17c478bd9Sstevel@tonic-gate /* 2*f5918cfdS * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate * 57c478bd9Sstevel@tonic-gate * All rights reserved. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may require 87c478bd9Sstevel@tonic-gate * a specific license from the United States Government. It is the 97c478bd9Sstevel@tonic-gate * responsibility of any person or organization contemplating export to 107c478bd9Sstevel@tonic-gate * obtain such a license before exporting. 117c478bd9Sstevel@tonic-gate * 127c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 137c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 147c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 157c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 167c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 177c478bd9Sstevel@tonic-gate * the name of FundsXpress. not be used in advertising or publicity pertaining 187c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 197c478bd9Sstevel@tonic-gate * permission. FundsXpress makes no representations about the suitability of 207c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 217c478bd9Sstevel@tonic-gate * or implied warranty. 227c478bd9Sstevel@tonic-gate * 237c478bd9Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 247c478bd9Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 257c478bd9Sstevel@tonic-gate * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * slave/kpropd.c 317c478bd9Sstevel@tonic-gate * 327c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology. 337c478bd9Sstevel@tonic-gate * All Rights Reserved. 347c478bd9Sstevel@tonic-gate * 357c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may 367c478bd9Sstevel@tonic-gate * require a specific license from the United States Government. 377c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 387c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting. 397c478bd9Sstevel@tonic-gate * 407c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 417c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 427c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 437c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 447c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 457c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 467c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior 477c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 487c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a 497c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 507c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 517c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 527c478bd9Sstevel@tonic-gate * or implied warranty. 537c478bd9Sstevel@tonic-gate * 547c478bd9Sstevel@tonic-gate * 557c478bd9Sstevel@tonic-gate * XXX We need to modify the protocol so that an acknowledge is set 567c478bd9Sstevel@tonic-gate * after each block, instead after the entire series is sent over. 577c478bd9Sstevel@tonic-gate * The reason for this is so that error packets can get interpreted 587c478bd9Sstevel@tonic-gate * right away. If you don't do this, the sender may never get the 597c478bd9Sstevel@tonic-gate * error packet, because it will die an EPIPE trying to complete the 607c478bd9Sstevel@tonic-gate * write... 617c478bd9Sstevel@tonic-gate */ 627c478bd9Sstevel@tonic-gate 6356a424ccSmp 647c478bd9Sstevel@tonic-gate #include <stdio.h> 657c478bd9Sstevel@tonic-gate #include <ctype.h> 667c478bd9Sstevel@tonic-gate #include <sys/file.h> 677c478bd9Sstevel@tonic-gate #include <signal.h> 687c478bd9Sstevel@tonic-gate #include <string.h> 697c478bd9Sstevel@tonic-gate #include <fcntl.h> 707c478bd9Sstevel@tonic-gate #include <sys/types.h> 717c478bd9Sstevel@tonic-gate #include <sys/time.h> 727c478bd9Sstevel@tonic-gate #include <sys/stat.h> 737c478bd9Sstevel@tonic-gate #include <sys/socket.h> 747c478bd9Sstevel@tonic-gate #include <sys/wait.h> 757c478bd9Sstevel@tonic-gate #include <netinet/in.h> 767c478bd9Sstevel@tonic-gate #include <arpa/inet.h> 777c478bd9Sstevel@tonic-gate #include <sys/param.h> 787c478bd9Sstevel@tonic-gate #include <netdb.h> 797c478bd9Sstevel@tonic-gate #include <syslog.h> 807c478bd9Sstevel@tonic-gate #include <libintl.h> 817c478bd9Sstevel@tonic-gate #include <locale.h> 827c478bd9Sstevel@tonic-gate #include <k5-int.h> 837c478bd9Sstevel@tonic-gate #include <socket-utils.h> 847c478bd9Sstevel@tonic-gate #include "com_err.h" 857c478bd9Sstevel@tonic-gate #include <errno.h> 867c478bd9Sstevel@tonic-gate 877c478bd9Sstevel@tonic-gate #include "kprop.h" 887c478bd9Sstevel@tonic-gate #include <iprop_hdr.h> 897c478bd9Sstevel@tonic-gate #include "iprop.h" 907c478bd9Sstevel@tonic-gate #include <kadm5/admin.h> 917c478bd9Sstevel@tonic-gate #include <kdb/kdb_log.h> 927c478bd9Sstevel@tonic-gate 937c64d375Smp /* Solaris Kerberos */ 947c64d375Smp #include <libgen.h> 957c64d375Smp 967c478bd9Sstevel@tonic-gate #define SYSLOG_CLASS LOG_DAEMON 977c478bd9Sstevel@tonic-gate 987c478bd9Sstevel@tonic-gate char *poll_time = NULL; 997c478bd9Sstevel@tonic-gate char *def_realm = NULL; 1007c478bd9Sstevel@tonic-gate boolean_t runonce = B_FALSE; 1017c478bd9Sstevel@tonic-gate 1027c478bd9Sstevel@tonic-gate /* 1037c478bd9Sstevel@tonic-gate * This struct simulates the use of _kadm5_server_handle_t 1047c478bd9Sstevel@tonic-gate */ 1057c478bd9Sstevel@tonic-gate typedef struct _kadm5_iprop_handle_t { 1067c478bd9Sstevel@tonic-gate krb5_ui_4 magic_number; 1077c478bd9Sstevel@tonic-gate krb5_ui_4 struct_version; 1087c478bd9Sstevel@tonic-gate krb5_ui_4 api_version; 1097c478bd9Sstevel@tonic-gate char *cache_name; 1107c478bd9Sstevel@tonic-gate int destroy_cache; 1117c478bd9Sstevel@tonic-gate CLIENT *clnt; 1127c478bd9Sstevel@tonic-gate krb5_context context; 1137c478bd9Sstevel@tonic-gate kadm5_config_params params; 1147c478bd9Sstevel@tonic-gate struct _kadm5_iprop_handle_t *lhandle; 1157c478bd9Sstevel@tonic-gate } *kadm5_iprop_handle_t; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION; 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate char *progname; 1207c478bd9Sstevel@tonic-gate int debug = 0; 1217c478bd9Sstevel@tonic-gate char *srvtab = 0; 1227c478bd9Sstevel@tonic-gate int standalone = 0; 1237c478bd9Sstevel@tonic-gate 1247c478bd9Sstevel@tonic-gate krb5_principal server; /* This is our server principal name */ 1257c478bd9Sstevel@tonic-gate krb5_principal client; /* This is who we're talking to */ 1267c478bd9Sstevel@tonic-gate krb5_context kpropd_context; 1277c478bd9Sstevel@tonic-gate krb5_auth_context auth_context; 1287c478bd9Sstevel@tonic-gate char *realm = NULL; /* Our realm */ 1297c478bd9Sstevel@tonic-gate char *file = KPROPD_DEFAULT_FILE; 1307c478bd9Sstevel@tonic-gate char *temp_file_name; 1317c478bd9Sstevel@tonic-gate char *kdb5_util = KPROPD_DEFAULT_KDB5_UTIL; 1327c478bd9Sstevel@tonic-gate char *kerb_database = NULL; 1337c478bd9Sstevel@tonic-gate char *acl_file_name = KPROPD_ACL_FILE; 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate krb5_address sender_addr; 1367c478bd9Sstevel@tonic-gate krb5_address receiver_addr; 1377c478bd9Sstevel@tonic-gate short port = 0; 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate void PRS 1407c478bd9Sstevel@tonic-gate (int, char**); 1417c478bd9Sstevel@tonic-gate int do_standalone 1427c478bd9Sstevel@tonic-gate (iprop_role iproprole); 1437c478bd9Sstevel@tonic-gate void doit 14456a424ccSmp (int); 1457c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx); 1467c478bd9Sstevel@tonic-gate 147*f5918cfdS /* Solaris Kerberos */ 1487c478bd9Sstevel@tonic-gate void kerberos_authenticate 14956a424ccSmp (krb5_context, 1507c478bd9Sstevel@tonic-gate int, 1517c478bd9Sstevel@tonic-gate krb5_principal *, 1527c478bd9Sstevel@tonic-gate krb5_enctype *, 153*f5918cfdS struct sockaddr_storage *); 1547c478bd9Sstevel@tonic-gate krb5_boolean authorized_principal 15556a424ccSmp (krb5_context, 1567c478bd9Sstevel@tonic-gate krb5_principal, 1577c478bd9Sstevel@tonic-gate krb5_enctype); 1587c478bd9Sstevel@tonic-gate void recv_database 15956a424ccSmp (krb5_context, 1607c478bd9Sstevel@tonic-gate int, 1617c478bd9Sstevel@tonic-gate int, 1627c478bd9Sstevel@tonic-gate krb5_data *); 1637c478bd9Sstevel@tonic-gate void load_database 16456a424ccSmp (krb5_context, 1657c478bd9Sstevel@tonic-gate char *, 1667c478bd9Sstevel@tonic-gate char *); 1677c478bd9Sstevel@tonic-gate void send_error 16856a424ccSmp (krb5_context, 1697c478bd9Sstevel@tonic-gate int, 1707c478bd9Sstevel@tonic-gate krb5_error_code, 1717c478bd9Sstevel@tonic-gate char *); 1727c478bd9Sstevel@tonic-gate void recv_error 17356a424ccSmp (krb5_context, 1747c478bd9Sstevel@tonic-gate krb5_data *); 1757c478bd9Sstevel@tonic-gate int convert_polltime 1767c478bd9Sstevel@tonic-gate (char *); 1777c478bd9Sstevel@tonic-gate unsigned int backoff_from_master 1787c478bd9Sstevel@tonic-gate (int *); 1797c478bd9Sstevel@tonic-gate 1807c478bd9Sstevel@tonic-gate static void usage() 1817c478bd9Sstevel@tonic-gate { 1827c478bd9Sstevel@tonic-gate fprintf(stderr, 1837c478bd9Sstevel@tonic-gate gettext("\nUsage: %s\n"), /* progname may be a long pathname */ 1847c478bd9Sstevel@tonic-gate progname); 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate fprintf(stderr, 1877c478bd9Sstevel@tonic-gate gettext("\t[-r realm] [-s srvtab] [-dS] [-f slave_file]\n")); 1887c478bd9Sstevel@tonic-gate 1897c478bd9Sstevel@tonic-gate fprintf(stderr, 1907c478bd9Sstevel@tonic-gate gettext("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n")); 1917c478bd9Sstevel@tonic-gate 1927c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("\t[-P port] [-a acl_file]\n")); 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate exit(1); 1957c478bd9Sstevel@tonic-gate } 1967c478bd9Sstevel@tonic-gate 1977c478bd9Sstevel@tonic-gate int 1987c478bd9Sstevel@tonic-gate main(argc, argv) 1997c478bd9Sstevel@tonic-gate int argc; 2007c478bd9Sstevel@tonic-gate char **argv; 2017c478bd9Sstevel@tonic-gate { 2027c478bd9Sstevel@tonic-gate krb5_error_code retval; 2037c478bd9Sstevel@tonic-gate int ret = 0; 2047c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 20554925bf6Swillf int iprop_supported; 2067c64d375Smp krb5_boolean is_master = FALSE; 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate PRS(argc, argv); 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 2137c478bd9Sstevel@tonic-gate /* 2147c478bd9Sstevel@tonic-gate * We wanna do iprop ! 2157c478bd9Sstevel@tonic-gate */ 21654925bf6Swillf retval = krb5_db_supports_iprop(kpropd_context, 21754925bf6Swillf &iprop_supported); 21854925bf6Swillf if (retval) { 2197c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 22054925bf6Swillf com_err(progname, retval, 2217c64d375Smp gettext("while determining if dbmodule plugin " 2227c64d375Smp "supports iprop")); 22354925bf6Swillf exit(1); 22454925bf6Swillf } 22554925bf6Swillf if (!iprop_supported) { 2267c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 2277c64d375Smp com_err(progname, 0, 22854925bf6Swillf gettext("Current dbmodule plugin does not support " 2297c64d375Smp "iprop")); 2307c64d375Smp exit(1); 2317c64d375Smp } 2327c64d375Smp 2337c64d375Smp /* 2347c64d375Smp * Solaris Kerberos: 2357c64d375Smp * Ensure that kpropd is only run on a slave 2367c64d375Smp */ 2377c64d375Smp if (retval = kadm5_is_master(kpropd_context, def_realm, 2387c64d375Smp &is_master)) { 2397c64d375Smp com_err(progname, retval, 2407c64d375Smp gettext("while trying to determine whether host is " 2417c64d375Smp "master KDC for realm %s"), def_realm); 2427c64d375Smp exit(1); 2437c64d375Smp } 2447c64d375Smp 2457c64d375Smp if (is_master == TRUE) { 2467c64d375Smp char *master = NULL; 2477c64d375Smp kadm5_get_master(kpropd_context, def_realm, &master); 2487c64d375Smp 2497c64d375Smp com_err(progname, 0, 2507c64d375Smp gettext("%s is the master KDC for the realm %s. " 2517c64d375Smp "%s can only be run on a slave KDC"), 2527c64d375Smp master ? master : "unknown", def_realm, progname); 25354925bf6Swillf exit(1); 25454925bf6Swillf } 25554925bf6Swillf 2567c478bd9Sstevel@tonic-gate retval = do_iprop(log_ctx); 2577c478bd9Sstevel@tonic-gate if (retval) { 2587c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 2597c478bd9Sstevel@tonic-gate com_err(progname, retval, 2607c64d375Smp gettext("while doing iprop")); 2617c478bd9Sstevel@tonic-gate exit(1); 2627c478bd9Sstevel@tonic-gate } 2637c478bd9Sstevel@tonic-gate 2647c478bd9Sstevel@tonic-gate } else { 2657c64d375Smp 2667c64d375Smp /* 2677c64d375Smp * Solaris Kerberos: 2687c64d375Smp * Ensure that the kpropd.acl file exists and contains at least 2697c64d375Smp * 1 entry. 2707c64d375Smp */ 2717c64d375Smp FILE *tmp_acl_file; 2727c64d375Smp int seen_file = 0; 2737c64d375Smp char buf[1024]; 2747c64d375Smp 2757c64d375Smp tmp_acl_file = fopen(acl_file_name, "r"); 2767c64d375Smp if (!tmp_acl_file) { 2777c64d375Smp com_err(progname, errno, 2787c64d375Smp gettext("while opening acl file %s"), 2797c64d375Smp acl_file_name); 2807c64d375Smp exit(1); 2817c64d375Smp } 2827c64d375Smp 2837c64d375Smp while (!feof(tmp_acl_file) && !seen_file ) { 2847c64d375Smp if (!fgets(buf, sizeof(buf), tmp_acl_file)) 2857c64d375Smp break; 2867c64d375Smp 2877c64d375Smp if (buf[0] != '#' && !isspace(buf[0])) 2887c64d375Smp seen_file = 1; 2897c64d375Smp } 2907c64d375Smp if (!seen_file) { 2917c64d375Smp com_err(progname, 0, 2927c64d375Smp gettext("No entries found in %s. Can't " 2937c64d375Smp "authorize propagation requests"), acl_file_name); 2947c64d375Smp exit(1); 2957c64d375Smp } 2967c64d375Smp fclose(tmp_acl_file); 2977c64d375Smp 2987c478bd9Sstevel@tonic-gate if (standalone) 2997c478bd9Sstevel@tonic-gate ret = do_standalone(IPROP_NULL); 3007c478bd9Sstevel@tonic-gate else 3017c478bd9Sstevel@tonic-gate doit(0); 3027c478bd9Sstevel@tonic-gate } 3037c478bd9Sstevel@tonic-gate 3047c478bd9Sstevel@tonic-gate exit(ret); 3057c478bd9Sstevel@tonic-gate } 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate int do_standalone(iprop_role iproprole) 3087c478bd9Sstevel@tonic-gate { 3097c478bd9Sstevel@tonic-gate struct linger linger; 3107c478bd9Sstevel@tonic-gate struct servent *sp; 3117c478bd9Sstevel@tonic-gate int finet, fromlen, s; 3127c478bd9Sstevel@tonic-gate int on = 1; 3137c478bd9Sstevel@tonic-gate int ret, status = 0; 3147c478bd9Sstevel@tonic-gate struct sockaddr_in6 sin6 = { AF_INET6 }; 3157c478bd9Sstevel@tonic-gate int sin6_size = sizeof (sin6); 3167c478bd9Sstevel@tonic-gate 3177c478bd9Sstevel@tonic-gate /* listen for either ipv4 or ipv6 */ 3187c478bd9Sstevel@tonic-gate finet = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); 3197c478bd9Sstevel@tonic-gate if (finet < 0 ) { 3207c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while obtaining socket")); 3217c478bd9Sstevel@tonic-gate exit(1); 3227c478bd9Sstevel@tonic-gate } 3237c478bd9Sstevel@tonic-gate 3247c478bd9Sstevel@tonic-gate if(!port) { 3257c478bd9Sstevel@tonic-gate sp = getservbyname(KPROP_SERVICE, "tcp"); 3267c478bd9Sstevel@tonic-gate if (sp == NULL) { 3277c478bd9Sstevel@tonic-gate com_err(progname, 0, gettext("%s/tcp: unknown service"), 3287c478bd9Sstevel@tonic-gate KPROP_SERVICE); 3297c478bd9Sstevel@tonic-gate exit(1); 3307c478bd9Sstevel@tonic-gate } 3317c478bd9Sstevel@tonic-gate sin6.sin6_port = sp->s_port; 3327c478bd9Sstevel@tonic-gate } else 3337c478bd9Sstevel@tonic-gate sin6.sin6_port = port; 3347c478bd9Sstevel@tonic-gate 3357c478bd9Sstevel@tonic-gate /* 3367c478bd9Sstevel@tonic-gate * We need to close the socket immediately if iprop is enabled, 3377c478bd9Sstevel@tonic-gate * since back-to-back full resyncs are possible, so we do not 3387c478bd9Sstevel@tonic-gate * linger around for too long 3397c478bd9Sstevel@tonic-gate */ 3407c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) { 3417c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 3427c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) 3437c478bd9Sstevel@tonic-gate com_err(progname, errno, 3447c64d375Smp gettext("while setting socket option (SO_REUSEADDR)")); 3457c478bd9Sstevel@tonic-gate linger.l_onoff = 1; 3467c478bd9Sstevel@tonic-gate linger.l_linger = 2; 3477c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_LINGER, 3487c478bd9Sstevel@tonic-gate (void *)&linger, sizeof(linger)) < 0) 3497c478bd9Sstevel@tonic-gate com_err(progname, errno, 3507c64d375Smp gettext("while setting socket option (SO_LINGER)")); 3517c478bd9Sstevel@tonic-gate } 3527c478bd9Sstevel@tonic-gate if ((ret = bind(finet, (struct sockaddr *)&sin6, sizeof(sin6))) < 0) { 3537c478bd9Sstevel@tonic-gate if (debug) { 3547c478bd9Sstevel@tonic-gate on = 1; 3557c478bd9Sstevel@tonic-gate fprintf(stderr, 3567c478bd9Sstevel@tonic-gate gettext("%s: attempting to rebind socket " 3577c478bd9Sstevel@tonic-gate "with SO_REUSEADDR\n"), progname); 3587c478bd9Sstevel@tonic-gate if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, 3597c478bd9Sstevel@tonic-gate (char *)&on, sizeof(on)) < 0) { 3607c478bd9Sstevel@tonic-gate com_err(progname, errno, 3617c64d375Smp gettext("while setting socket option (SO_REUSEADDR)")); 3627c478bd9Sstevel@tonic-gate } 3637c478bd9Sstevel@tonic-gate ret = bind(finet, (struct sockaddr *) &sin6, sizeof(sin6)); 36456a424ccSmp } 3657c478bd9Sstevel@tonic-gate 36656a424ccSmp if (ret < 0) { 3677c64d375Smp /* 3687c64d375Smp * Solaris Kerberos: 3697c64d375Smp * com_err will print the err msg associated with errno 3707c64d375Smp */ 3717c64d375Smp #if 0 37256a424ccSmp perror(gettext("bind")); 3737c64d375Smp #endif 37456a424ccSmp com_err(progname, errno, 3757c478bd9Sstevel@tonic-gate gettext("while binding listener socket")); 37656a424ccSmp exit(1); 37756a424ccSmp } 3787c478bd9Sstevel@tonic-gate } 3797c64d375Smp if (!debug && (iproprole != IPROP_SLAVE)) { 3807c64d375Smp /* Solaris Kerberos: Indicate where further messages will be sent */ 3817c64d375Smp fprintf(stderr, 3827c64d375Smp gettext("%s: Logging to SYSLOG with LOG_DAEMON facility\n"), 3837c64d375Smp progname); 3847c64d375Smp if (daemon(1, 0)) { 3857c64d375Smp com_err(progname, errno, gettext("while daemonizing")); 3867c64d375Smp exit(1); 3877c64d375Smp } 3887c64d375Smp rem_default_com_err_hook(); 3897c64d375Smp } 3907c64d375Smp 3917c478bd9Sstevel@tonic-gate #ifdef PID_FILE 39256a424ccSmp if ((pidfile = fopen(PID_FILE, "w")) != NULL) { 39356a424ccSmp fprintf(pidfile, gettext("%d\n"), getpid()); 39456a424ccSmp fclose(pidfile); 39556a424ccSmp } else 39656a424ccSmp com_err(progname, errno, 3977c478bd9Sstevel@tonic-gate gettext("while opening pid file %s for writing"), 3987c478bd9Sstevel@tonic-gate PID_FILE); 3997c478bd9Sstevel@tonic-gate #endif 40056a424ccSmp if (listen(finet, 5) < 0) { 4017c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 4027c64d375Smp com_err(progname, errno, gettext("while listening on socket")); 40356a424ccSmp exit(1); 4047c478bd9Sstevel@tonic-gate } 40556a424ccSmp while (1) { 40656a424ccSmp int child_pid; 4077c478bd9Sstevel@tonic-gate 40856a424ccSmp s = accept(finet, (struct sockaddr *) &sin6, &sin6_size); 4097c478bd9Sstevel@tonic-gate 41056a424ccSmp if (s < 0) { 4117c64d375Smp if (errno != EINTR) { 4127c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 41356a424ccSmp com_err(progname, errno, 4147c64d375Smp gettext("while accepting connection")); 4157c64d375Smp } 41656a424ccSmp continue; 41756a424ccSmp } 41856a424ccSmp if (debug && (iproprole != IPROP_SLAVE)) 41956a424ccSmp child_pid = 0; 42056a424ccSmp else 42156a424ccSmp child_pid = fork(); 42256a424ccSmp switch (child_pid) { 42356a424ccSmp case -1: 42456a424ccSmp com_err(progname, errno, gettext("while forking")); 42556a424ccSmp exit(1); 4267c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 42756a424ccSmp case 0: 4287c478bd9Sstevel@tonic-gate /* child */ 42956a424ccSmp (void) close(finet); 43056a424ccSmp 43156a424ccSmp doit(s); 43256a424ccSmp close(s); 43356a424ccSmp _exit(0); 4347c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 43556a424ccSmp default: 4367c478bd9Sstevel@tonic-gate /* parent */ 4377c478bd9Sstevel@tonic-gate if (wait(&status) < 0) { 4387c478bd9Sstevel@tonic-gate com_err(progname, errno, 4397c478bd9Sstevel@tonic-gate gettext("while waiting to receive database")); 4407c478bd9Sstevel@tonic-gate exit(1); 4417c478bd9Sstevel@tonic-gate } 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate close(s); 4447c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 4457c478bd9Sstevel@tonic-gate close(finet); 4467c478bd9Sstevel@tonic-gate 4477c478bd9Sstevel@tonic-gate if ((ret = WEXITSTATUS(status)) != 0) 4487c478bd9Sstevel@tonic-gate return (ret); 4497c478bd9Sstevel@tonic-gate } 4507c478bd9Sstevel@tonic-gate 4517c478bd9Sstevel@tonic-gate if (iproprole == IPROP_SLAVE) 4527c478bd9Sstevel@tonic-gate break; 4537c478bd9Sstevel@tonic-gate } 4547c478bd9Sstevel@tonic-gate 4557c478bd9Sstevel@tonic-gate return (0); 4567c478bd9Sstevel@tonic-gate } 4577c478bd9Sstevel@tonic-gate 4587c478bd9Sstevel@tonic-gate void doit(fd) 4597c478bd9Sstevel@tonic-gate int fd; 4607c478bd9Sstevel@tonic-gate { 4617c478bd9Sstevel@tonic-gate struct sockaddr_storage from; 4627c478bd9Sstevel@tonic-gate socklen_t fromlen; 4637c478bd9Sstevel@tonic-gate int on = 1; 4647c478bd9Sstevel@tonic-gate struct hostent *hp; 4657c478bd9Sstevel@tonic-gate krb5_error_code retval; 4667c478bd9Sstevel@tonic-gate krb5_data confmsg; 4677c478bd9Sstevel@tonic-gate int lock_fd; 46856a424ccSmp mode_t omask; 4697c478bd9Sstevel@tonic-gate krb5_enctype etype; 47056a424ccSmp int database_fd; 4717c478bd9Sstevel@tonic-gate char ntop[NI_MAXHOST] = ""; 4727c478bd9Sstevel@tonic-gate krb5_context doit_context; 4737c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 4747c478bd9Sstevel@tonic-gate 4757c478bd9Sstevel@tonic-gate retval = krb5_init_context(&doit_context); 4767c478bd9Sstevel@tonic-gate if (retval) { 4777c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing krb5")); 4787c478bd9Sstevel@tonic-gate exit(1); 4797c478bd9Sstevel@tonic-gate } 4807c478bd9Sstevel@tonic-gate log_ctx = kpropd_context->kdblog_context; 4817c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) 4827c478bd9Sstevel@tonic-gate ulog_set_role(doit_context, IPROP_SLAVE); 4837c478bd9Sstevel@tonic-gate 4847c478bd9Sstevel@tonic-gate fromlen = (socklen_t)sizeof (from); 4857c478bd9Sstevel@tonic-gate if (getpeername(fd, (struct sockaddr *) &from, &fromlen) < 0) { 4867c478bd9Sstevel@tonic-gate fprintf(stderr, "%s: ", progname); 4877c478bd9Sstevel@tonic-gate perror(gettext("getpeername")); 4887c478bd9Sstevel@tonic-gate exit(1); 4897c478bd9Sstevel@tonic-gate } 4907c478bd9Sstevel@tonic-gate if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (caddr_t) &on, 4917c478bd9Sstevel@tonic-gate sizeof (on)) < 0) { 4927c478bd9Sstevel@tonic-gate com_err(progname, errno, 4937c478bd9Sstevel@tonic-gate gettext("while attempting setsockopt (SO_KEEPALIVE)")); 4947c478bd9Sstevel@tonic-gate } 4957c478bd9Sstevel@tonic-gate 4967c478bd9Sstevel@tonic-gate if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop), 4977c478bd9Sstevel@tonic-gate NULL, 0, NI_NUMERICHOST) != 0) { 4987c478bd9Sstevel@tonic-gate 4997c478bd9Sstevel@tonic-gate /* getnameifo failed so use inet_ntop() to get printable addresses */ 5007c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET) { 5017c478bd9Sstevel@tonic-gate 5027c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, 5037c478bd9Sstevel@tonic-gate (const void *)&ss2sin(&from)->sin_addr, 5047c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 5057c478bd9Sstevel@tonic-gate 5067c478bd9Sstevel@tonic-gate } else if (from.ss_family == AF_INET6 && 5077c478bd9Sstevel@tonic-gate ! IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 5087c478bd9Sstevel@tonic-gate 5097c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 5107c478bd9Sstevel@tonic-gate 5117c478bd9Sstevel@tonic-gate inet_ntop(AF_INET6, 5127c478bd9Sstevel@tonic-gate (const void *)&ss2sin6(&from)->sin6_addr, ntop, 5137c478bd9Sstevel@tonic-gate sizeof(ntop)); 5147c478bd9Sstevel@tonic-gate } 5157c478bd9Sstevel@tonic-gate /* ipv4 mapped ipv6 addrs handled later */ 5167c478bd9Sstevel@tonic-gate } 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET || from.ss_family == AF_INET6) { 5197c478bd9Sstevel@tonic-gate 5207c478bd9Sstevel@tonic-gate if (from.ss_family == AF_INET6 && 5217c478bd9Sstevel@tonic-gate IN6_IS_ADDR_V4MAPPED(&ss2sin6(&from)->sin6_addr)) { 5227c478bd9Sstevel@tonic-gate 5237c478bd9Sstevel@tonic-gate ipaddr_t v4addr; 5247c478bd9Sstevel@tonic-gate 5257c478bd9Sstevel@tonic-gate /* coerce ipv4 mapped ipv6 addr to normal ipv4 addr */ 5267c478bd9Sstevel@tonic-gate IN6_V4MAPPED_TO_IPADDR(&(ss2sin6(&from)->sin6_addr), 5277c478bd9Sstevel@tonic-gate v4addr); 5287c478bd9Sstevel@tonic-gate 5297c478bd9Sstevel@tonic-gate inet_ntop(AF_INET, (const void *) &v4addr, 5307c478bd9Sstevel@tonic-gate ntop, sizeof(ntop)); 5317c478bd9Sstevel@tonic-gate } 5327c478bd9Sstevel@tonic-gate 5337c478bd9Sstevel@tonic-gate syslog(LOG_INFO, gettext("Connection from %s"), ntop); 5347c478bd9Sstevel@tonic-gate 5357c478bd9Sstevel@tonic-gate if (debug) 5367c478bd9Sstevel@tonic-gate printf("Connection from %s\n", ntop); 5377c478bd9Sstevel@tonic-gate 5387c478bd9Sstevel@tonic-gate } else { 5397c478bd9Sstevel@tonic-gate /* address family isn't either AF_INET || AF_INET6 */ 5407c478bd9Sstevel@tonic-gate syslog(LOG_INFO, 5417c478bd9Sstevel@tonic-gate gettext("Connection from unknown address family:%d"), 5427c478bd9Sstevel@tonic-gate from.ss_family); 5437c478bd9Sstevel@tonic-gate 5447c478bd9Sstevel@tonic-gate if (debug) { 5457c478bd9Sstevel@tonic-gate printf(gettext("Connection from unknown address family:%d"), 5467c478bd9Sstevel@tonic-gate from.ss_family); 5477c478bd9Sstevel@tonic-gate } 5487c478bd9Sstevel@tonic-gate } 5497c478bd9Sstevel@tonic-gate 5507c478bd9Sstevel@tonic-gate /* 5517c478bd9Sstevel@tonic-gate * Now do the authentication 5527c478bd9Sstevel@tonic-gate */ 553*f5918cfdS /* Solaris Kerberos */ 554*f5918cfdS kerberos_authenticate(doit_context, fd, &client, &etype, &from); 5557c478bd9Sstevel@tonic-gate 5567c478bd9Sstevel@tonic-gate if (!authorized_principal(doit_context, client, etype)) { 55756a424ccSmp char *name; 5587c478bd9Sstevel@tonic-gate 55956a424ccSmp retval = krb5_unparse_name(doit_context, client, &name); 56056a424ccSmp if (retval) { 5617c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 56256a424ccSmp com_err(progname, retval, 5637c64d375Smp gettext("while unparsing client name")); 56456a424ccSmp exit(1); 56556a424ccSmp } 56656a424ccSmp syslog(LOG_WARNING, 5677c478bd9Sstevel@tonic-gate gettext("Rejected connection from unauthorized principal %s"), 56856a424ccSmp name); 56956a424ccSmp free(name); 57056a424ccSmp exit(1); 5717c478bd9Sstevel@tonic-gate } 5727c478bd9Sstevel@tonic-gate omask = umask(077); 5737c478bd9Sstevel@tonic-gate lock_fd = open(temp_file_name, O_RDWR|O_CREAT, 0600); 5747c478bd9Sstevel@tonic-gate (void) umask(omask); 5757c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, 5767c478bd9Sstevel@tonic-gate KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK); 5777c478bd9Sstevel@tonic-gate if (retval) { 5787c478bd9Sstevel@tonic-gate com_err(progname, retval, 5797c478bd9Sstevel@tonic-gate gettext("while trying to lock '%s'"), 5807c478bd9Sstevel@tonic-gate temp_file_name); 5817c478bd9Sstevel@tonic-gate exit(1); 5827c478bd9Sstevel@tonic-gate } 5837c478bd9Sstevel@tonic-gate if ((database_fd = open(temp_file_name, 5847c478bd9Sstevel@tonic-gate O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) { 5857c478bd9Sstevel@tonic-gate com_err(progname, errno, 5867c478bd9Sstevel@tonic-gate gettext("while opening database file, '%s'"), 5877c478bd9Sstevel@tonic-gate temp_file_name); 5887c478bd9Sstevel@tonic-gate exit(1); 5897c478bd9Sstevel@tonic-gate } 5907c478bd9Sstevel@tonic-gate recv_database(doit_context, fd, database_fd, &confmsg); 5917c478bd9Sstevel@tonic-gate if (rename(temp_file_name, file)) { 5927c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 5937c478bd9Sstevel@tonic-gate com_err(progname, errno, 5947c64d375Smp gettext("while renaming %s to %s"), 5957c478bd9Sstevel@tonic-gate temp_file_name, file); 5967c478bd9Sstevel@tonic-gate exit(1); 5977c478bd9Sstevel@tonic-gate } 5987c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_SHARED); 5997c478bd9Sstevel@tonic-gate if (retval) { 6007c478bd9Sstevel@tonic-gate com_err(progname, retval, 6017c478bd9Sstevel@tonic-gate gettext("while downgrading lock on '%s'"), 6027c478bd9Sstevel@tonic-gate temp_file_name); 6037c478bd9Sstevel@tonic-gate exit(1); 6047c478bd9Sstevel@tonic-gate } 6057c478bd9Sstevel@tonic-gate load_database(doit_context, kdb5_util, file); 6067c478bd9Sstevel@tonic-gate retval = krb5_lock_file(doit_context, lock_fd, KRB5_LOCKMODE_UNLOCK); 6077c478bd9Sstevel@tonic-gate if (retval) { 6087c478bd9Sstevel@tonic-gate com_err(progname, retval, 6097c478bd9Sstevel@tonic-gate gettext("while unlocking '%s'"), temp_file_name); 6107c478bd9Sstevel@tonic-gate exit(1); 6117c478bd9Sstevel@tonic-gate } 6127c478bd9Sstevel@tonic-gate (void)close(lock_fd); 6137c478bd9Sstevel@tonic-gate 6147c478bd9Sstevel@tonic-gate /* 6157c478bd9Sstevel@tonic-gate * Send the acknowledgement message generated in 6167c478bd9Sstevel@tonic-gate * recv_database, then close the socket. 6177c478bd9Sstevel@tonic-gate */ 61856a424ccSmp retval = krb5_write_message(doit_context, (void *) &fd, &confmsg); 61956a424ccSmp if (retval) { 6207c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 6217c478bd9Sstevel@tonic-gate com_err(progname, retval, 6227c478bd9Sstevel@tonic-gate gettext("while sending # of received bytes")); 6237c478bd9Sstevel@tonic-gate exit(1); 6247c478bd9Sstevel@tonic-gate } 6257c478bd9Sstevel@tonic-gate krb5_free_data_contents(doit_context, &confmsg); 6267c478bd9Sstevel@tonic-gate if (close(fd) < 0) { 6277c478bd9Sstevel@tonic-gate com_err(progname, errno, 6287c478bd9Sstevel@tonic-gate gettext("while trying to close database file")); 6297c478bd9Sstevel@tonic-gate exit(1); 6307c478bd9Sstevel@tonic-gate } 63156a424ccSmp 6327c478bd9Sstevel@tonic-gate exit(0); 6337c478bd9Sstevel@tonic-gate } 6347c478bd9Sstevel@tonic-gate 6357c478bd9Sstevel@tonic-gate 6367c478bd9Sstevel@tonic-gate /* 6377c478bd9Sstevel@tonic-gate * Routine to handle incremental update transfer(s) from master KDC 6387c478bd9Sstevel@tonic-gate */ 6397c478bd9Sstevel@tonic-gate krb5_error_code do_iprop(kdb_log_context *log_ctx) { 6407c478bd9Sstevel@tonic-gate CLIENT *cl; 6417c478bd9Sstevel@tonic-gate kadm5_ret_t retval; 6427c478bd9Sstevel@tonic-gate kadm5_config_params params; 6437c478bd9Sstevel@tonic-gate krb5_ccache cc; 6447c478bd9Sstevel@tonic-gate krb5_principal iprop_svc_principal; 6457c478bd9Sstevel@tonic-gate void *server_handle = NULL; 6467c478bd9Sstevel@tonic-gate char *iprop_svc_princstr = NULL; 6477c478bd9Sstevel@tonic-gate char *master_svc_princstr = NULL; 6487c478bd9Sstevel@tonic-gate char *admin_server = NULL; 6497c478bd9Sstevel@tonic-gate char *keytab_name = NULL; 6507c478bd9Sstevel@tonic-gate unsigned int pollin, backoff_time; 6517c478bd9Sstevel@tonic-gate int backoff_cnt = 0; 6527c478bd9Sstevel@tonic-gate int reinit_cnt = 0; 6537c478bd9Sstevel@tonic-gate int ret; 6547c478bd9Sstevel@tonic-gate boolean_t frdone = B_FALSE; 6557c478bd9Sstevel@tonic-gate 6567c478bd9Sstevel@tonic-gate kdb_incr_result_t *incr_ret; 6577c478bd9Sstevel@tonic-gate static kdb_last_t mylast; 6587c478bd9Sstevel@tonic-gate 6597c478bd9Sstevel@tonic-gate kdb_fullresync_result_t *full_ret; 6607c478bd9Sstevel@tonic-gate char *full_resync_arg = NULL; 6617c478bd9Sstevel@tonic-gate 6627c478bd9Sstevel@tonic-gate kadm5_iprop_handle_t handle; 6637c478bd9Sstevel@tonic-gate kdb_hlog_t *ulog; 6647c478bd9Sstevel@tonic-gate 6657c64d375Smp krb5_keytab kt; 6667c64d375Smp krb5_keytab_entry entry; 6677c64d375Smp char kt_name[MAX_KEYTAB_NAME_LEN]; 6687c64d375Smp 6697c64d375Smp /* 6707c64d375Smp * Solaris Kerberos: 6717c64d375Smp * Delay daemonizing until some basic configuration checks have been 6727c64d375Smp * performed 6737c64d375Smp */ 6747c64d375Smp #if 0 6757c478bd9Sstevel@tonic-gate if (!debug) 6767c478bd9Sstevel@tonic-gate daemon(0, 0); 6777c64d375Smp #endif 6787c478bd9Sstevel@tonic-gate pollin = (unsigned int)0; 6797c478bd9Sstevel@tonic-gate (void) memset((char *)¶ms, 0, sizeof (params)); 6807c478bd9Sstevel@tonic-gate ulog = log_ctx->ulog; 6817c478bd9Sstevel@tonic-gate 6827c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 6837c478bd9Sstevel@tonic-gate params.realm = def_realm; 6847c478bd9Sstevel@tonic-gate 6857c478bd9Sstevel@tonic-gate if (master_svc_princstr == NULL) { 6867c478bd9Sstevel@tonic-gate if (retval = kadm5_get_kiprop_host_srv_name(kpropd_context, 6877c478bd9Sstevel@tonic-gate def_realm, &master_svc_princstr)) { 6887c64d375Smp /* Solaris Kerberos: keep error messages consistent */ 6897c478bd9Sstevel@tonic-gate com_err(progname, retval, 6907c64d375Smp gettext("while getting kiprop host based " 6917c64d375Smp "service name for realm %s"), def_realm); 6927c478bd9Sstevel@tonic-gate exit(1); 6937c478bd9Sstevel@tonic-gate } 6947c478bd9Sstevel@tonic-gate } 6957c478bd9Sstevel@tonic-gate 6967c478bd9Sstevel@tonic-gate /* 6977c478bd9Sstevel@tonic-gate * Set cc to the default credentials cache 6987c478bd9Sstevel@tonic-gate */ 6997c478bd9Sstevel@tonic-gate if (retval = krb5_cc_default(kpropd_context, &cc)) { 7007c478bd9Sstevel@tonic-gate com_err(progname, retval, 7017c478bd9Sstevel@tonic-gate gettext("while opening default " 7027c478bd9Sstevel@tonic-gate "credentials cache")); 7037c478bd9Sstevel@tonic-gate exit(1); 7047c478bd9Sstevel@tonic-gate } 7057c478bd9Sstevel@tonic-gate 7067c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, NULL, KIPROP_SVC_NAME, 7077c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &iprop_svc_principal); 7087c478bd9Sstevel@tonic-gate if (retval) { 7097c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to construct " 7107c478bd9Sstevel@tonic-gate "host service principal")); 7117c478bd9Sstevel@tonic-gate exit(1); 7127c478bd9Sstevel@tonic-gate } 7137c478bd9Sstevel@tonic-gate 714159d09a2SMark Phalan /* Solaris Kerberos */ 715159d09a2SMark Phalan if (krb5_is_referral_realm(krb5_princ_realm(kpropd_context, 716159d09a2SMark Phalan iprop_svc_principal))) { 717159d09a2SMark Phalan krb5_data *r = krb5_princ_realm(kpropd_context, 718159d09a2SMark Phalan iprop_svc_principal); 719159d09a2SMark Phalan assert(def_realm != NULL); 720159d09a2SMark Phalan r->length = strlen(def_realm); 721159d09a2SMark Phalan r->data = strdup(def_realm); 722159d09a2SMark Phalan if (r->data == NULL) { 723159d09a2SMark Phalan com_err(progname, retval, 724159d09a2SMark Phalan ("while determining local service principal name")); 725159d09a2SMark Phalan exit(1); 726159d09a2SMark Phalan } 727159d09a2SMark Phalan } 728159d09a2SMark Phalan 7297c478bd9Sstevel@tonic-gate if (retval = krb5_unparse_name(kpropd_context, iprop_svc_principal, 7307c478bd9Sstevel@tonic-gate &iprop_svc_princstr)) { 7317c478bd9Sstevel@tonic-gate com_err(progname, retval, 7327c478bd9Sstevel@tonic-gate gettext("while canonicalizing " 7337c478bd9Sstevel@tonic-gate "principal name")); 7347c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 7357c478bd9Sstevel@tonic-gate exit(1); 7367c478bd9Sstevel@tonic-gate } 7377c64d375Smp 7387c64d375Smp /* 7397c64d375Smp * Solaris Kerberos: 7407c64d375Smp * Check to see if kiprop/<fqdn>@REALM is in the keytab 7417c64d375Smp */ 7427c64d375Smp kt_name[0] = '\0'; 7437c64d375Smp if (retval = krb5_kt_default_name(kpropd_context, kt_name, 7447c64d375Smp MAX_KEYTAB_NAME_LEN)){ 7457c64d375Smp com_err(progname, retval, gettext ("while resolving the " 7467c64d375Smp "name of the default keytab")); 7477c64d375Smp } 7487c64d375Smp 7497c64d375Smp if (retval = krb5_kt_default(kpropd_context, &kt)) { 7507c64d375Smp com_err(progname, retval, gettext ("while resolving default " 7517c64d375Smp "keytab")); 7527c64d375Smp krb5_free_principal(kpropd_context, iprop_svc_principal); 7537c64d375Smp exit(1); 7547c64d375Smp } 7557c64d375Smp 7567c64d375Smp if (retval = krb5_kt_get_entry(kpropd_context, kt, iprop_svc_principal, 7577c64d375Smp 0, 0, &entry)) { 7587c64d375Smp com_err(progname, retval, gettext("while retrieving entry %s " 7597c64d375Smp "from %s"), iprop_svc_princstr, 7607c64d375Smp kt_name[0] ? kt_name : "default keytab"); 7617c64d375Smp krb5_kt_close(kpropd_context,kt); 7627c64d375Smp krb5_free_principal(kpropd_context, iprop_svc_principal); 7637c64d375Smp exit(1); 7647c64d375Smp } 7657c64d375Smp 7667c64d375Smp krb5_kt_close(kpropd_context,kt); 7677c478bd9Sstevel@tonic-gate krb5_free_principal(kpropd_context, iprop_svc_principal); 7687c478bd9Sstevel@tonic-gate 7697c64d375Smp if (!debug) { 7707c64d375Smp /* Solaris Kerberos: Indicate where further messages will be sent */ 7717c64d375Smp fprintf(stderr, gettext("%s: Logging to SYSLOG\n"), progname); 7727c64d375Smp if (daemon(0, 0)) { 7737c64d375Smp com_err(progname, errno, gettext("while daemonizing")); 7747c64d375Smp exit(1); 7757c64d375Smp } 7767c64d375Smp rem_default_com_err_hook(); 7777c64d375Smp } 7787c64d375Smp 7797c478bd9Sstevel@tonic-gate reinit: 7807c478bd9Sstevel@tonic-gate /* 7817c478bd9Sstevel@tonic-gate * Authentication, initialize rpcsec_gss handle etc. 7827c478bd9Sstevel@tonic-gate */ 7837c478bd9Sstevel@tonic-gate retval = kadm5_init_with_skey(iprop_svc_princstr, keytab_name, 7847c478bd9Sstevel@tonic-gate master_svc_princstr, 7857c478bd9Sstevel@tonic-gate ¶ms, 7867c478bd9Sstevel@tonic-gate KADM5_STRUCT_VERSION, 7877c478bd9Sstevel@tonic-gate KADM5_API_VERSION_2, 78854925bf6Swillf NULL, 7897c478bd9Sstevel@tonic-gate &server_handle); 7907c478bd9Sstevel@tonic-gate 7917c478bd9Sstevel@tonic-gate if (retval) { 7927c478bd9Sstevel@tonic-gate if (retval == KADM5_RPC_ERROR) { 7937c478bd9Sstevel@tonic-gate reinit_cnt++; 7947c478bd9Sstevel@tonic-gate if (server_handle) 7957c478bd9Sstevel@tonic-gate kadm5_destroy((void *) server_handle); 7967c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 7977c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 7987c478bd9Sstevel@tonic-gate 7997c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext( 8007c478bd9Sstevel@tonic-gate "while attempting to connect" 8017c478bd9Sstevel@tonic-gate " to master KDC ... retrying")); 8027c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&reinit_cnt); 8037c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 8047c478bd9Sstevel@tonic-gate goto reinit; 8057c478bd9Sstevel@tonic-gate } else { 8067c64d375Smp /* Solaris Kerberos: Be more verbose */ 8077c478bd9Sstevel@tonic-gate com_err(progname, retval, 8087c64d375Smp gettext("while initializing %s interface for " 8097c64d375Smp "%s"), progname, iprop_svc_princstr); 8107c478bd9Sstevel@tonic-gate if (retval == KADM5_BAD_CLIENT_PARAMS || 8117c478bd9Sstevel@tonic-gate retval == KADM5_BAD_SERVER_PARAMS) 8127c478bd9Sstevel@tonic-gate usage(); 8137c478bd9Sstevel@tonic-gate exit(1); 8147c478bd9Sstevel@tonic-gate } 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate 8177c478bd9Sstevel@tonic-gate /* 8187c478bd9Sstevel@tonic-gate * Reset re-initialization count to zero now. 8197c478bd9Sstevel@tonic-gate */ 8207c478bd9Sstevel@tonic-gate reinit_cnt = backoff_time = 0; 8217c478bd9Sstevel@tonic-gate 8227c478bd9Sstevel@tonic-gate /* 8237c478bd9Sstevel@tonic-gate * Reset the handle to the correct type for the RPC call 8247c478bd9Sstevel@tonic-gate */ 8257c478bd9Sstevel@tonic-gate handle = server_handle; 8267c478bd9Sstevel@tonic-gate 8277c478bd9Sstevel@tonic-gate /* 8287c478bd9Sstevel@tonic-gate * If we have reached this far, we have succesfully established 8297c478bd9Sstevel@tonic-gate * a RPCSEC_GSS connection; we now start polling for updates 8307c478bd9Sstevel@tonic-gate */ 8317c478bd9Sstevel@tonic-gate if (poll_time == NULL) { 8327c478bd9Sstevel@tonic-gate if ((poll_time = (char *)strdup("2m")) == NULL) { 8337c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 8347c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 8357c64d375Smp gettext("while allocating poll_time")); 8367c478bd9Sstevel@tonic-gate exit(1); 8377c478bd9Sstevel@tonic-gate } 8387c478bd9Sstevel@tonic-gate } 8397c478bd9Sstevel@tonic-gate 8407c478bd9Sstevel@tonic-gate if (pollin == (unsigned int)0) 8417c478bd9Sstevel@tonic-gate pollin = convert_polltime(poll_time); 8427c478bd9Sstevel@tonic-gate 8437c478bd9Sstevel@tonic-gate for (;;) { 8447c478bd9Sstevel@tonic-gate incr_ret = NULL; 8457c478bd9Sstevel@tonic-gate full_ret = NULL; 8467c478bd9Sstevel@tonic-gate 8477c478bd9Sstevel@tonic-gate /* 8487c478bd9Sstevel@tonic-gate * Get the most recent ulog entry sno + ts, which 8497c478bd9Sstevel@tonic-gate * we package in the request to the master KDC 8507c478bd9Sstevel@tonic-gate */ 8517c478bd9Sstevel@tonic-gate mylast.last_sno = ulog->kdb_last_sno; 8527c478bd9Sstevel@tonic-gate mylast.last_time = ulog->kdb_last_time; 8537c478bd9Sstevel@tonic-gate 8547c478bd9Sstevel@tonic-gate /* 8557c478bd9Sstevel@tonic-gate * Loop continuously on an iprop_get_updates_1(), 8567c478bd9Sstevel@tonic-gate * so that we can keep probing the master for updates 8577c478bd9Sstevel@tonic-gate * or (if needed) do a full resync of the krb5 db. 8587c478bd9Sstevel@tonic-gate */ 8597c478bd9Sstevel@tonic-gate 8607c478bd9Sstevel@tonic-gate incr_ret = iprop_get_updates_1(&mylast, handle->clnt); 8617c478bd9Sstevel@tonic-gate if (incr_ret == (kdb_incr_result_t *)NULL) { 8627c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 8637c478bd9Sstevel@tonic-gate "iprop_get_updates call failed"); 8647c478bd9Sstevel@tonic-gate if (server_handle) 8657c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 8667c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 8677c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 8687c478bd9Sstevel@tonic-gate goto reinit; 8697c478bd9Sstevel@tonic-gate } 8707c478bd9Sstevel@tonic-gate 8717c478bd9Sstevel@tonic-gate switch (incr_ret->ret) { 8727c478bd9Sstevel@tonic-gate 8737c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 8747c478bd9Sstevel@tonic-gate /* 8757c478bd9Sstevel@tonic-gate * We dont do a full resync again, if the last 8767c478bd9Sstevel@tonic-gate * X'fer was a resync and if the master sno is 8777c478bd9Sstevel@tonic-gate * still "0", i.e. no updates so far. 8787c478bd9Sstevel@tonic-gate */ 8797c478bd9Sstevel@tonic-gate if ((frdone == B_TRUE) && (incr_ret->lastentry.last_sno 8807c478bd9Sstevel@tonic-gate == 0)) { 8817c478bd9Sstevel@tonic-gate break; 8827c478bd9Sstevel@tonic-gate } else { 8837c478bd9Sstevel@tonic-gate 8847c478bd9Sstevel@tonic-gate full_ret = iprop_full_resync_1((void *) 8857c478bd9Sstevel@tonic-gate &full_resync_arg, handle->clnt); 8867c478bd9Sstevel@tonic-gate 8877c478bd9Sstevel@tonic-gate if (full_ret == (kdb_fullresync_result_t *) 8887c478bd9Sstevel@tonic-gate NULL) { 8897c478bd9Sstevel@tonic-gate clnt_perror(handle->clnt, 8907c478bd9Sstevel@tonic-gate "iprop_full_resync call failed"); 8917c478bd9Sstevel@tonic-gate if (server_handle) 8927c478bd9Sstevel@tonic-gate kadm5_destroy((void *) 8937c478bd9Sstevel@tonic-gate server_handle); 8947c478bd9Sstevel@tonic-gate server_handle = (void *)NULL; 8957c478bd9Sstevel@tonic-gate handle = (kadm5_iprop_handle_t)NULL; 8967c478bd9Sstevel@tonic-gate goto reinit; 8977c478bd9Sstevel@tonic-gate } 8987c478bd9Sstevel@tonic-gate } 8997c478bd9Sstevel@tonic-gate 9007c478bd9Sstevel@tonic-gate switch (full_ret->ret) { 9017c478bd9Sstevel@tonic-gate case UPDATE_OK: 9027c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9037c478bd9Sstevel@tonic-gate /* 9047c478bd9Sstevel@tonic-gate * We now listen on the kprop port for 9057c478bd9Sstevel@tonic-gate * the full dump 9067c478bd9Sstevel@tonic-gate */ 9077c478bd9Sstevel@tonic-gate ret = do_standalone(log_ctx->iproprole); 9087c478bd9Sstevel@tonic-gate if (ret) 9097c478bd9Sstevel@tonic-gate syslog(LOG_WARNING, 9107c478bd9Sstevel@tonic-gate gettext("kpropd: Full resync, " 9117c478bd9Sstevel@tonic-gate "invalid return.")); 9127c478bd9Sstevel@tonic-gate if (debug) 9137c478bd9Sstevel@tonic-gate if (ret) 9147c478bd9Sstevel@tonic-gate fprintf(stderr, 9157c478bd9Sstevel@tonic-gate gettext("Full resync " 9167c478bd9Sstevel@tonic-gate "was unsuccessful\n")); 9177c478bd9Sstevel@tonic-gate else 9187c478bd9Sstevel@tonic-gate fprintf(stderr, 9197c478bd9Sstevel@tonic-gate gettext("Full resync " 9207c478bd9Sstevel@tonic-gate "was successful\n")); 9217c478bd9Sstevel@tonic-gate frdone = B_TRUE; 9227c478bd9Sstevel@tonic-gate break; 9237c478bd9Sstevel@tonic-gate 9247c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 9257c478bd9Sstevel@tonic-gate /* 9267c478bd9Sstevel@tonic-gate * Exponential backoff 9277c478bd9Sstevel@tonic-gate */ 9287c478bd9Sstevel@tonic-gate backoff_cnt++; 9297c478bd9Sstevel@tonic-gate break; 9307c478bd9Sstevel@tonic-gate 9317c478bd9Sstevel@tonic-gate case UPDATE_FULL_RESYNC_NEEDED: 9327c478bd9Sstevel@tonic-gate case UPDATE_NIL: 9337c478bd9Sstevel@tonic-gate default: 9347c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9357c478bd9Sstevel@tonic-gate frdone = B_FALSE; 9367c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9377c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 9387c478bd9Sstevel@tonic-gate break; 9397c478bd9Sstevel@tonic-gate 9407c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 9417c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9427c478bd9Sstevel@tonic-gate " permission denied.")); 9437c478bd9Sstevel@tonic-gate goto error; 9447c478bd9Sstevel@tonic-gate 9457c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 9467c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: Full resync," 9477c478bd9Sstevel@tonic-gate " error returned from master KDC.")); 9487c478bd9Sstevel@tonic-gate goto error; 9497c478bd9Sstevel@tonic-gate } 9507c478bd9Sstevel@tonic-gate break; 9517c478bd9Sstevel@tonic-gate 9527c478bd9Sstevel@tonic-gate case UPDATE_OK: 9537c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9547c478bd9Sstevel@tonic-gate frdone = B_FALSE; 9557c478bd9Sstevel@tonic-gate 9567c478bd9Sstevel@tonic-gate /* 9577c478bd9Sstevel@tonic-gate * ulog_replay() will convert the ulog updates to db 9587c478bd9Sstevel@tonic-gate * entries using the kdb conv api and will commit 9597c478bd9Sstevel@tonic-gate * the entries to the slave kdc database 9607c478bd9Sstevel@tonic-gate */ 9617c478bd9Sstevel@tonic-gate retval = ulog_replay(kpropd_context, incr_ret); 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate if (retval) { 9647c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ulog_replay" 9657c478bd9Sstevel@tonic-gate " failed, updates not registered.")); 9667c478bd9Sstevel@tonic-gate break; 9677c478bd9Sstevel@tonic-gate } 9687c478bd9Sstevel@tonic-gate 9697c478bd9Sstevel@tonic-gate if (debug) 9707c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Update transfer " 9717c478bd9Sstevel@tonic-gate "from master was OK\n")); 9727c478bd9Sstevel@tonic-gate break; 9737c478bd9Sstevel@tonic-gate 9747c478bd9Sstevel@tonic-gate case UPDATE_PERM_DENIED: 9757c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 9767c478bd9Sstevel@tonic-gate " permission denied.")); 9777c478bd9Sstevel@tonic-gate goto error; 9787c478bd9Sstevel@tonic-gate 9797c478bd9Sstevel@tonic-gate case UPDATE_ERROR: 9807c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates, error " 9817c478bd9Sstevel@tonic-gate "returned from master KDC.")); 9827c478bd9Sstevel@tonic-gate goto error; 9837c478bd9Sstevel@tonic-gate 9847c478bd9Sstevel@tonic-gate case UPDATE_BUSY: 9857c478bd9Sstevel@tonic-gate /* 9867c478bd9Sstevel@tonic-gate * Exponential backoff 9877c478bd9Sstevel@tonic-gate */ 9887c478bd9Sstevel@tonic-gate backoff_cnt++; 9897c478bd9Sstevel@tonic-gate break; 9907c478bd9Sstevel@tonic-gate 9917c478bd9Sstevel@tonic-gate case UPDATE_NIL: 9927c478bd9Sstevel@tonic-gate /* 9937c478bd9Sstevel@tonic-gate * Master-slave are in sync 9947c478bd9Sstevel@tonic-gate */ 9957c478bd9Sstevel@tonic-gate if (debug) 9967c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Master, slave KDC's " 9977c478bd9Sstevel@tonic-gate "are in-sync, no updates\n")); 9987c478bd9Sstevel@tonic-gate backoff_cnt = 0; 9997c478bd9Sstevel@tonic-gate frdone = B_FALSE; 10007c478bd9Sstevel@tonic-gate break; 10017c478bd9Sstevel@tonic-gate 10027c478bd9Sstevel@tonic-gate default: 10037c478bd9Sstevel@tonic-gate backoff_cnt = 0; 10047c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: get_updates," 10057c478bd9Sstevel@tonic-gate " invalid return from master KDC.")); 10067c478bd9Sstevel@tonic-gate break; 10077c478bd9Sstevel@tonic-gate } 10087c478bd9Sstevel@tonic-gate 10097c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 10107c478bd9Sstevel@tonic-gate goto done; 10117c478bd9Sstevel@tonic-gate 10127c478bd9Sstevel@tonic-gate /* 10137c478bd9Sstevel@tonic-gate * Sleep for the specified poll interval (Default is 2 mts), 10147c478bd9Sstevel@tonic-gate * or do a binary exponential backoff if we get an 10157c478bd9Sstevel@tonic-gate * UPDATE_BUSY signal 10167c478bd9Sstevel@tonic-gate */ 10177c478bd9Sstevel@tonic-gate if (backoff_cnt > 0) { 10187c478bd9Sstevel@tonic-gate backoff_time = backoff_from_master(&backoff_cnt); 10197c478bd9Sstevel@tonic-gate if (debug) 10207c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("Busy signal received " 10217c478bd9Sstevel@tonic-gate "from master, backoff for %d secs\n"), 10227c478bd9Sstevel@tonic-gate backoff_time); 10237c478bd9Sstevel@tonic-gate (void) sleep(backoff_time); 10247c478bd9Sstevel@tonic-gate } 10257c478bd9Sstevel@tonic-gate else 10267c478bd9Sstevel@tonic-gate (void) sleep(pollin); 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate } 10297c478bd9Sstevel@tonic-gate 10307c478bd9Sstevel@tonic-gate 10317c478bd9Sstevel@tonic-gate error: 10327c478bd9Sstevel@tonic-gate if (debug) 10337c478bd9Sstevel@tonic-gate fprintf(stderr, gettext("ERROR returned by master, bailing\n")); 10347c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("kpropd: ERROR returned by master KDC," 10357c478bd9Sstevel@tonic-gate " bailing.\n")); 10367c478bd9Sstevel@tonic-gate done: 10377c478bd9Sstevel@tonic-gate if (poll_time) 10387c478bd9Sstevel@tonic-gate free(poll_time); 10397c478bd9Sstevel@tonic-gate if(iprop_svc_princstr) 10407c478bd9Sstevel@tonic-gate free(iprop_svc_princstr); 10417c478bd9Sstevel@tonic-gate if (master_svc_princstr) 10427c478bd9Sstevel@tonic-gate free(master_svc_princstr); 10437c478bd9Sstevel@tonic-gate if (retval = krb5_cc_close(kpropd_context, cc)) { 10447c478bd9Sstevel@tonic-gate com_err(progname, retval, 10457c478bd9Sstevel@tonic-gate gettext("while closing default ccache")); 10467c478bd9Sstevel@tonic-gate exit(1); 10477c478bd9Sstevel@tonic-gate } 10487c478bd9Sstevel@tonic-gate if (def_realm) 10497c478bd9Sstevel@tonic-gate free(def_realm); 10507c478bd9Sstevel@tonic-gate if (server_handle) 10517c478bd9Sstevel@tonic-gate kadm5_destroy((void *)server_handle); 10527c478bd9Sstevel@tonic-gate if (kpropd_context) 10537c478bd9Sstevel@tonic-gate krb5_free_context(kpropd_context); 10547c478bd9Sstevel@tonic-gate 10557c478bd9Sstevel@tonic-gate if (runonce == B_TRUE) 10567c478bd9Sstevel@tonic-gate return (0); 10577c478bd9Sstevel@tonic-gate else 10587c478bd9Sstevel@tonic-gate exit(1); 10597c478bd9Sstevel@tonic-gate } 10607c478bd9Sstevel@tonic-gate 10617c478bd9Sstevel@tonic-gate 10627c478bd9Sstevel@tonic-gate /* 10637c478bd9Sstevel@tonic-gate * Do exponential backoff, since master KDC is BUSY or down 10647c478bd9Sstevel@tonic-gate */ 10657c478bd9Sstevel@tonic-gate unsigned int backoff_from_master(int *cnt) { 10667c478bd9Sstevel@tonic-gate unsigned int btime; 10677c478bd9Sstevel@tonic-gate 10687c478bd9Sstevel@tonic-gate btime = (unsigned int)(2<<(*cnt)); 10697c478bd9Sstevel@tonic-gate if (btime > MAX_BACKOFF) { 10707c478bd9Sstevel@tonic-gate btime = MAX_BACKOFF; 10717c478bd9Sstevel@tonic-gate *cnt--; 10727c478bd9Sstevel@tonic-gate } 10737c478bd9Sstevel@tonic-gate 10747c478bd9Sstevel@tonic-gate return (btime); 10757c478bd9Sstevel@tonic-gate } 10767c478bd9Sstevel@tonic-gate 10777c478bd9Sstevel@tonic-gate 10787c478bd9Sstevel@tonic-gate /* 10797c478bd9Sstevel@tonic-gate * Routine to convert the `pollstr' string to seconds 10807c478bd9Sstevel@tonic-gate */ 10817c478bd9Sstevel@tonic-gate int convert_polltime(char *pollstr) { 10827c478bd9Sstevel@tonic-gate char *tokenptr = NULL; 10837c478bd9Sstevel@tonic-gate int len, polltime; 10847c478bd9Sstevel@tonic-gate 10857c478bd9Sstevel@tonic-gate len = polltime = 0; 10867c478bd9Sstevel@tonic-gate 10877c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "s")) < strlen(pollstr)) { 10887c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 10897c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 10907c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr); 10917c478bd9Sstevel@tonic-gate } 10927c478bd9Sstevel@tonic-gate 10937c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "m")) < strlen(pollstr)) { 10947c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 10957c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 10967c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 60; 10977c478bd9Sstevel@tonic-gate } 10987c478bd9Sstevel@tonic-gate 10997c478bd9Sstevel@tonic-gate if ((len = strcspn(pollstr, "h")) < strlen(pollstr)) { 11007c478bd9Sstevel@tonic-gate tokenptr = malloc((len + 1) * sizeof(char)); 11017c478bd9Sstevel@tonic-gate (void) strlcpy(tokenptr, pollstr, len + 1); 11027c478bd9Sstevel@tonic-gate polltime = atoi(tokenptr) * 3600; 11037c478bd9Sstevel@tonic-gate } 11047c478bd9Sstevel@tonic-gate 11057c478bd9Sstevel@tonic-gate if (tokenptr != NULL) 11067c478bd9Sstevel@tonic-gate free(tokenptr); 11077c478bd9Sstevel@tonic-gate /* 11087c478bd9Sstevel@tonic-gate * If we have a bogus pollstr value, set polltime to the 11097c478bd9Sstevel@tonic-gate * default of 2 mts (120 seconds). 11107c478bd9Sstevel@tonic-gate */ 11117c478bd9Sstevel@tonic-gate if (polltime == 0) 11127c478bd9Sstevel@tonic-gate polltime = 120; 11137c478bd9Sstevel@tonic-gate return (polltime); 11147c478bd9Sstevel@tonic-gate } 11157c478bd9Sstevel@tonic-gate 11167c478bd9Sstevel@tonic-gate static void 11177c478bd9Sstevel@tonic-gate kpropd_com_err_proc(whoami, code, fmt, args) 11187c478bd9Sstevel@tonic-gate const char *whoami; 11197c478bd9Sstevel@tonic-gate long code; 11207c478bd9Sstevel@tonic-gate const char *fmt; 11217c478bd9Sstevel@tonic-gate va_list args; 11227c478bd9Sstevel@tonic-gate { 11237c478bd9Sstevel@tonic-gate char error_buf[8096]; 11247c478bd9Sstevel@tonic-gate 11257c478bd9Sstevel@tonic-gate error_buf[0] = '\0'; 11267c478bd9Sstevel@tonic-gate if (fmt) 11277c478bd9Sstevel@tonic-gate vsprintf(error_buf, fmt, args); 11287c478bd9Sstevel@tonic-gate syslog(LOG_ERR, "%s%s%s%s%s", whoami ? whoami : "", whoami ? ": " : "", 11297c478bd9Sstevel@tonic-gate code ? error_message(code) : "", code ? " " : "", error_buf); 11307c478bd9Sstevel@tonic-gate } 11317c478bd9Sstevel@tonic-gate 11327c478bd9Sstevel@tonic-gate void PRS(argc,argv) 11337c478bd9Sstevel@tonic-gate int argc; 11347c478bd9Sstevel@tonic-gate char **argv; 11357c478bd9Sstevel@tonic-gate { 11367c478bd9Sstevel@tonic-gate register char *word, ch; 11377c478bd9Sstevel@tonic-gate char *cp; 11387c478bd9Sstevel@tonic-gate int c; 11397c478bd9Sstevel@tonic-gate struct hostent *hp; 11407c478bd9Sstevel@tonic-gate char my_host_name[MAXHOSTNAMELEN], buf[BUFSIZ]; 11417c478bd9Sstevel@tonic-gate krb5_error_code retval; 11427c478bd9Sstevel@tonic-gate static const char tmp[] = ".temp"; 11437c478bd9Sstevel@tonic-gate kadm5_config_params params; 11447c478bd9Sstevel@tonic-gate 11457c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 11467c478bd9Sstevel@tonic-gate 11477c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 11487c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "KPROPD_TEST" /* Use this only if it weren't */ 11497c478bd9Sstevel@tonic-gate #endif 11507c478bd9Sstevel@tonic-gate 11517c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 11527c478bd9Sstevel@tonic-gate 11537c478bd9Sstevel@tonic-gate (void) memset((char *) ¶ms, 0, sizeof (params)); 11547c478bd9Sstevel@tonic-gate 11557c478bd9Sstevel@tonic-gate retval = krb5_init_context(&kpropd_context); 11567c478bd9Sstevel@tonic-gate if (retval) { 11577c478bd9Sstevel@tonic-gate com_err(argv[0], retval, 11587c478bd9Sstevel@tonic-gate gettext("while initializing krb5")); 11597c478bd9Sstevel@tonic-gate exit(1); 11607c478bd9Sstevel@tonic-gate } 11617c64d375Smp 11627c64d375Smp /* Solaris Kerberos: Sanitize progname */ 11637c64d375Smp progname = basename(argv[0]); 11647c64d375Smp 11657c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, "dtf:F:p:P:r:s:Sa:")) != EOF){ 11667c478bd9Sstevel@tonic-gate switch (c) { 11677c478bd9Sstevel@tonic-gate case 'd': 11687c478bd9Sstevel@tonic-gate debug++; 11697c478bd9Sstevel@tonic-gate break; 11707c478bd9Sstevel@tonic-gate case 't': 11717c478bd9Sstevel@tonic-gate /* 11727c478bd9Sstevel@tonic-gate * Undocumented option - for testing only. 11737c478bd9Sstevel@tonic-gate * 11747c478bd9Sstevel@tonic-gate * Option to run the kpropd server exactly 11757c478bd9Sstevel@tonic-gate * once (this is true only if iprop is enabled). 11767c478bd9Sstevel@tonic-gate */ 11777c478bd9Sstevel@tonic-gate runonce = B_TRUE; 11787c478bd9Sstevel@tonic-gate break; 11797c478bd9Sstevel@tonic-gate 11807c478bd9Sstevel@tonic-gate case 'f': 11817c478bd9Sstevel@tonic-gate file = optarg; 11827c478bd9Sstevel@tonic-gate if (!file) 11837c478bd9Sstevel@tonic-gate usage(); 11847c478bd9Sstevel@tonic-gate break; 11857c478bd9Sstevel@tonic-gate case 'F': 11867c478bd9Sstevel@tonic-gate kerb_database = optarg; 11877c478bd9Sstevel@tonic-gate if (!kerb_database) 11887c478bd9Sstevel@tonic-gate usage(); 11897c478bd9Sstevel@tonic-gate break; 11907c478bd9Sstevel@tonic-gate case 'p': 11917c478bd9Sstevel@tonic-gate kdb5_util = optarg; 11927c478bd9Sstevel@tonic-gate if (!kdb5_util) 11937c478bd9Sstevel@tonic-gate usage(); 11947c478bd9Sstevel@tonic-gate break; 11957c478bd9Sstevel@tonic-gate case 'P': 11967c478bd9Sstevel@tonic-gate port = htons(atoi(optarg)); 11977c478bd9Sstevel@tonic-gate if (!port) 11987c478bd9Sstevel@tonic-gate usage(); 11997c478bd9Sstevel@tonic-gate break; 12007c478bd9Sstevel@tonic-gate case 'r': 12017c478bd9Sstevel@tonic-gate realm = optarg; 12027c478bd9Sstevel@tonic-gate if (!realm) 12037c478bd9Sstevel@tonic-gate usage(); 12047c478bd9Sstevel@tonic-gate params.realm = realm; 12057c478bd9Sstevel@tonic-gate params.mask |= KADM5_CONFIG_REALM; 12067c478bd9Sstevel@tonic-gate break; 12077c478bd9Sstevel@tonic-gate case 's': 12087c478bd9Sstevel@tonic-gate srvtab = optarg; 12097c478bd9Sstevel@tonic-gate if (!srvtab) 12107c478bd9Sstevel@tonic-gate usage(); 12117c478bd9Sstevel@tonic-gate break; 12127c478bd9Sstevel@tonic-gate case 'S': 12137c478bd9Sstevel@tonic-gate standalone++; 12147c478bd9Sstevel@tonic-gate break; 12157c478bd9Sstevel@tonic-gate case 'a': 12167c478bd9Sstevel@tonic-gate acl_file_name = optarg; 12177c478bd9Sstevel@tonic-gate if (!acl_file_name) 12187c478bd9Sstevel@tonic-gate usage(); 12197c478bd9Sstevel@tonic-gate break; 12207c478bd9Sstevel@tonic-gate case '?': 12217c478bd9Sstevel@tonic-gate default: 12227c478bd9Sstevel@tonic-gate usage(); 12237c478bd9Sstevel@tonic-gate } 12247c478bd9Sstevel@tonic-gate 12257c478bd9Sstevel@tonic-gate } 12267c478bd9Sstevel@tonic-gate /* 12277c478bd9Sstevel@tonic-gate * If not in debug mode, switch com_err reporting to syslog 12287c478bd9Sstevel@tonic-gate */ 12297c478bd9Sstevel@tonic-gate if (! debug) { 12307c478bd9Sstevel@tonic-gate openlog("kpropd", LOG_PID | LOG_ODELAY, SYSLOG_CLASS); 12317c64d375Smp /* 12327c64d375Smp * Solaris Kerberos: 12337c64d375Smp * Don't replace default logging. Add a new logging channel. 12347c64d375Smp * Stop logging to stderr when daemonizing 12357c64d375Smp */ 12367c64d375Smp add_com_err_hook(kpropd_com_err_proc); 12377c478bd9Sstevel@tonic-gate } 12387c478bd9Sstevel@tonic-gate /* 12397c478bd9Sstevel@tonic-gate * Get my hostname, so we can construct my service name 12407c478bd9Sstevel@tonic-gate */ 12417c478bd9Sstevel@tonic-gate retval = krb5_sname_to_principal(kpropd_context, 12427c478bd9Sstevel@tonic-gate NULL, KPROP_SERVICE_NAME, 12437c478bd9Sstevel@tonic-gate KRB5_NT_SRV_HST, &server); 12447c478bd9Sstevel@tonic-gate if (retval) { 12457c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12467c478bd9Sstevel@tonic-gate com_err(progname, retval, 12477c64d375Smp gettext("while trying to construct my service name")); 12487c478bd9Sstevel@tonic-gate exit(1); 12497c478bd9Sstevel@tonic-gate } 12507c478bd9Sstevel@tonic-gate if (realm) { 125156a424ccSmp retval = krb5_set_principal_realm(kpropd_context, server, realm); 125256a424ccSmp if (retval) { 125356a424ccSmp com_err(progname, errno, 125456a424ccSmp gettext("while constructing my service realm")); 125556a424ccSmp exit(1); 125656a424ccSmp } 12577c478bd9Sstevel@tonic-gate } 12587c478bd9Sstevel@tonic-gate /* 12597c478bd9Sstevel@tonic-gate * Construct the name of the temporary file. 12607c478bd9Sstevel@tonic-gate */ 12617c478bd9Sstevel@tonic-gate if ((temp_file_name = (char *) malloc(strlen(file) + 12627c478bd9Sstevel@tonic-gate strlen(tmp) + 1)) == NULL) { 12637c478bd9Sstevel@tonic-gate com_err(progname, ENOMEM, 12647c478bd9Sstevel@tonic-gate gettext("while allocating filename for temp file")); 12657c478bd9Sstevel@tonic-gate exit(1); 12667c478bd9Sstevel@tonic-gate } 12677c478bd9Sstevel@tonic-gate strcpy(temp_file_name, file); 12687c478bd9Sstevel@tonic-gate strcat(temp_file_name, tmp); 12697c478bd9Sstevel@tonic-gate 1270159d09a2SMark Phalan retval = kadm5_get_config_params(kpropd_context, 1, NULL, ¶ms, 12717c478bd9Sstevel@tonic-gate ¶ms); 12727c478bd9Sstevel@tonic-gate if (retval) { 12737c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while initializing")); 12747c478bd9Sstevel@tonic-gate exit(1); 12757c478bd9Sstevel@tonic-gate } 12767c478bd9Sstevel@tonic-gate if (params.iprop_enabled == TRUE) { 12777c478bd9Sstevel@tonic-gate ulog_set_role(kpropd_context, IPROP_SLAVE); 12787c478bd9Sstevel@tonic-gate poll_time = params.iprop_polltime; 12797c478bd9Sstevel@tonic-gate 12807c478bd9Sstevel@tonic-gate if (ulog_map(kpropd_context, ¶ms, FKPROPD)) { 12817c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12827c478bd9Sstevel@tonic-gate com_err(progname, errno, 12837c64d375Smp gettext("while mapping log")); 12847c478bd9Sstevel@tonic-gate exit(1); 12857c478bd9Sstevel@tonic-gate } 12867c478bd9Sstevel@tonic-gate } 12877c478bd9Sstevel@tonic-gate 12887c478bd9Sstevel@tonic-gate /* 12897c478bd9Sstevel@tonic-gate * Grab the realm info and check if iprop is enabled. 12907c478bd9Sstevel@tonic-gate */ 12917c478bd9Sstevel@tonic-gate if (def_realm == NULL) { 12927c478bd9Sstevel@tonic-gate retval = krb5_get_default_realm(kpropd_context, &def_realm); 12937c478bd9Sstevel@tonic-gate if (retval) { 12947c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 12957c478bd9Sstevel@tonic-gate com_err(progname, retval, 12967c64d375Smp gettext("while retrieving default realm")); 12977c478bd9Sstevel@tonic-gate exit(1); 12987c478bd9Sstevel@tonic-gate } 12997c478bd9Sstevel@tonic-gate } 13007c478bd9Sstevel@tonic-gate } 13017c478bd9Sstevel@tonic-gate 13027c478bd9Sstevel@tonic-gate /* 13037c478bd9Sstevel@tonic-gate * Figure out who's calling on the other end of the connection.... 13047c478bd9Sstevel@tonic-gate */ 1305*f5918cfdS /* Solaris Kerberos */ 13067c478bd9Sstevel@tonic-gate void 13077c478bd9Sstevel@tonic-gate kerberos_authenticate(context, fd, clientp, etype, ss) 13087c478bd9Sstevel@tonic-gate krb5_context context; 13097c478bd9Sstevel@tonic-gate int fd; 13107c478bd9Sstevel@tonic-gate krb5_principal * clientp; 13117c478bd9Sstevel@tonic-gate krb5_enctype * etype; 1312*f5918cfdS struct sockaddr_storage * ss; 13137c478bd9Sstevel@tonic-gate { 13147c478bd9Sstevel@tonic-gate krb5_error_code retval; 13157c478bd9Sstevel@tonic-gate krb5_ticket * ticket; 13167c478bd9Sstevel@tonic-gate struct sockaddr_storage r_ss; 13177c478bd9Sstevel@tonic-gate int ss_length; 13187c478bd9Sstevel@tonic-gate krb5_keytab keytab = NULL; 13197c478bd9Sstevel@tonic-gate 13207c478bd9Sstevel@tonic-gate /* 13217c478bd9Sstevel@tonic-gate * Set recv_addr and send_addr 13227c478bd9Sstevel@tonic-gate */ 1323*f5918cfdS /* Solaris Kerberos */ 1324*f5918cfdS if (cvtkaddr(ss, &sender_addr) == NULL) { 13257c478bd9Sstevel@tonic-gate com_err(progname, errno, 13267c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 13277c478bd9Sstevel@tonic-gate exit(1); 13287c478bd9Sstevel@tonic-gate } 13297c478bd9Sstevel@tonic-gate 13307c478bd9Sstevel@tonic-gate ss_length = sizeof (r_ss); 13317c478bd9Sstevel@tonic-gate if (getsockname(fd, (struct sockaddr *) &r_ss, &ss_length)) { 13327c478bd9Sstevel@tonic-gate com_err(progname, errno, 13337c478bd9Sstevel@tonic-gate gettext("while getting local socket address")); 13347c478bd9Sstevel@tonic-gate exit(1); 13357c478bd9Sstevel@tonic-gate } 13367c478bd9Sstevel@tonic-gate 13377c478bd9Sstevel@tonic-gate if (cvtkaddr(&r_ss, &receiver_addr) == NULL) { 13387c478bd9Sstevel@tonic-gate com_err(progname, errno, 13397c478bd9Sstevel@tonic-gate gettext("while converting socket address")); 13407c478bd9Sstevel@tonic-gate exit(1); 13417c478bd9Sstevel@tonic-gate } 13427c478bd9Sstevel@tonic-gate 13437c478bd9Sstevel@tonic-gate if (debug) { 13447c478bd9Sstevel@tonic-gate char *name; 134556a424ccSmp 134656a424ccSmp retval = krb5_unparse_name(context, server, &name); 134756a424ccSmp if (retval) { 13487c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 13497c64d375Smp com_err(progname, retval, gettext("while unparsing server name")); 13507c478bd9Sstevel@tonic-gate exit(1); 13517c478bd9Sstevel@tonic-gate } 13527c478bd9Sstevel@tonic-gate printf(gettext("krb5_recvauth(%d, %s, %s, ...)\n"), fd, kprop_version, 13537c478bd9Sstevel@tonic-gate name); 13547c478bd9Sstevel@tonic-gate free(name); 13557c478bd9Sstevel@tonic-gate } 13567c478bd9Sstevel@tonic-gate 135756a424ccSmp retval = krb5_auth_con_init(context, &auth_context); 135856a424ccSmp if (retval) { 13597c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_init: %s"), 136056a424ccSmp error_message(retval)); 13617c478bd9Sstevel@tonic-gate exit(1); 13627c478bd9Sstevel@tonic-gate } 13637c478bd9Sstevel@tonic-gate 136456a424ccSmp retval = krb5_auth_con_setflags(context, auth_context, 136556a424ccSmp KRB5_AUTH_CONTEXT_DO_SEQUENCE); 136656a424ccSmp if (retval) { 13677c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setflags: %s"), 13687c478bd9Sstevel@tonic-gate error_message(retval)); 13697c478bd9Sstevel@tonic-gate exit(1); 13707c478bd9Sstevel@tonic-gate } 13717c478bd9Sstevel@tonic-gate 137256a424ccSmp retval = krb5_auth_con_setaddrs(context, auth_context, &receiver_addr, 137356a424ccSmp &sender_addr); 137456a424ccSmp if (retval) { 13757c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_auth_con_setaddrs: %s"), 13767c478bd9Sstevel@tonic-gate error_message(retval)); 13777c478bd9Sstevel@tonic-gate exit(1); 13787c478bd9Sstevel@tonic-gate } 13797c478bd9Sstevel@tonic-gate 13807c478bd9Sstevel@tonic-gate if (srvtab) { 138156a424ccSmp retval = krb5_kt_resolve(context, srvtab, &keytab); 138256a424ccSmp if (retval) { 13837c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_kt_resolve: %s"), error_message(retval)); 13847c478bd9Sstevel@tonic-gate exit(1); 13857c478bd9Sstevel@tonic-gate } 13867c478bd9Sstevel@tonic-gate } 13877c478bd9Sstevel@tonic-gate 138856a424ccSmp retval = krb5_recvauth(context, &auth_context, (void *) &fd, 138956a424ccSmp kprop_version, server, 0, keytab, &ticket); 139056a424ccSmp if (retval) { 139156a424ccSmp syslog(LOG_ERR, gettext("Error in krb5_recvauth: %s"), error_message(retval)); 13927c478bd9Sstevel@tonic-gate exit(1); 13937c478bd9Sstevel@tonic-gate } 13947c478bd9Sstevel@tonic-gate 139556a424ccSmp retval = krb5_copy_principal(context, ticket->enc_part2->client, clientp); 139656a424ccSmp if (retval) { 13977c478bd9Sstevel@tonic-gate syslog(LOG_ERR, gettext("Error in krb5_copy_prinicpal: %s"), 13987c478bd9Sstevel@tonic-gate error_message(retval)); 13997c478bd9Sstevel@tonic-gate exit(1); 14007c478bd9Sstevel@tonic-gate } 14017c478bd9Sstevel@tonic-gate 14027c478bd9Sstevel@tonic-gate *etype = ticket->enc_part.enctype; 14037c478bd9Sstevel@tonic-gate 14047c478bd9Sstevel@tonic-gate if (debug) { 14057c478bd9Sstevel@tonic-gate char * name; 14067c478bd9Sstevel@tonic-gate char etypebuf[100]; 14077c478bd9Sstevel@tonic-gate 140856a424ccSmp retval = krb5_unparse_name(context, *clientp, &name); 140956a424ccSmp if (retval) { 14107c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 14117c478bd9Sstevel@tonic-gate com_err(progname, retval, 14127c64d375Smp gettext("while unparsing client name")); 14137c478bd9Sstevel@tonic-gate exit(1); 14147c478bd9Sstevel@tonic-gate } 14157c478bd9Sstevel@tonic-gate 141656a424ccSmp retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf)); 141756a424ccSmp if (retval) { 14187c64d375Smp /* Solaris Kerberos: Keep error messages consistent */ 14197c64d375Smp com_err(progname, retval, gettext("while unparsing ticket etype")); 14207c478bd9Sstevel@tonic-gate exit(1); 14217c478bd9Sstevel@tonic-gate } 14227c478bd9Sstevel@tonic-gate 14237c478bd9Sstevel@tonic-gate printf("authenticated client: %s (etype == %s)\n", name, etypebuf); 14247c478bd9Sstevel@tonic-gate free(name); 14257c478bd9Sstevel@tonic-gate } 14267c478bd9Sstevel@tonic-gate 14277c478bd9Sstevel@tonic-gate krb5_free_ticket(context, ticket); 14287c478bd9Sstevel@tonic-gate } 14297c478bd9Sstevel@tonic-gate 14307c478bd9Sstevel@tonic-gate krb5_boolean 14317c478bd9Sstevel@tonic-gate authorized_principal(context, p, auth_etype) 14327c478bd9Sstevel@tonic-gate krb5_context context; 14337c478bd9Sstevel@tonic-gate krb5_principal p; 14347c478bd9Sstevel@tonic-gate krb5_enctype auth_etype; 14357c478bd9Sstevel@tonic-gate { 14367c478bd9Sstevel@tonic-gate char *name, *ptr; 14377c478bd9Sstevel@tonic-gate char buf[1024]; 14387c478bd9Sstevel@tonic-gate krb5_error_code retval; 14397c478bd9Sstevel@tonic-gate FILE *acl_file; 14407c478bd9Sstevel@tonic-gate int end; 14417c478bd9Sstevel@tonic-gate krb5_enctype acl_etype; 14427c478bd9Sstevel@tonic-gate 14437c478bd9Sstevel@tonic-gate retval = krb5_unparse_name(context, p, &name); 14447c478bd9Sstevel@tonic-gate if (retval) 14457c478bd9Sstevel@tonic-gate return FALSE; 14467c478bd9Sstevel@tonic-gate 14477c478bd9Sstevel@tonic-gate acl_file = fopen(acl_file_name, "r"); 14487c478bd9Sstevel@tonic-gate if (!acl_file) 14497c478bd9Sstevel@tonic-gate return FALSE; 14507c478bd9Sstevel@tonic-gate 14517c478bd9Sstevel@tonic-gate while (!feof(acl_file)) { 14527c478bd9Sstevel@tonic-gate if (!fgets(buf, sizeof(buf), acl_file)) 14537c478bd9Sstevel@tonic-gate break; 14547c478bd9Sstevel@tonic-gate end = strlen(buf) - 1; 14557c478bd9Sstevel@tonic-gate if (buf[end] == '\n') 14567c478bd9Sstevel@tonic-gate buf[end] = '\0'; 14577c478bd9Sstevel@tonic-gate if (!strncmp(name, buf, strlen(name))) { 14587c478bd9Sstevel@tonic-gate ptr = buf+strlen(name); 14597c478bd9Sstevel@tonic-gate 14607c478bd9Sstevel@tonic-gate /* if the next character is not whitespace or nul, then 14617c478bd9Sstevel@tonic-gate the match is only partial. continue on to new lines. */ 146256a424ccSmp if (*ptr && !isspace((int) *ptr)) 14637c478bd9Sstevel@tonic-gate continue; 14647c478bd9Sstevel@tonic-gate 14657c478bd9Sstevel@tonic-gate /* otherwise, skip trailing whitespace */ 146656a424ccSmp for (; *ptr && isspace((int) *ptr); ptr++) ; 14677c478bd9Sstevel@tonic-gate 14687c478bd9Sstevel@tonic-gate /* now, look for an etype string. if there isn't one, 14697c478bd9Sstevel@tonic-gate return true. if there is an invalid string, continue. 14707c478bd9Sstevel@tonic-gate If there is a valid string, return true only if it 14717c478bd9Sstevel@tonic-gate matches the etype passed in, otherwise continue */ 14727c478bd9Sstevel@tonic-gate 14737c478bd9Sstevel@tonic-gate if ((*ptr) && 14747c478bd9Sstevel@tonic-gate ((retval = krb5_string_to_enctype(ptr, &acl_etype)) || 14757c478bd9Sstevel@tonic-gate (acl_etype != auth_etype))) 14767c478bd9Sstevel@tonic-gate continue; 14777c478bd9Sstevel@tonic-gate 14787c478bd9Sstevel@tonic-gate free(name); 14797c478bd9Sstevel@tonic-gate fclose(acl_file); 14807c478bd9Sstevel@tonic-gate return TRUE; 14817c478bd9Sstevel@tonic-gate } 14827c478bd9Sstevel@tonic-gate } 14837c478bd9Sstevel@tonic-gate free(name); 14847c478bd9Sstevel@tonic-gate fclose(acl_file); 14857c478bd9Sstevel@tonic-gate return FALSE; 14867c478bd9Sstevel@tonic-gate } 14877c478bd9Sstevel@tonic-gate 14887c478bd9Sstevel@tonic-gate void 14897c478bd9Sstevel@tonic-gate recv_database(context, fd, database_fd, confmsg) 14907c478bd9Sstevel@tonic-gate krb5_context context; 14917c478bd9Sstevel@tonic-gate int fd; 14927c478bd9Sstevel@tonic-gate int database_fd; 14937c478bd9Sstevel@tonic-gate krb5_data *confmsg; 14947c478bd9Sstevel@tonic-gate { 149556a424ccSmp krb5_ui_4 database_size; /* This must be 4 bytes */ 14967c478bd9Sstevel@tonic-gate int received_size, n; 14977c478bd9Sstevel@tonic-gate char buf[1024]; 14987c478bd9Sstevel@tonic-gate krb5_data inbuf, outbuf; 14997c478bd9Sstevel@tonic-gate krb5_error_code retval; 15007c478bd9Sstevel@tonic-gate 15017c478bd9Sstevel@tonic-gate /* 15027c478bd9Sstevel@tonic-gate * Receive and decode size from client 15037c478bd9Sstevel@tonic-gate */ 150456a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 150556a424ccSmp if (retval) { 15067c478bd9Sstevel@tonic-gate send_error(context, fd, retval, gettext("while reading database size")); 15077c478bd9Sstevel@tonic-gate com_err(progname, retval, 15087c478bd9Sstevel@tonic-gate gettext("while reading size of database from client")); 15097c478bd9Sstevel@tonic-gate exit(1); 15107c478bd9Sstevel@tonic-gate } 15117c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 15127c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 151356a424ccSmp retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL); 151456a424ccSmp if (retval) { 151556a424ccSmp send_error(context, fd, retval, gettext( 151656a424ccSmp "while decoding database size")); 15177c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15187c478bd9Sstevel@tonic-gate com_err(progname, retval, 15197c478bd9Sstevel@tonic-gate gettext("while decoding database size from client")); 15207c478bd9Sstevel@tonic-gate exit(1); 15217c478bd9Sstevel@tonic-gate } 15227c478bd9Sstevel@tonic-gate memcpy((char *) &database_size, outbuf.data, sizeof(database_size)); 15237c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15247c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 15257c478bd9Sstevel@tonic-gate database_size = ntohl(database_size); 15267c478bd9Sstevel@tonic-gate 152756a424ccSmp /* 152856a424ccSmp * Initialize the initial vector. 152956a424ccSmp */ 153056a424ccSmp retval = krb5_auth_con_initivector(context, auth_context); 153156a424ccSmp if (retval) { 153256a424ccSmp send_error(context, fd, retval, gettext( 153356a424ccSmp "failed while initializing i_vector")); 153456a424ccSmp com_err(progname, retval, gettext("while initializing i_vector")); 153556a424ccSmp exit(1); 153656a424ccSmp } 15377c478bd9Sstevel@tonic-gate 15387c478bd9Sstevel@tonic-gate /* 15397c478bd9Sstevel@tonic-gate * Now start receiving the database from the net 15407c478bd9Sstevel@tonic-gate */ 15417c478bd9Sstevel@tonic-gate received_size = 0; 15427c478bd9Sstevel@tonic-gate while (received_size < database_size) { 154356a424ccSmp retval = krb5_read_message(context, (void *) &fd, &inbuf); 154456a424ccSmp if (retval) { 15457c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15467c478bd9Sstevel@tonic-gate gettext("while reading database block starting at offset %d"), 15477c478bd9Sstevel@tonic-gate received_size); 15487c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 15497c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 15507c478bd9Sstevel@tonic-gate exit(1); 15517c478bd9Sstevel@tonic-gate } 15527c478bd9Sstevel@tonic-gate if (krb5_is_krb_error(&inbuf)) 15537c478bd9Sstevel@tonic-gate recv_error(context, &inbuf); 155456a424ccSmp retval = krb5_rd_priv(context, auth_context, &inbuf, 155556a424ccSmp &outbuf, NULL); 155656a424ccSmp if (retval) { 15577c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15587c478bd9Sstevel@tonic-gate gettext("while decoding database block starting at offset %d"), 15597c478bd9Sstevel@tonic-gate received_size); 15607c478bd9Sstevel@tonic-gate com_err(progname, retval, buf); 15617c478bd9Sstevel@tonic-gate send_error(context, fd, retval, buf); 15627c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15637c478bd9Sstevel@tonic-gate exit(1); 15647c478bd9Sstevel@tonic-gate } 15657c478bd9Sstevel@tonic-gate n = write(database_fd, outbuf.data, outbuf.length); 15667c478bd9Sstevel@tonic-gate if (n < 0) { 15677c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15687c478bd9Sstevel@tonic-gate gettext( 15697c478bd9Sstevel@tonic-gate "while writing database block starting at offset %d"), 15707c478bd9Sstevel@tonic-gate received_size); 15717c478bd9Sstevel@tonic-gate send_error(context, fd, errno, buf); 15727c478bd9Sstevel@tonic-gate } else if (n != outbuf.length) { 15737c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15747c478bd9Sstevel@tonic-gate gettext( 15757c478bd9Sstevel@tonic-gate "incomplete write while writing database block starting at\n" 15767c478bd9Sstevel@tonic-gate "offset %d (%d written, %d expected)"), 15777c478bd9Sstevel@tonic-gate received_size, n, outbuf.length); 15787c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 15797c478bd9Sstevel@tonic-gate } 15807c478bd9Sstevel@tonic-gate received_size += outbuf.length; 15817c478bd9Sstevel@tonic-gate /* SUNWresync121: our krb5...contents sets length to 0 */ 15827c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &inbuf); 15837c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 158456a424ccSmp 15857c478bd9Sstevel@tonic-gate } 15867c478bd9Sstevel@tonic-gate /* 15877c478bd9Sstevel@tonic-gate * OK, we've seen the entire file. Did we get too many bytes? 15887c478bd9Sstevel@tonic-gate */ 15897c478bd9Sstevel@tonic-gate if (received_size > database_size) { 15907c478bd9Sstevel@tonic-gate snprintf(buf, sizeof (buf), 15917c478bd9Sstevel@tonic-gate gettext("Received %d bytes, expected %d bytes for database file"), 15927c478bd9Sstevel@tonic-gate received_size, database_size); 15937c478bd9Sstevel@tonic-gate send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); 15947c478bd9Sstevel@tonic-gate } 15957c478bd9Sstevel@tonic-gate /* 15967c478bd9Sstevel@tonic-gate * Create message acknowledging number of bytes received, but 15977c478bd9Sstevel@tonic-gate * don't send it until kdb5_util returns successfully. 15987c478bd9Sstevel@tonic-gate */ 15997c478bd9Sstevel@tonic-gate database_size = htonl(database_size); 16007c478bd9Sstevel@tonic-gate inbuf.data = (char *) &database_size; 16017c478bd9Sstevel@tonic-gate inbuf.length = sizeof(database_size); 160256a424ccSmp retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); 160356a424ccSmp if (retval) { 16047c478bd9Sstevel@tonic-gate com_err(progname, retval, 16057c478bd9Sstevel@tonic-gate gettext("while encoding # of receieved bytes")); 16067c478bd9Sstevel@tonic-gate send_error(context, fd, retval, 16077c478bd9Sstevel@tonic-gate gettext("while encoding # of received bytes")); 16087c478bd9Sstevel@tonic-gate exit(1); 16097c478bd9Sstevel@tonic-gate } 16107c478bd9Sstevel@tonic-gate } 16117c478bd9Sstevel@tonic-gate 16127c478bd9Sstevel@tonic-gate 16137c478bd9Sstevel@tonic-gate void 16147c478bd9Sstevel@tonic-gate send_error(context, fd, err_code, err_text) 16157c478bd9Sstevel@tonic-gate krb5_context context; 16167c478bd9Sstevel@tonic-gate int fd; 16177c478bd9Sstevel@tonic-gate krb5_error_code err_code; 16187c478bd9Sstevel@tonic-gate char *err_text; 16197c478bd9Sstevel@tonic-gate { 16207c478bd9Sstevel@tonic-gate krb5_error error; 16217c478bd9Sstevel@tonic-gate const char *text; 16227c478bd9Sstevel@tonic-gate krb5_data outbuf; 16237c478bd9Sstevel@tonic-gate char buf[1024]; 16247c478bd9Sstevel@tonic-gate 16257c478bd9Sstevel@tonic-gate memset((char *)&error, 0, sizeof(error)); 16267c478bd9Sstevel@tonic-gate krb5_us_timeofday(context, &error.stime, &error.susec); 16277c478bd9Sstevel@tonic-gate error.server = server; 16287c478bd9Sstevel@tonic-gate error.client = client; 16297c478bd9Sstevel@tonic-gate 16307c478bd9Sstevel@tonic-gate if (err_text) 16317c478bd9Sstevel@tonic-gate text = err_text; 16327c478bd9Sstevel@tonic-gate else 16337c478bd9Sstevel@tonic-gate text = error_message(err_code); 16347c478bd9Sstevel@tonic-gate 16357c478bd9Sstevel@tonic-gate error.error = err_code - ERROR_TABLE_BASE_krb5; 16367c478bd9Sstevel@tonic-gate if (error.error > 127) { 16377c478bd9Sstevel@tonic-gate error.error = KRB_ERR_GENERIC; 16387c478bd9Sstevel@tonic-gate if (err_text) { 16397c478bd9Sstevel@tonic-gate sprintf(buf, "%s %s", error_message(err_code), 16407c478bd9Sstevel@tonic-gate err_text); 16417c478bd9Sstevel@tonic-gate text = buf; 16427c478bd9Sstevel@tonic-gate } 16437c478bd9Sstevel@tonic-gate } 16447c478bd9Sstevel@tonic-gate error.text.length = strlen(text) + 1; 164556a424ccSmp error.text.data = malloc(error.text.length); 164656a424ccSmp if (error.text.data) { 16477c478bd9Sstevel@tonic-gate strcpy(error.text.data, text); 16487c478bd9Sstevel@tonic-gate if (!krb5_mk_error(context, &error, &outbuf)) { 16497c478bd9Sstevel@tonic-gate (void) krb5_write_message(context, (void *)&fd,&outbuf); 16507c478bd9Sstevel@tonic-gate krb5_free_data_contents(context, &outbuf); 16517c478bd9Sstevel@tonic-gate } 16527c478bd9Sstevel@tonic-gate free(error.text.data); 16537c478bd9Sstevel@tonic-gate } 16547c478bd9Sstevel@tonic-gate } 16557c478bd9Sstevel@tonic-gate 16567c478bd9Sstevel@tonic-gate void 16577c478bd9Sstevel@tonic-gate recv_error(context, inbuf) 16587c478bd9Sstevel@tonic-gate krb5_context context; 16597c478bd9Sstevel@tonic-gate krb5_data *inbuf; 16607c478bd9Sstevel@tonic-gate { 16617c478bd9Sstevel@tonic-gate krb5_error *error; 16627c478bd9Sstevel@tonic-gate krb5_error_code retval; 16637c478bd9Sstevel@tonic-gate 166456a424ccSmp retval = krb5_rd_error(context, inbuf, &error); 166556a424ccSmp if (retval) { 16667c478bd9Sstevel@tonic-gate com_err(progname, retval, 16677c478bd9Sstevel@tonic-gate gettext("while decoding error packet from client")); 16687c478bd9Sstevel@tonic-gate exit(1); 16697c478bd9Sstevel@tonic-gate } 16707c478bd9Sstevel@tonic-gate if (error->error == KRB_ERR_GENERIC) { 16717c478bd9Sstevel@tonic-gate if (error->text.data) 16727c478bd9Sstevel@tonic-gate fprintf(stderr, 16737c478bd9Sstevel@tonic-gate gettext("Generic remote error: %s\n"), 16747c478bd9Sstevel@tonic-gate error->text.data); 16757c478bd9Sstevel@tonic-gate } else if (error->error) { 16767c478bd9Sstevel@tonic-gate com_err(progname, error->error + ERROR_TABLE_BASE_krb5, 16777c478bd9Sstevel@tonic-gate gettext("signalled from server")); 16787c478bd9Sstevel@tonic-gate if (error->text.data) 16797c478bd9Sstevel@tonic-gate fprintf(stderr, 16807c478bd9Sstevel@tonic-gate gettext("Error text from client: %s\n"), 16817c478bd9Sstevel@tonic-gate error->text.data); 16827c478bd9Sstevel@tonic-gate } 16837c478bd9Sstevel@tonic-gate krb5_free_error(context, error); 16847c478bd9Sstevel@tonic-gate exit(1); 16857c478bd9Sstevel@tonic-gate } 16867c478bd9Sstevel@tonic-gate 16877c478bd9Sstevel@tonic-gate void 168856a424ccSmp load_database(context, kdb_util, database_file_name) 16897c478bd9Sstevel@tonic-gate krb5_context context; 169056a424ccSmp char *kdb_util; 16917c478bd9Sstevel@tonic-gate char *database_file_name; 16927c478bd9Sstevel@tonic-gate { 16937c478bd9Sstevel@tonic-gate static char *edit_av[10]; 169456a424ccSmp int error_ret, save_stderr = -1; 16957c478bd9Sstevel@tonic-gate int child_pid; 16967c478bd9Sstevel@tonic-gate int count; 169756a424ccSmp 169856a424ccSmp /* <sys/param.h> has been included, so BSD will be defined on 169956a424ccSmp BSD systems */ 170056a424ccSmp #if BSD > 0 && BSD <= 43 170156a424ccSmp #ifndef WEXITSTATUS 170256a424ccSmp #define WEXITSTATUS(w) (w).w_retcode 170356a424ccSmp #endif 170456a424ccSmp union wait waitb; 170556a424ccSmp #else 17067c478bd9Sstevel@tonic-gate int waitb; 170756a424ccSmp #endif 17087c478bd9Sstevel@tonic-gate krb5_error_code retval; 17097c478bd9Sstevel@tonic-gate kdb_log_context *log_ctx; 17107c478bd9Sstevel@tonic-gate 17117c478bd9Sstevel@tonic-gate if (debug) 171256a424ccSmp printf(gettext("calling kdb_util to load database\n")); 17137c478bd9Sstevel@tonic-gate 17147c478bd9Sstevel@tonic-gate log_ctx = context->kdblog_context; 17157c478bd9Sstevel@tonic-gate 171656a424ccSmp edit_av[0] = kdb_util; 17177c478bd9Sstevel@tonic-gate count = 1; 17187c478bd9Sstevel@tonic-gate if (realm) { 17197c478bd9Sstevel@tonic-gate edit_av[count++] = "-r"; 17207c478bd9Sstevel@tonic-gate edit_av[count++] = realm; 17217c478bd9Sstevel@tonic-gate } 17227c478bd9Sstevel@tonic-gate edit_av[count++] = "load"; 17237c478bd9Sstevel@tonic-gate if (kerb_database) { 17247c478bd9Sstevel@tonic-gate edit_av[count++] = "-d"; 17257c478bd9Sstevel@tonic-gate edit_av[count++] = kerb_database; 17267c478bd9Sstevel@tonic-gate } 17277c478bd9Sstevel@tonic-gate 17287c478bd9Sstevel@tonic-gate if (log_ctx && (log_ctx->iproprole == IPROP_SLAVE)) { 17297c478bd9Sstevel@tonic-gate edit_av[count++] = "-i"; 17307c478bd9Sstevel@tonic-gate } 17317c478bd9Sstevel@tonic-gate edit_av[count++] = database_file_name; 17327c478bd9Sstevel@tonic-gate edit_av[count++] = NULL; 17337c478bd9Sstevel@tonic-gate 17347c478bd9Sstevel@tonic-gate switch(child_pid = fork()) { 17357c478bd9Sstevel@tonic-gate case -1: 17367c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while trying to fork %s"), 173756a424ccSmp kdb_util); 17387c478bd9Sstevel@tonic-gate exit(1); 17397c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 17407c478bd9Sstevel@tonic-gate case 0: 17417c478bd9Sstevel@tonic-gate if (!debug) { 17427c478bd9Sstevel@tonic-gate save_stderr = dup(2); 17437c478bd9Sstevel@tonic-gate close(0); 17447c478bd9Sstevel@tonic-gate close(1); 17457c478bd9Sstevel@tonic-gate close(2); 17467c478bd9Sstevel@tonic-gate open("/dev/null", O_RDWR); 17477c478bd9Sstevel@tonic-gate dup(0); 17487c478bd9Sstevel@tonic-gate dup(0); 17497c478bd9Sstevel@tonic-gate } 17507c478bd9Sstevel@tonic-gate 175156a424ccSmp execv(kdb_util, edit_av); 17527c478bd9Sstevel@tonic-gate retval = errno; 17537c478bd9Sstevel@tonic-gate if (!debug) 17547c478bd9Sstevel@tonic-gate dup2(save_stderr, 2); 17557c478bd9Sstevel@tonic-gate com_err(progname, retval, gettext("while trying to exec %s"), 175656a424ccSmp kdb_util); 17577c478bd9Sstevel@tonic-gate _exit(1); 17587c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 17597c478bd9Sstevel@tonic-gate default: 17607c478bd9Sstevel@tonic-gate if (debug) 17617c478bd9Sstevel@tonic-gate printf(gettext("Child PID is %d\n"), child_pid); 17627c478bd9Sstevel@tonic-gate if (wait(&waitb) < 0) { 17637c478bd9Sstevel@tonic-gate com_err(progname, errno, gettext("while waiting for %s"), 176456a424ccSmp kdb_util); 17657c478bd9Sstevel@tonic-gate exit(1); 17667c478bd9Sstevel@tonic-gate } 17677c478bd9Sstevel@tonic-gate } 17687c478bd9Sstevel@tonic-gate 176956a424ccSmp error_ret = WEXITSTATUS(waitb); 177056a424ccSmp if (error_ret) { 17717c478bd9Sstevel@tonic-gate com_err(progname, 0, 177256a424ccSmp gettext("%s returned a bad exit status (%d)"), 177356a424ccSmp kdb_util, error_ret); 17747c478bd9Sstevel@tonic-gate exit(1); 17757c478bd9Sstevel@tonic-gate } 17767c478bd9Sstevel@tonic-gate return; 17777c478bd9Sstevel@tonic-gate } 1778