2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 static krb5_log_facility
*log_facility
;
39 static char *server_time_lost
= "5 min";
40 static int time_before_lost
;
41 const char *slave_str
= NULL
;
44 connect_to_master (krb5_context context
, const char *master
,
48 struct sockaddr_in addr
;
51 fd
= socket (AF_INET
, SOCK_STREAM
, 0);
53 krb5_err (context
, 1, errno
, "socket AF_INET");
54 memset (&addr
, 0, sizeof(addr
));
55 addr
.sin_family
= AF_INET
;
57 addr
.sin_port
= krb5_getportbyname (context
,
60 if (addr
.sin_port
== 0) {
64 port
= strtol (port_str
, &ptr
, 10);
65 if (port
== 0 && ptr
== port_str
)
66 krb5_errx (context
, 1, "bad port `%s'", port_str
);
67 addr
.sin_port
= htons(port
);
70 addr
.sin_port
= krb5_getportbyname (context
, IPROP_SERVICE
,
73 he
= roken_gethostbyname (master
);
75 krb5_errx (context
, 1, "gethostbyname: %s", hstrerror(h_errno
));
76 memcpy (&addr
.sin_addr
, he
->h_addr
, sizeof(addr
.sin_addr
));
77 if(connect(fd
, (struct sockaddr
*)&addr
, sizeof(addr
)) < 0)
78 krb5_err (context
, 1, errno
, "connect");
83 get_creds(krb5_context context
, const char *keytab_str
,
84 krb5_ccache
*cache
, const char *serverhost
)
87 krb5_principal client
;
89 krb5_get_init_creds_opt
*init_opts
;
94 if (keytab_str
== NULL
) {
95 ret
= krb5_kt_default_name (context
, keytab_buf
, sizeof(keytab_buf
));
97 krb5_err (context
, 1, ret
, "krb5_kt_default_name");
98 keytab_str
= keytab_buf
;
101 ret
= krb5_kt_resolve(context
, keytab_str
, &keytab
);
103 krb5_err(context
, 1, ret
, "%s", keytab_str
);
106 ret
= krb5_sname_to_principal (context
, slave_str
, IPROP_NAME
,
107 KRB5_NT_SRV_HST
, &client
);
108 if (ret
) krb5_err(context
, 1, ret
, "krb5_sname_to_principal");
110 ret
= krb5_get_init_creds_opt_alloc(context
, &init_opts
);
111 if (ret
) krb5_err(context
, 1, ret
, "krb5_get_init_creds_opt_alloc");
113 asprintf (&server
, "%s/%s", IPROP_NAME
, serverhost
);
115 krb5_errx (context
, 1, "malloc: no memory");
117 ret
= krb5_get_init_creds_keytab(context
, &creds
, client
, keytab
,
118 0, server
, init_opts
);
120 krb5_get_init_creds_opt_free(context
, init_opts
);
121 if(ret
) krb5_err(context
, 1, ret
, "krb5_get_init_creds");
123 ret
= krb5_kt_close(context
, keytab
);
124 if(ret
) krb5_err(context
, 1, ret
, "krb5_kt_close");
126 ret
= krb5_cc_gen_new(context
, &krb5_mcc_ops
, cache
);
127 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_gen_new");
129 ret
= krb5_cc_initialize(context
, *cache
, client
);
130 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_initialize");
132 ret
= krb5_cc_store_cred(context
, *cache
, &creds
);
133 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_store_cred");
137 ihave (krb5_context context
, krb5_auth_context auth_context
,
138 int fd
, uint32_t version
)
145 sp
= krb5_storage_from_mem (buf
, 8);
146 krb5_store_int32 (sp
, I_HAVE
);
147 krb5_store_int32 (sp
, version
);
148 krb5_storage_free (sp
);
152 ret
= krb5_write_priv_message(context
, auth_context
, &fd
, &data
);
154 krb5_err (context
, 1, ret
, "krb5_write_priv_message");
158 receive_loop (krb5_context context
,
160 kadm5_server_context
*server_context
)
169 * Seek to the current version of the local database.
172 int32_t len
, timestamp
, tmp
;
175 if(krb5_ret_int32 (sp
, &vers
) != 0)
177 krb5_ret_int32 (sp
, ×tamp
);
178 krb5_ret_int32 (sp
, &tmp
);
180 krb5_ret_int32 (sp
, &len
);
181 if (vers
<= server_context
->log_context
.version
)
182 krb5_storage_seek(sp
, len
+ 8, SEEK_CUR
);
183 } while(vers
<= server_context
->log_context
.version
);
186 * Read up rest of the entires into the memory...
188 left
= krb5_storage_seek (sp
, -16, SEEK_CUR
);
189 right
= krb5_storage_seek (sp
, 0, SEEK_END
);
190 buf
= malloc (right
- left
);
191 if (buf
== NULL
&& (right
- left
) != 0)
192 krb5_errx (context
, 1, "malloc: no memory");
195 * ...and then write them out to the on-disk log.
197 krb5_storage_seek (sp
, left
, SEEK_SET
);
198 krb5_storage_read (sp
, buf
, right
- left
);
199 sret
= write (server_context
->log_context
.log_fd
, buf
, right
-left
);
200 if (sret
!= right
- left
)
201 krb5_err(context
, 1, errno
, "Failed to write log to disk");
202 ret
= fsync (server_context
->log_context
.log_fd
);
204 krb5_err(context
, 1, errno
, "Failed to sync log to disk");
208 * Go back to the startpoint and start to commit the entires to
211 krb5_storage_seek (sp
, left
, SEEK_SET
);
214 int32_t len
, len2
, timestamp
, tmp
;
218 if(krb5_ret_int32 (sp
, &vers
) != 0)
220 ret
= krb5_ret_int32 (sp
, ×tamp
);
221 if (ret
) krb5_errx(context
, 1, "entry %ld: too short", (long)vers
);
222 ret
= krb5_ret_int32 (sp
, &tmp
);
223 if (ret
) krb5_errx(context
, 1, "entry %ld: too short", (long)vers
);
225 ret
= krb5_ret_int32 (sp
, &len
);
226 if (ret
) krb5_errx(context
, 1, "entry %ld: too short", (long)vers
);
228 krb5_errx(context
, 1, "log is corrupted, "
229 "negative length of entry version %ld: %ld",
230 (long)vers
, (long)len
);
231 cur
= krb5_storage_seek(sp
, 0, SEEK_CUR
);
233 krb5_warnx (context
, "replaying entry %d", (int)vers
);
235 ret
= kadm5_log_replay (server_context
,
238 char *s
= krb5_get_error_message(server_context
->context
, ret
);
240 "kadm5_log_replay: %ld. Lost entry entry, "
241 "Database out of sync ?: %s (%d)",
242 (long)vers
, s
? s
: "unknown error", ret
);
248 * Make sure the krb5_log_replay does the right thing wrt
249 * reading out data from the sp.
251 cur2
= krb5_storage_seek(sp
, 0, SEEK_CUR
);
252 if (cur
+ len
!= cur2
)
253 krb5_errx(context
, 1,
254 "kadm5_log_reply version: %ld didn't read the whole entry",
258 if (krb5_ret_int32 (sp
, &len2
) != 0)
259 krb5_errx(context
, 1, "entry %ld: postamble too short", (long)vers
);
260 if(krb5_ret_int32 (sp
, &vers2
) != 0)
261 krb5_errx(context
, 1, "entry %ld: postamble too short", (long)vers
);
264 krb5_errx(context
, 1, "entry %ld: len != len2", (long)vers
);
266 krb5_errx(context
, 1, "entry %ld: vers != vers2", (long)vers
);
273 server_context
->log_context
.version
= vers
;
277 receive (krb5_context context
,
279 kadm5_server_context
*server_context
)
283 ret
= server_context
->db
->hdb_open(context
,
285 O_RDWR
| O_CREAT
, 0600);
287 krb5_err (context
, 1, ret
, "db->open");
289 receive_loop (context
, sp
, server_context
);
291 ret
= server_context
->db
->hdb_close (context
, server_context
->db
);
293 krb5_err (context
, 1, ret
, "db->close");
297 send_im_here (krb5_context context
, int fd
,
298 krb5_auth_context auth_context
)
304 ret
= krb5_data_alloc (&data
, 4);
306 krb5_err (context
, 1, ret
, "send_im_here");
308 sp
= krb5_storage_from_data (&data
);
310 krb5_errx (context
, 1, "krb5_storage_from_data");
311 krb5_store_int32(sp
, I_AM_HERE
);
312 krb5_storage_free(sp
);
314 ret
= krb5_write_priv_message(context
, auth_context
, &fd
, &data
);
315 krb5_data_free(&data
);
318 krb5_err (context
, 1, ret
, "krb5_write_priv_message");
322 receive_everything (krb5_context context
, int fd
,
323 kadm5_server_context
*server_context
,
324 krb5_auth_context auth_context
)
335 krb5_warnx(context
, "receive complete database");
337 asprintf(&dbname
, "%s-NEW", server_context
->db
->hdb_name
);
338 ret
= hdb_create(context
, &mydb
, dbname
);
340 krb5_err(context
,1, ret
, "hdb_create");
343 ret
= hdb_set_master_keyfile (context
,
344 mydb
, server_context
->config
.stash_file
);
346 krb5_err(context
,1, ret
, "hdb_set_master_keyfile");
348 /* I really want to use O_EXCL here, but given that I can't easily clean
349 up on error, I won't */
350 ret
= mydb
->hdb_open(context
, mydb
, O_RDWR
| O_CREAT
| O_TRUNC
, 0600);
352 krb5_err (context
, 1, ret
, "db->open");
356 ret
= krb5_read_priv_message(context
, auth_context
, &fd
, &data
);
359 krb5_err (context
, 1, ret
, "krb5_read_priv_message");
361 sp
= krb5_storage_from_data (&data
);
363 krb5_errx (context
, 1, "krb5_storage_from_data");
364 krb5_ret_int32 (sp
, &opcode
);
365 if (opcode
== ONE_PRINC
) {
369 krb5_storage_free(sp
);
371 fake_data
.data
= (char *)data
.data
+ 4;
372 fake_data
.length
= data
.length
- 4;
374 memset(&entry
, 0, sizeof(entry
));
376 ret
= hdb_value2entry (context
, &fake_data
, &entry
.entry
);
378 krb5_err (context
, 1, ret
, "hdb_value2entry");
379 ret
= mydb
->hdb_store(server_context
->context
,
383 krb5_err (context
, 1, ret
, "hdb_store");
385 hdb_free_entry (context
, &entry
);
386 krb5_data_free (&data
);
387 } else if (opcode
== NOW_YOU_HAVE
)
390 krb5_errx (context
, 1, "strange opcode %d", opcode
);
391 } while (opcode
== ONE_PRINC
);
393 if (opcode
!= NOW_YOU_HAVE
)
394 krb5_errx (context
, 1, "receive_everything: strange %d", opcode
);
396 krb5_ret_int32 (sp
, &vno
);
397 krb5_storage_free(sp
);
399 ret
= kadm5_log_reinit (server_context
);
401 krb5_err(context
, 1, ret
, "kadm5_log_reinit");
403 ret
= kadm5_log_set_version (server_context
, vno
- 1);
405 krb5_err (context
, 1, ret
, "kadm5_log_set_version");
407 ret
= kadm5_log_nop (server_context
);
409 krb5_err (context
, 1, ret
, "kadm5_log_nop");
411 krb5_data_free (&data
);
413 ret
= mydb
->hdb_rename (context
, mydb
, server_context
->db
->hdb_name
);
415 krb5_err (context
, 1, ret
, "db->rename");
417 ret
= mydb
->hdb_close (context
, mydb
);
419 krb5_err (context
, 1, ret
, "db->close");
421 ret
= mydb
->hdb_destroy (context
, mydb
);
423 krb5_err (context
, 1, ret
, "db->destroy");
425 krb5_warnx(context
, "receive complete database, version %ld", (long)vno
);
428 static char *config_file
;
430 static int version_flag
;
431 static int help_flag
;
432 static char *keytab_str
;
433 static char *port_str
;
434 static int detach_from_console
= 0;
436 static struct getargs args
[] = {
437 { "config-file", 'c', arg_string
, &config_file
},
438 { "realm", 'r', arg_string
, &realm
},
439 { "keytab", 'k', arg_string
, &keytab_str
,
440 "keytab to get authentication from", "kspec" },
441 { "time-lost", 0, arg_string
, &server_time_lost
,
442 "time before server is considered lost", "time" },
443 { "port", 0, arg_string
, &port_str
,
444 "port ipropd-slave will connect to", "port"},
445 { "detach", 0, arg_flag
, &detach_from_console
,
446 "detach from console" },
447 { "hostname", 0, arg_string
, &slave_str
,
448 "hostname of slave (if not same as hostname)", "hostname" },
449 { "version", 0, arg_flag
, &version_flag
},
450 { "help", 0, arg_flag
, &help_flag
}
453 static int num_args
= sizeof(args
) / sizeof(args
[0]);
456 main(int argc
, char **argv
)
459 krb5_context context
;
460 krb5_auth_context auth_context
;
462 kadm5_server_context
*server_context
;
463 kadm5_config_params conf
;
466 krb5_principal server
;
472 optidx
= krb5_program_setup(&context
, argc
, argv
, args
, num_args
, NULL
);
475 krb5_std_usage(0, args
, num_args
);
483 if (config_file
== NULL
) {
484 asprintf(&config_file
, "%s/kdc.conf", hdb_db_dir(context
));
485 if (config_file
== NULL
)
486 errx(1, "out of memory");
489 ret
= krb5_prepend_config_files_default(config_file
, &files
);
491 krb5_err(context
, 1, ret
, "getting configuration files");
493 ret
= krb5_set_config_files(context
, files
);
494 krb5_free_config_files(files
);
496 krb5_err(context
, 1, ret
, "reading configuration files");
502 krb5_std_usage(1, args
, num_args
);
506 if (detach_from_console
)
509 krb5_openlog (context
, "ipropd-slave", &log_facility
);
510 krb5_set_warn_dest(context
, log_facility
);
512 ret
= krb5_kt_register(context
, &hdb_kt_ops
);
514 krb5_err(context
, 1, ret
, "krb5_kt_register");
516 time_before_lost
= parse_time (server_time_lost
, "s");
517 if (time_before_lost
< 0)
518 krb5_errx (context
, 1, "couldn't parse time: %s", server_time_lost
);
520 memset(&conf
, 0, sizeof(conf
));
522 conf
.mask
|= KADM5_CONFIG_REALM
;
525 ret
= kadm5_init_with_password_ctx (context
,
532 krb5_err (context
, 1, ret
, "kadm5_init_with_password_ctx");
534 server_context
= (kadm5_server_context
*)kadm_handle
;
536 ret
= kadm5_log_init (server_context
);
538 krb5_err (context
, 1, ret
, "kadm5_log_init");
540 get_creds(context
, keytab_str
, &ccache
, master
);
542 master_fd
= connect_to_master (context
, master
, port_str
);
544 ret
= krb5_sname_to_principal (context
, master
, IPROP_NAME
,
545 KRB5_NT_SRV_HST
, &server
);
547 krb5_err (context
, 1, ret
, "krb5_sname_to_principal");
550 ret
= krb5_sendauth (context
, &auth_context
, &master_fd
,
551 IPROP_VERSION
, NULL
, server
,
552 AP_OPTS_MUTUAL_REQUIRED
, NULL
, NULL
,
553 ccache
, NULL
, NULL
, NULL
);
555 krb5_err (context
, 1, ret
, "krb5_sendauth");
557 krb5_warnx(context
, "ipropd-slave started at version: %ld",
558 (long)server_context
->log_context
.version
);
560 ihave (context
, auth_context
, master_fd
,
561 server_context
->log_context
.version
);
563 while (exit_flag
== 0) {
570 if (master_fd
>= FD_SETSIZE
)
571 krb5_errx (context
, 1, "fd too large");
574 FD_SET(master_fd
, &readset
);
576 to
.tv_sec
= time_before_lost
;
579 ret
= select (master_fd
+ 1,
580 &readset
, NULL
, NULL
, &to
);
585 krb5_err (context
, 1, errno
, "select");
588 krb5_errx (context
, 1, "server didn't send a message "
589 "in %d seconds", time_before_lost
);
591 ret
= krb5_read_priv_message(context
, auth_context
, &master_fd
, &out
);
594 krb5_err (context
, 1, ret
, "krb5_read_priv_message");
596 sp
= krb5_storage_from_mem (out
.data
, out
.length
);
597 krb5_ret_int32 (sp
, &tmp
);
600 receive (context
, sp
, server_context
);
601 ihave (context
, auth_context
, master_fd
,
602 server_context
->log_context
.version
);
604 case TELL_YOU_EVERYTHING
:
605 receive_everything (context
, master_fd
, server_context
,
609 send_im_here (context
, master_fd
, auth_context
);
616 krb5_warnx (context
, "Ignoring command %d", tmp
);
619 krb5_storage_free (sp
);
620 krb5_data_free (&out
);
623 if(exit_flag
== SIGXCPU
)
624 krb5_warnx(context
, "%s CPU time limit exceeded", getprogname());
625 else if(exit_flag
== SIGINT
|| exit_flag
== SIGTERM
)
626 krb5_warnx(context
, "%s terminated", getprogname());
628 krb5_warnx(context
, "%s unexpected exit reason: %ld",
629 getprogname(), (long)exit_flag
);