17c478bd9Sstevel@tonic-gate /* 2*56a424ccSmp * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate * 57c478bd9Sstevel@tonic-gate * All rights reserved. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may require 87c478bd9Sstevel@tonic-gate * a specific license from the United States Government. It is the 97c478bd9Sstevel@tonic-gate * responsibility of any person or organization contemplating export to 107c478bd9Sstevel@tonic-gate * obtain such a license before exporting. 117c478bd9Sstevel@tonic-gate * 127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 177c478bd9Sstevel@tonic-gate * the name of FundsXpress. not be used in advertising or publicity pertaining 187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 197c478bd9Sstevel@tonic-gate * permission. FundsXpress makes no representations about the suitability of 207c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 217c478bd9Sstevel@tonic-gate * or implied warranty. 227c478bd9Sstevel@tonic-gate * 237c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 247c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 257c478bd9Sstevel@tonic-gate * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate /* 317c478bd9Sstevel@tonic-gate * slave/kpropd.c 327c478bd9Sstevel@tonic-gate * 337c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 347c478bd9Sstevel@tonic-gate * All Rights Reserved. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 377c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 387c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 397c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 407c478bd9Sstevel@tonic-gate * 417c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 427c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 437c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 447c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 457c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 467c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 477c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 487c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 497c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 507c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 517c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 527c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 537c478bd9Sstevel@tonic-gate * or implied warranty. 547c478bd9Sstevel@tonic-gate * 557c478bd9Sstevel@tonic-gate * 567c478bd9Sstevel@tonic-gate * XXX We need to modify the protocol so that an acknowledge is set 577c478bd9Sstevel@tonic-gate * after each block, instead after the entire series is sent over. 587c478bd9Sstevel@tonic-gate * The reason for this is so that error packets can get interpreted 597c478bd9Sstevel@tonic-gate * right away. If you don't do this, the sender may never get the 607c478bd9Sstevel@tonic-gate * error packet, because it will die an EPIPE trying to complete the 617c478bd9Sstevel@tonic-gate * write... 627c478bd9Sstevel@tonic-gate */ 637c478bd9Sstevel@tonic-gate 64*56a424ccSmp 657c478bd9Sstevel@tonic-gate #include <stdio.h> 667c478bd9Sstevel@tonic-gate #include <ctype.h> 677c478bd9Sstevel@tonic-gate #include <sys/file.h> 687c478bd9Sstevel@tonic-gate #include <signal.h> 697c478bd9Sstevel@tonic-gate #include <string.h> 707c478bd9Sstevel@tonic-gate #include <fcntl.h> 717c478bd9Sstevel@tonic-gate #include <sys/types.h> 727c478bd9Sstevel@tonic-gate #include <sys/time.h> 737c478bd9Sstevel@tonic-gate #include <sys/stat.h> 747c478bd9Sstevel@tonic-gate #include <sys/socket.h> 757c478bd9Sstevel@tonic-gate #include <sys/wait.h> 767c478bd9Sstevel@tonic-gate #include <netinet/in.h> 777c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 787c478bd9Sstevel@tonic-gate #include <sys/param.h> 797c478bd9Sstevel@tonic-gate #include <netdb.h> 807c478bd9Sstevel@tonic-gate #include <syslog.h> 817c478bd9Sstevel@tonic-gate #include <libintl.h> 827c478bd9Sstevel@tonic-gate #include <locale.h> 837c478bd9Sstevel@tonic-gate #include <k5-int.h> 847c478bd9Sstevel@tonic-gate #include <socket-utils.h> 857c478bd9Sstevel@tonic-gate #include "com_err.h" 867c478bd9Sstevel@tonic-gate #include <errno.h> 877c478bd9Sstevel@tonic-gate 887c478bd9Sstevel@tonic-gate #include "kprop.h" 897c478bd9Sstevel@tonic-gate #include <iprop_hdr.h> 907c478bd9Sstevel@tonic-gate #include "iprop.h" 917c478bd9Sstevel@tonic-gate #include <kadm5/admin.h> 927c478bd9Sstevel@tonic-gate #include <kdb/kdb_log.h> 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate #define SYSLOG_CLASS LOG_DAEMON 957c478bd9Sstevel@tonic-gate 967c478bd9Sstevel@tonic-gate char *poll_time = NULL; 977c478bd9Sstevel@tonic-gate char *def_realm = NULL; 987c478bd9Sstevel@tonic-gate boolean_t runonce = B_FALSE; 997c478bd9Sstevel@tonic-gate 1007c478bd9Sstevel@tonic-gate /* 1017c478bd9Sstevel@tonic-gate * This struct simulates the use of _kadm5_server_handle_t 1027c478bd9Sstevel@tonic-gate */ 1037c478bd9Sstevel@tonic-gate typedef struct _kadm5_iprop_handle_t { 1047c478bd9Sstevel@tonic-gate krb5_ui_4 magic_number; 1057c478bd9Sstevel@tonic-gate krb5_ui_4 struct_version; 1067c478bd9Sstevel@tonic-gate krb5_ui_4 api_version; 1077c478bd9Sstevel@tonic-gate char *cache_name; 1087c478bd9Sstevel@tonic-gate int destroy_cache; 1097c478bd9Sstevel@tonic-gate CLIENT *clnt; 1107c478bd9Sstevel@tonic-gate krb5_context context; 1117c478bd9Sstevel@tonic-gate kadm5_config_params params; 1127c478bd9Sstevel@tonic-gate struct _kadm5_iprop_handle_t *lhandle; 1137c478bd9Sstevel@tonic-gate } *kadm5_iprop_handle_t; 1147c478bd9Sstevel@tonic-gate 1157c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate char *progname; 1187c478bd9Sstevel@tonic-gate int debug = 0; 1197c478bd9Sstevel@tonic-gate char *srvtab = 0; 1207c478bd9Sstevel@tonic-gate int standalone = 0; 1217c478bd9Sstevel@tonic-gate 1227c478bd9Sstevel@tonic-gate krb5_principal server; /* This is our server principal name */ 1237c478bd9Sstevel@tonic-gate krb5_principal client; /* This is who we're talking to */ 1247c478bd9Sstevel@tonic-gate krb5_context kpropd_context; 1257c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 1267c478bd9Sstevel@tonic-gate char *realm = NULL; /* Our realm */ 1277c478bd9Sstevel@tonic-gate char *file = KPROPD_DEFAULT_FILE; 1287c478bd9Sstevel@tonic-gate char *temp_file_name; 1297c478bd9Sstevel@tonic-gate char *kdb5_util = KPROPD_DEFAULT_KDB5_UTIL; 1307c478bd9Sstevel@tonic-gate char *kerb_database = NULL; 1317c478bd9Sstevel@tonic-gate char *acl_file_name = KPROPD_ACL_FILE; 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate krb5_address sender_addr; 1347c478bd9Sstevel@tonic-gate krb5_address receiver_addr; 1357c478bd9Sstevel@tonic-gate short port = 0; 1367c478bd9Sstevel@tonic-gate 1377c478bd9Sstevel@tonic-gate void PRS 1387c478bd9Sstevel@tonic-gate (int, char**); 1397c478bd9Sstevel@tonic-gate int do_standalone 1407c478bd9Sstevel@tonic-gate (iprop_role iproprole); 1417c478bd9Sstevel@tonic-gate void doit 142*56a424ccSmp (int); 1437c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx); 1447c478bd9Sstevel@tonic-gate 1457c478bd9Sstevel@tonic-gate void kerberos_authenticate 146*56a424ccSmp (krb5_context, 1477c478bd9Sstevel@tonic-gate int, 1487c478bd9Sstevel@tonic-gate krb5_principal *, 1497c478bd9Sstevel@tonic-gate krb5_enctype *, 1507c478bd9Sstevel@tonic-gate struct sockaddr_storage); 1517c478bd9Sstevel@tonic-gate krb5_boolean authorized_principal 152*56a424ccSmp (krb5_context, 1537c478bd9Sstevel@tonic-gate krb5_principal, 1547c478bd9Sstevel@tonic-gate krb5_enctype); 1557c478bd9Sstevel@tonic-gate void recv_database 156*56a424ccSmp (krb5_context, 1577c478bd9Sstevel@tonic-gate int, 1587c478bd9Sstevel@tonic-gate int, 1597c478bd9Sstevel@tonic-gate krb5_data *); 1607c478bd9Sstevel@tonic-gate void load_database 161*56a424ccSmp (krb5_context, 1627c478bd9Sstevel@tonic-gate char *, 1637c478bd9Sstevel@tonic-gate char *); 1647c478bd9Sstevel@tonic-gate void send_error 165*56a424ccSmp (krb5_context, 1667c478bd9Sstevel@tonic-gate int, 1677c478bd9Sstevel@tonic-gate krb5_error_code, 1687c478bd9Sstevel@tonic-gate char *); 1697c478bd9Sstevel@tonic-gate void recv_error 170*56a424ccSmp (krb5_context, 1717c478bd9Sstevel@tonic-gate krb5_data *); 1727c478bd9Sstevel@tonic-gate int convert_polltime 1737c478bd9Sstevel@tonic-gate (char *); 1747c478bd9Sstevel@tonic-gate unsigned int backoff_from_master 1757c478bd9Sstevel@tonic-gate (int *); 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate static void usage() 1787c478bd9Sstevel@tonic-gate { 1797c478bd9Sstevel@tonic-gate fprintf(stderr, 1807c478bd9Sstevel@tonic-gate gettext("\nUsage: %s\n"), /* progname may be a long pathname */ 1817c478bd9Sstevel@tonic-gate progname); 1827c478bd9Sstevel@tonic-gate 1837c478bd9Sstevel@tonic-gate fprintf(stderr, 1847c478bd9Sstevel@tonic-gate gettext("\t[-r realm] [-s srvtab] [-dS] [-f slave_file]\n")); 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate fprintf(stderr, 1877c478bd9Sstevel@tonic-gate gettext("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n")); 1887c478bd9Sstevel@tonic-gate 1897c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("\t[-P port] [-a acl_file]\n")); 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate exit(1); 1927c478bd9Sstevel@tonic-gate } 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate int 1957c478bd9Sstevel@tonic-gate main(argc, argv) 1967c478bd9Sstevel@tonic-gate int argc; 1977c478bd9Sstevel@tonic-gate char **argv; 1987c478bd9Sstevel@tonic-gate { 1997c478bd9Sstevel@tonic-gate krb5_error_code retval; 2007c478bd9Sstevel@tonic-gate int ret = 0; 2017c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 2027c478bd9Sstevel@tonic-gate 2037c478bd9Sstevel@tonic-gate PRS(argc, argv); 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 2087c478bd9Sstevel@tonic-gate /* 2097c478bd9Sstevel@tonic-gate * We wanna do iprop ! 2107c478bd9Sstevel@tonic-gate */ 2117c478bd9Sstevel@tonic-gate retval = do_iprop(log_ctx); 2127c478bd9Sstevel@tonic-gate if (retval) { 2137c478bd9Sstevel@tonic-gate com_err(progname, retval, 2147c478bd9Sstevel@tonic-gate gettext("do_iprop failed.\n")); 2157c478bd9Sstevel@tonic-gate exit(1); 2167c478bd9Sstevel@tonic-gate } 2177c478bd9Sstevel@tonic-gate 2187c478bd9Sstevel@tonic-gate } else { 2197c478bd9Sstevel@tonic-gate if (standalone) 2207c478bd9Sstevel@tonic-gate ret = do_standalone(IPROP_NULL); 2217c478bd9Sstevel@tonic-gate else 2227c478bd9Sstevel@tonic-gate doit(0); 2237c478bd9Sstevel@tonic-gate } 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate exit(ret); 2267c478bd9Sstevel@tonic-gate } 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate int do_standalone(iprop_role iproprole) 2297c478bd9Sstevel@tonic-gate { 2307c478bd9Sstevel@tonic-gate struct linger linger; 2317c478bd9Sstevel@tonic-gate struct servent *sp; 2327c478bd9Sstevel@tonic-gate int finet, fromlen, s; 2337c478bd9Sstevel@tonic-gate int on = 1; 2347c478bd9Sstevel@tonic-gate int ret, status = 0; 2357c478bd9Sstevel@tonic-gate struct sockaddr_in6 sin6 = { AF_INET6 }; 2367c478bd9Sstevel@tonic-gate int sin6_size = sizeof (sin6); 2377c478bd9Sstevel@tonic-gate 2387c478bd9Sstevel@tonic-gate /* listen for either ipv4 or ipv6 */ 2397c478bd9Sstevel@tonic-gate finet = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); 2407c478bd9Sstevel@tonic-gate if (finet < 0 ) { 2417c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while obtaining socket")); 2427c478bd9Sstevel@tonic-gate exit(1); 2437c478bd9Sstevel@tonic-gate } 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate if(!port) { 2467c478bd9Sstevel@tonic-gate sp = getservbyname(KPROP_SERVICE, "tcp"); 2477c478bd9Sstevel@tonic-gate if (sp == NULL) { 2487c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("%s/tcp: unknown service"), 2497c478bd9Sstevel@tonic-gate KPROP_SERVICE); 2507c478bd9Sstevel@tonic-gate exit(1); 2517c478bd9Sstevel@tonic-gate } 2527c478bd9Sstevel@tonic-gate sin6.sin6_port = sp->s_port; 2537c478bd9Sstevel@tonic-gate } else 2547c478bd9Sstevel@tonic-gate sin6.sin6_port = port; 2557c478bd9Sstevel@tonic-gate 2567c478bd9Sstevel@tonic-gate /* 2577c478bd9Sstevel@tonic-gate * We need to close the socket immediately if iprop is enabled, 2587c478bd9Sstevel@tonic-gate * since back-to-back full resyncs are possible, so we do not 2597c478bd9Sstevel@tonic-gate * linger around for too long 2607c478bd9Sstevel@tonic-gate */ 2617c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) { 2627c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 2637c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) 2647c478bd9Sstevel@tonic-gate com_err(progname, errno, 2657c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_REUSEADDR)")); 2667c478bd9Sstevel@tonic-gate linger.l_onoff = 1; 2677c478bd9Sstevel@tonic-gate linger.l_linger = 2; 2687c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_LINGER, 2697c478bd9Sstevel@tonic-gate (void *)&linger, sizeof(linger)) < 0) 2707c478bd9Sstevel@tonic-gate com_err(progname, errno, 2717c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_LINGER)")); 2727c478bd9Sstevel@tonic-gate } 2737c478bd9Sstevel@tonic-gate if ((ret = bind(finet, (struct sockaddr *)&sin6, sizeof(sin6))) < 0) { 2747c478bd9Sstevel@tonic-gate if (debug) { 2757c478bd9Sstevel@tonic-gate on = 1; 2767c478bd9Sstevel@tonic-gate fprintf(stderr, 2777c478bd9Sstevel@tonic-gate gettext("%s: attempting to rebind socket " 2787c478bd9Sstevel@tonic-gate "with SO_REUSEADDR\n"), progname); 2797c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 2807c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) { 2817c478bd9Sstevel@tonic-gate com_err(progname, errno, 2827c478bd9Sstevel@tonic-gate gettext("in setsockopt(SO_REUSEADDR)")); 2837c478bd9Sstevel@tonic-gate } 2847c478bd9Sstevel@tonic-gate ret = bind(finet, (struct sockaddr *) &sin6, sizeof(sin6)); 285*56a424ccSmp } 2867c478bd9Sstevel@tonic-gate 287*56a424ccSmp if (ret < 0) { 288*56a424ccSmp perror(gettext("bind")); 289*56a424ccSmp com_err(progname, errno, 2907c478bd9Sstevel@tonic-gate gettext("while binding listener socket")); 291*56a424ccSmp exit(1); 292*56a424ccSmp } 2937c478bd9Sstevel@tonic-gate } 294*56a424ccSmp if (!debug && (iproprole != IPROP_SLAVE)) 295*56a424ccSmp daemon(1, 0); 2967c478bd9Sstevel@tonic-gate #ifdef PID_FILE 297*56a424ccSmp if ((pidfile = fopen(PID_FILE, "w")) != NULL) { 298*56a424ccSmp fprintf(pidfile, gettext("%d\n"), getpid()); 299*56a424ccSmp fclose(pidfile); 300*56a424ccSmp } else 301*56a424ccSmp com_err(progname, errno, 3027c478bd9Sstevel@tonic-gate gettext("while opening pid file %s for writing"), 3037c478bd9Sstevel@tonic-gate PID_FILE); 3047c478bd9Sstevel@tonic-gate #endif 305*56a424ccSmp if (listen(finet, 5) < 0) { 306*56a424ccSmp com_err(progname, errno, gettext("in listen call")); 307*56a424ccSmp exit(1); 3087c478bd9Sstevel@tonic-gate } 309*56a424ccSmp while (1) { 310*56a424ccSmp int child_pid; 3117c478bd9Sstevel@tonic-gate 312*56a424ccSmp s = accept(finet, (struct sockaddr *) &sin6, &sin6_size); 3137c478bd9Sstevel@tonic-gate 314*56a424ccSmp if (s < 0) { 315*56a424ccSmp if (errno != EINTR) 316*56a424ccSmp com_err(progname, errno, 317*56a424ccSmp gettext("from accept system call")); 318*56a424ccSmp continue; 319*56a424ccSmp } 320*56a424ccSmp if (debug && (iproprole != IPROP_SLAVE)) 321*56a424ccSmp child_pid = 0; 322*56a424ccSmp else 323*56a424ccSmp child_pid = fork(); 324*56a424ccSmp switch (child_pid) { 325*56a424ccSmp case -1: 326*56a424ccSmp com_err(progname, errno, gettext("while forking")); 327*56a424ccSmp exit(1); 3287c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 329*56a424ccSmp case 0: 3307c478bd9Sstevel@tonic-gate /* child */ 331*56a424ccSmp (void) close(finet); 332*56a424ccSmp 333*56a424ccSmp doit(s); 334*56a424ccSmp close(s); 335*56a424ccSmp _exit(0); 3367c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 337*56a424ccSmp default: 3387c478bd9Sstevel@tonic-gate /* parent */ 3397c478bd9Sstevel@tonic-gate if (wait(&status) < 0) { 3407c478bd9Sstevel@tonic-gate com_err(progname, errno, 3417c478bd9Sstevel@tonic-gate gettext("while waiting to receive database")); 3427c478bd9Sstevel@tonic-gate exit(1); 3437c478bd9Sstevel@tonic-gate } 3447c478bd9Sstevel@tonic-gate 3457c478bd9Sstevel@tonic-gate close(s); 3467c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 3477c478bd9Sstevel@tonic-gate close(finet); 3487c478bd9Sstevel@tonic-gate 3497c478bd9Sstevel@tonic-gate if ((ret = WEXITSTATUS(status)) != 0) 3507c478bd9Sstevel@tonic-gate return (ret); 3517c478bd9Sstevel@tonic-gate } 3527c478bd9Sstevel@tonic-gate 3537c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 3547c478bd9Sstevel@tonic-gate break; 3557c478bd9Sstevel@tonic-gate } 3567c478bd9Sstevel@tonic-gate 3577c478bd9Sstevel@tonic-gate return (0); 3587c478bd9Sstevel@tonic-gate } 3597c478bd9Sstevel@tonic-gate 3607c478bd9Sstevel@tonic-gate void doit(fd) 3617c478bd9Sstevel@tonic-gate int fd; 3627c478bd9Sstevel@tonic-gate { 3637c478bd9Sstevel@tonic-gate struct sockaddr_storage from; 3647c478bd9Sstevel@tonic-gate socklen_t fromlen; 3657c478bd9Sstevel@tonic-gate int on = 1; 3667c478bd9Sstevel@tonic-gate struct hostent *hp; 3677c478bd9Sstevel@tonic-gate krb5_error_code retval; 3687c478bd9Sstevel@tonic-gate krb5_data confmsg; 3697c478bd9Sstevel@tonic-gate int lock_fd; 370*56a424ccSmp mode_t omask; 3717c478bd9Sstevel@tonic-gate krb5_enctype etype; 372*56a424ccSmp int database_fd; 3737c478bd9Sstevel@tonic-gate char ntop[NI_MAXHOST] = ""; 3747c478bd9Sstevel@tonic-gate krb5_context doit_context; 3757c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 3767c478bd9Sstevel@tonic-gate 3777c478bd9Sstevel@tonic-gate retval = krb5_init_context(&doit_context); 3787c478bd9Sstevel@tonic-gate if (retval) { 3797c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing krb5")); 3807c478bd9Sstevel@tonic-gate exit(1); 3817c478bd9Sstevel@tonic-gate } 3827c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 3837c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) 3847c478bd9Sstevel@tonic-gate ulog_set_role(doit_context, IPROP_SLAVE); 3857c478bd9Sstevel@tonic-gate 3867c478bd9Sstevel@tonic-gate fromlen = (socklen_t)sizeof (from); 3877c478bd9Sstevel@tonic-gate if (getpeername(fd, (struct sockaddr *) &from, &fromlen) < 0) { 3887c478bd9Sstevel@tonic-gate fprintf(stderr, "%s: ", progname); 3897c478bd9Sstevel@tonic-gate perror(gettext("getpeername")); 3907c478bd9Sstevel@tonic-gate exit(1); 3917c478bd9Sstevel@tonic-gate } 3927c478bd9Sstevel@tonic-gate if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (caddr_t) &on, 3937c478bd9Sstevel@tonic-gate sizeof (on)) < 0) { 3947c478bd9Sstevel@tonic-gate com_err(progname, errno, 3957c478bd9Sstevel@tonic-gate gettext("while attempting setsockopt (SO_KEEPALIVE)")); 3967c478bd9Sstevel@tonic-gate } 3977c478bd9Sstevel@tonic-gate 3987c478bd9Sstevel@tonic-gate if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop), 3997c478bd9Sstevel@tonic-gate NULL, 0, NI_NUMERICHOST) != 0) { 4007c478bd9Sstevel@tonic-gate 4017c478bd9Sstevel@tonic-gate /* getnameifo failed so use inet_ntop() to get printable addresses */ 4027c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET) { 4037c478bd9Sstevel@tonic-gate 4047c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, 4057c478bd9Sstevel@tonic-gate (const void *)&ss2sin(&from)->sin_addr, 4067c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate } else if (from.ss_family == AF_INET6 && 4097c478bd9Sstevel@tonic-gate ! IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 4107c478bd9Sstevel@tonic-gate 4117c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 4127c478bd9Sstevel@tonic-gate 4137c478bd9Sstevel@tonic-gate inet_ntop(AF_INET6, 4147c478bd9Sstevel@tonic-gate (const void *)&ss2sin6(&from)->sin6_addr, ntop, 4157c478bd9Sstevel@tonic-gate sizeof(ntop)); 4167c478bd9Sstevel@tonic-gate } 4177c478bd9Sstevel@tonic-gate /* ipv4 mapped ipv6 addrs handled later */ 4187c478bd9Sstevel@tonic-gate } 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET || from.ss_family == AF_INET6) { 4217c478bd9Sstevel@tonic-gate 4227c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET6 && 4237c478bd9Sstevel@tonic-gate IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 4247c478bd9Sstevel@tonic-gate 4257c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 4267c478bd9Sstevel@tonic-gate 4277c478bd9Sstevel@tonic-gate /* coerce ipv4 mapped ipv6 addr to normal ipv4 addr */ 4287c478bd9Sstevel@tonic-gate IN6_V4MAPPED_TO_IPADDR(&(ss2sin6(&from)->sin6_addr), 4297c478bd9Sstevel@tonic-gate v4addr); 4307c478bd9Sstevel@tonic-gate 4317c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, (const void *) &v4addr, 4327c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 4337c478bd9Sstevel@tonic-gate } 4347c478bd9Sstevel@tonic-gate 4357c478bd9Sstevel@tonic-gate syslog(LOG_INFO, gettext("Connection from %s"), ntop); 4367c478bd9Sstevel@tonic-gate 4377c478bd9Sstevel@tonic-gate if (debug) 4387c478bd9Sstevel@tonic-gate printf("Connection from %s\n", ntop); 4397c478bd9Sstevel@tonic-gate 4407c478bd9Sstevel@tonic-gate } else { 4417c478bd9Sstevel@tonic-gate /* address family isn't either AF_INET || AF_INET6 */ 4427c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 4437c478bd9Sstevel@tonic-gate gettext("Connection from unknown address family:%d"), 4447c478bd9Sstevel@tonic-gate from.ss_family); 4457c478bd9Sstevel@tonic-gate 4467c478bd9Sstevel@tonic-gate if (debug) { 4477c478bd9Sstevel@tonic-gate printf(gettext("Connection from unknown address family:%d"), 4487c478bd9Sstevel@tonic-gate from.ss_family); 4497c478bd9Sstevel@tonic-gate } 4507c478bd9Sstevel@tonic-gate } 4517c478bd9Sstevel@tonic-gate 4527c478bd9Sstevel@tonic-gate /* 4537c478bd9Sstevel@tonic-gate * Now do the authentication 4547c478bd9Sstevel@tonic-gate */ 4557c478bd9Sstevel@tonic-gate kerberos_authenticate(doit_context, fd, &client, &etype, from); 4567c478bd9Sstevel@tonic-gate 4577c478bd9Sstevel@tonic-gate if (!authorized_principal(doit_context, client, etype)) { 458*56a424ccSmp char *name; 4597c478bd9Sstevel@tonic-gate 460*56a424ccSmp retval = krb5_unparse_name(doit_context, client, &name); 461*56a424ccSmp if (retval) { 462*56a424ccSmp com_err(progname, retval, 4637c478bd9Sstevel@tonic-gate gettext("While unparsing client name")); 464*56a424ccSmp exit(1); 465*56a424ccSmp } 466*56a424ccSmp syslog(LOG_WARNING, 4677c478bd9Sstevel@tonic-gate gettext("Rejected connection from unauthorized principal %s"), 468*56a424ccSmp name); 469*56a424ccSmp free(name); 470*56a424ccSmp exit(1); 4717c478bd9Sstevel@tonic-gate } 4727c478bd9Sstevel@tonic-gate omask = umask(077); 4737c478bd9Sstevel@tonic-gate lock_fd = open(temp_file_name, O_RDWR|O_CREAT, 0600); 4747c478bd9Sstevel@tonic-gate (void) umask(omask); 4757c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, 4767c478bd9Sstevel@tonic-gate KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK); 4777c478bd9Sstevel@tonic-gate if (retval) { 4787c478bd9Sstevel@tonic-gate com_err(progname, retval, 4797c478bd9Sstevel@tonic-gate gettext("while trying to lock '%s'"), 4807c478bd9Sstevel@tonic-gate temp_file_name); 4817c478bd9Sstevel@tonic-gate exit(1); 4827c478bd9Sstevel@tonic-gate } 4837c478bd9Sstevel@tonic-gate if ((database_fd = open(temp_file_name, 4847c478bd9Sstevel@tonic-gate O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) { 4857c478bd9Sstevel@tonic-gate com_err(progname, errno, 4867c478bd9Sstevel@tonic-gate gettext("while opening database file, '%s'"), 4877c478bd9Sstevel@tonic-gate temp_file_name); 4887c478bd9Sstevel@tonic-gate exit(1); 4897c478bd9Sstevel@tonic-gate } 4907c478bd9Sstevel@tonic-gate recv_database(doit_context, fd, database_fd, &confmsg); 4917c478bd9Sstevel@tonic-gate if (rename(temp_file_name, file)) { 4927c478bd9Sstevel@tonic-gate com_err(progname, errno, 4937c478bd9Sstevel@tonic-gate gettext("While renaming %s to %s"), 4947c478bd9Sstevel@tonic-gate temp_file_name, file); 4957c478bd9Sstevel@tonic-gate exit(1); 4967c478bd9Sstevel@tonic-gate } 4977c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_SHARED); 4987c478bd9Sstevel@tonic-gate if (retval) { 4997c478bd9Sstevel@tonic-gate com_err(progname, retval, 5007c478bd9Sstevel@tonic-gate gettext("while downgrading lock on '%s'"), 5017c478bd9Sstevel@tonic-gate temp_file_name); 5027c478bd9Sstevel@tonic-gate exit(1); 5037c478bd9Sstevel@tonic-gate } 5047c478bd9Sstevel@tonic-gate load_database(doit_context, kdb5_util, file); 5057c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_UNLOCK); 5067c478bd9Sstevel@tonic-gate if (retval) { 5077c478bd9Sstevel@tonic-gate com_err(progname, retval, 5087c478bd9Sstevel@tonic-gate gettext("while unlocking '%s'"), temp_file_name); 5097c478bd9Sstevel@tonic-gate exit(1); 5107c478bd9Sstevel@tonic-gate } 5117c478bd9Sstevel@tonic-gate (void)close(lock_fd); 5127c478bd9Sstevel@tonic-gate 5137c478bd9Sstevel@tonic-gate /* 5147c478bd9Sstevel@tonic-gate * Send the acknowledgement message generated in 5157c478bd9Sstevel@tonic-gate * recv_database, then close the socket. 5167c478bd9Sstevel@tonic-gate */ 517*56a424ccSmp retval = krb5_write_message(doit_context, (void *) &fd, &confmsg); 518*56a424ccSmp if (retval) { 5197c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 5207c478bd9Sstevel@tonic-gate com_err(progname, retval, 5217c478bd9Sstevel@tonic-gate gettext("while sending # of received bytes")); 5227c478bd9Sstevel@tonic-gate exit(1); 5237c478bd9Sstevel@tonic-gate } 5247c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 5257c478bd9Sstevel@tonic-gate if (close(fd) < 0) { 5267c478bd9Sstevel@tonic-gate com_err(progname, errno, 5277c478bd9Sstevel@tonic-gate gettext("while trying to close database file")); 5287c478bd9Sstevel@tonic-gate exit(1); 5297c478bd9Sstevel@tonic-gate } 530*56a424ccSmp 5317c478bd9Sstevel@tonic-gate exit(0); 5327c478bd9Sstevel@tonic-gate } 5337c478bd9Sstevel@tonic-gate 5347c478bd9Sstevel@tonic-gate 5357c478bd9Sstevel@tonic-gate /* 5367c478bd9Sstevel@tonic-gate * Routine to handle incremental update transfer(s) from master KDC 5377c478bd9Sstevel@tonic-gate */ 5387c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx) { 5397c478bd9Sstevel@tonic-gate CLIENT *cl; 5407c478bd9Sstevel@tonic-gate kadm5_ret_t retval; 5417c478bd9Sstevel@tonic-gate kadm5_config_params params; 5427c478bd9Sstevel@tonic-gate krb5_ccache cc; 5437c478bd9Sstevel@tonic-gate krb5_principal iprop_svc_principal; 5447c478bd9Sstevel@tonic-gate void *server_handle = NULL; 5457c478bd9Sstevel@tonic-gate char *iprop_svc_princstr = NULL; 5467c478bd9Sstevel@tonic-gate char *master_svc_princstr = NULL; 5477c478bd9Sstevel@tonic-gate char *admin_server = NULL; 5487c478bd9Sstevel@tonic-gate char *keytab_name = NULL; 5497c478bd9Sstevel@tonic-gate unsigned int pollin, backoff_time; 5507c478bd9Sstevel@tonic-gate int backoff_cnt = 0; 5517c478bd9Sstevel@tonic-gate int reinit_cnt = 0; 5527c478bd9Sstevel@tonic-gate int ret; 5537c478bd9Sstevel@tonic-gate boolean_t frdone = B_FALSE; 5547c478bd9Sstevel@tonic-gate 5557c478bd9Sstevel@tonic-gate kdb_incr_result_t *incr_ret; 5567c478bd9Sstevel@tonic-gate static kdb_last_t mylast; 5577c478bd9Sstevel@tonic-gate 5587c478bd9Sstevel@tonic-gate kdb_fullresync_result_t *full_ret; 5597c478bd9Sstevel@tonic-gate char *full_resync_arg = NULL; 5607c478bd9Sstevel@tonic-gate 5617c478bd9Sstevel@tonic-gate kadm5_iprop_handle_t handle; 5627c478bd9Sstevel@tonic-gate kdb_hlog_t *ulog; 5637c478bd9Sstevel@tonic-gate 5647c478bd9Sstevel@tonic-gate if (!debug) 5657c478bd9Sstevel@tonic-gate daemon(0, 0); 5667c478bd9Sstevel@tonic-gate 5677c478bd9Sstevel@tonic-gate pollin = (unsigned int)0; 5687c478bd9Sstevel@tonic-gate (void) memset((char *)¶ms, 0, sizeof (params)); 5697c478bd9Sstevel@tonic-gate ulog = log_ctx->ulog; 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 5727c478bd9Sstevel@tonic-gate params.realm = def_realm; 5737c478bd9Sstevel@tonic-gate 5747c478bd9Sstevel@tonic-gate if (master_svc_princstr == NULL) { 5757c478bd9Sstevel@tonic-gate if (retval = kadm5_get_kiprop_host_srv_name(kpropd_context, 5767c478bd9Sstevel@tonic-gate def_realm, &master_svc_princstr)) { 5777c478bd9Sstevel@tonic-gate com_err(progname, retval, 5787c478bd9Sstevel@tonic-gate gettext("%s: unable to get kiprop host based " 5797c478bd9Sstevel@tonic-gate "service name for realm %s\n"), 5807c478bd9Sstevel@tonic-gate progname, def_realm); 5817c478bd9Sstevel@tonic-gate exit(1); 5827c478bd9Sstevel@tonic-gate } 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate 5857c478bd9Sstevel@tonic-gate /* 5867c478bd9Sstevel@tonic-gate * Set cc to the default credentials cache 5877c478bd9Sstevel@tonic-gate */ 5887c478bd9Sstevel@tonic-gate if (retval = krb5_cc_default(kpropd_context, &cc)) { 5897c478bd9Sstevel@tonic-gate com_err(progname, retval, 5907c478bd9Sstevel@tonic-gate gettext("while opening default " 5917c478bd9Sstevel@tonic-gate "credentials cache")); 5927c478bd9Sstevel@tonic-gate exit(1); 5937c478bd9Sstevel@tonic-gate } 5947c478bd9Sstevel@tonic-gate 5957c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, NULL, KIPROP_SVC_NAME, 5967c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &iprop_svc_principal); 5977c478bd9Sstevel@tonic-gate if (retval) { 5987c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to construct " 5997c478bd9Sstevel@tonic-gate "host service principal")); 6007c478bd9Sstevel@tonic-gate exit(1); 6017c478bd9Sstevel@tonic-gate } 6027c478bd9Sstevel@tonic-gate 6037c478bd9Sstevel@tonic-gate if (retval = krb5_unparse_name(kpropd_context, iprop_svc_principal, 6047c478bd9Sstevel@tonic-gate &iprop_svc_princstr)) { 6057c478bd9Sstevel@tonic-gate com_err(progname, retval, 6067c478bd9Sstevel@tonic-gate gettext("while canonicalizing " 6077c478bd9Sstevel@tonic-gate "principal name")); 6087c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 6097c478bd9Sstevel@tonic-gate exit(1); 6107c478bd9Sstevel@tonic-gate } 6117c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 6127c478bd9Sstevel@tonic-gate 6137c478bd9Sstevel@tonic-gate reinit: 6147c478bd9Sstevel@tonic-gate /* 6157c478bd9Sstevel@tonic-gate * Authentication, initialize rpcsec_gss handle etc. 6167c478bd9Sstevel@tonic-gate */ 6177c478bd9Sstevel@tonic-gate retval = kadm5_init_with_skey(iprop_svc_princstr, keytab_name, 6187c478bd9Sstevel@tonic-gate master_svc_princstr, 6197c478bd9Sstevel@tonic-gate ¶ms, 6207c478bd9Sstevel@tonic-gate KADM5_STRUCT_VERSION, 6217c478bd9Sstevel@tonic-gate KADM5_API_VERSION_2, 6227c478bd9Sstevel@tonic-gate &server_handle); 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate if (retval) { 6257c478bd9Sstevel@tonic-gate if (retval == KADM5_RPC_ERROR) { 6267c478bd9Sstevel@tonic-gate reinit_cnt++; 6277c478bd9Sstevel@tonic-gate if (server_handle) 6287c478bd9Sstevel@tonic-gate kadm5_destroy((void *) server_handle); 6297c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 6307c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 6317c478bd9Sstevel@tonic-gate 6327c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext( 6337c478bd9Sstevel@tonic-gate "while attempting to connect" 6347c478bd9Sstevel@tonic-gate " to master KDC ... retrying")); 6357c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&reinit_cnt); 6367c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 6377c478bd9Sstevel@tonic-gate goto reinit; 6387c478bd9Sstevel@tonic-gate } else { 6397c478bd9Sstevel@tonic-gate com_err(progname, retval, 6407c478bd9Sstevel@tonic-gate gettext("while initializing %s interface"), 6417c478bd9Sstevel@tonic-gate progname); 6427c478bd9Sstevel@tonic-gate if (retval == KADM5_BAD_CLIENT_PARAMS || 6437c478bd9Sstevel@tonic-gate retval == KADM5_BAD_SERVER_PARAMS) 6447c478bd9Sstevel@tonic-gate usage(); 6457c478bd9Sstevel@tonic-gate exit(1); 6467c478bd9Sstevel@tonic-gate } 6477c478bd9Sstevel@tonic-gate } 6487c478bd9Sstevel@tonic-gate 6497c478bd9Sstevel@tonic-gate /* 6507c478bd9Sstevel@tonic-gate * Reset re-initialization count to zero now. 6517c478bd9Sstevel@tonic-gate */ 6527c478bd9Sstevel@tonic-gate reinit_cnt = backoff_time = 0; 6537c478bd9Sstevel@tonic-gate 6547c478bd9Sstevel@tonic-gate /* 6557c478bd9Sstevel@tonic-gate * Reset the handle to the correct type for the RPC call 6567c478bd9Sstevel@tonic-gate */ 6577c478bd9Sstevel@tonic-gate handle = server_handle; 6587c478bd9Sstevel@tonic-gate 6597c478bd9Sstevel@tonic-gate /* 6607c478bd9Sstevel@tonic-gate * If we have reached this far, we have succesfully established 6617c478bd9Sstevel@tonic-gate * a RPCSEC_GSS connection; we now start polling for updates 6627c478bd9Sstevel@tonic-gate */ 6637c478bd9Sstevel@tonic-gate if (poll_time == NULL) { 6647c478bd9Sstevel@tonic-gate if ((poll_time = (char *)strdup("2m")) == NULL) { 6657c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 6667c478bd9Sstevel@tonic-gate gettext("Unable to allocate poll_time")); 6677c478bd9Sstevel@tonic-gate exit(1); 6687c478bd9Sstevel@tonic-gate } 6697c478bd9Sstevel@tonic-gate } 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate if (pollin == (unsigned int)0) 6727c478bd9Sstevel@tonic-gate pollin = convert_polltime(poll_time); 6737c478bd9Sstevel@tonic-gate 6747c478bd9Sstevel@tonic-gate for (;;) { 6757c478bd9Sstevel@tonic-gate incr_ret = NULL; 6767c478bd9Sstevel@tonic-gate full_ret = NULL; 6777c478bd9Sstevel@tonic-gate 6787c478bd9Sstevel@tonic-gate /* 6797c478bd9Sstevel@tonic-gate * Get the most recent ulog entry sno + ts, which 6807c478bd9Sstevel@tonic-gate * we package in the request to the master KDC 6817c478bd9Sstevel@tonic-gate */ 6827c478bd9Sstevel@tonic-gate mylast.last_sno = ulog->kdb_last_sno; 6837c478bd9Sstevel@tonic-gate mylast.last_time = ulog->kdb_last_time; 6847c478bd9Sstevel@tonic-gate 6857c478bd9Sstevel@tonic-gate /* 6867c478bd9Sstevel@tonic-gate * Loop continuously on an iprop_get_updates_1(), 6877c478bd9Sstevel@tonic-gate * so that we can keep probing the master for updates 6887c478bd9Sstevel@tonic-gate * or (if needed) do a full resync of the krb5 db. 6897c478bd9Sstevel@tonic-gate */ 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate incr_ret = iprop_get_updates_1(&mylast, handle->clnt); 6927c478bd9Sstevel@tonic-gate if (incr_ret == (kdb_incr_result_t *)NULL) { 6937c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 6947c478bd9Sstevel@tonic-gate "iprop_get_updates call failed"); 6957c478bd9Sstevel@tonic-gate if (server_handle) 6967c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 6977c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 6987c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 6997c478bd9Sstevel@tonic-gate goto reinit; 7007c478bd9Sstevel@tonic-gate } 7017c478bd9Sstevel@tonic-gate 7027c478bd9Sstevel@tonic-gate switch (incr_ret->ret) { 7037c478bd9Sstevel@tonic-gate 7047c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 7057c478bd9Sstevel@tonic-gate /* 7067c478bd9Sstevel@tonic-gate * We dont do a full resync again, if the last 7077c478bd9Sstevel@tonic-gate * X'fer was a resync and if the master sno is 7087c478bd9Sstevel@tonic-gate * still "0", i.e. no updates so far. 7097c478bd9Sstevel@tonic-gate */ 7107c478bd9Sstevel@tonic-gate if ((frdone == B_TRUE) && (incr_ret->lastentry.last_sno 7117c478bd9Sstevel@tonic-gate == 0)) { 7127c478bd9Sstevel@tonic-gate break; 7137c478bd9Sstevel@tonic-gate } else { 7147c478bd9Sstevel@tonic-gate 7157c478bd9Sstevel@tonic-gate full_ret = iprop_full_resync_1((void *) 7167c478bd9Sstevel@tonic-gate &full_resync_arg, handle->clnt); 7177c478bd9Sstevel@tonic-gate 7187c478bd9Sstevel@tonic-gate if (full_ret == (kdb_fullresync_result_t *) 7197c478bd9Sstevel@tonic-gate NULL) { 7207c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 7217c478bd9Sstevel@tonic-gate "iprop_full_resync call failed"); 7227c478bd9Sstevel@tonic-gate if (server_handle) 7237c478bd9Sstevel@tonic-gate kadm5_destroy((void *) 7247c478bd9Sstevel@tonic-gate server_handle); 7257c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 7267c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 7277c478bd9Sstevel@tonic-gate goto reinit; 7287c478bd9Sstevel@tonic-gate } 7297c478bd9Sstevel@tonic-gate } 7307c478bd9Sstevel@tonic-gate 7317c478bd9Sstevel@tonic-gate switch (full_ret->ret) { 7327c478bd9Sstevel@tonic-gate case UPDATE_OK: 7337c478bd9Sstevel@tonic-gate backoff_cnt = 0; 7347c478bd9Sstevel@tonic-gate /* 7357c478bd9Sstevel@tonic-gate * We now listen on the kprop port for 7367c478bd9Sstevel@tonic-gate * the full dump 7377c478bd9Sstevel@tonic-gate */ 7387c478bd9Sstevel@tonic-gate ret = do_standalone(log_ctx->iproprole); 7397c478bd9Sstevel@tonic-gate if (ret) 7407c478bd9Sstevel@tonic-gate syslog(LOG_WARNING, 7417c478bd9Sstevel@tonic-gate gettext("kpropd: Full resync, " 7427c478bd9Sstevel@tonic-gate "invalid return.")); 7437c478bd9Sstevel@tonic-gate if (debug) 7447c478bd9Sstevel@tonic-gate if (ret) 7457c478bd9Sstevel@tonic-gate fprintf(stderr, 7467c478bd9Sstevel@tonic-gate gettext("Full resync " 7477c478bd9Sstevel@tonic-gate "was unsuccessful\n")); 7487c478bd9Sstevel@tonic-gate else 7497c478bd9Sstevel@tonic-gate fprintf(stderr, 7507c478bd9Sstevel@tonic-gate gettext("Full resync " 7517c478bd9Sstevel@tonic-gate "was successful\n")); 7527c478bd9Sstevel@tonic-gate frdone = B_TRUE; 7537c478bd9Sstevel@tonic-gate break; 7547c478bd9Sstevel@tonic-gate 7557c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 7567c478bd9Sstevel@tonic-gate /* 7577c478bd9Sstevel@tonic-gate * Exponential backoff 7587c478bd9Sstevel@tonic-gate */ 7597c478bd9Sstevel@tonic-gate backoff_cnt++; 7607c478bd9Sstevel@tonic-gate break; 7617c478bd9Sstevel@tonic-gate 7627c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 7637c478bd9Sstevel@tonic-gate case UPDATE_NIL: 7647c478bd9Sstevel@tonic-gate default: 7657c478bd9Sstevel@tonic-gate backoff_cnt = 0; 7667c478bd9Sstevel@tonic-gate frdone = B_FALSE; 7677c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7687c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 7697c478bd9Sstevel@tonic-gate break; 7707c478bd9Sstevel@tonic-gate 7717c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 7727c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7737c478bd9Sstevel@tonic-gate " permission denied.")); 7747c478bd9Sstevel@tonic-gate goto error; 7757c478bd9Sstevel@tonic-gate 7767c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 7777c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 7787c478bd9Sstevel@tonic-gate " error returned from master KDC.")); 7797c478bd9Sstevel@tonic-gate goto error; 7807c478bd9Sstevel@tonic-gate } 7817c478bd9Sstevel@tonic-gate break; 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate case UPDATE_OK: 7847c478bd9Sstevel@tonic-gate backoff_cnt = 0; 7857c478bd9Sstevel@tonic-gate frdone = B_FALSE; 7867c478bd9Sstevel@tonic-gate 7877c478bd9Sstevel@tonic-gate /* 7887c478bd9Sstevel@tonic-gate * ulog_replay() will convert the ulog updates to db 7897c478bd9Sstevel@tonic-gate * entries using the kdb conv api and will commit 7907c478bd9Sstevel@tonic-gate * the entries to the slave kdc database 7917c478bd9Sstevel@tonic-gate */ 7927c478bd9Sstevel@tonic-gate retval = ulog_replay(kpropd_context, incr_ret); 7937c478bd9Sstevel@tonic-gate 7947c478bd9Sstevel@tonic-gate if (retval) { 7957c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ulog_replay" 7967c478bd9Sstevel@tonic-gate " failed, updates not registered.")); 7977c478bd9Sstevel@tonic-gate break; 7987c478bd9Sstevel@tonic-gate } 7997c478bd9Sstevel@tonic-gate 8007c478bd9Sstevel@tonic-gate if (debug) 8017c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Update transfer " 8027c478bd9Sstevel@tonic-gate "from master was OK\n")); 8037c478bd9Sstevel@tonic-gate break; 8047c478bd9Sstevel@tonic-gate 8057c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 8067c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 8077c478bd9Sstevel@tonic-gate " permission denied.")); 8087c478bd9Sstevel@tonic-gate goto error; 8097c478bd9Sstevel@tonic-gate 8107c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 8117c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates, error " 8127c478bd9Sstevel@tonic-gate "returned from master KDC.")); 8137c478bd9Sstevel@tonic-gate goto error; 8147c478bd9Sstevel@tonic-gate 8157c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 8167c478bd9Sstevel@tonic-gate /* 8177c478bd9Sstevel@tonic-gate * Exponential backoff 8187c478bd9Sstevel@tonic-gate */ 8197c478bd9Sstevel@tonic-gate backoff_cnt++; 8207c478bd9Sstevel@tonic-gate break; 8217c478bd9Sstevel@tonic-gate 8227c478bd9Sstevel@tonic-gate case UPDATE_NIL: 8237c478bd9Sstevel@tonic-gate /* 8247c478bd9Sstevel@tonic-gate * Master-slave are in sync 8257c478bd9Sstevel@tonic-gate */ 8267c478bd9Sstevel@tonic-gate if (debug) 8277c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Master, slave KDC's " 8287c478bd9Sstevel@tonic-gate "are in-sync, no updates\n")); 8297c478bd9Sstevel@tonic-gate backoff_cnt = 0; 8307c478bd9Sstevel@tonic-gate frdone = B_FALSE; 8317c478bd9Sstevel@tonic-gate break; 8327c478bd9Sstevel@tonic-gate 8337c478bd9Sstevel@tonic-gate default: 8347c478bd9Sstevel@tonic-gate backoff_cnt = 0; 8357c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 8367c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 8377c478bd9Sstevel@tonic-gate break; 8387c478bd9Sstevel@tonic-gate } 8397c478bd9Sstevel@tonic-gate 8407c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 8417c478bd9Sstevel@tonic-gate goto done; 8427c478bd9Sstevel@tonic-gate 8437c478bd9Sstevel@tonic-gate /* 8447c478bd9Sstevel@tonic-gate * Sleep for the specified poll interval (Default is 2 mts), 8457c478bd9Sstevel@tonic-gate * or do a binary exponential backoff if we get an 8467c478bd9Sstevel@tonic-gate * UPDATE_BUSY signal 8477c478bd9Sstevel@tonic-gate */ 8487c478bd9Sstevel@tonic-gate if (backoff_cnt > 0) { 8497c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&backoff_cnt); 8507c478bd9Sstevel@tonic-gate if (debug) 8517c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Busy signal received " 8527c478bd9Sstevel@tonic-gate "from master, backoff for %d secs\n"), 8537c478bd9Sstevel@tonic-gate backoff_time); 8547c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 8557c478bd9Sstevel@tonic-gate } 8567c478bd9Sstevel@tonic-gate else 8577c478bd9Sstevel@tonic-gate (void) sleep(pollin); 8587c478bd9Sstevel@tonic-gate 8597c478bd9Sstevel@tonic-gate } 8607c478bd9Sstevel@tonic-gate 8617c478bd9Sstevel@tonic-gate 8627c478bd9Sstevel@tonic-gate error: 8637c478bd9Sstevel@tonic-gate if (debug) 8647c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("ERROR returned by master, bailing\n")); 8657c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ERROR returned by master KDC," 8667c478bd9Sstevel@tonic-gate " bailing.\n")); 8677c478bd9Sstevel@tonic-gate done: 8687c478bd9Sstevel@tonic-gate if (poll_time) 8697c478bd9Sstevel@tonic-gate free(poll_time); 8707c478bd9Sstevel@tonic-gate if(iprop_svc_princstr) 8717c478bd9Sstevel@tonic-gate free(iprop_svc_princstr); 8727c478bd9Sstevel@tonic-gate if (master_svc_princstr) 8737c478bd9Sstevel@tonic-gate free(master_svc_princstr); 8747c478bd9Sstevel@tonic-gate if (retval = krb5_cc_close(kpropd_context, cc)) { 8757c478bd9Sstevel@tonic-gate com_err(progname, retval, 8767c478bd9Sstevel@tonic-gate gettext("while closing default ccache")); 8777c478bd9Sstevel@tonic-gate exit(1); 8787c478bd9Sstevel@tonic-gate } 8797c478bd9Sstevel@tonic-gate if (def_realm) 8807c478bd9Sstevel@tonic-gate free(def_realm); 8817c478bd9Sstevel@tonic-gate if (server_handle) 8827c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 8837c478bd9Sstevel@tonic-gate if (kpropd_context) 8847c478bd9Sstevel@tonic-gate krb5_free_context(kpropd_context); 8857c478bd9Sstevel@tonic-gate 8867c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 8877c478bd9Sstevel@tonic-gate return (0); 8887c478bd9Sstevel@tonic-gate else 8897c478bd9Sstevel@tonic-gate exit(1); 8907c478bd9Sstevel@tonic-gate } 8917c478bd9Sstevel@tonic-gate 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate /* 8947c478bd9Sstevel@tonic-gate * Do exponential backoff, since master KDC is BUSY or down 8957c478bd9Sstevel@tonic-gate */ 8967c478bd9Sstevel@tonic-gate unsigned int backoff_from_master(int *cnt) { 8977c478bd9Sstevel@tonic-gate unsigned int btime; 8987c478bd9Sstevel@tonic-gate 8997c478bd9Sstevel@tonic-gate btime = (unsigned int)(2<<(*cnt)); 9007c478bd9Sstevel@tonic-gate if (btime > MAX_BACKOFF) { 9017c478bd9Sstevel@tonic-gate btime = MAX_BACKOFF; 9027c478bd9Sstevel@tonic-gate *cnt--; 9037c478bd9Sstevel@tonic-gate } 9047c478bd9Sstevel@tonic-gate 9057c478bd9Sstevel@tonic-gate return (btime); 9067c478bd9Sstevel@tonic-gate } 9077c478bd9Sstevel@tonic-gate 9087c478bd9Sstevel@tonic-gate 9097c478bd9Sstevel@tonic-gate /* 9107c478bd9Sstevel@tonic-gate * Routine to convert the `pollstr' string to seconds 9117c478bd9Sstevel@tonic-gate */ 9127c478bd9Sstevel@tonic-gate int convert_polltime(char *pollstr) { 9137c478bd9Sstevel@tonic-gate char *tokenptr = NULL; 9147c478bd9Sstevel@tonic-gate int len, polltime; 9157c478bd9Sstevel@tonic-gate 9167c478bd9Sstevel@tonic-gate len = polltime = 0; 9177c478bd9Sstevel@tonic-gate 9187c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "s")) < strlen(pollstr)) { 9197c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9207c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9217c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr); 9227c478bd9Sstevel@tonic-gate } 9237c478bd9Sstevel@tonic-gate 9247c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "m")) < strlen(pollstr)) { 9257c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9267c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9277c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 60; 9287c478bd9Sstevel@tonic-gate } 9297c478bd9Sstevel@tonic-gate 9307c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "h")) < strlen(pollstr)) { 9317c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 9327c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 9337c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 3600; 9347c478bd9Sstevel@tonic-gate } 9357c478bd9Sstevel@tonic-gate 9367c478bd9Sstevel@tonic-gate if (tokenptr != NULL) 9377c478bd9Sstevel@tonic-gate free(tokenptr); 9387c478bd9Sstevel@tonic-gate /* 9397c478bd9Sstevel@tonic-gate * If we have a bogus pollstr value, set polltime to the 9407c478bd9Sstevel@tonic-gate * default of 2 mts (120 seconds). 9417c478bd9Sstevel@tonic-gate */ 9427c478bd9Sstevel@tonic-gate if (polltime == 0) 9437c478bd9Sstevel@tonic-gate polltime = 120; 9447c478bd9Sstevel@tonic-gate return (polltime); 9457c478bd9Sstevel@tonic-gate } 9467c478bd9Sstevel@tonic-gate 9477c478bd9Sstevel@tonic-gate static void 9487c478bd9Sstevel@tonic-gate kpropd_com_err_proc(whoami, code, fmt, args) 9497c478bd9Sstevel@tonic-gate const char *whoami; 9507c478bd9Sstevel@tonic-gate long code; 9517c478bd9Sstevel@tonic-gate const char *fmt; 9527c478bd9Sstevel@tonic-gate va_list args; 9537c478bd9Sstevel@tonic-gate { 9547c478bd9Sstevel@tonic-gate char error_buf[8096]; 9557c478bd9Sstevel@tonic-gate 9567c478bd9Sstevel@tonic-gate error_buf[0] = '\0'; 9577c478bd9Sstevel@tonic-gate if (fmt) 9587c478bd9Sstevel@tonic-gate vsprintf(error_buf, fmt, args); 9597c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "%s%s%s%s%s", whoami ? whoami : "", whoami ? ": " : "", 9607c478bd9Sstevel@tonic-gate code ? error_message(code) : "", code ? " " : "", error_buf); 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate void PRS(argc,argv) 9647c478bd9Sstevel@tonic-gate int argc; 9657c478bd9Sstevel@tonic-gate char **argv; 9667c478bd9Sstevel@tonic-gate { 9677c478bd9Sstevel@tonic-gate register char *word, ch; 9687c478bd9Sstevel@tonic-gate char *cp; 9697c478bd9Sstevel@tonic-gate int c; 9707c478bd9Sstevel@tonic-gate struct hostent *hp; 9717c478bd9Sstevel@tonic-gate char my_host_name[MAXHOSTNAMELEN], buf[BUFSIZ]; 9727c478bd9Sstevel@tonic-gate krb5_error_code retval; 9737c478bd9Sstevel@tonic-gate static const char tmp[] = ".temp"; 9747c478bd9Sstevel@tonic-gate kadm5_config_params params; 9757c478bd9Sstevel@tonic-gate 9767c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 9777c478bd9Sstevel@tonic-gate 9787c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 9797c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KPROPD_TEST" /* Use this only if it weren't */ 9807c478bd9Sstevel@tonic-gate #endif 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 9837c478bd9Sstevel@tonic-gate 9847c478bd9Sstevel@tonic-gate (void) memset((char *) ¶ms, 0, sizeof (params)); 9857c478bd9Sstevel@tonic-gate 9867c478bd9Sstevel@tonic-gate retval = krb5_init_context(&kpropd_context); 9877c478bd9Sstevel@tonic-gate if (retval) { 9887c478bd9Sstevel@tonic-gate com_err(argv[0], retval, 9897c478bd9Sstevel@tonic-gate gettext("while initializing krb5")); 9907c478bd9Sstevel@tonic-gate exit(1); 9917c478bd9Sstevel@tonic-gate } 9927c478bd9Sstevel@tonic-gate progname = argv[0]; 9937c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, "dtf:F:p:P:r:s:Sa:")) != EOF){ 9947c478bd9Sstevel@tonic-gate switch (c) { 9957c478bd9Sstevel@tonic-gate case 'd': 9967c478bd9Sstevel@tonic-gate debug++; 9977c478bd9Sstevel@tonic-gate break; 9987c478bd9Sstevel@tonic-gate case 't': 9997c478bd9Sstevel@tonic-gate /* 10007c478bd9Sstevel@tonic-gate * Undocumented option - for testing only. 10017c478bd9Sstevel@tonic-gate * 10027c478bd9Sstevel@tonic-gate * Option to run the kpropd server exactly 10037c478bd9Sstevel@tonic-gate * once (this is true only if iprop is enabled). 10047c478bd9Sstevel@tonic-gate */ 10057c478bd9Sstevel@tonic-gate runonce = B_TRUE; 10067c478bd9Sstevel@tonic-gate break; 10077c478bd9Sstevel@tonic-gate 10087c478bd9Sstevel@tonic-gate case 'f': 10097c478bd9Sstevel@tonic-gate file = optarg; 10107c478bd9Sstevel@tonic-gate if (!file) 10117c478bd9Sstevel@tonic-gate usage(); 10127c478bd9Sstevel@tonic-gate break; 10137c478bd9Sstevel@tonic-gate case 'F': 10147c478bd9Sstevel@tonic-gate kerb_database = optarg; 10157c478bd9Sstevel@tonic-gate if (!kerb_database) 10167c478bd9Sstevel@tonic-gate usage(); 10177c478bd9Sstevel@tonic-gate break; 10187c478bd9Sstevel@tonic-gate case 'p': 10197c478bd9Sstevel@tonic-gate kdb5_util = optarg; 10207c478bd9Sstevel@tonic-gate if (!kdb5_util) 10217c478bd9Sstevel@tonic-gate usage(); 10227c478bd9Sstevel@tonic-gate break; 10237c478bd9Sstevel@tonic-gate case 'P': 10247c478bd9Sstevel@tonic-gate port = htons(atoi(optarg)); 10257c478bd9Sstevel@tonic-gate if (!port) 10267c478bd9Sstevel@tonic-gate usage(); 10277c478bd9Sstevel@tonic-gate break; 10287c478bd9Sstevel@tonic-gate case 'r': 10297c478bd9Sstevel@tonic-gate realm = optarg; 10307c478bd9Sstevel@tonic-gate if (!realm) 10317c478bd9Sstevel@tonic-gate usage(); 10327c478bd9Sstevel@tonic-gate params.realm = realm; 10337c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 10347c478bd9Sstevel@tonic-gate break; 10357c478bd9Sstevel@tonic-gate case 's': 10367c478bd9Sstevel@tonic-gate srvtab = optarg; 10377c478bd9Sstevel@tonic-gate if (!srvtab) 10387c478bd9Sstevel@tonic-gate usage(); 10397c478bd9Sstevel@tonic-gate break; 10407c478bd9Sstevel@tonic-gate case 'S': 10417c478bd9Sstevel@tonic-gate standalone++; 10427c478bd9Sstevel@tonic-gate break; 10437c478bd9Sstevel@tonic-gate case 'a': 10447c478bd9Sstevel@tonic-gate acl_file_name = optarg; 10457c478bd9Sstevel@tonic-gate if (!acl_file_name) 10467c478bd9Sstevel@tonic-gate usage(); 10477c478bd9Sstevel@tonic-gate break; 10487c478bd9Sstevel@tonic-gate case '?': 10497c478bd9Sstevel@tonic-gate default: 10507c478bd9Sstevel@tonic-gate usage(); 10517c478bd9Sstevel@tonic-gate } 10527c478bd9Sstevel@tonic-gate 10537c478bd9Sstevel@tonic-gate } 10547c478bd9Sstevel@tonic-gate /* 10557c478bd9Sstevel@tonic-gate * If not in debug mode, switch com_err reporting to syslog 10567c478bd9Sstevel@tonic-gate */ 10577c478bd9Sstevel@tonic-gate if (! debug) { 10587c478bd9Sstevel@tonic-gate openlog("kpropd", LOG_PID | LOG_ODELAY, SYSLOG_CLASS); 10597c478bd9Sstevel@tonic-gate set_com_err_hook(kpropd_com_err_proc); 10607c478bd9Sstevel@tonic-gate } 10617c478bd9Sstevel@tonic-gate /* 10627c478bd9Sstevel@tonic-gate * Get my hostname, so we can construct my service name 10637c478bd9Sstevel@tonic-gate */ 10647c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, 10657c478bd9Sstevel@tonic-gate NULL, KPROP_SERVICE_NAME, 10667c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &server); 10677c478bd9Sstevel@tonic-gate if (retval) { 10687c478bd9Sstevel@tonic-gate com_err(progname, retval, 10697c478bd9Sstevel@tonic-gate gettext("While trying to construct my service name")); 10707c478bd9Sstevel@tonic-gate exit(1); 10717c478bd9Sstevel@tonic-gate } 10727c478bd9Sstevel@tonic-gate if (realm) { 1073*56a424ccSmp retval = krb5_set_principal_realm(kpropd_context, server, realm); 1074*56a424ccSmp if (retval) { 1075*56a424ccSmp com_err(progname, errno, 1076*56a424ccSmp gettext("while constructing my service realm")); 1077*56a424ccSmp exit(1); 1078*56a424ccSmp } 10797c478bd9Sstevel@tonic-gate } 10807c478bd9Sstevel@tonic-gate /* 10817c478bd9Sstevel@tonic-gate * Construct the name of the temporary file. 10827c478bd9Sstevel@tonic-gate */ 10837c478bd9Sstevel@tonic-gate if ((temp_file_name = (char *) malloc(strlen(file) + 10847c478bd9Sstevel@tonic-gate strlen(tmp) + 1)) == NULL) { 10857c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 10867c478bd9Sstevel@tonic-gate gettext("while allocating filename for temp file")); 10877c478bd9Sstevel@tonic-gate exit(1); 10887c478bd9Sstevel@tonic-gate } 10897c478bd9Sstevel@tonic-gate strcpy(temp_file_name, file); 10907c478bd9Sstevel@tonic-gate strcat(temp_file_name, tmp); 10917c478bd9Sstevel@tonic-gate 10927c478bd9Sstevel@tonic-gate retval = kadm5_get_config_params(kpropd_context, NULL, NULL, ¶ms, 10937c478bd9Sstevel@tonic-gate ¶ms); 10947c478bd9Sstevel@tonic-gate if (retval) { 10957c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing")); 10967c478bd9Sstevel@tonic-gate exit(1); 10977c478bd9Sstevel@tonic-gate } 10987c478bd9Sstevel@tonic-gate if (params.iprop_enabled == TRUE) { 10997c478bd9Sstevel@tonic-gate ulog_set_role(kpropd_context, IPROP_SLAVE); 11007c478bd9Sstevel@tonic-gate poll_time = params.iprop_polltime; 11017c478bd9Sstevel@tonic-gate 11027c478bd9Sstevel@tonic-gate if (ulog_map(kpropd_context, ¶ms, FKPROPD)) { 11037c478bd9Sstevel@tonic-gate com_err(progname, errno, 11047c478bd9Sstevel@tonic-gate gettext("Unable to map log!\n")); 11057c478bd9Sstevel@tonic-gate exit(1); 11067c478bd9Sstevel@tonic-gate } 11077c478bd9Sstevel@tonic-gate } 11087c478bd9Sstevel@tonic-gate 11097c478bd9Sstevel@tonic-gate /* 11107c478bd9Sstevel@tonic-gate * Grab the realm info and check if iprop is enabled. 11117c478bd9Sstevel@tonic-gate */ 11127c478bd9Sstevel@tonic-gate if (def_realm == NULL) { 11137c478bd9Sstevel@tonic-gate retval = krb5_get_default_realm(kpropd_context, &def_realm); 11147c478bd9Sstevel@tonic-gate if (retval) { 11157c478bd9Sstevel@tonic-gate com_err(progname, retval, 11167c478bd9Sstevel@tonic-gate gettext("Unable to get default realm")); 11177c478bd9Sstevel@tonic-gate exit(1); 11187c478bd9Sstevel@tonic-gate } 11197c478bd9Sstevel@tonic-gate } 11207c478bd9Sstevel@tonic-gate } 11217c478bd9Sstevel@tonic-gate 11227c478bd9Sstevel@tonic-gate /* 11237c478bd9Sstevel@tonic-gate * Figure out who's calling on the other end of the connection.... 11247c478bd9Sstevel@tonic-gate */ 11257c478bd9Sstevel@tonic-gate void 11267c478bd9Sstevel@tonic-gate kerberos_authenticate(context, fd, clientp, etype, ss) 11277c478bd9Sstevel@tonic-gate krb5_context context; 11287c478bd9Sstevel@tonic-gate int fd; 11297c478bd9Sstevel@tonic-gate krb5_principal * clientp; 11307c478bd9Sstevel@tonic-gate krb5_enctype * etype; 11317c478bd9Sstevel@tonic-gate struct sockaddr_storage ss; 11327c478bd9Sstevel@tonic-gate { 11337c478bd9Sstevel@tonic-gate krb5_error_code retval; 11347c478bd9Sstevel@tonic-gate krb5_ticket * ticket; 11357c478bd9Sstevel@tonic-gate struct sockaddr_storage r_ss; 11367c478bd9Sstevel@tonic-gate int ss_length; 11377c478bd9Sstevel@tonic-gate krb5_keytab keytab = NULL; 11387c478bd9Sstevel@tonic-gate 11397c478bd9Sstevel@tonic-gate /* 11407c478bd9Sstevel@tonic-gate * Set recv_addr and send_addr 11417c478bd9Sstevel@tonic-gate */ 11427c478bd9Sstevel@tonic-gate if (cvtkaddr(&ss, &sender_addr) == NULL) { 11437c478bd9Sstevel@tonic-gate com_err(progname, errno, 11447c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 11457c478bd9Sstevel@tonic-gate exit(1); 11467c478bd9Sstevel@tonic-gate } 11477c478bd9Sstevel@tonic-gate 11487c478bd9Sstevel@tonic-gate ss_length = sizeof (r_ss); 11497c478bd9Sstevel@tonic-gate if (getsockname(fd, (struct sockaddr *) &r_ss, &ss_length)) { 11507c478bd9Sstevel@tonic-gate com_err(progname, errno, 11517c478bd9Sstevel@tonic-gate gettext("while getting local socket address")); 11527c478bd9Sstevel@tonic-gate exit(1); 11537c478bd9Sstevel@tonic-gate } 11547c478bd9Sstevel@tonic-gate 11557c478bd9Sstevel@tonic-gate if (cvtkaddr(&r_ss, &receiver_addr) == NULL) { 11567c478bd9Sstevel@tonic-gate com_err(progname, errno, 11577c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 11587c478bd9Sstevel@tonic-gate exit(1); 11597c478bd9Sstevel@tonic-gate } 11607c478bd9Sstevel@tonic-gate 11617c478bd9Sstevel@tonic-gate if (debug) { 11627c478bd9Sstevel@tonic-gate char *name; 1163*56a424ccSmp 1164*56a424ccSmp retval = krb5_unparse_name(context, server, &name); 1165*56a424ccSmp if (retval) { 11667c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("While unparsing server name")); 11677c478bd9Sstevel@tonic-gate exit(1); 11687c478bd9Sstevel@tonic-gate } 11697c478bd9Sstevel@tonic-gate printf(gettext("krb5_recvauth(%d, %s, %s, ...)\n"), fd, kprop_version, 11707c478bd9Sstevel@tonic-gate name); 11717c478bd9Sstevel@tonic-gate free(name); 11727c478bd9Sstevel@tonic-gate } 11737c478bd9Sstevel@tonic-gate 1174*56a424ccSmp retval = krb5_auth_con_init(context, &auth_context); 1175*56a424ccSmp if (retval) { 11767c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_init: %s"), 1177*56a424ccSmp error_message(retval)); 11787c478bd9Sstevel@tonic-gate exit(1); 11797c478bd9Sstevel@tonic-gate } 11807c478bd9Sstevel@tonic-gate 1181*56a424ccSmp retval = krb5_auth_con_setflags(context, auth_context, 1182*56a424ccSmp KRB5_AUTH_CONTEXT_DO_SEQUENCE); 1183*56a424ccSmp if (retval) { 11847c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setflags: %s"), 11857c478bd9Sstevel@tonic-gate error_message(retval)); 11867c478bd9Sstevel@tonic-gate exit(1); 11877c478bd9Sstevel@tonic-gate } 11887c478bd9Sstevel@tonic-gate 1189*56a424ccSmp retval = krb5_auth_con_setaddrs(context, auth_context, &receiver_addr, 1190*56a424ccSmp &sender_addr); 1191*56a424ccSmp if (retval) { 11927c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setaddrs: %s"), 11937c478bd9Sstevel@tonic-gate error_message(retval)); 11947c478bd9Sstevel@tonic-gate exit(1); 11957c478bd9Sstevel@tonic-gate } 11967c478bd9Sstevel@tonic-gate 11977c478bd9Sstevel@tonic-gate if (srvtab) { 1198*56a424ccSmp retval = krb5_kt_resolve(context, srvtab, &keytab); 1199*56a424ccSmp if (retval) { 12007c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_kt_resolve: %s"), error_message(retval)); 12017c478bd9Sstevel@tonic-gate exit(1); 12027c478bd9Sstevel@tonic-gate } 12037c478bd9Sstevel@tonic-gate } 12047c478bd9Sstevel@tonic-gate 1205*56a424ccSmp retval = krb5_recvauth(context, &auth_context, (void *) &fd, 1206*56a424ccSmp kprop_version, server, 0, keytab, &ticket); 1207*56a424ccSmp if (retval) { 1208*56a424ccSmp syslog(LOG_ERR, gettext("Error in krb5_recvauth: %s"), error_message(retval)); 12097c478bd9Sstevel@tonic-gate exit(1); 12107c478bd9Sstevel@tonic-gate } 12117c478bd9Sstevel@tonic-gate 1212*56a424ccSmp retval = krb5_copy_principal(context, ticket->enc_part2->client, clientp); 1213*56a424ccSmp if (retval) { 12147c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_copy_prinicpal: %s"), 12157c478bd9Sstevel@tonic-gate error_message(retval)); 12167c478bd9Sstevel@tonic-gate exit(1); 12177c478bd9Sstevel@tonic-gate } 12187c478bd9Sstevel@tonic-gate 12197c478bd9Sstevel@tonic-gate *etype = ticket->enc_part.enctype; 12207c478bd9Sstevel@tonic-gate 12217c478bd9Sstevel@tonic-gate if (debug) { 12227c478bd9Sstevel@tonic-gate char * name; 12237c478bd9Sstevel@tonic-gate char etypebuf[100]; 12247c478bd9Sstevel@tonic-gate 1225*56a424ccSmp retval = krb5_unparse_name(context, *clientp, &name); 1226*56a424ccSmp if (retval) { 12277c478bd9Sstevel@tonic-gate com_err(progname, retval, 12287c478bd9Sstevel@tonic-gate gettext("While unparsing client name")); 12297c478bd9Sstevel@tonic-gate exit(1); 12307c478bd9Sstevel@tonic-gate } 12317c478bd9Sstevel@tonic-gate 1232*56a424ccSmp retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf)); 1233*56a424ccSmp if (retval) { 12347c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("While unparsing ticket etype")); 12357c478bd9Sstevel@tonic-gate exit(1); 12367c478bd9Sstevel@tonic-gate } 12377c478bd9Sstevel@tonic-gate 12387c478bd9Sstevel@tonic-gate printf("authenticated client: %s (etype == %s)\n", name, etypebuf); 12397c478bd9Sstevel@tonic-gate free(name); 12407c478bd9Sstevel@tonic-gate } 12417c478bd9Sstevel@tonic-gate 12427c478bd9Sstevel@tonic-gate krb5_free_ticket(context, ticket); 12437c478bd9Sstevel@tonic-gate } 12447c478bd9Sstevel@tonic-gate 12457c478bd9Sstevel@tonic-gate krb5_boolean 12467c478bd9Sstevel@tonic-gate authorized_principal(context, p, auth_etype) 12477c478bd9Sstevel@tonic-gate krb5_context context; 12487c478bd9Sstevel@tonic-gate krb5_principal p; 12497c478bd9Sstevel@tonic-gate krb5_enctype auth_etype; 12507c478bd9Sstevel@tonic-gate { 12517c478bd9Sstevel@tonic-gate char *name, *ptr; 12527c478bd9Sstevel@tonic-gate char buf[1024]; 12537c478bd9Sstevel@tonic-gate krb5_error_code retval; 12547c478bd9Sstevel@tonic-gate FILE *acl_file; 12557c478bd9Sstevel@tonic-gate int end; 12567c478bd9Sstevel@tonic-gate krb5_enctype acl_etype; 12577c478bd9Sstevel@tonic-gate 12587c478bd9Sstevel@tonic-gate retval = krb5_unparse_name(context, p, &name); 12597c478bd9Sstevel@tonic-gate if (retval) 12607c478bd9Sstevel@tonic-gate return FALSE; 12617c478bd9Sstevel@tonic-gate 12627c478bd9Sstevel@tonic-gate acl_file = fopen(acl_file_name, "r"); 12637c478bd9Sstevel@tonic-gate if (!acl_file) 12647c478bd9Sstevel@tonic-gate return FALSE; 12657c478bd9Sstevel@tonic-gate 12667c478bd9Sstevel@tonic-gate while (!feof(acl_file)) { 12677c478bd9Sstevel@tonic-gate if (!fgets(buf, sizeof(buf), acl_file)) 12687c478bd9Sstevel@tonic-gate break; 12697c478bd9Sstevel@tonic-gate end = strlen(buf) - 1; 12707c478bd9Sstevel@tonic-gate if (buf[end] == '\n') 12717c478bd9Sstevel@tonic-gate buf[end] = '\0'; 12727c478bd9Sstevel@tonic-gate if (!strncmp(name, buf, strlen(name))) { 12737c478bd9Sstevel@tonic-gate ptr = buf+strlen(name); 12747c478bd9Sstevel@tonic-gate 12757c478bd9Sstevel@tonic-gate /* if the next character is not whitespace or nul, then 12767c478bd9Sstevel@tonic-gate the match is only partial. continue on to new lines. */ 1277*56a424ccSmp if (*ptr && !isspace((int) *ptr)) 12787c478bd9Sstevel@tonic-gate continue; 12797c478bd9Sstevel@tonic-gate 12807c478bd9Sstevel@tonic-gate /* otherwise, skip trailing whitespace */ 1281*56a424ccSmp for (; *ptr && isspace((int) *ptr); ptr++) ; 12827c478bd9Sstevel@tonic-gate 12837c478bd9Sstevel@tonic-gate /* now, look for an etype string. if there isn't one, 12847c478bd9Sstevel@tonic-gate return true. if there is an invalid string, continue. 12857c478bd9Sstevel@tonic-gate If there is a valid string, return true only if it 12867c478bd9Sstevel@tonic-gate matches the etype passed in, otherwise continue */ 12877c478bd9Sstevel@tonic-gate 12887c478bd9Sstevel@tonic-gate if ((*ptr) && 12897c478bd9Sstevel@tonic-gate ((retval = krb5_string_to_enctype(ptr, &acl_etype)) || 12907c478bd9Sstevel@tonic-gate (acl_etype != auth_etype))) 12917c478bd9Sstevel@tonic-gate continue; 12927c478bd9Sstevel@tonic-gate 12937c478bd9Sstevel@tonic-gate free(name); 12947c478bd9Sstevel@tonic-gate fclose(acl_file); 12957c478bd9Sstevel@tonic-gate return TRUE; 12967c478bd9Sstevel@tonic-gate } 12977c478bd9Sstevel@tonic-gate } 12987c478bd9Sstevel@tonic-gate free(name); 12997c478bd9Sstevel@tonic-gate fclose(acl_file); 13007c478bd9Sstevel@tonic-gate return FALSE; 13017c478bd9Sstevel@tonic-gate } 13027c478bd9Sstevel@tonic-gate 13037c478bd9Sstevel@tonic-gate void 13047c478bd9Sstevel@tonic-gate recv_database(context, fd, database_fd, confmsg) 13057c478bd9Sstevel@tonic-gate krb5_context context; 13067c478bd9Sstevel@tonic-gate int fd; 13077c478bd9Sstevel@tonic-gate int database_fd; 13087c478bd9Sstevel@tonic-gate krb5_data *confmsg; 13097c478bd9Sstevel@tonic-gate { 1310*56a424ccSmp krb5_ui_4 database_size; /* This must be 4 bytes */ 13117c478bd9Sstevel@tonic-gate int received_size, n; 13127c478bd9Sstevel@tonic-gate char buf[1024]; 13137c478bd9Sstevel@tonic-gate krb5_data inbuf, outbuf; 13147c478bd9Sstevel@tonic-gate krb5_error_code retval; 13157c478bd9Sstevel@tonic-gate 13167c478bd9Sstevel@tonic-gate /* 13177c478bd9Sstevel@tonic-gate * Receive and decode size from client 13187c478bd9Sstevel@tonic-gate */ 1319*56a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 1320*56a424ccSmp if (retval) { 13217c478bd9Sstevel@tonic-gate send_error(context, fd, retval, gettext("while reading database size")); 13227c478bd9Sstevel@tonic-gate com_err(progname, retval, 13237c478bd9Sstevel@tonic-gate gettext("while reading size of database from client")); 13247c478bd9Sstevel@tonic-gate exit(1); 13257c478bd9Sstevel@tonic-gate } 13267c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 13277c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 1328*56a424ccSmp retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL); 1329*56a424ccSmp if (retval) { 1330*56a424ccSmp send_error(context, fd, retval, gettext( 1331*56a424ccSmp "while decoding database size")); 13327c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13337c478bd9Sstevel@tonic-gate com_err(progname, retval, 13347c478bd9Sstevel@tonic-gate gettext("while decoding database size from client")); 13357c478bd9Sstevel@tonic-gate exit(1); 13367c478bd9Sstevel@tonic-gate } 13377c478bd9Sstevel@tonic-gate memcpy((char *) &database_size, outbuf.data, sizeof(database_size)); 13387c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13397c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 13407c478bd9Sstevel@tonic-gate database_size = ntohl(database_size); 13417c478bd9Sstevel@tonic-gate 1342*56a424ccSmp /* 1343*56a424ccSmp * Initialize the initial vector. 1344*56a424ccSmp */ 1345*56a424ccSmp retval = krb5_auth_con_initivector(context, auth_context); 1346*56a424ccSmp if (retval) { 1347*56a424ccSmp send_error(context, fd, retval, gettext( 1348*56a424ccSmp "failed while initializing i_vector")); 1349*56a424ccSmp com_err(progname, retval, gettext("while initializing i_vector")); 1350*56a424ccSmp exit(1); 1351*56a424ccSmp } 13527c478bd9Sstevel@tonic-gate 13537c478bd9Sstevel@tonic-gate /* 13547c478bd9Sstevel@tonic-gate * Now start receiving the database from the net 13557c478bd9Sstevel@tonic-gate */ 13567c478bd9Sstevel@tonic-gate received_size = 0; 13577c478bd9Sstevel@tonic-gate while (received_size < database_size) { 1358*56a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 1359*56a424ccSmp if (retval) { 13607c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13617c478bd9Sstevel@tonic-gate gettext("while reading database block starting at offset %d"), 13627c478bd9Sstevel@tonic-gate received_size); 13637c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 13647c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 13657c478bd9Sstevel@tonic-gate exit(1); 13667c478bd9Sstevel@tonic-gate } 13677c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 13687c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 1369*56a424ccSmp retval = krb5_rd_priv(context, auth_context, &inbuf, 1370*56a424ccSmp &outbuf, NULL); 1371*56a424ccSmp if (retval) { 13727c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13737c478bd9Sstevel@tonic-gate gettext("while decoding database block starting at offset %d"), 13747c478bd9Sstevel@tonic-gate received_size); 13757c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 13767c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 13777c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13787c478bd9Sstevel@tonic-gate exit(1); 13797c478bd9Sstevel@tonic-gate } 13807c478bd9Sstevel@tonic-gate n = write(database_fd, outbuf.data, outbuf.length); 13817c478bd9Sstevel@tonic-gate if (n < 0) { 13827c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13837c478bd9Sstevel@tonic-gate gettext( 13847c478bd9Sstevel@tonic-gate "while writing database block starting at offset %d"), 13857c478bd9Sstevel@tonic-gate received_size); 13867c478bd9Sstevel@tonic-gate send_error(context, fd, errno, buf); 13877c478bd9Sstevel@tonic-gate } else if (n != outbuf.length) { 13887c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 13897c478bd9Sstevel@tonic-gate gettext( 13907c478bd9Sstevel@tonic-gate "incomplete write while writing database block starting at\n" 13917c478bd9Sstevel@tonic-gate "offset %d (%d written, %d expected)"), 13927c478bd9Sstevel@tonic-gate received_size, n, outbuf.length); 13937c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 13947c478bd9Sstevel@tonic-gate } 13957c478bd9Sstevel@tonic-gate received_size += outbuf.length; 13967c478bd9Sstevel@tonic-gate /* SUNWresync121: our krb5...contents sets length to 0 */ 13977c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 13987c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 1399*56a424ccSmp 14007c478bd9Sstevel@tonic-gate } 14017c478bd9Sstevel@tonic-gate /* 14027c478bd9Sstevel@tonic-gate * OK, we've seen the entire file. Did we get too many bytes? 14037c478bd9Sstevel@tonic-gate */ 14047c478bd9Sstevel@tonic-gate if (received_size > database_size) { 14057c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 14067c478bd9Sstevel@tonic-gate gettext("Received %d bytes, expected %d bytes for database file"), 14077c478bd9Sstevel@tonic-gate received_size, database_size); 14087c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 14097c478bd9Sstevel@tonic-gate } 14107c478bd9Sstevel@tonic-gate /* 14117c478bd9Sstevel@tonic-gate * Create message acknowledging number of bytes received, but 14127c478bd9Sstevel@tonic-gate * don't send it until kdb5_util returns successfully. 14137c478bd9Sstevel@tonic-gate */ 14147c478bd9Sstevel@tonic-gate database_size = htonl(database_size); 14157c478bd9Sstevel@tonic-gate inbuf.data = (char *) &database_size; 14167c478bd9Sstevel@tonic-gate inbuf.length = sizeof(database_size); 1417*56a424ccSmp retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); 1418*56a424ccSmp if (retval) { 14197c478bd9Sstevel@tonic-gate com_err(progname, retval, 14207c478bd9Sstevel@tonic-gate gettext("while encoding # of receieved bytes")); 14217c478bd9Sstevel@tonic-gate send_error(context, fd, retval, 14227c478bd9Sstevel@tonic-gate gettext("while encoding # of received bytes")); 14237c478bd9Sstevel@tonic-gate exit(1); 14247c478bd9Sstevel@tonic-gate } 14257c478bd9Sstevel@tonic-gate } 14267c478bd9Sstevel@tonic-gate 14277c478bd9Sstevel@tonic-gate 14287c478bd9Sstevel@tonic-gate void 14297c478bd9Sstevel@tonic-gate send_error(context, fd, err_code, err_text) 14307c478bd9Sstevel@tonic-gate krb5_context context; 14317c478bd9Sstevel@tonic-gate int fd; 14327c478bd9Sstevel@tonic-gate krb5_error_code err_code; 14337c478bd9Sstevel@tonic-gate char *err_text; 14347c478bd9Sstevel@tonic-gate { 14357c478bd9Sstevel@tonic-gate krb5_error error; 14367c478bd9Sstevel@tonic-gate const char *text; 14377c478bd9Sstevel@tonic-gate krb5_data outbuf; 14387c478bd9Sstevel@tonic-gate char buf[1024]; 14397c478bd9Sstevel@tonic-gate 14407c478bd9Sstevel@tonic-gate memset((char *)&error, 0, sizeof(error)); 14417c478bd9Sstevel@tonic-gate krb5_us_timeofday(context, &error.stime, &error.susec); 14427c478bd9Sstevel@tonic-gate error.server = server; 14437c478bd9Sstevel@tonic-gate error.client = client; 14447c478bd9Sstevel@tonic-gate 14457c478bd9Sstevel@tonic-gate if (err_text) 14467c478bd9Sstevel@tonic-gate text = err_text; 14477c478bd9Sstevel@tonic-gate else 14487c478bd9Sstevel@tonic-gate text = error_message(err_code); 14497c478bd9Sstevel@tonic-gate 14507c478bd9Sstevel@tonic-gate error.error = err_code - ERROR_TABLE_BASE_krb5; 14517c478bd9Sstevel@tonic-gate if (error.error > 127) { 14527c478bd9Sstevel@tonic-gate error.error = KRB_ERR_GENERIC; 14537c478bd9Sstevel@tonic-gate if (err_text) { 14547c478bd9Sstevel@tonic-gate sprintf(buf, "%s %s", error_message(err_code), 14557c478bd9Sstevel@tonic-gate err_text); 14567c478bd9Sstevel@tonic-gate text = buf; 14577c478bd9Sstevel@tonic-gate } 14587c478bd9Sstevel@tonic-gate } 14597c478bd9Sstevel@tonic-gate error.text.length = strlen(text) + 1; 1460*56a424ccSmp error.text.data = malloc(error.text.length); 1461*56a424ccSmp if (error.text.data) { 14627c478bd9Sstevel@tonic-gate strcpy(error.text.data, text); 14637c478bd9Sstevel@tonic-gate if (!krb5_mk_error(context, &error, &outbuf)) { 14647c478bd9Sstevel@tonic-gate (void) krb5_write_message(context, (void *)&fd,&outbuf); 14657c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 14667c478bd9Sstevel@tonic-gate } 14677c478bd9Sstevel@tonic-gate free(error.text.data); 14687c478bd9Sstevel@tonic-gate } 14697c478bd9Sstevel@tonic-gate } 14707c478bd9Sstevel@tonic-gate 14717c478bd9Sstevel@tonic-gate void 14727c478bd9Sstevel@tonic-gate recv_error(context, inbuf) 14737c478bd9Sstevel@tonic-gate krb5_context context; 14747c478bd9Sstevel@tonic-gate krb5_data *inbuf; 14757c478bd9Sstevel@tonic-gate { 14767c478bd9Sstevel@tonic-gate krb5_error *error; 14777c478bd9Sstevel@tonic-gate krb5_error_code retval; 14787c478bd9Sstevel@tonic-gate 1479*56a424ccSmp retval = krb5_rd_error(context, inbuf, &error); 1480*56a424ccSmp if (retval) { 14817c478bd9Sstevel@tonic-gate com_err(progname, retval, 14827c478bd9Sstevel@tonic-gate gettext("while decoding error packet from client")); 14837c478bd9Sstevel@tonic-gate exit(1); 14847c478bd9Sstevel@tonic-gate } 14857c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 14867c478bd9Sstevel@tonic-gate if (error->text.data) 14877c478bd9Sstevel@tonic-gate fprintf(stderr, 14887c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 14897c478bd9Sstevel@tonic-gate error->text.data); 14907c478bd9Sstevel@tonic-gate } else if (error->error) { 14917c478bd9Sstevel@tonic-gate com_err(progname, error->error + ERROR_TABLE_BASE_krb5, 14927c478bd9Sstevel@tonic-gate gettext("signalled from server")); 14937c478bd9Sstevel@tonic-gate if (error->text.data) 14947c478bd9Sstevel@tonic-gate fprintf(stderr, 14957c478bd9Sstevel@tonic-gate gettext("Error text from client: %s\n"), 14967c478bd9Sstevel@tonic-gate error->text.data); 14977c478bd9Sstevel@tonic-gate } 14987c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 14997c478bd9Sstevel@tonic-gate exit(1); 15007c478bd9Sstevel@tonic-gate } 15017c478bd9Sstevel@tonic-gate 15027c478bd9Sstevel@tonic-gate void 1503*56a424ccSmp load_database(context, kdb_util, database_file_name) 15047c478bd9Sstevel@tonic-gate krb5_context context; 1505*56a424ccSmp char *kdb_util; 15067c478bd9Sstevel@tonic-gate char *database_file_name; 15077c478bd9Sstevel@tonic-gate { 15087c478bd9Sstevel@tonic-gate static char *edit_av[10]; 1509*56a424ccSmp int error_ret, save_stderr = -1; 15107c478bd9Sstevel@tonic-gate int child_pid; 15117c478bd9Sstevel@tonic-gate int count; 1512*56a424ccSmp 1513*56a424ccSmp /* <sys/param.h> has been included, so BSD will be defined on 1514*56a424ccSmp BSD systems */ 1515*56a424ccSmp #if BSD > 0 && BSD <= 43 1516*56a424ccSmp #ifndef WEXITSTATUS 1517*56a424ccSmp #define WEXITSTATUS(w) (w).w_retcode 1518*56a424ccSmp #endif 1519*56a424ccSmp union wait waitb; 1520*56a424ccSmp #else 15217c478bd9Sstevel@tonic-gate int waitb; 1522*56a424ccSmp #endif 15237c478bd9Sstevel@tonic-gate krb5_error_code retval; 15247c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 15257c478bd9Sstevel@tonic-gate 15267c478bd9Sstevel@tonic-gate if (debug) 1527*56a424ccSmp printf(gettext("calling kdb_util to load database\n")); 15287c478bd9Sstevel@tonic-gate 15297c478bd9Sstevel@tonic-gate log_ctx = context->kdblog_context; 15307c478bd9Sstevel@tonic-gate 1531*56a424ccSmp edit_av[0] = kdb_util; 15327c478bd9Sstevel@tonic-gate count = 1; 15337c478bd9Sstevel@tonic-gate if (realm) { 15347c478bd9Sstevel@tonic-gate edit_av[count++] = "-r"; 15357c478bd9Sstevel@tonic-gate edit_av[count++] = realm; 15367c478bd9Sstevel@tonic-gate } 15377c478bd9Sstevel@tonic-gate edit_av[count++] = "load"; 15387c478bd9Sstevel@tonic-gate if (kerb_database) { 15397c478bd9Sstevel@tonic-gate edit_av[count++] = "-d"; 15407c478bd9Sstevel@tonic-gate edit_av[count++] = kerb_database; 15417c478bd9Sstevel@tonic-gate } 15427c478bd9Sstevel@tonic-gate 15437c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 15447c478bd9Sstevel@tonic-gate edit_av[count++] = "-i"; 15457c478bd9Sstevel@tonic-gate } 15467c478bd9Sstevel@tonic-gate edit_av[count++] = database_file_name; 15477c478bd9Sstevel@tonic-gate edit_av[count++] = NULL; 15487c478bd9Sstevel@tonic-gate 15497c478bd9Sstevel@tonic-gate switch(child_pid = fork()) { 15507c478bd9Sstevel@tonic-gate case -1: 15517c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to fork %s"), 1552*56a424ccSmp kdb_util); 15537c478bd9Sstevel@tonic-gate exit(1); 15547c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 15557c478bd9Sstevel@tonic-gate case 0: 15567c478bd9Sstevel@tonic-gate if (!debug) { 15577c478bd9Sstevel@tonic-gate save_stderr = dup(2); 15587c478bd9Sstevel@tonic-gate close(0); 15597c478bd9Sstevel@tonic-gate close(1); 15607c478bd9Sstevel@tonic-gate close(2); 15617c478bd9Sstevel@tonic-gate open("/dev/null", O_RDWR); 15627c478bd9Sstevel@tonic-gate dup(0); 15637c478bd9Sstevel@tonic-gate dup(0); 15647c478bd9Sstevel@tonic-gate } 15657c478bd9Sstevel@tonic-gate 1566*56a424ccSmp execv(kdb_util, edit_av); 15677c478bd9Sstevel@tonic-gate retval = errno; 15687c478bd9Sstevel@tonic-gate if (!debug) 15697c478bd9Sstevel@tonic-gate dup2(save_stderr, 2); 15707c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to exec %s"), 1571*56a424ccSmp kdb_util); 15727c478bd9Sstevel@tonic-gate _exit(1); 15737c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 15747c478bd9Sstevel@tonic-gate default: 15757c478bd9Sstevel@tonic-gate if (debug) 15767c478bd9Sstevel@tonic-gate printf(gettext("Child PID is %d\n"), child_pid); 15777c478bd9Sstevel@tonic-gate if (wait(&waitb) < 0) { 15787c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while waiting for %s"), 1579*56a424ccSmp kdb_util); 15807c478bd9Sstevel@tonic-gate exit(1); 15817c478bd9Sstevel@tonic-gate } 15827c478bd9Sstevel@tonic-gate } 15837c478bd9Sstevel@tonic-gate 1584*56a424ccSmp error_ret = WEXITSTATUS(waitb); 1585*56a424ccSmp if (error_ret) { 15867c478bd9Sstevel@tonic-gate com_err(progname, 0, 1587*56a424ccSmp gettext("%s returned a bad exit status (%d)"), 1588*56a424ccSmp kdb_util, error_ret); 15897c478bd9Sstevel@tonic-gate exit(1); 15907c478bd9Sstevel@tonic-gate } 15917c478bd9Sstevel@tonic-gate return; 15927c478bd9Sstevel@tonic-gate } 1593