel@tonic-gate krb5_principal p; 12667c478bd9Sstevel@tonic-gate krb5_enctype auth_etype; 12677c478bd9Sstevel@tonic-gate { 12687c478bd9Sstevel@tonic-gate char *name, *ptr; 12697c478bd9Sstevel@tonic-gate char buf[1024]; 12707c478bd9Sstevel@tonic-gate krb5_error_code retval; 12717c478bd9Sstevel@tonic-gate FILE *acl_file; 12727c478bd9Sstevel@tonic-gate int end; 12737c478bd9Sstevel@tonic-gate krb5_enctype acl_etype; 12747c478bd9Sstevel@tonic-gate 12757c478bd9Sstevel@tonic-gate retval = krb5_unparse_name(context, p, &name); 12767c478bd9Sstevel@tonic-gate if (retval) 12777c478bd9Sstevel@tonic-gate return FALSE; 12787c478bd9Sstevel@tonic-gate 12797c478bd9Sstevel@tonic-gate acl_file = fopen(acl_file_name, "r"); 12807c478bd9Sstevel@tonic-gate if (!acl_file) 12817c478bd9Sstevel@tonic-gate return FALSE; 12827c478bd9Sstevel@tonic-gate 12837c478bd9Sstevel@tonic-gate while (!feof(acl_file)) { 12847c478bd9Sstevel@tonic-gate if (!fgets(buf, sizeof(buf), acl_file)) 12857c478bd9Sstevel@tonic-gate break; 12867c478bd9Sstevel@tonic-gate end = strlen(buf) - 1; 12877c478bd9Sstevel@tonic-gate if (buf[end] == '\n') 12887c478bd9Sstevel@tonic-gate buf[end] = '\0'; 12897c478bd9Sstevel@tonic-gate if (!strncmp(name, buf, strlen(name))) { 12907c478bd9Sstevel@tonic-gate ptr = buf+strlen(name); 12917c478bd9Sstevel@tonic-gate 12927c478bd9Sstevel@tonic-gate /* if the next character is not whitespace or nul, then 12937c478bd9Sstevel@tonic-gate the match is only partial. continue on to new lines. */ 129456a424ccSmp if (*ptr && !isspace((int) *ptr)) 12957c478bd9Sstevel@tonic-gate continue; 12967c478bd9Sstevel@tonic-gate 12977c478bd9Sstevel@tonic-gate /* otherwise, skip trailing whitespace */ 129856a424ccSmp for (; *ptr && isspace((int) *ptr); ptr++) ; 12997c478bd9Sstevel@tonic-gate 13007c478bd9Sstevel@tonic-gate /* now, look for an etype string. if there isn't one, 13017c478bd9Sstevel@tonic-gate return true. if there is an invalid string, continue. 13027c478bd9Sstevel@tonic-gate If there is a valid string, return true only if it 13037c478bd9Sstevel@tonic-gate matches the etype passed in, otherwise continue */ 13047c478bd9Sstevel@tonic-gate 13057c478bd9Sstevel@tonic-gate if ((*ptr) && 13067c478bd9Sstevel@tonic-gate ((retval = krb5_string_to_enctype(ptr, &acl_etype)) || 13077c478bd9Sstevel@tonic-gate (acl_etype != auth_etype))) 13087c478bd9Sstevel@tonic-gate continue; 13097c478bd9Sstevel@tonic-gate 13107c478bd9Sstevel@tonic-gate free(name); 13117c478bd9Sstevel@tonic-gate fclose(acl_file); 13127c478bd9Sstevel@tonic-gate return TRUE; 13137c478bd9Sstevel@tonic-gate } 13147c478bd9Sstevel@tonic-gate } 13157c478bd9Sstevel@tonic-gate free(name); 13167c478bd9Sstevel@tonic-gate fclose(acl_file); 13177c478bd9Sstevel@tonic-gate return FALSE; 13187c478bd9Sstevel@tonic-gate } 13197c478bd9Sstevel@tonic-gate 13207c478bd9Sstevel@tonic-gate void 13217c478bd9Sstevel@tonic-gate recv_database(context, fd, database_fd, confmsg) 13227c478bd9Sstevel@tonic-gate krb5_context context; 13237c478bd9Sstevel@tonic-gate int fd; 13247c478bd9Sstevel@tonic-gate int database_fd; 13257c478bd9Sstevel@tonic-gate krb5_data *confmsg; 13267c478bd9Sstevel@tonic-gate { 132756a424ccSmp krb5_ui_4 database_size; /* This must be 4 bytes */ 13287c478bd9Sstevel@tonic-gate int received_size, n; 13297c478bd9Sstevel@tonic-gate char buf[1024]; 13307c478bd9Sstevel@tonic-gate krb5_data inbuf, outbuf; 13317c478bd9Sstevel@tonic-gate krb5_error_code retval; 13327c478bd9Sstevel@tonic-gate 13337c478bd9Sstevel@tonic-gate /* 13347c478bd9Sstevel@tonic-gate * Receive and decode size from client 13357c478bd9Sstevel@tonic-gate */ 133656a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 133756a424ccSmp if (retval) { 13387c478bd9Sstevel@tonic-gate send_error(context, fd, retval, gettext("while reading database size")); 13397c478bd9Sstevel@tonic-gate com_err(progname, retval, 13407c478bd9Sstevel@tonic-gate gettext("while reading size of database from client")); 13417c478bd9Sstevel@tonic-gate exit(1); 13427c478bd9Sstevel@tonic-gate } 13437c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 13447c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 134556a424ccSmp retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL); 134656a424ccSmp if (retval) { 134756a424ccSmp send_error(context, fd, retval, gettext( 134856a424ccSmp "while decoding database size")); 13497c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13507c478bd9Sstevel@tonic-gate com_err(progname, retval, 13517c478bd9Sstevel@tonic-gate gettext("while decoding database size from client")); 13527c478bd9Sstevel@tonic-gate exit(1); 13537c478bd9Sstevel@tonic-gate } 13547c478bd9Sstevel@tonic-gate memcpy((char *) &database_size, outbuf.data, sizeof(database_size)); 13557c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13567c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 13577c478bd9Sstevel@tonic-gate database_size = ntohl(database_size); 13587c478bd9Sstevel@tonic-gate 135956a424ccSmp /* 136056a424ccSmp * Initialize the initial vector. 136156a424ccSmp */ 136256a424ccSmp retval = krb5_auth_con_initivector(context, auth_context); 136356a424ccSmp if (retval) { 136456a424ccSmp send_error(context, fd, retval, gettext( 136556a424ccSmp "failed while initializing i_vector")); 136656a424ccSmp com_err(progname, retval, gettext("while initializing i_vector")); 136756a424ccSmp exit(1); 136856a424ccSmp } 13697c478bd9Sstevel@tonic-gate 13707c478bd9Sstevel@tonic-gate /* 13717c478bd9Sstevel@tonic-gate * Now start receiving the database from the net 13727c478bd9Sstevel@tonic-gate */ 13737c478bd9Sstevel@tonic-gate received_size = 0; 13747c478bd9Sstevel@tonic-gate while (received_size < database_size) { 137556a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 137656a424ccSmp if (retval) { 13777c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13787c478bd9Sstevel@tonic-gate gettext("while reading database block starting at offset %d"), 13797c478bd9Sstevel@tonic-gate received_size); 13807c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 13817c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 13827c478bd9Sstevel@tonic-gate exit(1); 13837c478bd9Sstevel@tonic-gate } 13847c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 13857c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 138656a424ccSmp retval = krb5_rd_priv(context, auth_context, &inbuf, 138756a424ccSmp &outbuf, NULL); 138856a424ccSmp if (retval) { 13897c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13907c478bd9Sstevel@tonic-gate gettext("while decoding database block starting at offset %d"), 13917c478bd9Sstevel@tonic-gate received_size); 13927c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 13937c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 13947c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13957c478bd9Sstevel@tonic-gate exit(1); 13967c478bd9Sstevel@tonic-gate } 13977c478bd9Sstevel@tonic-gate n = write(database_fd, outbuf.data, outbuf.length); 13987c478bd9Sstevel@tonic-gate if (n < 0) { 13997c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 14007c478bd9Sstevel@tonic-gate gettext( 14017c478bd9Sstevel@tonic-gate "while writing database block starting at offset %d"), 14027c478bd9Sstevel@tonic-gate received_size); 14037c478bd9Sstevel@tonic-gate send_error(context, fd, errno, buf); 14047c478bd9Sstevel@tonic-gate } else if (n != outbuf.length) { 14057c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 14067c478bd9Sstevel@tonic-gate gettext( 14077c478bd9Sstevel@tonic-gate "incomplete write while writing database block starting at\n" 14087c478bd9Sstevel@tonic-gate "offset %d (%d written, %d expected)"), 14097c478bd9Sstevel@tonic-gate received_size, n, outbuf.length); 14107c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 14117c478bd9Sstevel@tonic-gate } 14127c478bd9Sstevel@tonic-gate received_size += outbuf.length; 14137c478bd9Sstevel@tonic-gate /* SUNWresync121: our krb5...contents sets length to 0 */ 14147c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 14157c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 141656a424ccSmp 14177c478bd9Sstevel@tonic-gate } 14187c478bd9Sstevel@tonic-gate /* 14197c478bd9Sstevel@tonic-gate * OK, we've seen the entire file. Did we get too many bytes? 14207c478bd9Sstevel@tonic-gate */ 14217c478bd9Sstevel@tonic-gate if (received_size > database_size) { 14227c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 14237c478bd9Sstevel@tonic-gate gettext("Received %d bytes, expected %d bytes for database file"), 14247c478bd9Sstevel@tonic-gate received_size, database_size); 14257c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 14267c478bd9Sstevel@tonic-gate } 14277c478bd9Sstevel@tonic-gate /* 14287c478bd9Sstevel@tonic-gate * Create message acknowledging number of bytes received, but 14297c478bd9Sstevel@tonic-gate * don't send it until kdb5_util returns successfully. 14307c478bd9Sstevel@tonic-gate */ 14317c478bd9Sstevel@tonic-gate database_size = htonl(database_size); 14327c478bd9Sstevel@tonic-gate inbuf.data = (char *) &database_size; 14337c478bd9Sstevel@tonic-gate inbuf.length = sizeof(database_size); 143456a424ccSmp retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); 143556a424ccSmp if (retval) { 14367c478bd9Sstevel@tonic-gate com_err(progname, retval, 14377c478bd9Sstevel@tonic-gate gettext("while encoding # of receieved bytes")); 14387c478bd9Sstevel@tonic-gate send_error(context, fd, retval, 14397c478bd9Sstevel@tonic-gate gettext("while encoding # of received bytes")); 14407c478bd9Sstevel@tonic-gate exit(1); 14417c478bd9Sstevel@tonic-gate } 14427c478bd9Sstevel@tonic-gate } 14437c478bd9Sstevel@tonic-gate 14447c478bd9Sstevel@tonic-gate 14457c478bd9Sstevel@tonic-gate void 14467c478bd9Sstevel@tonic-gate send_error(context, fd, err_code, err_text) 14477c478bd9Sstevel@tonic-gate krb5_context context; 14487c478bd9Sstevel@tonic-gate int fd; 14497c478bd9Sstevel@tonic-gate krb5_error_code err_code; 14507c478bd9Sstevel@tonic-gate char *err_text; 14517c478bd9Sstevel@tonic-gate { 14527c478bd9Sstevel@tonic-gate krb5_error error; 14537c478bd9Sstevel@tonic-gate const char *text; 14547c478bd9Sstevel@tonic-gate krb5_data outbuf; 14557c478bd9Sstevel@tonic-gate char buf[1024]; 14567c478bd9Sstevel@tonic-gate 14577c478bd9Sstevel@tonic-gate memset((char *)&error, 0, sizeof(error)); 14587c478bd9Sstevel@tonic-gate krb5_us_timeofday(context, &error.stime, &error.susec); 14597c478bd9Sstevel@tonic-gate error.server = server; 14607c478bd9Sstevel@tonic-gate error.client = client; 14617c478bd9Sstevel@tonic-gate 14627c478bd9Sstevel@tonic-gate if (err_text) 14637c478bd9Sstevel@tonic-gate text = err_text; 14647c478bd9Sstevel@tonic-gate else 14657c478bd9Sstevel@tonic-gate text = error_message(err_code); 14667c478bd9Sstevel@tonic-gate 14677c478bd9Sstevel@tonic-gate error.error = err_code - ERROR_TABLE_BASE_krb5; 14687c478bd9Sstevel@tonic-gate if (error.error > 127) { 14697c478bd9Sstevel@tonic-gate error.error = KRB_ERR_GENERIC; 14707c478bd9Sstevel@tonic-gate if (err_text) { 14717c478bd9Sstevel@tonic-gate sprintf(buf, "%s %s", error_message(err_code), 14727c478bd9Sstevel@tonic-gate err_text); 14737c478bd9Sstevel@tonic-gate text = buf; 14747c478bd9Sstevel@tonic-gate } 14757c478bd9Sstevel@tonic-gate } 14767c478bd9Sstevel@tonic-gate error.text.length = strlen(text) + 1; 147756a424ccSmp error.text.data = malloc(error.text.length); 147856a424ccSmp if (error.text.data) { 14797c478bd9Sstevel@tonic-gate strcpy(error.text.data, text); 14807c478bd9Sstevel@tonic-gate if (!krb5_mk_error(context, &error, &outbuf)) { 14817c478bd9Sstevel@tonic-gate (void) krb5_write_message(context, (void *)&fd,&outbuf); 14827c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 14837c478bd9Sstevel@tonic-gate } 14847c478bd9Sstevel@tonic-gate free(error.text.data); 14857c478bd9Sstevel@tonic-gate } 14867c478bd9Sstevel@tonic-gate } 14877c478bd9Sstevel@tonic-gate 14887c478bd9Sstevel@tonic-gate void 14897c478bd9Sstevel@tonic-gate recv_error(context, inbuf) 14907c478bd9Sstevel@tonic-gate krb5_context context; 14917c478bd9Sstevel@tonic-gate krb5_data *inbuf; 14927c478bd9Sstevel@tonic-gate { 14937c478bd9Sstevel@tonic-gate krb5_error *error; 14947c478bd9Sstevel@tonic-gate krb5_error_code retval; 14957c478bd9Sstevel@tonic-gate 149656a424ccSmp retval = krb5_rd_error(context, inbuf, &error); 149756a424ccSmp if (retval) { 14987c478bd9Sstevel@tonic-gate com_err(progname, retval, 14997c478bd9Sstevel@tonic-gate gettext("while decoding error packet from client")); 15007c478bd9Sstevel@tonic-gate exit(1); 15017c478bd9Sstevel@tonic-gate } 15027c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 15037c478bd9Sstevel@tonic-gate if (error->text.data) 15047c478bd9Sstevel@tonic-gate fprintf(stderr, 15057c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 15067c478bd9Sstevel@tonic-gate error->text.data); 15077c478bd9Sstevel@tonic-gate } else if (error->error) { 15087c478bd9Sstevel@tonic-gate com_err(progname, error->error + ERROR_TABLE_BASE_krb5, 15097c478bd9Sstevel@tonic-gate gettext("signalled from server")); 15107c478bd9Sstevel@tonic-gate if (error->text.data) 15117c478bd9Sstevel@tonic-gate fprintf(stderr, 15127c478bd9Sstevel@tonic-gate gettext("Error text from client: %s\n"), 15137c478bd9Sstevel@tonic-gate error->text.data); 15147c478bd9Sstevel@tonic-gate } 15157c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 15167c478bd9Sstevel@tonic-gate exit(1); 15177c478bd9Sstevel@tonic-gate } 15187c478bd9Sstevel@tonic-gate 15197c478bd9Sstevel@tonic-gate void 152056a424ccSmp load_database(context, kdb_util, database_file_name) 15217c478bd9Sstevel@tonic-gate krb5_context context; 152256a424ccSmp char *kdb_util; 15237c478bd9Sstevel@tonic-gate char *database_file_name; 15247c478bd9Sstevel@tonic-gate { 15257c478bd9Sstevel@tonic-gate static char *edit_av[10]; 152656a424ccSmp int error_ret, save_stderr = -1; 15277c478bd9Sstevel@tonic-gate int child_pid; 15287c478bd9Sstevel@tonic-gate int count; 152956a424ccSmp 153056a424ccSmp /* <sys/param.h> has been included, so BSD will be defined on 153156a424ccSmp BSD systems */ 153256a424ccSmp #if BSD > 0 && BSD <= 43 153356a424ccSmp #ifndef WEXITSTATUS 153456a424ccSmp #define WEXITSTATUS(w) (w).w_retcode 153556a424ccSmp #endif 153656a424ccSmp union wait waitb; 153756a424ccSmp #else 15387c478bd9Sstevel@tonic-gate int waitb; 153956a424ccSmp #endif 15407c478bd9Sstevel@tonic-gate krb5_error_code retval; 15417c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 15427c478bd9Sstevel@tonic-gate 15437c478bd9Sstevel@tonic-gate if (debug) 154456a424ccSmp printf(gettext("calling kdb_util to load database\n")); 15457c478bd9Sstevel@tonic-gate 15467c478bd9Sstevel@tonic-gate log_ctx = context->kdblog_context; 15477c478bd9Sstevel@tonic-gate 154856a424ccSmp edit_av[0] = kdb_util; 15497c478bd9Sstevel@tonic-gate count = 1; 15507c478bd9Sstevel@tonic-gate if (realm) { 15517c478bd9Sstevel@tonic-gate edit_av[count++] = "-r"; 15527c478bd9Sstevel@tonic-gate edit_av[count++] = realm; 15537c478bd9Sstevel@tonic-gate } 15547c478bd9Sstevel@tonic-gate edit_av[count++] = "load"; 15557c478bd9Sstevel@tonic-gate if (kerb_database) { 15567c478bd9Sstevel@tonic-gate edit_av[count++] = "-d"; 15577c478bd9Sstevel@tonic-gate edit_av[count++] = kerb_database; 15587c478bd9Sstevel@tonic-gate } 15597c478bd9Sstevel@tonic-gate 15607c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 15617c478bd9Sstevel@tonic-gate edit_av[count++] = "-i"; 15627c478bd9Sstevel@tonic-gate } 15637c478bd9Sstevel@tonic-gate edit_av[count++] = database_file_name; 15647c478bd9Sstevel@tonic-gate edit_av[count++] = NULL; 15657c478bd9Sstevel@tonic-gate 15667c478bd9Sstevel@tonic-gate switch(child_pid = fork()) { 15677c478bd9Sstevel@tonic-gate case -1: 15687c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to fork %s"), 156956a424ccSmp kdb_util); 15707c478bd9Sstevel@tonic-gate exit(1); 15717c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 15727c478bd9Sstevel@tonic-gate case 0: 15737c478bd9Sstevel@tonic-gate if (!debug) { 15747c478bd9Sstevel@tonic-gate save_stderr = dup(2); 15757c478bd9Sstevel@tonic-gate close(0); 15767c478bd9Sstevel@tonic-gate close(1); 15777c478bd9Sstevel@tonic-gate close(2); 15787c478bd9Sstevel@tonic-gate open("/dev/null", O_RDWR); 15797c478bd9Sstevel@tonic-gate dup(0); 15807c478bd9Sstevel@tonic-gate dup(0); 15817c478bd9Sstevel@tonic-gate } 15827c478bd9Sstevel@tonic-gate 158356a424ccSmp execv(kdb_util, edit_av); 15847c478bd9Sstevel@tonic-gate retval = errno; 15857c478bd9Sstevel@tonic-gate if (!debug) 15867c478bd9Sstevel@tonic-gate dup2(save_stderr, 2); 15877c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to exec %s"), 158856a424ccSmp kdb_util); 15897c478bd9Sstevel@tonic-gate _exit(1); 15907c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 15917c478bd9Sstevel@tonic-gate default: 15927c478bd9Sstevel@tonic-gate if (debug) 15937c478bd9Sstevel@tonic-gate printf(gettext("Child PID is %d\n"), child_pid); 15947c478bd9Sstevel@tonic-gate if (wait(&waitb) < 0) { 15957c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while waiting for %s"), 159656a424ccSmp kdb_util); 15977c478bd9Sstevel@tonic-gate exit(1); 15987c478bd9Sstevel@tonic-gate } 15997c478bd9Sstevel@tonic-gate } 16007c478bd9Sstevel@tonic-gate 160156a424ccSmp error_ret = WEXITSTATUS(waitb); 160256a424ccSmp if (error_ret) { 16037c478bd9Sstevel@tonic-gate com_err(progname, 0, 160456a424ccSmp gettext("%s returned a bad exit status (%d)"), 160556a424ccSmp kdb_util, error_ret); 16067c478bd9Sstevel@tonic-gate exit(1); 16077c478bd9Sstevel@tonic-gate } 16087c478bd9Sstevel@tonic-gate return; 16097c478bd9Sstevel@tonic-gate } 1610