1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*0Sstevel@tonic-gate 8*0Sstevel@tonic-gate /* 9*0Sstevel@tonic-gate * kdc/main.c 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * Copyright 1990,2001 by the Massachusetts Institute of Technology. 12*0Sstevel@tonic-gate * 13*0Sstevel@tonic-gate * Export of this software from the United States of America may 14*0Sstevel@tonic-gate * require a specific license from the United States Government. 15*0Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating 16*0Sstevel@tonic-gate * export to obtain such a license before exporting. 17*0Sstevel@tonic-gate * 18*0Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 19*0Sstevel@tonic-gate * distribute this software and its documentation for any purpose and 20*0Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright 21*0Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and 22*0Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that 23*0Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining 24*0Sstevel@tonic-gate * to distribution of the software without specific, written prior 25*0Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label 26*0Sstevel@tonic-gate * your software as modified software and not distribute it in such a 27*0Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software. 28*0Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of 29*0Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express 30*0Sstevel@tonic-gate * or implied warranty. 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * 33*0Sstevel@tonic-gate * Main procedure body for the KDC server process. 34*0Sstevel@tonic-gate */ 35*0Sstevel@tonic-gate 36*0Sstevel@tonic-gate #include <stdio.h> 37*0Sstevel@tonic-gate #include <syslog.h> 38*0Sstevel@tonic-gate #include <signal.h> 39*0Sstevel@tonic-gate #include <errno.h> 40*0Sstevel@tonic-gate #include <netdb.h> 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate #include "k5-int.h" 43*0Sstevel@tonic-gate #include "com_err.h" 44*0Sstevel@tonic-gate #include "adm.h" 45*0Sstevel@tonic-gate #include "adm_proto.h" 46*0Sstevel@tonic-gate #include "kdc_util.h" 47*0Sstevel@tonic-gate #include "extern.h" 48*0Sstevel@tonic-gate #include "kdc5_err.h" 49*0Sstevel@tonic-gate #include <libintl.h> 50*0Sstevel@tonic-gate #include <locale.h> 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate #ifdef HAVE_NETINET_IN_H 53*0Sstevel@tonic-gate #include <netinet/in.h> 54*0Sstevel@tonic-gate #endif 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate kdc_realm_t *find_realm_data PROTOTYPE((char *, krb5_ui_4)); 57*0Sstevel@tonic-gate 58*0Sstevel@tonic-gate void usage PROTOTYPE((char *)); 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate krb5_sigtype request_exit PROTOTYPE((int)); 61*0Sstevel@tonic-gate krb5_sigtype request_hup PROTOTYPE((int)); 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate void setup_signal_handlers PROTOTYPE((void)); 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate krb5_error_code setup_sam PROTOTYPE((void)); 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate void initialize_realms PROTOTYPE((krb5_context, int, char **)); 68*0Sstevel@tonic-gate 69*0Sstevel@tonic-gate void finish_realms PROTOTYPE((char *)); 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate static int nofork = 0; 72*0Sstevel@tonic-gate static int rkey_init_done = 0; 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate /* Solaris Kerberos: global here that other functions access */ 75*0Sstevel@tonic-gate int max_tcp_data_connections; 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate #ifdef POSIX_SIGNALS 78*0Sstevel@tonic-gate static struct sigaction s_action; 79*0Sstevel@tonic-gate #endif /* POSIX_SIGNALS */ 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate #define KRB5_KDC_MAX_REALMS 32 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate /* 84*0Sstevel@tonic-gate * Find the realm entry for a given realm. 85*0Sstevel@tonic-gate */ 86*0Sstevel@tonic-gate kdc_realm_t * 87*0Sstevel@tonic-gate find_realm_data(rname, rsize) 88*0Sstevel@tonic-gate char *rname; 89*0Sstevel@tonic-gate krb5_ui_4 rsize; 90*0Sstevel@tonic-gate { 91*0Sstevel@tonic-gate int i; 92*0Sstevel@tonic-gate for (i=0; i<kdc_numrealms; i++) { 93*0Sstevel@tonic-gate if ((rsize == strlen(kdc_realmlist[i]->realm_name)) && 94*0Sstevel@tonic-gate !strncmp(rname, kdc_realmlist[i]->realm_name, rsize)) 95*0Sstevel@tonic-gate return(kdc_realmlist[i]); 96*0Sstevel@tonic-gate } 97*0Sstevel@tonic-gate return((kdc_realm_t *) NULL); 98*0Sstevel@tonic-gate } 99*0Sstevel@tonic-gate 100*0Sstevel@tonic-gate krb5_error_code 101*0Sstevel@tonic-gate setup_server_realm(sprinc) 102*0Sstevel@tonic-gate krb5_principal sprinc; 103*0Sstevel@tonic-gate { 104*0Sstevel@tonic-gate krb5_error_code kret; 105*0Sstevel@tonic-gate kdc_realm_t *newrealm; 106*0Sstevel@tonic-gate 107*0Sstevel@tonic-gate kret = 0; 108*0Sstevel@tonic-gate if (kdc_numrealms > 1) { 109*0Sstevel@tonic-gate if (!(newrealm = find_realm_data(sprinc->realm.data, 110*0Sstevel@tonic-gate (krb5_ui_4) sprinc->realm.length))) 111*0Sstevel@tonic-gate kret = ENOENT; 112*0Sstevel@tonic-gate else 113*0Sstevel@tonic-gate kdc_active_realm = newrealm; 114*0Sstevel@tonic-gate } 115*0Sstevel@tonic-gate else 116*0Sstevel@tonic-gate kdc_active_realm = kdc_realmlist[0]; 117*0Sstevel@tonic-gate return(kret); 118*0Sstevel@tonic-gate } 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate static void 121*0Sstevel@tonic-gate finish_realm(rdp) 122*0Sstevel@tonic-gate kdc_realm_t *rdp; 123*0Sstevel@tonic-gate { 124*0Sstevel@tonic-gate if (rdp->realm_dbname) 125*0Sstevel@tonic-gate free(rdp->realm_dbname); 126*0Sstevel@tonic-gate if (rdp->realm_mpname) 127*0Sstevel@tonic-gate free(rdp->realm_mpname); 128*0Sstevel@tonic-gate if (rdp->realm_stash) 129*0Sstevel@tonic-gate free(rdp->realm_stash); 130*0Sstevel@tonic-gate if (rdp->realm_ports) 131*0Sstevel@tonic-gate free(rdp->realm_ports); 132*0Sstevel@tonic-gate if (rdp->realm_tcp_ports) 133*0Sstevel@tonic-gate free(rdp->realm_tcp_ports); 134*0Sstevel@tonic-gate if (rdp->realm_kstypes) 135*0Sstevel@tonic-gate free(rdp->realm_kstypes); 136*0Sstevel@tonic-gate if (rdp->realm_keytab) 137*0Sstevel@tonic-gate krb5_kt_close(rdp->realm_context, rdp->realm_keytab); 138*0Sstevel@tonic-gate if (rdp->realm_context) { 139*0Sstevel@tonic-gate if (rdp->realm_mprinc) 140*0Sstevel@tonic-gate krb5_free_principal(rdp->realm_context, rdp->realm_mprinc); 141*0Sstevel@tonic-gate if (rdp->realm_mkey.length && rdp->realm_mkey.contents) { 142*0Sstevel@tonic-gate memset(rdp->realm_mkey.contents, 0, rdp->realm_mkey.length); 143*0Sstevel@tonic-gate free(rdp->realm_mkey.contents); 144*0Sstevel@tonic-gate } 145*0Sstevel@tonic-gate if (rdp->realm_tgskey.length && rdp->realm_tgskey.contents) { 146*0Sstevel@tonic-gate memset(rdp->realm_tgskey.contents, 0, rdp->realm_tgskey.length); 147*0Sstevel@tonic-gate free(rdp->realm_tgskey.contents); 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate krb5_db_fini(rdp->realm_context); 150*0Sstevel@tonic-gate if (rdp->realm_tgsprinc) 151*0Sstevel@tonic-gate krb5_free_principal(rdp->realm_context, rdp->realm_tgsprinc); 152*0Sstevel@tonic-gate krb5_free_context(rdp->realm_context); 153*0Sstevel@tonic-gate } 154*0Sstevel@tonic-gate free(rdp); 155*0Sstevel@tonic-gate } 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate /* 158*0Sstevel@tonic-gate * Initialize a realm control structure from the alternate profile or from 159*0Sstevel@tonic-gate * the specified defaults. 160*0Sstevel@tonic-gate * 161*0Sstevel@tonic-gate * After we're complete here, the essence of the realm is embodied in the 162*0Sstevel@tonic-gate * realm data and we should be all set to begin operation for that realm. 163*0Sstevel@tonic-gate */ 164*0Sstevel@tonic-gate static krb5_error_code 165*0Sstevel@tonic-gate init_realm(progname, rdp, realm, def_dbname, def_mpname, 166*0Sstevel@tonic-gate def_enctype, def_udp_ports, def_tcp_ports, def_manual) 167*0Sstevel@tonic-gate char *progname; 168*0Sstevel@tonic-gate kdc_realm_t *rdp; 169*0Sstevel@tonic-gate char *realm; 170*0Sstevel@tonic-gate char *def_dbname; 171*0Sstevel@tonic-gate char *def_mpname; 172*0Sstevel@tonic-gate krb5_enctype def_enctype; 173*0Sstevel@tonic-gate char *def_udp_ports; 174*0Sstevel@tonic-gate char *def_tcp_ports; 175*0Sstevel@tonic-gate krb5_boolean def_manual; 176*0Sstevel@tonic-gate { 177*0Sstevel@tonic-gate krb5_error_code kret; 178*0Sstevel@tonic-gate krb5_boolean manual; 179*0Sstevel@tonic-gate krb5_db_entry db_entry; 180*0Sstevel@tonic-gate int num2get; 181*0Sstevel@tonic-gate krb5_boolean more; 182*0Sstevel@tonic-gate krb5_boolean db_inited; 183*0Sstevel@tonic-gate krb5_realm_params *rparams; 184*0Sstevel@tonic-gate krb5_key_data *kdata; 185*0Sstevel@tonic-gate krb5_key_salt_tuple *kslist; 186*0Sstevel@tonic-gate krb5_int32 nkslist; 187*0Sstevel@tonic-gate int i; 188*0Sstevel@tonic-gate krb5_deltat now, krb5_kdb_max_time; 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate db_inited = 0; 191*0Sstevel@tonic-gate memset((char *) rdp, 0, sizeof(kdc_realm_t)); 192*0Sstevel@tonic-gate if (!realm) { 193*0Sstevel@tonic-gate kret = EINVAL; 194*0Sstevel@tonic-gate goto whoops; 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate rdp->realm_name = realm; 198*0Sstevel@tonic-gate kret = krb5_init_context(&rdp->realm_context); 199*0Sstevel@tonic-gate if (kret) { 200*0Sstevel@tonic-gate com_err(progname, kret, gettext("while getting context for realm %s"), 201*0Sstevel@tonic-gate realm); 202*0Sstevel@tonic-gate goto whoops; 203*0Sstevel@tonic-gate } 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate kret = krb5_read_realm_params(rdp->realm_context, rdp->realm_name, 206*0Sstevel@tonic-gate (char *) NULL, (char *) NULL, &rparams); 207*0Sstevel@tonic-gate if (kret) { 208*0Sstevel@tonic-gate com_err(progname, kret, gettext("while reading realm parameters")); 209*0Sstevel@tonic-gate goto whoops; 210*0Sstevel@tonic-gate } 211*0Sstevel@tonic-gate 212*0Sstevel@tonic-gate /* Handle profile file name */ 213*0Sstevel@tonic-gate if (rparams && rparams->realm_profile) 214*0Sstevel@tonic-gate rdp->realm_profile = strdup(rparams->realm_profile); 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate /* Handle database name */ 217*0Sstevel@tonic-gate if (rparams && rparams->realm_dbname) 218*0Sstevel@tonic-gate rdp->realm_dbname = strdup(rparams->realm_dbname); 219*0Sstevel@tonic-gate else 220*0Sstevel@tonic-gate rdp->realm_dbname = (def_dbname) ? strdup(def_dbname) : 221*0Sstevel@tonic-gate strdup(DEFAULT_KDB_FILE); 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate /* Handle master key name */ 224*0Sstevel@tonic-gate if (rparams && rparams->realm_mkey_name) 225*0Sstevel@tonic-gate rdp->realm_mpname = strdup(rparams->realm_mkey_name); 226*0Sstevel@tonic-gate else 227*0Sstevel@tonic-gate rdp->realm_mpname = (def_mpname) ? strdup(def_mpname) : 228*0Sstevel@tonic-gate strdup(KRB5_KDB_M_NAME); 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate /* Handle KDC ports */ 231*0Sstevel@tonic-gate if (rparams && rparams->realm_kdc_ports) 232*0Sstevel@tonic-gate rdp->realm_ports = strdup(rparams->realm_kdc_ports); 233*0Sstevel@tonic-gate else 234*0Sstevel@tonic-gate rdp->realm_ports = strdup(def_udp_ports); 235*0Sstevel@tonic-gate if (rparams && rparams->realm_kdc_tcp_ports) 236*0Sstevel@tonic-gate rdp->realm_tcp_ports = strdup(rparams->realm_kdc_tcp_ports); 237*0Sstevel@tonic-gate else 238*0Sstevel@tonic-gate rdp->realm_tcp_ports = strdup(def_tcp_ports); 239*0Sstevel@tonic-gate 240*0Sstevel@tonic-gate /* Handle stash file */ 241*0Sstevel@tonic-gate if (rparams && rparams->realm_stash_file) { 242*0Sstevel@tonic-gate rdp->realm_stash = strdup(rparams->realm_stash_file); 243*0Sstevel@tonic-gate manual = FALSE; 244*0Sstevel@tonic-gate } else 245*0Sstevel@tonic-gate manual = def_manual; 246*0Sstevel@tonic-gate 247*0Sstevel@tonic-gate /* Handle master key type */ 248*0Sstevel@tonic-gate if (rparams && rparams->realm_enctype_valid) 249*0Sstevel@tonic-gate rdp->realm_mkey.enctype = (krb5_enctype) rparams->realm_enctype; 250*0Sstevel@tonic-gate else 251*0Sstevel@tonic-gate rdp->realm_mkey.enctype = manual ? def_enctype : ENCTYPE_UNKNOWN; 252*0Sstevel@tonic-gate if ((kret = krb5_timeofday(rdp->realm_context, &now))) { 253*0Sstevel@tonic-gate com_err(progname, kret, gettext("while getting timeofday")); 254*0Sstevel@tonic-gate goto whoops; 255*0Sstevel@tonic-gate } 256*0Sstevel@tonic-gate 257*0Sstevel@tonic-gate /* Handle ticket maximum life */ 258*0Sstevel@tonic-gate if (rparams && rparams->realm_max_life_valid) 259*0Sstevel@tonic-gate rdp->realm_maxlife = rparams->realm_max_life; 260*0Sstevel@tonic-gate else 261*0Sstevel@tonic-gate rdp->realm_maxlife = KRB5_KDB_EXPIRATION - now - 3600; 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate /* Handle ticket renewable maximum life */ 264*0Sstevel@tonic-gate if (rparams && rparams->realm_max_rlife_valid) 265*0Sstevel@tonic-gate rdp->realm_maxrlife = rparams->realm_max_rlife; 266*0Sstevel@tonic-gate else 267*0Sstevel@tonic-gate rdp->realm_maxrlife = KRB5_KDB_EXPIRATION - now - 3600; 268*0Sstevel@tonic-gate 269*0Sstevel@tonic-gate /* Handle key/salt list */ 270*0Sstevel@tonic-gate if (rparams && rparams->realm_num_keysalts) { 271*0Sstevel@tonic-gate rdp->realm_kstypes = rparams->realm_keysalts; 272*0Sstevel@tonic-gate rdp->realm_nkstypes = rparams->realm_num_keysalts; 273*0Sstevel@tonic-gate rparams->realm_keysalts = NULL; 274*0Sstevel@tonic-gate rparams->realm_num_keysalts = 0; 275*0Sstevel@tonic-gate kslist = (krb5_key_salt_tuple *) rdp->realm_kstypes; 276*0Sstevel@tonic-gate nkslist = rdp->realm_nkstypes; 277*0Sstevel@tonic-gate } else { 278*0Sstevel@tonic-gate /* 279*0Sstevel@tonic-gate * XXX Initialize default key/salt list. 280*0Sstevel@tonic-gate */ 281*0Sstevel@tonic-gate if ((kslist = (krb5_key_salt_tuple *) 282*0Sstevel@tonic-gate malloc(sizeof(krb5_key_salt_tuple)))) { 283*0Sstevel@tonic-gate kslist->ks_enctype = ENCTYPE_DES_CBC_CRC; 284*0Sstevel@tonic-gate kslist->ks_salttype = KRB5_KDB_SALTTYPE_NORMAL; 285*0Sstevel@tonic-gate rdp->realm_kstypes = kslist; 286*0Sstevel@tonic-gate rdp->realm_nkstypes = 1; 287*0Sstevel@tonic-gate nkslist = 1; 288*0Sstevel@tonic-gate } 289*0Sstevel@tonic-gate else { 290*0Sstevel@tonic-gate com_err(progname, ENOMEM, 291*0Sstevel@tonic-gate gettext("while setting up key/salt list for realm %s"), 292*0Sstevel@tonic-gate realm); 293*0Sstevel@tonic-gate exit(1); 294*0Sstevel@tonic-gate } 295*0Sstevel@tonic-gate } 296*0Sstevel@tonic-gate 297*0Sstevel@tonic-gate if (rparams) 298*0Sstevel@tonic-gate krb5_free_realm_params(rdp->realm_context, rparams); 299*0Sstevel@tonic-gate 300*0Sstevel@tonic-gate /* 301*0Sstevel@tonic-gate * We've got our parameters, now go and setup our realm context. 302*0Sstevel@tonic-gate */ 303*0Sstevel@tonic-gate 304*0Sstevel@tonic-gate /* Set the default realm of this context */ 305*0Sstevel@tonic-gate if ((kret = krb5_set_default_realm(rdp->realm_context, realm))) { 306*0Sstevel@tonic-gate com_err(progname, kret, gettext("while setting default realm to %s"), 307*0Sstevel@tonic-gate realm); 308*0Sstevel@tonic-gate goto whoops; 309*0Sstevel@tonic-gate } 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate /* Assemble and parse the master key name */ 312*0Sstevel@tonic-gate if ((kret = krb5_db_setup_mkey_name(rdp->realm_context, rdp->realm_mpname, 313*0Sstevel@tonic-gate rdp->realm_name, (char **) NULL, 314*0Sstevel@tonic-gate &rdp->realm_mprinc))) { 315*0Sstevel@tonic-gate com_err(progname, kret, 316*0Sstevel@tonic-gate gettext("while setting up master key name %s for realm %s"), 317*0Sstevel@tonic-gate rdp->realm_mpname, realm); 318*0Sstevel@tonic-gate goto whoops; 319*0Sstevel@tonic-gate } 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate /* 322*0Sstevel@tonic-gate * Get the master key. 323*0Sstevel@tonic-gate */ 324*0Sstevel@tonic-gate if ((kret = krb5_db_fetch_mkey(rdp->realm_context, rdp->realm_mprinc, 325*0Sstevel@tonic-gate rdp->realm_mkey.enctype, manual, 326*0Sstevel@tonic-gate FALSE, rdp->realm_stash, 327*0Sstevel@tonic-gate 0, &rdp->realm_mkey))) { 328*0Sstevel@tonic-gate com_err(progname, kret, 329*0Sstevel@tonic-gate gettext("while fetching master key %s for realm %s"), 330*0Sstevel@tonic-gate rdp->realm_mpname, realm); 331*0Sstevel@tonic-gate goto whoops; 332*0Sstevel@tonic-gate } 333*0Sstevel@tonic-gate 334*0Sstevel@tonic-gate /* Set and open the database. */ 335*0Sstevel@tonic-gate if (rdp->realm_dbname && 336*0Sstevel@tonic-gate (kret = krb5_db_set_name(rdp->realm_context, rdp->realm_dbname))) { 337*0Sstevel@tonic-gate com_err(progname, kret, 338*0Sstevel@tonic-gate gettext("while setting database name to %s for realm %s"), 339*0Sstevel@tonic-gate rdp->realm_dbname, realm); 340*0Sstevel@tonic-gate goto whoops; 341*0Sstevel@tonic-gate } 342*0Sstevel@tonic-gate if ((kret = krb5_db_init(rdp->realm_context))) { 343*0Sstevel@tonic-gate com_err(progname, kret, 344*0Sstevel@tonic-gate gettext("while initializing database "), 345*0Sstevel@tonic-gate gettext("for realm %s"), realm); 346*0Sstevel@tonic-gate goto whoops; 347*0Sstevel@tonic-gate } else 348*0Sstevel@tonic-gate db_inited = 1; 349*0Sstevel@tonic-gate 350*0Sstevel@tonic-gate /* Verify the master key */ 351*0Sstevel@tonic-gate if ((kret = krb5_db_verify_master_key(rdp->realm_context, 352*0Sstevel@tonic-gate rdp->realm_mprinc, 353*0Sstevel@tonic-gate &rdp->realm_mkey))) { 354*0Sstevel@tonic-gate com_err(progname, kret, 355*0Sstevel@tonic-gate gettext("while verifying master key for realm %s"), 356*0Sstevel@tonic-gate realm); 357*0Sstevel@tonic-gate goto whoops; 358*0Sstevel@tonic-gate } 359*0Sstevel@tonic-gate 360*0Sstevel@tonic-gate /* Fetch the master key and get its version number */ 361*0Sstevel@tonic-gate num2get = 1; 362*0Sstevel@tonic-gate kret = krb5_db_get_principal(rdp->realm_context, rdp->realm_mprinc, 363*0Sstevel@tonic-gate &db_entry, &num2get, &more); 364*0Sstevel@tonic-gate if (!kret) { 365*0Sstevel@tonic-gate if (num2get != 1) 366*0Sstevel@tonic-gate kret = KRB5_KDB_NOMASTERKEY; 367*0Sstevel@tonic-gate else { 368*0Sstevel@tonic-gate if (more) { 369*0Sstevel@tonic-gate krb5_db_free_principal(rdp->realm_context, 370*0Sstevel@tonic-gate &db_entry, 371*0Sstevel@tonic-gate num2get); 372*0Sstevel@tonic-gate kret = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE; 373*0Sstevel@tonic-gate } 374*0Sstevel@tonic-gate } 375*0Sstevel@tonic-gate } 376*0Sstevel@tonic-gate if (kret) { 377*0Sstevel@tonic-gate com_err(progname, kret, 378*0Sstevel@tonic-gate gettext("while fetching master entry for realm %s"), 379*0Sstevel@tonic-gate realm); 380*0Sstevel@tonic-gate goto whoops; 381*0Sstevel@tonic-gate } 382*0Sstevel@tonic-gate 383*0Sstevel@tonic-gate /* 384*0Sstevel@tonic-gate * Get the most recent master key. Search the key list in 385*0Sstevel@tonic-gate * the order specified by the key/salt list. 386*0Sstevel@tonic-gate */ 387*0Sstevel@tonic-gate kdata = (krb5_key_data *) NULL; 388*0Sstevel@tonic-gate for (i=0; i<nkslist; i++) { 389*0Sstevel@tonic-gate if (!(kret = krb5_dbe_find_enctype(rdp->realm_context, 390*0Sstevel@tonic-gate &db_entry, 391*0Sstevel@tonic-gate kslist[i].ks_enctype, 392*0Sstevel@tonic-gate -1, 393*0Sstevel@tonic-gate -1, 394*0Sstevel@tonic-gate &kdata))) 395*0Sstevel@tonic-gate break; 396*0Sstevel@tonic-gate } 397*0Sstevel@tonic-gate if (!kdata) { 398*0Sstevel@tonic-gate com_err(progname, kret, 399*0Sstevel@tonic-gate gettext("while finding master key for realm %s"), 400*0Sstevel@tonic-gate realm); 401*0Sstevel@tonic-gate goto whoops; 402*0Sstevel@tonic-gate } 403*0Sstevel@tonic-gate rdp->realm_mkvno = kdata->key_data_kvno; 404*0Sstevel@tonic-gate krb5_db_free_principal(rdp->realm_context, &db_entry, num2get); 405*0Sstevel@tonic-gate 406*0Sstevel@tonic-gate if ((kret = krb5_db_set_mkey(rdp->realm_context, &rdp->realm_mkey))) { 407*0Sstevel@tonic-gate com_err(progname, kret, 408*0Sstevel@tonic-gate gettext("while processing master key for realm %s"), 409*0Sstevel@tonic-gate realm); 410*0Sstevel@tonic-gate goto whoops; 411*0Sstevel@tonic-gate } 412*0Sstevel@tonic-gate 413*0Sstevel@tonic-gate /* Set up the keytab */ 414*0Sstevel@tonic-gate if ((kret = krb5_ktkdb_resolve(rdp->realm_context, 415*0Sstevel@tonic-gate NULL, 416*0Sstevel@tonic-gate &rdp->realm_keytab))) { 417*0Sstevel@tonic-gate com_err(progname, kret, 418*0Sstevel@tonic-gate gettext("while resolving kdb keytab for realm %s"), 419*0Sstevel@tonic-gate realm); 420*0Sstevel@tonic-gate goto whoops; 421*0Sstevel@tonic-gate } 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate /* Preformat the TGS name */ 424*0Sstevel@tonic-gate if ((kret = krb5_build_principal(rdp->realm_context, &rdp->realm_tgsprinc, 425*0Sstevel@tonic-gate strlen(realm), realm, KRB5_TGS_NAME, 426*0Sstevel@tonic-gate realm, (char *) NULL))) { 427*0Sstevel@tonic-gate com_err(progname, kret, 428*0Sstevel@tonic-gate gettext("while building TGS name for realm %s"), 429*0Sstevel@tonic-gate realm); 430*0Sstevel@tonic-gate goto whoops; 431*0Sstevel@tonic-gate } 432*0Sstevel@tonic-gate 433*0Sstevel@tonic-gate /* Get the TGS database entry */ 434*0Sstevel@tonic-gate num2get = 1; 435*0Sstevel@tonic-gate if (!(kret = krb5_db_get_principal(rdp->realm_context, 436*0Sstevel@tonic-gate rdp->realm_tgsprinc, 437*0Sstevel@tonic-gate &db_entry, 438*0Sstevel@tonic-gate &num2get, 439*0Sstevel@tonic-gate &more))) { 440*0Sstevel@tonic-gate if (num2get != 1) 441*0Sstevel@tonic-gate kret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; 442*0Sstevel@tonic-gate else { 443*0Sstevel@tonic-gate if (more) { 444*0Sstevel@tonic-gate krb5_db_free_principal(rdp->realm_context, 445*0Sstevel@tonic-gate &db_entry, 446*0Sstevel@tonic-gate num2get); 447*0Sstevel@tonic-gate kret = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE; 448*0Sstevel@tonic-gate } 449*0Sstevel@tonic-gate } 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate if (kret) { 452*0Sstevel@tonic-gate com_err(progname, kret, 453*0Sstevel@tonic-gate gettext("while fetching TGS entry for realm %s"), 454*0Sstevel@tonic-gate realm); 455*0Sstevel@tonic-gate goto whoops; 456*0Sstevel@tonic-gate } 457*0Sstevel@tonic-gate /* 458*0Sstevel@tonic-gate * Get the most recent TGS key. Search the key list in 459*0Sstevel@tonic-gate * the order specified by the key/salt list. 460*0Sstevel@tonic-gate */ 461*0Sstevel@tonic-gate kdata = (krb5_key_data *) NULL; 462*0Sstevel@tonic-gate for (i=0; i<nkslist; i++) { 463*0Sstevel@tonic-gate if (!(kret = krb5_dbe_find_enctype(rdp->realm_context, 464*0Sstevel@tonic-gate &db_entry, 465*0Sstevel@tonic-gate kslist[i].ks_enctype, 466*0Sstevel@tonic-gate -1, 467*0Sstevel@tonic-gate -1, 468*0Sstevel@tonic-gate &kdata))) 469*0Sstevel@tonic-gate break; 470*0Sstevel@tonic-gate } 471*0Sstevel@tonic-gate if (!kdata) { 472*0Sstevel@tonic-gate com_err(progname, kret, 473*0Sstevel@tonic-gate gettext("while finding TGS key for realm %s"), 474*0Sstevel@tonic-gate realm); 475*0Sstevel@tonic-gate goto whoops; 476*0Sstevel@tonic-gate } 477*0Sstevel@tonic-gate if (!(kret = krb5_dbekd_decrypt_key_data(rdp->realm_context, 478*0Sstevel@tonic-gate &rdp->realm_mkey, 479*0Sstevel@tonic-gate kdata, 480*0Sstevel@tonic-gate &rdp->realm_tgskey, NULL))){ 481*0Sstevel@tonic-gate rdp->realm_tgskvno = kdata->key_data_kvno; 482*0Sstevel@tonic-gate } 483*0Sstevel@tonic-gate krb5_db_free_principal(rdp->realm_context, 484*0Sstevel@tonic-gate &db_entry, 485*0Sstevel@tonic-gate num2get); 486*0Sstevel@tonic-gate if (kret) { 487*0Sstevel@tonic-gate com_err(progname, kret, 488*0Sstevel@tonic-gate gettext("while decrypting TGS key for realm %s"), 489*0Sstevel@tonic-gate realm); 490*0Sstevel@tonic-gate goto whoops; 491*0Sstevel@tonic-gate } 492*0Sstevel@tonic-gate 493*0Sstevel@tonic-gate if (!rkey_init_done) { 494*0Sstevel@tonic-gate krb5_timestamp now; 495*0Sstevel@tonic-gate krb5_data seed; 496*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 497*0Sstevel@tonic-gate krb5_keyblock temp_key; 498*0Sstevel@tonic-gate #endif 499*0Sstevel@tonic-gate /* 500*0Sstevel@tonic-gate * If all that worked, then initialize the random key 501*0Sstevel@tonic-gate * generators. 502*0Sstevel@tonic-gate */ 503*0Sstevel@tonic-gate 504*0Sstevel@tonic-gate if ((kret = krb5_timeofday(rdp->realm_context, &now))) 505*0Sstevel@tonic-gate goto whoops; 506*0Sstevel@tonic-gate seed.length = sizeof(now); 507*0Sstevel@tonic-gate seed.data = (char *) &now; 508*0Sstevel@tonic-gate if ((kret = krb5_c_random_seed(rdp->realm_context, &seed))) 509*0Sstevel@tonic-gate goto whoops; 510*0Sstevel@tonic-gate 511*0Sstevel@tonic-gate seed.length = rdp->realm_mkey.length; 512*0Sstevel@tonic-gate seed.data = (char *)rdp->realm_mkey.contents; 513*0Sstevel@tonic-gate 514*0Sstevel@tonic-gate if ((kret = krb5_c_random_seed(rdp->realm_context, &seed))) 515*0Sstevel@tonic-gate goto whoops; 516*0Sstevel@tonic-gate 517*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 518*0Sstevel@tonic-gate if ((kret = krb5_c_make_random_key(rdp->realm_context, 519*0Sstevel@tonic-gate ENCTYPE_DES_CBC_CRC, &temp_key))) { 520*0Sstevel@tonic-gate com_err(progname, kret, 521*0Sstevel@tonic-gate "while initializing V4 random key generator"); 522*0Sstevel@tonic-gate goto whoops; 523*0Sstevel@tonic-gate } 524*0Sstevel@tonic-gate 525*0Sstevel@tonic-gate (void) des_init_random_number_generator(temp_key.contents); 526*0Sstevel@tonic-gate krb5_free_keyblock_contents(rdp->realm_context, &temp_key); 527*0Sstevel@tonic-gate #endif 528*0Sstevel@tonic-gate rkey_init_done = 1; 529*0Sstevel@tonic-gate } 530*0Sstevel@tonic-gate whoops: 531*0Sstevel@tonic-gate /* 532*0Sstevel@tonic-gate * If we choked, then clean up any dirt we may have dropped on the floor. 533*0Sstevel@tonic-gate */ 534*0Sstevel@tonic-gate if (kret) { 535*0Sstevel@tonic-gate finish_realm(rdp); 536*0Sstevel@tonic-gate } 537*0Sstevel@tonic-gate return(kret); 538*0Sstevel@tonic-gate } 539*0Sstevel@tonic-gate 540*0Sstevel@tonic-gate krb5_sigtype 541*0Sstevel@tonic-gate request_exit(signo) 542*0Sstevel@tonic-gate int signo; 543*0Sstevel@tonic-gate { 544*0Sstevel@tonic-gate signal_requests_exit = 1; 545*0Sstevel@tonic-gate 546*0Sstevel@tonic-gate #ifdef POSIX_SIGTYPE 547*0Sstevel@tonic-gate return; 548*0Sstevel@tonic-gate #else 549*0Sstevel@tonic-gate return(0); 550*0Sstevel@tonic-gate #endif 551*0Sstevel@tonic-gate } 552*0Sstevel@tonic-gate 553*0Sstevel@tonic-gate krb5_sigtype 554*0Sstevel@tonic-gate request_hup(signo) 555*0Sstevel@tonic-gate int signo; 556*0Sstevel@tonic-gate { 557*0Sstevel@tonic-gate signal_requests_hup = 1; 558*0Sstevel@tonic-gate 559*0Sstevel@tonic-gate #ifdef POSIX_SIGTYPE 560*0Sstevel@tonic-gate return; 561*0Sstevel@tonic-gate #else 562*0Sstevel@tonic-gate return(0); 563*0Sstevel@tonic-gate #endif 564*0Sstevel@tonic-gate } 565*0Sstevel@tonic-gate 566*0Sstevel@tonic-gate void 567*0Sstevel@tonic-gate setup_signal_handlers() 568*0Sstevel@tonic-gate { 569*0Sstevel@tonic-gate #ifdef POSIX_SIGNALS 570*0Sstevel@tonic-gate (void) sigemptyset(&s_action.sa_mask); 571*0Sstevel@tonic-gate s_action.sa_flags = 0; 572*0Sstevel@tonic-gate s_action.sa_handler = request_exit; 573*0Sstevel@tonic-gate (void) sigaction(SIGINT, &s_action, (struct sigaction *) NULL); 574*0Sstevel@tonic-gate (void) sigaction(SIGTERM, &s_action, (struct sigaction *) NULL); 575*0Sstevel@tonic-gate s_action.sa_handler = request_hup; 576*0Sstevel@tonic-gate (void) sigaction(SIGHUP, &s_action, (struct sigaction *) NULL); 577*0Sstevel@tonic-gate #else /* POSIX_SIGNALS */ 578*0Sstevel@tonic-gate signal(SIGINT, request_exit); 579*0Sstevel@tonic-gate signal(SIGTERM, request_exit); 580*0Sstevel@tonic-gate signal(SIGHUP, request_hup); 581*0Sstevel@tonic-gate #endif /* POSIX_SIGNALS */ 582*0Sstevel@tonic-gate 583*0Sstevel@tonic-gate return; 584*0Sstevel@tonic-gate } 585*0Sstevel@tonic-gate 586*0Sstevel@tonic-gate krb5_error_code 587*0Sstevel@tonic-gate setup_sam() 588*0Sstevel@tonic-gate { 589*0Sstevel@tonic-gate return krb5_c_make_random_key(kdc_context, ENCTYPE_DES_CBC_MD5, &psr_key); 590*0Sstevel@tonic-gate } 591*0Sstevel@tonic-gate 592*0Sstevel@tonic-gate void 593*0Sstevel@tonic-gate usage(name) 594*0Sstevel@tonic-gate char *name; 595*0Sstevel@tonic-gate { 596*0Sstevel@tonic-gate fprintf(stderr, gettext("usage: %s [-d dbpathname] [-r dbrealmname] [-R replaycachename ]\n\t[-m] [-k masterenctype] [-M masterkeyname] [-p port] [-n]\n"), name); 597*0Sstevel@tonic-gate return; 598*0Sstevel@tonic-gate } 599*0Sstevel@tonic-gate 600*0Sstevel@tonic-gate void 601*0Sstevel@tonic-gate initialize_realms(kcontext, argc, argv) 602*0Sstevel@tonic-gate krb5_context kcontext; 603*0Sstevel@tonic-gate int argc; 604*0Sstevel@tonic-gate char **argv; 605*0Sstevel@tonic-gate { 606*0Sstevel@tonic-gate int c; 607*0Sstevel@tonic-gate char *db_name = (char *) NULL; 608*0Sstevel@tonic-gate char *mkey_name = (char *) NULL; 609*0Sstevel@tonic-gate char *rcname = KDCRCACHE; 610*0Sstevel@tonic-gate char *lrealm; 611*0Sstevel@tonic-gate krb5_error_code retval; 612*0Sstevel@tonic-gate krb5_enctype menctype = ENCTYPE_UNKNOWN; 613*0Sstevel@tonic-gate kdc_realm_t *rdatap; 614*0Sstevel@tonic-gate krb5_boolean manual = FALSE; 615*0Sstevel@tonic-gate char *default_udp_ports = 0; 616*0Sstevel@tonic-gate char *default_tcp_ports = 0; 617*0Sstevel@tonic-gate krb5_pointer aprof; 618*0Sstevel@tonic-gate const char *hierarchy[3]; 619*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 620*0Sstevel@tonic-gate char *v4mode = 0; 621*0Sstevel@tonic-gate #endif 622*0Sstevel@tonic-gate extern char *optarg; 623*0Sstevel@tonic-gate #ifdef ATHENA_DES3_KLUDGE 624*0Sstevel@tonic-gate extern struct krb5_keytypes krb5_enctypes_list[]; 625*0Sstevel@tonic-gate extern int krb5_enctypes_length; 626*0Sstevel@tonic-gate #endif 627*0Sstevel@tonic-gate 628*0Sstevel@tonic-gate if (!krb5_aprof_init(DEFAULT_KDC_PROFILE, KDC_PROFILE_ENV, &aprof)) { 629*0Sstevel@tonic-gate hierarchy[0] = "kdcdefaults"; 630*0Sstevel@tonic-gate hierarchy[1] = "kdc_ports"; 631*0Sstevel@tonic-gate hierarchy[2] = (char *) NULL; 632*0Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_udp_ports)) 633*0Sstevel@tonic-gate default_udp_ports = 0; 634*0Sstevel@tonic-gate hierarchy[1] = "kdc_tcp_ports"; 635*0Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &default_tcp_ports)) 636*0Sstevel@tonic-gate default_tcp_ports = 0; 637*0Sstevel@tonic-gate hierarchy[1] = "kdc_max_tcp_connections"; 638*0Sstevel@tonic-gate if (krb5_aprof_get_int32(aprof, hierarchy, TRUE, 639*0Sstevel@tonic-gate &max_tcp_data_connections)) { 640*0Sstevel@tonic-gate max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS; 641*0Sstevel@tonic-gate } else if (max_tcp_data_connections < MIN_KDC_TCP_CONNECTIONS) { 642*0Sstevel@tonic-gate max_tcp_data_connections = DEFAULT_KDC_TCP_CONNECTIONS; 643*0Sstevel@tonic-gate } 644*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 645*0Sstevel@tonic-gate hierarchy[1] = "v4_mode"; 646*0Sstevel@tonic-gate if (krb5_aprof_get_string(aprof, hierarchy, TRUE, &v4mode)) 647*0Sstevel@tonic-gate v4mode = 0; 648*0Sstevel@tonic-gate #endif 649*0Sstevel@tonic-gate /* aprof_init can return 0 with aprof == NULL */ 650*0Sstevel@tonic-gate if (aprof) 651*0Sstevel@tonic-gate krb5_aprof_finish(aprof); 652*0Sstevel@tonic-gate } 653*0Sstevel@tonic-gate if (default_udp_ports == 0) 654*0Sstevel@tonic-gate default_udp_ports = strdup(DEFAULT_KDC_UDP_PORTLIST); 655*0Sstevel@tonic-gate if (default_tcp_ports == 0) 656*0Sstevel@tonic-gate default_tcp_ports = strdup(DEFAULT_KDC_TCP_PORTLIST); 657*0Sstevel@tonic-gate /* 658*0Sstevel@tonic-gate * Loop through the option list. Each time we encounter a realm name, 659*0Sstevel@tonic-gate * use the previously scanned options to fill in for defaults. 660*0Sstevel@tonic-gate */ 661*0Sstevel@tonic-gate while ((c = getopt(argc, argv, "r:d:mM:k:R:e:p:s:n")) != -1) { /* SUNW */ 662*0Sstevel@tonic-gate switch(c) { 663*0Sstevel@tonic-gate case 'r': /* realm name for db */ 664*0Sstevel@tonic-gate if (!find_realm_data(optarg, (krb5_ui_4) strlen(optarg))) { 665*0Sstevel@tonic-gate if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) { 666*0Sstevel@tonic-gate if ((retval = init_realm(argv[0], rdatap, optarg, db_name, 667*0Sstevel@tonic-gate mkey_name, menctype, 668*0Sstevel@tonic-gate default_udp_ports, 669*0Sstevel@tonic-gate default_tcp_ports, manual))) { 670*0Sstevel@tonic-gate fprintf(stderr,gettext("%s: cannot initialize realm %s\n"), 671*0Sstevel@tonic-gate argv[0], optarg); 672*0Sstevel@tonic-gate exit(1); 673*0Sstevel@tonic-gate } 674*0Sstevel@tonic-gate kdc_realmlist[kdc_numrealms] = rdatap; 675*0Sstevel@tonic-gate kdc_numrealms++; 676*0Sstevel@tonic-gate } 677*0Sstevel@tonic-gate } 678*0Sstevel@tonic-gate break; 679*0Sstevel@tonic-gate case 'd': /* pathname for db */ 680*0Sstevel@tonic-gate db_name = optarg; 681*0Sstevel@tonic-gate break; 682*0Sstevel@tonic-gate case 'm': /* manual type-in of master key */ 683*0Sstevel@tonic-gate manual = TRUE; 684*0Sstevel@tonic-gate if (menctype == ENCTYPE_UNKNOWN) 685*0Sstevel@tonic-gate menctype = ENCTYPE_DES_CBC_CRC; 686*0Sstevel@tonic-gate break; 687*0Sstevel@tonic-gate case 'M': /* master key name in DB */ 688*0Sstevel@tonic-gate mkey_name = optarg; 689*0Sstevel@tonic-gate break; 690*0Sstevel@tonic-gate case 'n': 691*0Sstevel@tonic-gate nofork++; /* don't detach from terminal */ 692*0Sstevel@tonic-gate break; 693*0Sstevel@tonic-gate case 'k': /* enctype for master key */ 694*0Sstevel@tonic-gate if (krb5_string_to_enctype(optarg, &menctype)) 695*0Sstevel@tonic-gate com_err(argv[0], 0, 696*0Sstevel@tonic-gate gettext("invalid enctype %s"), optarg); 697*0Sstevel@tonic-gate break; 698*0Sstevel@tonic-gate case 'R': 699*0Sstevel@tonic-gate rcname = optarg; 700*0Sstevel@tonic-gate break; 701*0Sstevel@tonic-gate case 'p': 702*0Sstevel@tonic-gate if (default_udp_ports) 703*0Sstevel@tonic-gate free(default_udp_ports); 704*0Sstevel@tonic-gate default_udp_ports = strdup(optarg); 705*0Sstevel@tonic-gate 706*0Sstevel@tonic-gate if (default_tcp_ports) 707*0Sstevel@tonic-gate free(default_tcp_ports); 708*0Sstevel@tonic-gate default_tcp_ports = strdup(optarg); 709*0Sstevel@tonic-gate 710*0Sstevel@tonic-gate break; 711*0Sstevel@tonic-gate case '4': 712*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 713*0Sstevel@tonic-gate if (v4mode) 714*0Sstevel@tonic-gate free(v4mode); 715*0Sstevel@tonic-gate v4mode = strdup(optarg); 716*0Sstevel@tonic-gate #endif 717*0Sstevel@tonic-gate break; 718*0Sstevel@tonic-gate case '3': 719*0Sstevel@tonic-gate #ifdef ATHENA_DES3_KLUDGE 720*0Sstevel@tonic-gate if (krb5_enctypes_list[krb5_enctypes_length-1].etype 721*0Sstevel@tonic-gate != ENCTYPE_LOCAL_DES3_HMAC_SHA1) { 722*0Sstevel@tonic-gate fprintf(stderr, 723*0Sstevel@tonic-gate "internal inconsistency in enctypes_list" 724*0Sstevel@tonic-gate " while disabling\n" 725*0Sstevel@tonic-gate "des3-marc-hmac-sha1 enctype\n"); 726*0Sstevel@tonic-gate exit(1); 727*0Sstevel@tonic-gate } 728*0Sstevel@tonic-gate krb5_enctypes_length--; 729*0Sstevel@tonic-gate break; 730*0Sstevel@tonic-gate #endif 731*0Sstevel@tonic-gate case '?': 732*0Sstevel@tonic-gate default: 733*0Sstevel@tonic-gate usage(argv[0]); 734*0Sstevel@tonic-gate exit(1); 735*0Sstevel@tonic-gate } 736*0Sstevel@tonic-gate } 737*0Sstevel@tonic-gate 738*0Sstevel@tonic-gate #ifdef KRB5_KRB4_COMPAT 739*0Sstevel@tonic-gate /* 740*0Sstevel@tonic-gate * Setup the v4 mode 741*0Sstevel@tonic-gate */ 742*0Sstevel@tonic-gate process_v4_mode(argv[0], v4mode); 743*0Sstevel@tonic-gate #endif 744*0Sstevel@tonic-gate 745*0Sstevel@tonic-gate /* 746*0Sstevel@tonic-gate * Check to see if we processed any realms. 747*0Sstevel@tonic-gate */ 748*0Sstevel@tonic-gate if (kdc_numrealms == 0) { 749*0Sstevel@tonic-gate /* no realm specified, use default realm */ 750*0Sstevel@tonic-gate if ((retval = krb5_get_default_realm(kcontext, &lrealm))) { 751*0Sstevel@tonic-gate com_err(argv[0], retval, 752*0Sstevel@tonic-gate gettext("while attempting to retrieve default realm")); 753*0Sstevel@tonic-gate exit(1); 754*0Sstevel@tonic-gate } 755*0Sstevel@tonic-gate if ((rdatap = (kdc_realm_t *) malloc(sizeof(kdc_realm_t)))) { 756*0Sstevel@tonic-gate if ((retval = init_realm(argv[0], rdatap, lrealm, db_name, 757*0Sstevel@tonic-gate mkey_name, menctype, default_udp_ports, 758*0Sstevel@tonic-gate default_tcp_ports, manual))) { 759*0Sstevel@tonic-gate fprintf(stderr, 760*0Sstevel@tonic-gate gettext("%s: cannot initialize realm %s\n"), 761*0Sstevel@tonic-gate argv[0], lrealm); 762*0Sstevel@tonic-gate exit(1); 763*0Sstevel@tonic-gate } 764*0Sstevel@tonic-gate kdc_realmlist[0] = rdatap; 765*0Sstevel@tonic-gate kdc_numrealms++; 766*0Sstevel@tonic-gate } 767*0Sstevel@tonic-gate } 768*0Sstevel@tonic-gate 769*0Sstevel@tonic-gate #ifdef USE_RCACHE 770*0Sstevel@tonic-gate /* 771*0Sstevel@tonic-gate * Now handle the replay cache. 772*0Sstevel@tonic-gate */ 773*0Sstevel@tonic-gate if ((retval = kdc_initialize_rcache(kcontext, rcname))) { 774*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing KDC replay cache")); 775*0Sstevel@tonic-gate exit(1); 776*0Sstevel@tonic-gate } 777*0Sstevel@tonic-gate #endif 778*0Sstevel@tonic-gate 779*0Sstevel@tonic-gate /* Ensure that this is set for our first request. */ 780*0Sstevel@tonic-gate kdc_active_realm = kdc_realmlist[0]; 781*0Sstevel@tonic-gate if (default_udp_ports) 782*0Sstevel@tonic-gate free(default_udp_ports); 783*0Sstevel@tonic-gate if (default_tcp_ports) 784*0Sstevel@tonic-gate free(default_tcp_ports); 785*0Sstevel@tonic-gate 786*0Sstevel@tonic-gate return; 787*0Sstevel@tonic-gate } 788*0Sstevel@tonic-gate 789*0Sstevel@tonic-gate void 790*0Sstevel@tonic-gate finish_realms(prog) 791*0Sstevel@tonic-gate char *prog; 792*0Sstevel@tonic-gate { 793*0Sstevel@tonic-gate int i; 794*0Sstevel@tonic-gate 795*0Sstevel@tonic-gate for (i = 0; i < kdc_numrealms; i++) { 796*0Sstevel@tonic-gate finish_realm(kdc_realmlist[i]); 797*0Sstevel@tonic-gate kdc_realmlist[i] = 0; 798*0Sstevel@tonic-gate } 799*0Sstevel@tonic-gate } 800*0Sstevel@tonic-gate 801*0Sstevel@tonic-gate /* 802*0Sstevel@tonic-gate outline: 803*0Sstevel@tonic-gate 804*0Sstevel@tonic-gate process args & setup 805*0Sstevel@tonic-gate 806*0Sstevel@tonic-gate initialize database access (fetch master key, open DB) 807*0Sstevel@tonic-gate 808*0Sstevel@tonic-gate initialize network 809*0Sstevel@tonic-gate 810*0Sstevel@tonic-gate loop: 811*0Sstevel@tonic-gate listen for packet 812*0Sstevel@tonic-gate 813*0Sstevel@tonic-gate determine packet type, dispatch to handling routine 814*0Sstevel@tonic-gate (AS or TGS (or V4?)) 815*0Sstevel@tonic-gate 816*0Sstevel@tonic-gate reflect response 817*0Sstevel@tonic-gate 818*0Sstevel@tonic-gate exit on signal 819*0Sstevel@tonic-gate 820*0Sstevel@tonic-gate clean up secrets, close db 821*0Sstevel@tonic-gate 822*0Sstevel@tonic-gate shut down network 823*0Sstevel@tonic-gate 824*0Sstevel@tonic-gate exit 825*0Sstevel@tonic-gate */ 826*0Sstevel@tonic-gate 827*0Sstevel@tonic-gate int main(argc, argv) 828*0Sstevel@tonic-gate int argc; 829*0Sstevel@tonic-gate char *argv[]; 830*0Sstevel@tonic-gate { 831*0Sstevel@tonic-gate krb5_error_code retval; 832*0Sstevel@tonic-gate krb5_context kcontext; 833*0Sstevel@tonic-gate int *port_list; 834*0Sstevel@tonic-gate int errout = 0; 835*0Sstevel@tonic-gate 836*0Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 837*0Sstevel@tonic-gate 838*0Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 839*0Sstevel@tonic-gate #define TEXT_DOMAIN "KRB5KDC_TEST" /* Use this only if it weren't */ 840*0Sstevel@tonic-gate #endif 841*0Sstevel@tonic-gate 842*0Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 843*0Sstevel@tonic-gate 844*0Sstevel@tonic-gate if (strrchr(argv[0], '/')) 845*0Sstevel@tonic-gate argv[0] = strrchr(argv[0], '/')+1; 846*0Sstevel@tonic-gate 847*0Sstevel@tonic-gate if (!(kdc_realmlist = (kdc_realm_t **) malloc(sizeof(kdc_realm_t *) * 848*0Sstevel@tonic-gate KRB5_KDC_MAX_REALMS))) { 849*0Sstevel@tonic-gate fprintf(stderr, gettext("%s: cannot get memory for realm list\n"), argv[0]); 850*0Sstevel@tonic-gate exit(1); 851*0Sstevel@tonic-gate } 852*0Sstevel@tonic-gate memset((char *) kdc_realmlist, 0, 853*0Sstevel@tonic-gate (size_t) (sizeof(kdc_realm_t *) * KRB5_KDC_MAX_REALMS)); 854*0Sstevel@tonic-gate port_list = NULL; 855*0Sstevel@tonic-gate 856*0Sstevel@tonic-gate /* 857*0Sstevel@tonic-gate * A note about Kerberos contexts: This context, "kcontext", is used 858*0Sstevel@tonic-gate * for the KDC operations, i.e. setup, network connection and error 859*0Sstevel@tonic-gate * reporting. The per-realm operations use the "realm_context" 860*0Sstevel@tonic-gate * associated with each realm. 861*0Sstevel@tonic-gate */ 862*0Sstevel@tonic-gate retval = krb5_init_context(&kcontext); 863*0Sstevel@tonic-gate if (retval) { 864*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing krb5")); 865*0Sstevel@tonic-gate exit(1); 866*0Sstevel@tonic-gate } 867*0Sstevel@tonic-gate krb5_klog_init(kcontext, "kdc", argv[0], 1); 868*0Sstevel@tonic-gate /* initialize_kdc5_error_table(); SUNWresync121 XXX */ 869*0Sstevel@tonic-gate 870*0Sstevel@tonic-gate /* 871*0Sstevel@tonic-gate * Scan through the argument list 872*0Sstevel@tonic-gate */ 873*0Sstevel@tonic-gate initialize_realms(kcontext, argc, argv); 874*0Sstevel@tonic-gate 875*0Sstevel@tonic-gate setup_signal_handlers(); 876*0Sstevel@tonic-gate 877*0Sstevel@tonic-gate if (retval = setup_sam()) { 878*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing SAM")); 879*0Sstevel@tonic-gate finish_realms(argv[0]); 880*0Sstevel@tonic-gate return 1; 881*0Sstevel@tonic-gate } 882*0Sstevel@tonic-gate 883*0Sstevel@tonic-gate if ((retval = setup_network(argv[0]))) { 884*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while initializing network")); 885*0Sstevel@tonic-gate finish_realms(argv[0]); 886*0Sstevel@tonic-gate return 1; 887*0Sstevel@tonic-gate } 888*0Sstevel@tonic-gate if (!nofork && daemon(0, 0)) { 889*0Sstevel@tonic-gate com_err(argv[0], errno, gettext("while detaching from tty")); 890*0Sstevel@tonic-gate finish_realms(argv[0]); 891*0Sstevel@tonic-gate return 1; 892*0Sstevel@tonic-gate } 893*0Sstevel@tonic-gate if (retval = krb5_klog_syslog(LOG_INFO, "commencing operation")) { 894*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while logging message")); 895*0Sstevel@tonic-gate errout++; 896*0Sstevel@tonic-gate }; 897*0Sstevel@tonic-gate 898*0Sstevel@tonic-gate if ((retval = listen_and_process(argv[0]))) { 899*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while processing network requests")); 900*0Sstevel@tonic-gate errout++; 901*0Sstevel@tonic-gate } 902*0Sstevel@tonic-gate if ((retval = closedown_network(argv[0]))) { 903*0Sstevel@tonic-gate com_err(argv[0], retval, gettext("while shutting down network")); 904*0Sstevel@tonic-gate errout++; 905*0Sstevel@tonic-gate } 906*0Sstevel@tonic-gate krb5_klog_syslog(LOG_INFO, "shutting down"); 907*0Sstevel@tonic-gate krb5_klog_close(kdc_context); 908*0Sstevel@tonic-gate finish_realms(argv[0]); 909*0Sstevel@tonic-gate krb5_free_context(kcontext); 910*0Sstevel@tonic-gate return errout; 911*0Sstevel@tonic-gate } 912