xref: /onnv-gate/usr/src/cmd/krb5/slave/kprop.c (revision 96:4c8311d51cba)
10Sstevel@tonic-gate /*
2*96Ssemery  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
30Sstevel@tonic-gate  * Use is subject to license terms.
40Sstevel@tonic-gate  */
50Sstevel@tonic-gate 
60Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
70Sstevel@tonic-gate 
80Sstevel@tonic-gate /*
90Sstevel@tonic-gate  * slave/kprop.c
100Sstevel@tonic-gate  *
110Sstevel@tonic-gate  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
120Sstevel@tonic-gate  * All Rights Reserved.
130Sstevel@tonic-gate  *
140Sstevel@tonic-gate  * Export of this software from the United States of America may
150Sstevel@tonic-gate  *   require a specific license from the United States Government.
160Sstevel@tonic-gate  *   It is the responsibility of any person or organization contemplating
170Sstevel@tonic-gate  *   export to obtain such a license before exporting.
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
200Sstevel@tonic-gate  * distribute this software and its documentation for any purpose and
210Sstevel@tonic-gate  * without fee is hereby granted, provided that the above copyright
220Sstevel@tonic-gate  * notice appear in all copies and that both that copyright notice and
230Sstevel@tonic-gate  * this permission notice appear in supporting documentation, and that
240Sstevel@tonic-gate  * the name of M.I.T. not be used in advertising or publicity pertaining
250Sstevel@tonic-gate  * to distribution of the software without specific, written prior
260Sstevel@tonic-gate  * permission.  Furthermore if you modify this software you must label
270Sstevel@tonic-gate  * your software as modified software and not distribute it in such a
280Sstevel@tonic-gate  * fashion that it might be confused with the original M.I.T. software.
290Sstevel@tonic-gate  * M.I.T. makes no representations about the suitability of
300Sstevel@tonic-gate  * this software for any purpose.  It is provided "as is" without express
310Sstevel@tonic-gate  * or implied warranty.
320Sstevel@tonic-gate  *
330Sstevel@tonic-gate  *
340Sstevel@tonic-gate  */
350Sstevel@tonic-gate 
360Sstevel@tonic-gate 
370Sstevel@tonic-gate #include <errno.h>
380Sstevel@tonic-gate #include <stdio.h>
390Sstevel@tonic-gate #include <stdlib.h>
400Sstevel@tonic-gate #include <ctype.h>
410Sstevel@tonic-gate #include <sys/file.h>
420Sstevel@tonic-gate #include <signal.h>
430Sstevel@tonic-gate #include <string.h>
440Sstevel@tonic-gate #include <sys/types.h>
450Sstevel@tonic-gate #include <sys/time.h>
460Sstevel@tonic-gate #include <sys/stat.h>
470Sstevel@tonic-gate #include <sys/socket.h>
480Sstevel@tonic-gate #include <netinet/in.h>
490Sstevel@tonic-gate #include <sys/param.h>
500Sstevel@tonic-gate #include <netdb.h>
510Sstevel@tonic-gate #include <fcntl.h>
520Sstevel@tonic-gate #include <libintl.h>
530Sstevel@tonic-gate #include <locale.h>
540Sstevel@tonic-gate #include <k5-int.h>
550Sstevel@tonic-gate #include "com_err.h"
560Sstevel@tonic-gate #include "kprop.h"
570Sstevel@tonic-gate static char *kprop_version = KPROP_PROT_VERSION;
580Sstevel@tonic-gate 
590Sstevel@tonic-gate char	*progname = 0;
600Sstevel@tonic-gate int     debug = 0;
610Sstevel@tonic-gate char	*srvtab = 0;
620Sstevel@tonic-gate char	*slave_host;
630Sstevel@tonic-gate char	*realm = 0;
640Sstevel@tonic-gate char	*file = KPROP_DEFAULT_FILE;
650Sstevel@tonic-gate short	port = 0;
660Sstevel@tonic-gate 
670Sstevel@tonic-gate krb5_principal	my_principal;		/* The Kerberos principal we'll be */
680Sstevel@tonic-gate 				/* running under, initialized in */
690Sstevel@tonic-gate 				/* get_tickets() */
700Sstevel@tonic-gate krb5_ccache	ccache;		/* Credentials cache which we'll be using */
710Sstevel@tonic-gate /* krb5_creds 	my_creds;	/* My credentials */
720Sstevel@tonic-gate krb5_creds	creds;
730Sstevel@tonic-gate krb5_address	sender_addr;
740Sstevel@tonic-gate krb5_address	receiver_addr;
750Sstevel@tonic-gate 
760Sstevel@tonic-gate void	PRS
770Sstevel@tonic-gate 	 (int, char **);
780Sstevel@tonic-gate void	get_tickets
790Sstevel@tonic-gate 	 (krb5_context);
800Sstevel@tonic-gate static void usage
810Sstevel@tonic-gate 	 (void);
820Sstevel@tonic-gate krb5_error_code open_connection
830Sstevel@tonic-gate 	(char *, int *, char *, int);
840Sstevel@tonic-gate void	kerberos_authenticate
850Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context *,
860Sstevel@tonic-gate 		   int, krb5_principal, krb5_creds **);
870Sstevel@tonic-gate int	open_database
880Sstevel@tonic-gate 	 (krb5_context, char *, int *);
890Sstevel@tonic-gate void	close_database
900Sstevel@tonic-gate 	 (krb5_context, int);
910Sstevel@tonic-gate void	xmit_database
920Sstevel@tonic-gate 	 (krb5_context, krb5_auth_context, krb5_creds *,
930Sstevel@tonic-gate 		   int, int, int);
940Sstevel@tonic-gate void	send_error
950Sstevel@tonic-gate 	 (krb5_context, krb5_creds *, int, char *, krb5_error_code);
960Sstevel@tonic-gate void	update_last_prop_file
970Sstevel@tonic-gate 	 (char *, char *);
980Sstevel@tonic-gate 
990Sstevel@tonic-gate static void usage()
1000Sstevel@tonic-gate {
1010Sstevel@tonic-gate 	fprintf(stderr,
1020Sstevel@tonic-gate 		gettext
1030Sstevel@tonic-gate 		("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"),
1040Sstevel@tonic-gate 		progname);
1050Sstevel@tonic-gate 	exit(1);
1060Sstevel@tonic-gate }
1070Sstevel@tonic-gate 
1080Sstevel@tonic-gate int
1090Sstevel@tonic-gate main(argc, argv)
1100Sstevel@tonic-gate 	int	argc;
1110Sstevel@tonic-gate 	char	**argv;
1120Sstevel@tonic-gate {
1130Sstevel@tonic-gate 	int	fd, database_fd, database_size;
1140Sstevel@tonic-gate 	krb5_error_code	retval;
1150Sstevel@tonic-gate 	krb5_context context;
1160Sstevel@tonic-gate 	krb5_creds *my_creds;
1170Sstevel@tonic-gate 	krb5_auth_context auth_context;
1180Sstevel@tonic-gate #define	ERRMSGSIZ	256
1190Sstevel@tonic-gate 	char	Errmsg[ERRMSGSIZ];
1200Sstevel@tonic-gate 
1210Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1220Sstevel@tonic-gate 
1230Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
1240Sstevel@tonic-gate #define	TEXT_DOMAIN	"KPROP_TEST"	/* Use this only if it weren't */
1250Sstevel@tonic-gate #endif
1260Sstevel@tonic-gate 
1270Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1280Sstevel@tonic-gate 
1290Sstevel@tonic-gate 	retval = krb5_init_context(&context);
1300Sstevel@tonic-gate 	if (retval) {
1310Sstevel@tonic-gate 		com_err(argv[0], retval, gettext("while initializing krb5"));
1320Sstevel@tonic-gate 		exit(1);
1330Sstevel@tonic-gate 	}
1340Sstevel@tonic-gate 	PRS(argc, argv);
1350Sstevel@tonic-gate 	get_tickets(context);
1360Sstevel@tonic-gate 
1370Sstevel@tonic-gate 	database_fd = open_database(context, file, &database_size);
1380Sstevel@tonic-gate 	if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) {
1390Sstevel@tonic-gate 		com_err(progname, retval, gettext("%s while opening connection to %s"),
1400Sstevel@tonic-gate 			Errmsg, slave_host);
1410Sstevel@tonic-gate 		exit(1);
1420Sstevel@tonic-gate 	}
1430Sstevel@tonic-gate 	if (fd < 0) {
1440Sstevel@tonic-gate 		fprintf(stderr,
1450Sstevel@tonic-gate 			gettext("%s: %s while opening connection to %s\n"),
1460Sstevel@tonic-gate 			progname, Errmsg, slave_host);
1470Sstevel@tonic-gate 		exit(1);
1480Sstevel@tonic-gate 	}
1490Sstevel@tonic-gate 	kerberos_authenticate(context, &auth_context, fd, my_principal,
1500Sstevel@tonic-gate 			      &my_creds);
1510Sstevel@tonic-gate 	xmit_database(context, auth_context, my_creds, fd, database_fd,
1520Sstevel@tonic-gate 		      database_size);
1530Sstevel@tonic-gate 	update_last_prop_file(slave_host, file);
1540Sstevel@tonic-gate 	printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host);
1550Sstevel@tonic-gate 	krb5_free_cred_contents(context, my_creds);
1560Sstevel@tonic-gate 	close_database(context, database_fd);
1570Sstevel@tonic-gate 	exit(0);
1580Sstevel@tonic-gate }
1590Sstevel@tonic-gate void PRS(argc, argv)
1600Sstevel@tonic-gate 	int	argc;
1610Sstevel@tonic-gate 	char	**argv;
1620Sstevel@tonic-gate {
1630Sstevel@tonic-gate 	int c;
1640Sstevel@tonic-gate 	register char	*word, ch;
1650Sstevel@tonic-gate 	extern int optind;
1660Sstevel@tonic-gate 	extern char *optarg;
1670Sstevel@tonic-gate 
1680Sstevel@tonic-gate 	progname = argv[0];
1690Sstevel@tonic-gate 	while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) {
1700Sstevel@tonic-gate 		switch (c) {
1710Sstevel@tonic-gate 				case 'r':
1720Sstevel@tonic-gate 			realm = optarg;
1730Sstevel@tonic-gate 					if (!realm)
1740Sstevel@tonic-gate 						usage();
1750Sstevel@tonic-gate 					break;
1760Sstevel@tonic-gate 				case 'f':
1770Sstevel@tonic-gate 			file = optarg;
1780Sstevel@tonic-gate 					if (!file)
1790Sstevel@tonic-gate 						usage();
1800Sstevel@tonic-gate 					break;
1810Sstevel@tonic-gate 				case 'd':
1820Sstevel@tonic-gate 					debug++;
1830Sstevel@tonic-gate 					break;
1840Sstevel@tonic-gate 				case 'P':
185*96Ssemery 			port = atoi(optarg);
1860Sstevel@tonic-gate 					if (!port)
1870Sstevel@tonic-gate 						usage();
1880Sstevel@tonic-gate 					break;
1890Sstevel@tonic-gate 				case 's':
1900Sstevel@tonic-gate 			srvtab = optarg;
1910Sstevel@tonic-gate 					if (!srvtab)
1920Sstevel@tonic-gate 						usage();
1930Sstevel@tonic-gate 					break;
1940Sstevel@tonic-gate 		case '?':
1950Sstevel@tonic-gate 				default:
1960Sstevel@tonic-gate 			printf (gettext("Error \n"));
1970Sstevel@tonic-gate 					usage();
1980Sstevel@tonic-gate 				}
1990Sstevel@tonic-gate 			}
2000Sstevel@tonic-gate 	argc -= optind;
2010Sstevel@tonic-gate 	argv = &argv[optind];
2020Sstevel@tonic-gate 	if (*argv)
2030Sstevel@tonic-gate 		slave_host = *argv;
2040Sstevel@tonic-gate 			else
2050Sstevel@tonic-gate 		usage();
2060Sstevel@tonic-gate 
2070Sstevel@tonic-gate }
2080Sstevel@tonic-gate 
2090Sstevel@tonic-gate void get_tickets(context)
2100Sstevel@tonic-gate     krb5_context context;
2110Sstevel@tonic-gate {
2120Sstevel@tonic-gate 	char   my_host_name[MAXHOSTNAMELEN];
2130Sstevel@tonic-gate 	char   buf[BUFSIZ];
2140Sstevel@tonic-gate 	char   *cp;
2150Sstevel@tonic-gate 	struct hostent *hp;
2160Sstevel@tonic-gate 	krb5_error_code retval;
2170Sstevel@tonic-gate 	static char tkstring[] = "/tmp/kproptktXXXXXX";
2180Sstevel@tonic-gate 	krb5_keytab keytab = NULL;
2190Sstevel@tonic-gate 	krb5_get_init_creds_opt opt;
2200Sstevel@tonic-gate 	char *svcname = NULL;
2210Sstevel@tonic-gate 	char *def_realm = NULL;
2220Sstevel@tonic-gate 	char *master_host = NULL;
2230Sstevel@tonic-gate 
2240Sstevel@tonic-gate 
2250Sstevel@tonic-gate 	/*
2260Sstevel@tonic-gate 	 * Figure out what tickets we'll be using to send stuff
2270Sstevel@tonic-gate 	 */
2280Sstevel@tonic-gate 	if (realm) {
2290Sstevel@tonic-gate 	    if ((def_realm = strdup(realm)) == NULL) {
2300Sstevel@tonic-gate 	      com_err(progname, ENOMEM,
2310Sstevel@tonic-gate 		      gettext("while allocating default realm name '%s'"),
2320Sstevel@tonic-gate 		      realm);
2330Sstevel@tonic-gate 	      exit(1);
2340Sstevel@tonic-gate 	    }
2350Sstevel@tonic-gate 	} else {
2360Sstevel@tonic-gate 	    retval = krb5_get_default_realm(context, &def_realm);
2370Sstevel@tonic-gate 	    if (retval) {
2380Sstevel@tonic-gate 	        com_err(progname, retval,
2390Sstevel@tonic-gate 			gettext("while getting default realm"));
2400Sstevel@tonic-gate 	        exit(1);
2410Sstevel@tonic-gate 	    }
2420Sstevel@tonic-gate 	}
2430Sstevel@tonic-gate 
2440Sstevel@tonic-gate 	/*
2450Sstevel@tonic-gate 	 * Always pick up the master hostname from krb5.conf, as
2460Sstevel@tonic-gate 	 * opposed to picking up the localhost, so we do not get bit
2470Sstevel@tonic-gate 	 * if the master KDC is HA and hence points to a logicalhost.
2480Sstevel@tonic-gate 	 */
2490Sstevel@tonic-gate 	retval = kadm5_get_master(context, def_realm, &master_host);
2500Sstevel@tonic-gate 	if (retval) {
2510Sstevel@tonic-gate 	    free(def_realm);
2520Sstevel@tonic-gate 	    com_err(progname, retval,
2530Sstevel@tonic-gate 		gettext("while getting admin server fqdn"));
2540Sstevel@tonic-gate 	    exit(1);
2550Sstevel@tonic-gate 	}
2560Sstevel@tonic-gate 
2570Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context, master_host, NULL,
2580Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &my_principal);
2590Sstevel@tonic-gate 
2600Sstevel@tonic-gate 	free(def_realm);
2610Sstevel@tonic-gate 	free(master_host);
2620Sstevel@tonic-gate 	if (retval) {
2630Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting client principal name"));
2640Sstevel@tonic-gate 	    exit(1);
2650Sstevel@tonic-gate 	}
2660Sstevel@tonic-gate 
2670Sstevel@tonic-gate 	if (realm) {
2680Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data);
2690Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, my_principal, strlen(realm));
2700Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, my_principal, strdup(realm));
2710Sstevel@tonic-gate 	}
2720Sstevel@tonic-gate #if 0
2730Sstevel@tonic-gate 	krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL;
2740Sstevel@tonic-gate #endif
2750Sstevel@tonic-gate 
2760Sstevel@tonic-gate 	/*
2770Sstevel@tonic-gate 	 * Initialize cache file which we're going to be using
2780Sstevel@tonic-gate 	 */
2790Sstevel@tonic-gate 	(void) mktemp(tkstring);
2800Sstevel@tonic-gate 	snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring);
2810Sstevel@tonic-gate 	if (retval = krb5_cc_resolve(context, buf, &ccache)) {
2820Sstevel@tonic-gate 		com_err(progname, retval, gettext("while opening credential cache %s"),
2830Sstevel@tonic-gate 			buf);
2840Sstevel@tonic-gate 		exit(1);
2850Sstevel@tonic-gate 	}
2860Sstevel@tonic-gate 	if (retval = krb5_cc_initialize(context, ccache, my_principal)) {
2870Sstevel@tonic-gate 		com_err (progname, retval, gettext("when initializing cache %s"),
2880Sstevel@tonic-gate 			 buf);
2890Sstevel@tonic-gate 		exit(1);
2900Sstevel@tonic-gate 	}
2910Sstevel@tonic-gate 
2920Sstevel@tonic-gate 	/*
2930Sstevel@tonic-gate 	 * Get the tickets we'll need.
2940Sstevel@tonic-gate 	 *
2950Sstevel@tonic-gate 	 * Construct the principal name for the slave host.
2960Sstevel@tonic-gate 	 */
2970Sstevel@tonic-gate 	memset((char *)&creds, 0, sizeof(creds));
2980Sstevel@tonic-gate 	retval = krb5_sname_to_principal(context,
2990Sstevel@tonic-gate 					 slave_host, KPROP_SERVICE_NAME,
3000Sstevel@tonic-gate 					 KRB5_NT_SRV_HST, &creds.server);
3010Sstevel@tonic-gate 	if (retval) {
3020Sstevel@tonic-gate 	    com_err(progname, errno, gettext("while setting server principal name"));
3030Sstevel@tonic-gate 	    (void) krb5_cc_destroy(context, ccache);
3040Sstevel@tonic-gate 	    exit(1);
3050Sstevel@tonic-gate 	}
3060Sstevel@tonic-gate 	if (realm) {
3070Sstevel@tonic-gate 	    (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data);
3080Sstevel@tonic-gate 	    krb5_princ_set_realm_length(context, creds.server, strlen(realm));
3090Sstevel@tonic-gate 	    krb5_princ_set_realm_data(context, creds.server, strdup(realm));
3100Sstevel@tonic-gate 	}
3110Sstevel@tonic-gate 
3120Sstevel@tonic-gate 	/*
3130Sstevel@tonic-gate 	 * Now fill in the client....
3140Sstevel@tonic-gate 	 */
3150Sstevel@tonic-gate 	if (retval = krb5_copy_principal(context, my_principal, &creds.client)) {
3160Sstevel@tonic-gate 		com_err(progname, retval, gettext("While copying client principal"));
3170Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3180Sstevel@tonic-gate 		exit(1);
3190Sstevel@tonic-gate 	}
3200Sstevel@tonic-gate 	if (srvtab) {
3210Sstevel@tonic-gate 		if (retval = krb5_kt_resolve(context, srvtab, &keytab)) {
3220Sstevel@tonic-gate 			com_err(progname, retval, gettext("while resolving keytab"));
3230Sstevel@tonic-gate 			(void) krb5_cc_destroy(context, ccache);
3240Sstevel@tonic-gate 			exit(1);
3250Sstevel@tonic-gate 		}
3260Sstevel@tonic-gate 	}
3270Sstevel@tonic-gate 	(void) memset(&opt, 0, sizeof (opt));
3280Sstevel@tonic-gate 	krb5_get_init_creds_opt_init(&opt);
3290Sstevel@tonic-gate 	retval = krb5_unparse_name(context,  creds.server, &svcname);
3300Sstevel@tonic-gate 	if (retval) {
3310Sstevel@tonic-gate 		com_err(progname, errno, gettext("while parsing svc principal name"));
3320Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3330Sstevel@tonic-gate 		exit (1);
3340Sstevel@tonic-gate 	}
3350Sstevel@tonic-gate 	retval = krb5_get_init_creds_keytab(context, &creds, creds.client,
3360Sstevel@tonic-gate 				keytab,  0, svcname, &opt);
3370Sstevel@tonic-gate 
3380Sstevel@tonic-gate 	if (svcname)
3390Sstevel@tonic-gate 		free(svcname);
3400Sstevel@tonic-gate 
3410Sstevel@tonic-gate 	if (retval) {
3420Sstevel@tonic-gate 		com_err(progname, retval, gettext("while getting initial ticket\n"));
3430Sstevel@tonic-gate 		(void) krb5_cc_destroy(context, ccache);
3440Sstevel@tonic-gate 		exit(1);
3450Sstevel@tonic-gate 	}
3460Sstevel@tonic-gate 
3470Sstevel@tonic-gate 	if (keytab)
3480Sstevel@tonic-gate 	    (void) krb5_kt_close(context, keytab);
3490Sstevel@tonic-gate 
3500Sstevel@tonic-gate 	/*
3510Sstevel@tonic-gate 	 * Now destroy the cache right away --- the credentials we
3520Sstevel@tonic-gate 	 * need will be in my_creds.
3530Sstevel@tonic-gate 	 */
3540Sstevel@tonic-gate 	if (retval = krb5_cc_destroy(context, ccache)) {
3550Sstevel@tonic-gate 		com_err(progname, retval, gettext("while destroying ticket cache"));
3560Sstevel@tonic-gate 		exit(1);
3570Sstevel@tonic-gate 	}
3580Sstevel@tonic-gate }
3590Sstevel@tonic-gate 
3600Sstevel@tonic-gate krb5_error_code
3610Sstevel@tonic-gate open_connection(host, fd, Errmsg, ErrmsgSz)
3620Sstevel@tonic-gate 	char	*host;
3630Sstevel@tonic-gate 	int	*fd;
3640Sstevel@tonic-gate 	char	*Errmsg;
3650Sstevel@tonic-gate 	int	 ErrmsgSz;
3660Sstevel@tonic-gate {
3670Sstevel@tonic-gate 	int	s;
3680Sstevel@tonic-gate 	krb5_error_code	retval;
3690Sstevel@tonic-gate 
3700Sstevel@tonic-gate 	int	socket_length;
3710Sstevel@tonic-gate 	struct addrinfo hints, *ai, *aitop;
3720Sstevel@tonic-gate 	struct sockaddr_storage	  ss;
3730Sstevel@tonic-gate 	char serv_or_port[NI_MAXSERV];
3740Sstevel@tonic-gate 	enum err_types {SOCKET, CONNECT};
3750Sstevel@tonic-gate 	int which_err;
3760Sstevel@tonic-gate 
3770Sstevel@tonic-gate 	memset(&hints, 0, sizeof(hints));
3780Sstevel@tonic-gate 	hints.ai_family = AF_UNSPEC;    /* go for either IPv4 or v6 */
3790Sstevel@tonic-gate 	hints.ai_socktype = SOCK_STREAM;
3800Sstevel@tonic-gate 
3810Sstevel@tonic-gate 	if (port != 0)
382*96Ssemery 		(void) snprintf(serv_or_port, sizeof(serv_or_port), ("%hu"),
3830Sstevel@tonic-gate 				port);
3840Sstevel@tonic-gate 	else
3850Sstevel@tonic-gate 		strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port));
3860Sstevel@tonic-gate 
3870Sstevel@tonic-gate 	if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) {
3880Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"),
3890Sstevel@tonic-gate 				host);
3900Sstevel@tonic-gate 		*fd = -1;
3910Sstevel@tonic-gate 		return(0);
3920Sstevel@tonic-gate 	}
3930Sstevel@tonic-gate 
3940Sstevel@tonic-gate 	for (ai = aitop; ai; ai = ai->ai_next) {
3950Sstevel@tonic-gate 		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
3960Sstevel@tonic-gate 			continue;
3970Sstevel@tonic-gate 
3980Sstevel@tonic-gate 		s = socket(ai->ai_family, SOCK_STREAM, 0);
3990Sstevel@tonic-gate 		if (s < 0) {
4000Sstevel@tonic-gate 			which_err = SOCKET;
4010Sstevel@tonic-gate 			retval = errno;
4020Sstevel@tonic-gate 			continue;
4030Sstevel@tonic-gate 		}
4040Sstevel@tonic-gate 
4050Sstevel@tonic-gate 		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
4060Sstevel@tonic-gate 		    errno != EINPROGRESS) {
4070Sstevel@tonic-gate 			which_err = CONNECT;
4080Sstevel@tonic-gate 			retval = errno;
4090Sstevel@tonic-gate 			close(s);
4100Sstevel@tonic-gate 			continue;	/* fail -- try next */
4110Sstevel@tonic-gate 		}
4120Sstevel@tonic-gate 
4130Sstevel@tonic-gate 		break; /* success */
4140Sstevel@tonic-gate 	}
4150Sstevel@tonic-gate 
4160Sstevel@tonic-gate 	if (ai == NULL) {
4170Sstevel@tonic-gate 		switch (which_err) {
4180Sstevel@tonic-gate 			case SOCKET:
4190Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4200Sstevel@tonic-gate 						gettext("in call to socket"));
4210Sstevel@tonic-gate 				break;
4220Sstevel@tonic-gate 			case CONNECT:
4230Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4240Sstevel@tonic-gate 						gettext("in call to connect"));
4250Sstevel@tonic-gate 				break;
4260Sstevel@tonic-gate 			default :
4270Sstevel@tonic-gate 				retval = -1; /* generic error */
4280Sstevel@tonic-gate 				(void) snprintf(Errmsg, ERRMSGSIZ,
4290Sstevel@tonic-gate 					gettext("could not setup network"));
4300Sstevel@tonic-gate 				break;
4310Sstevel@tonic-gate 		}
4320Sstevel@tonic-gate 		if (aitop != NULL)
4330Sstevel@tonic-gate 			freeaddrinfo(aitop);
4340Sstevel@tonic-gate 		return(retval);
4350Sstevel@tonic-gate 	}
4360Sstevel@tonic-gate 
4370Sstevel@tonic-gate 	*fd = s;
4380Sstevel@tonic-gate 
4390Sstevel@tonic-gate 	/*
4400Sstevel@tonic-gate 	 * Set receiver_addr and sender_addr.
4410Sstevel@tonic-gate 	 */
4420Sstevel@tonic-gate 	if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr)
4430Sstevel@tonic-gate 			== NULL) {
4440Sstevel@tonic-gate 		retval = errno;
4450Sstevel@tonic-gate 		com_err(progname, errno,
4460Sstevel@tonic-gate 			gettext("while converting socket address"));
4470Sstevel@tonic-gate 		if (aitop != NULL)
4480Sstevel@tonic-gate 			freeaddrinfo(aitop);
4490Sstevel@tonic-gate 		return(retval);
4500Sstevel@tonic-gate 	}
4510Sstevel@tonic-gate 	if (aitop != NULL)
4520Sstevel@tonic-gate 		freeaddrinfo(aitop);
4530Sstevel@tonic-gate 
4540Sstevel@tonic-gate 	socket_length = sizeof(ss);
4550Sstevel@tonic-gate 	if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) {
4560Sstevel@tonic-gate 		retval = errno;
4570Sstevel@tonic-gate 		close(s);
4580Sstevel@tonic-gate 		(void) snprintf(Errmsg, ERRMSGSIZ,
4590Sstevel@tonic-gate 				gettext("in call to getsockname"));
4600Sstevel@tonic-gate 		return(retval);
4610Sstevel@tonic-gate 	}
4620Sstevel@tonic-gate 
4630Sstevel@tonic-gate 	if (cvtkaddr(&ss, &sender_addr) == NULL) {
4640Sstevel@tonic-gate 		retval = errno;
4650Sstevel@tonic-gate 		com_err(progname, errno,
4660Sstevel@tonic-gate 			gettext("while converting socket address"));
4670Sstevel@tonic-gate 		return(retval);
4680Sstevel@tonic-gate 	}
4690Sstevel@tonic-gate 
4700Sstevel@tonic-gate 	return(0);
4710Sstevel@tonic-gate }
4720Sstevel@tonic-gate 
4730Sstevel@tonic-gate 
4740Sstevel@tonic-gate void kerberos_authenticate(context, auth_context, fd, me, new_creds)
4750Sstevel@tonic-gate     krb5_context context;
4760Sstevel@tonic-gate     krb5_auth_context *auth_context;
4770Sstevel@tonic-gate     int	fd;
4780Sstevel@tonic-gate     krb5_principal me;
4790Sstevel@tonic-gate     krb5_creds ** new_creds;
4800Sstevel@tonic-gate {
4810Sstevel@tonic-gate 	krb5_error_code	retval;
4820Sstevel@tonic-gate 	krb5_error	*error = NULL;
4830Sstevel@tonic-gate 	krb5_ap_rep_enc_part	*rep_result;
4840Sstevel@tonic-gate 
4850Sstevel@tonic-gate     if (retval = krb5_auth_con_init(context, auth_context))
4860Sstevel@tonic-gate 	exit(1);
4870Sstevel@tonic-gate 
4880Sstevel@tonic-gate     krb5_auth_con_setflags(context, *auth_context,
4890Sstevel@tonic-gate 			   KRB5_AUTH_CONTEXT_DO_SEQUENCE);
4900Sstevel@tonic-gate 
4910Sstevel@tonic-gate     if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr,
4920Sstevel@tonic-gate 				        &receiver_addr)) {
4930Sstevel@tonic-gate 	com_err(progname, retval, gettext("in krb5_auth_con_setaddrs"));
4940Sstevel@tonic-gate 	exit(1);
4950Sstevel@tonic-gate     }
4960Sstevel@tonic-gate 
4970Sstevel@tonic-gate 	if (retval = krb5_sendauth(context, auth_context, (void *)&fd,
4980Sstevel@tonic-gate 				   kprop_version, me, creds.server,
4990Sstevel@tonic-gate 				   AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
5000Sstevel@tonic-gate 				   &error, &rep_result, new_creds)) {
5010Sstevel@tonic-gate 		com_err(progname, retval, gettext("while authenticating to server"));
5020Sstevel@tonic-gate 		if (error) {
5030Sstevel@tonic-gate 			if (error->error == KRB_ERR_GENERIC) {
5040Sstevel@tonic-gate 				if (error->text.data)
5050Sstevel@tonic-gate 					fprintf(stderr,
5060Sstevel@tonic-gate 						gettext("Generic remote error: %s\n"),
5070Sstevel@tonic-gate 						error->text.data);
5080Sstevel@tonic-gate 			} else if (error->error) {
5090Sstevel@tonic-gate 				com_err(progname,
5100Sstevel@tonic-gate 					error->error + ERROR_TABLE_BASE_krb5,
5110Sstevel@tonic-gate 					gettext("signalled from server"));
5120Sstevel@tonic-gate 				if (error->text.data)
5130Sstevel@tonic-gate 					fprintf(stderr,
5140Sstevel@tonic-gate 					gettext("Error text from server: %s\n"),
5150Sstevel@tonic-gate 						error->text.data);
5160Sstevel@tonic-gate 			}
5170Sstevel@tonic-gate 			krb5_free_error(context, error);
5180Sstevel@tonic-gate 		}
5190Sstevel@tonic-gate 		exit(1);
5200Sstevel@tonic-gate 	}
5210Sstevel@tonic-gate 	krb5_free_ap_rep_enc_part(context, rep_result);
5220Sstevel@tonic-gate }
5230Sstevel@tonic-gate 
5240Sstevel@tonic-gate char * dbpathname;
5250Sstevel@tonic-gate /*
5260Sstevel@tonic-gate  * Open the Kerberos database dump file.  Takes care of locking it
5270Sstevel@tonic-gate  * and making sure that the .ok file is more recent that the database
5280Sstevel@tonic-gate  * dump file itself.
5290Sstevel@tonic-gate  *
5300Sstevel@tonic-gate  * Returns the file descriptor of the database dump file.  Also fills
5310Sstevel@tonic-gate  * in the size of the database file.
5320Sstevel@tonic-gate  */
5330Sstevel@tonic-gate int
5340Sstevel@tonic-gate open_database(context, data_fn, size)
5350Sstevel@tonic-gate     krb5_context context;
5360Sstevel@tonic-gate     char *data_fn;
5370Sstevel@tonic-gate     int	*size;
5380Sstevel@tonic-gate {
5390Sstevel@tonic-gate 	int		fd;
5400Sstevel@tonic-gate 	int		err;
5410Sstevel@tonic-gate 	struct stat 	stbuf, stbuf_ok;
5420Sstevel@tonic-gate 	char		*data_ok_fn;
5430Sstevel@tonic-gate 	static char ok[] = ".dump_ok";
5440Sstevel@tonic-gate 
5450Sstevel@tonic-gate 	dbpathname = strdup(data_fn);
5460Sstevel@tonic-gate 	if (!dbpathname) {
5470Sstevel@tonic-gate  	    com_err(progname, ENOMEM, gettext("allocating database file name '%s'"),
5480Sstevel@tonic-gate  		    data_fn);
5490Sstevel@tonic-gate  	    exit(1);
5500Sstevel@tonic-gate  	}
5510Sstevel@tonic-gate 	if ((fd = open(dbpathname, O_RDONLY)) < 0) {
5520Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to open %s"),
5530Sstevel@tonic-gate 			dbpathname);
5540Sstevel@tonic-gate 		exit(1);
5550Sstevel@tonic-gate 	}
5560Sstevel@tonic-gate 
5570Sstevel@tonic-gate 	err = krb5_lock_file(context, fd,
5580Sstevel@tonic-gate 			     KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
5590Sstevel@tonic-gate 	if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
5600Sstevel@tonic-gate 	    com_err(progname, 0, gettext("database locked"));
5610Sstevel@tonic-gate 	    exit(1);
5620Sstevel@tonic-gate 	} else if (err) {
5630Sstevel@tonic-gate 	    com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname);
5640Sstevel@tonic-gate 	    exit(1);
5650Sstevel@tonic-gate 	}
5660Sstevel@tonic-gate 	if (fstat(fd, &stbuf)) {
5670Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
5680Sstevel@tonic-gate 			data_fn);
5690Sstevel@tonic-gate 		exit(1);
5700Sstevel@tonic-gate 	}
5710Sstevel@tonic-gate 	if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1))
5720Sstevel@tonic-gate 	    == NULL) {
5730Sstevel@tonic-gate 		com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn"));
5740Sstevel@tonic-gate 		exit(1);
5750Sstevel@tonic-gate 	}
5760Sstevel@tonic-gate 	strcpy(data_ok_fn, data_fn);
5770Sstevel@tonic-gate 	strcat(data_ok_fn, ok);
5780Sstevel@tonic-gate 	if (stat(data_ok_fn, &stbuf_ok)) {
5790Sstevel@tonic-gate 		com_err(progname, errno, gettext("while trying to stat %s"),
5800Sstevel@tonic-gate 			data_ok_fn);
5810Sstevel@tonic-gate 		free(data_ok_fn);
5820Sstevel@tonic-gate 		exit(1);
5830Sstevel@tonic-gate 	}
5840Sstevel@tonic-gate 	free(data_ok_fn);
5850Sstevel@tonic-gate 	if (stbuf.st_mtime > stbuf_ok.st_mtime) {
5860Sstevel@tonic-gate 		com_err(progname, 0, gettext("'%s' more recent than '%s'."),
5870Sstevel@tonic-gate 			data_fn, data_ok_fn);
5880Sstevel@tonic-gate 		exit(1);
5890Sstevel@tonic-gate 	}
5900Sstevel@tonic-gate 	*size = stbuf.st_size;
5910Sstevel@tonic-gate 	return(fd);
5920Sstevel@tonic-gate }
5930Sstevel@tonic-gate 
5940Sstevel@tonic-gate void
5950Sstevel@tonic-gate close_database(context, fd)
5960Sstevel@tonic-gate     krb5_context context;
5970Sstevel@tonic-gate     int fd;
5980Sstevel@tonic-gate {
5990Sstevel@tonic-gate     int err;
6000Sstevel@tonic-gate     if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK))
6010Sstevel@tonic-gate 	com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname);
6020Sstevel@tonic-gate     free(dbpathname);
6030Sstevel@tonic-gate     (void)close(fd);
6040Sstevel@tonic-gate     return;
6050Sstevel@tonic-gate }
6060Sstevel@tonic-gate 
6070Sstevel@tonic-gate /*
6080Sstevel@tonic-gate  * Now we send over the database.  We use the following protocol:
6090Sstevel@tonic-gate  * Send over a KRB_SAFE message with the size.  Then we send over the
6100Sstevel@tonic-gate  * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV.
6110Sstevel@tonic-gate  * Then we expect to see a KRB_SAFE message with the size sent back.
6120Sstevel@tonic-gate  *
6130Sstevel@tonic-gate  * At any point in the protocol, we may send a KRB_ERROR message; this
6140Sstevel@tonic-gate  * will abort the entire operation.
6150Sstevel@tonic-gate  */
6160Sstevel@tonic-gate void
6170Sstevel@tonic-gate xmit_database(context, auth_context, my_creds, fd, database_fd, database_size)
6180Sstevel@tonic-gate     krb5_context context;
6190Sstevel@tonic-gate     krb5_auth_context auth_context;
6200Sstevel@tonic-gate     krb5_creds *my_creds;
6210Sstevel@tonic-gate     int	fd;
6220Sstevel@tonic-gate     int	database_fd;
6230Sstevel@tonic-gate     int	database_size;
6240Sstevel@tonic-gate {
6250Sstevel@tonic-gate 	krb5_int32	send_size, sent_size, n;
6260Sstevel@tonic-gate 	krb5_data	inbuf, outbuf;
6270Sstevel@tonic-gate 	char		buf[KPROP_BUFSIZ];
6280Sstevel@tonic-gate 	krb5_error_code	retval;
6290Sstevel@tonic-gate 	krb5_error	*error;
6300Sstevel@tonic-gate 
6310Sstevel@tonic-gate 	/*
6320Sstevel@tonic-gate 	 * Send over the size
6330Sstevel@tonic-gate 	 */
6340Sstevel@tonic-gate 	send_size = htonl(database_size);
6350Sstevel@tonic-gate 	inbuf.data = (char *) &send_size;
6360Sstevel@tonic-gate 	inbuf.length = sizeof(send_size); /* must be 4, really */
6370Sstevel@tonic-gate 	/* KPROP_CKSUMTYPE */
6380Sstevel@tonic-gate 	if (retval = krb5_mk_safe(context, auth_context, &inbuf,
6390Sstevel@tonic-gate 				  &outbuf, NULL)) {
6400Sstevel@tonic-gate 		com_err(progname, retval, gettext("while encoding database size"));
6410Sstevel@tonic-gate 		send_error(context, my_creds, fd, gettext("while encoding database size"), retval);
6420Sstevel@tonic-gate 		exit(1);
6430Sstevel@tonic-gate 	}
6440Sstevel@tonic-gate 	if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) {
6450Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
6460Sstevel@tonic-gate 		com_err(progname, retval, gettext("while sending database size"));
6470Sstevel@tonic-gate 		exit(1);
6480Sstevel@tonic-gate 	}
6490Sstevel@tonic-gate 	krb5_free_data_contents(context, &outbuf);
6500Sstevel@tonic-gate     /*
6510Sstevel@tonic-gate      * Initialize the initial vector.
6520Sstevel@tonic-gate      */
6530Sstevel@tonic-gate     if (retval = krb5_auth_con_initivector(context, auth_context)) {
6540Sstevel@tonic-gate 	send_error(context, my_creds, fd,
6550Sstevel@tonic-gate 		   gettext("failed while initializing i_vector"), retval);
6560Sstevel@tonic-gate 	com_err(progname, retval, gettext("while allocating i_vector"));
6570Sstevel@tonic-gate 	exit(1);
6580Sstevel@tonic-gate     }
6590Sstevel@tonic-gate 	/*
6600Sstevel@tonic-gate 	 * Send over the file, block by block....
6610Sstevel@tonic-gate 	 */
6620Sstevel@tonic-gate 	inbuf.data = buf;
6630Sstevel@tonic-gate 	sent_size = 0;
6640Sstevel@tonic-gate 	while (n = read(database_fd, buf, sizeof(buf))) {
6650Sstevel@tonic-gate 		inbuf.length = n;
6660Sstevel@tonic-gate 		if (retval = krb5_mk_priv(context, auth_context, &inbuf,
6670Sstevel@tonic-gate 					  &outbuf, NULL)) {
6680Sstevel@tonic-gate 			snprintf(buf, sizeof (buf),
6690Sstevel@tonic-gate 				gettext("while encoding database block starting at %d"),
6700Sstevel@tonic-gate 				sent_size);
6710Sstevel@tonic-gate 			com_err(progname, retval, buf);
6720Sstevel@tonic-gate 			send_error(context, my_creds, fd, buf, retval);
6730Sstevel@tonic-gate 			exit(1);
6740Sstevel@tonic-gate 		}
6750Sstevel@tonic-gate 		if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) {
6760Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
6770Sstevel@tonic-gate 			com_err(progname, retval,
6780Sstevel@tonic-gate 				gettext("while sending database block starting at %d"),
6790Sstevel@tonic-gate 				sent_size);
6800Sstevel@tonic-gate 			exit(1);
6810Sstevel@tonic-gate 		}
6820Sstevel@tonic-gate 		krb5_free_data_contents(context, &outbuf);
6830Sstevel@tonic-gate 		sent_size += n;
6840Sstevel@tonic-gate 		if (debug)
6850Sstevel@tonic-gate 			printf(gettext("%d bytes sent.\n"), sent_size);
6860Sstevel@tonic-gate 	}
6870Sstevel@tonic-gate 	if (sent_size != database_size) {
6880Sstevel@tonic-gate 		com_err(progname, 0, gettext("Premature EOF found for database file!"));
6890Sstevel@tonic-gate 		send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"),
6900Sstevel@tonic-gate 			   KRB5KRB_ERR_GENERIC);
6910Sstevel@tonic-gate 		exit(1);
6920Sstevel@tonic-gate 	}
6930Sstevel@tonic-gate 	/*
6940Sstevel@tonic-gate 	 * OK, we've sent the database; now let's wait for a success
6950Sstevel@tonic-gate 	 * indication from the remote end.
6960Sstevel@tonic-gate 	 */
6970Sstevel@tonic-gate 	if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) {
6980Sstevel@tonic-gate 		com_err(progname, retval,
6990Sstevel@tonic-gate 			gettext("while reading response from server"));
7000Sstevel@tonic-gate 		exit(1);
7010Sstevel@tonic-gate 	}
7020Sstevel@tonic-gate 	/*
7030Sstevel@tonic-gate 	 * If we got an error response back from the server, display
7040Sstevel@tonic-gate 	 * the error message
7050Sstevel@tonic-gate 	 */
7060Sstevel@tonic-gate 	if (krb5_is_krb_error(&inbuf)) {
7070Sstevel@tonic-gate 		if (retval = krb5_rd_error(context, &inbuf, &error)) {
7080Sstevel@tonic-gate 			com_err(progname, retval,
7090Sstevel@tonic-gate 				gettext("while decoding error response from server"));
7100Sstevel@tonic-gate 			exit(1);
7110Sstevel@tonic-gate 		}
7120Sstevel@tonic-gate 		if (error->error == KRB_ERR_GENERIC) {
7130Sstevel@tonic-gate 			if (error->text.data)
7140Sstevel@tonic-gate 				fprintf(stderr,
7150Sstevel@tonic-gate 				gettext("Generic remote error: %s\n"),
7160Sstevel@tonic-gate 					error->text.data);
7170Sstevel@tonic-gate 		} else if (error->error) {
7180Sstevel@tonic-gate 			com_err(progname, error->error + ERROR_TABLE_BASE_krb5,
7190Sstevel@tonic-gate 				gettext("signalled from server"));
7200Sstevel@tonic-gate 			if (error->text.data)
7210Sstevel@tonic-gate 				fprintf(stderr,
7220Sstevel@tonic-gate 				gettext("Error text from server: %s\n"),
7230Sstevel@tonic-gate 					error->text.data);
7240Sstevel@tonic-gate 		}
7250Sstevel@tonic-gate 		krb5_free_error(context, error);
7260Sstevel@tonic-gate 		exit(1);
7270Sstevel@tonic-gate 	}
7280Sstevel@tonic-gate 	if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) {
7290Sstevel@tonic-gate 		com_err(progname, retval,
7300Sstevel@tonic-gate 			gettext("while decoding final size packet from server"));
7310Sstevel@tonic-gate 		exit(1);
7320Sstevel@tonic-gate 	}
7330Sstevel@tonic-gate 	memcpy((char *)&send_size, outbuf.data, sizeof(send_size));
7340Sstevel@tonic-gate 	send_size = ntohl(send_size);
7350Sstevel@tonic-gate 	if (send_size != database_size) {
7360Sstevel@tonic-gate 		com_err(progname, 0,
7370Sstevel@tonic-gate 			gettext("Kpropd sent database size %d, expecting %d"),
7380Sstevel@tonic-gate 			send_size, database_size);
7390Sstevel@tonic-gate 		exit(1);
7400Sstevel@tonic-gate 	}
7410Sstevel@tonic-gate 	free(outbuf.data);
7420Sstevel@tonic-gate 	free(inbuf.data);
7430Sstevel@tonic-gate }
7440Sstevel@tonic-gate 
7450Sstevel@tonic-gate void
7460Sstevel@tonic-gate send_error(context, my_creds, fd, err_text, err_code)
7470Sstevel@tonic-gate     krb5_context context;
7480Sstevel@tonic-gate     krb5_creds *my_creds;
7490Sstevel@tonic-gate     int	fd;
7500Sstevel@tonic-gate     char	*err_text;
7510Sstevel@tonic-gate     krb5_error_code	err_code;
7520Sstevel@tonic-gate {
7530Sstevel@tonic-gate 	krb5_error	error;
7540Sstevel@tonic-gate 	const char	*text;
7550Sstevel@tonic-gate 	krb5_data	outbuf;
7560Sstevel@tonic-gate 
7570Sstevel@tonic-gate 	memset((char *)&error, 0, sizeof(error));
7580Sstevel@tonic-gate 	krb5_us_timeofday(context, &error.ctime, &error.cusec);
7590Sstevel@tonic-gate 	error.server = my_creds->server;
7600Sstevel@tonic-gate 	error.client = my_principal;
7610Sstevel@tonic-gate 	error.error = err_code - ERROR_TABLE_BASE_krb5;
7620Sstevel@tonic-gate 	if (error.error > 127)
7630Sstevel@tonic-gate 		error.error = KRB_ERR_GENERIC;
7640Sstevel@tonic-gate 	if (err_text)
7650Sstevel@tonic-gate 		text = err_text;
7660Sstevel@tonic-gate 	else
7670Sstevel@tonic-gate 		text = error_message(err_code);
7680Sstevel@tonic-gate 	error.text.length = strlen(text) + 1;
7690Sstevel@tonic-gate 	if (error.text.data = malloc(error.text.length)) {
7700Sstevel@tonic-gate 		strcpy(error.text.data, text);
7710Sstevel@tonic-gate 		if (!krb5_mk_error(context, &error, &outbuf)) {
7720Sstevel@tonic-gate 			(void) krb5_write_message(context, (void *)&fd,&outbuf);
7730Sstevel@tonic-gate 			krb5_free_data_contents(context, &outbuf);
7740Sstevel@tonic-gate 		}
7750Sstevel@tonic-gate 		free(error.text.data);
7760Sstevel@tonic-gate 	}
7770Sstevel@tonic-gate }
7780Sstevel@tonic-gate 
7790Sstevel@tonic-gate void update_last_prop_file(hostname, file_name)
7800Sstevel@tonic-gate 	char *hostname;
7810Sstevel@tonic-gate 	char *file_name;
7820Sstevel@tonic-gate {
7830Sstevel@tonic-gate 	/* handle slave locking/failure stuff */
7840Sstevel@tonic-gate 	char *file_last_prop;
7850Sstevel@tonic-gate 	int fd;
7860Sstevel@tonic-gate 	static char last_prop[]=".last_prop";
7870Sstevel@tonic-gate 
7880Sstevel@tonic-gate 	if ((file_last_prop = (char *)malloc(strlen(file_name) +
7890Sstevel@tonic-gate 					     strlen(hostname) + 1 +
7900Sstevel@tonic-gate 					     strlen(last_prop) + 1)) == NULL) {
7910Sstevel@tonic-gate 		com_err(progname, ENOMEM,
7920Sstevel@tonic-gate 			gettext("while allocating filename for update_last_prop_file"));
7930Sstevel@tonic-gate 		return;
7940Sstevel@tonic-gate 	}
7950Sstevel@tonic-gate 	strcpy(file_last_prop, file_name);
7960Sstevel@tonic-gate 
7970Sstevel@tonic-gate 	/*
7980Sstevel@tonic-gate 	 * If a nondefault file name was specified then we should not add an
7990Sstevel@tonic-gate 	 * extraneous host name to the file name given that a file name could
8000Sstevel@tonic-gate 	 * have already specified a host name and therefore would be redundant.
8010Sstevel@tonic-gate 	 */
8020Sstevel@tonic-gate 	if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) {
8030Sstevel@tonic-gate 		strcat(file_last_prop, ".");
8040Sstevel@tonic-gate 		strcat(file_last_prop, hostname);
8050Sstevel@tonic-gate 	}
8060Sstevel@tonic-gate 	strcat(file_last_prop, last_prop);
8070Sstevel@tonic-gate 	if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
8080Sstevel@tonic-gate 		com_err(progname, errno,
8090Sstevel@tonic-gate 			gettext("while creating 'last_prop' file, '%s'"),
8100Sstevel@tonic-gate 			file_last_prop);
8110Sstevel@tonic-gate 		free(file_last_prop);
8120Sstevel@tonic-gate 		return;
8130Sstevel@tonic-gate 	}
8140Sstevel@tonic-gate 	write(fd, "", 1);
8150Sstevel@tonic-gate 	free(file_last_prop);
8160Sstevel@tonic-gate 	close(fd);
8170Sstevel@tonic-gate 	return;
8180Sstevel@tonic-gate }
819