kuser/kinit.c

   1 /*
   2  * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37
  38 #ifdef HAVE_FRAMEWORK_SECURITY
  39 #include <Security/Security.h>
  40 #endif
  41
  42 #ifndef NO_NTLM
  43 #include "heimntlm.h"
  44 #endif
  45
  46 #ifndef SIGINFO
  47 #define SIGINFO SIGUSR1
  48 #endif
  49
  50 int forwardable_flag    = -1;
  51 int proxiable_flag      = -1;
  52 int renewable_flag      = -1;
  53 int renew_flag          = 0;
  54 int pac_flag            = -1;
  55 int validate_flag       = 0;
  56 int version_flag        = 0;
  57 int help_flag           = 0;
  58 int addrs_flag          = -1;
  59 struct getarg_strings extra_addresses;
  60 int anonymous_flag      = 0;
  61 char *lifetime          = NULL;
  62 char *renew_life        = NULL;
  63 char *server_str        = NULL;
  64 static krb5_principal tgs_service;
  65 char *cred_cache        = NULL;
  66 char *start_str         = NULL;
  67 static int switch_cache_flags = 1;
  68 struct getarg_strings etype_str;
  69 int use_keytab          = 0;
  70 char *keytab_str        = NULL;
  71 static krb5_keytab kt   = NULL;
  72 int do_afslog           = -1;
  73 int fcache_version;
  74 char *password_file     = NULL;
  75 char *pk_user_id        = NULL;
  76 int pk_enterprise_flag = 0;
  77 struct hx509_certs_data *ent_user_id = NULL;
  78 char *pk_x509_anchors   = NULL;
  79 int pk_use_enckey       = 0;
  80 static int canonicalize_flag = 0;
  81 static int enterprise_flag = 0;
  82 static int ok_as_delegate_flag = 0;
  83 static char *fast_armor_cache_string = NULL;
  84 static int use_referrals_flag = 0;
  85 static int windows_flag = 0;
  86 #ifndef NO_NTLM
  87 static char *ntlm_domain;
  88 #endif
  89
  90
  91 static struct getargs args[] = {
  92     /*
  93      * used by MIT
  94      * a: ~A
  95      * V: verbose
  96      * F: ~f
  97      * P: ~p
  98      * C: v4 cache name?
  99      * 5:
 100      *
 101      * old flags
 102      * 4:
 103      * 9:
 104      */
 105     { "afslog",         0  , arg_flag, &do_afslog,
 106       NP_("obtain afs tokens", ""), NULL },
 107
 108     { "cache",          'c', arg_string, &cred_cache,
 109       NP_("credentials cache", ""), "cachename" },
 110
 111     { "forwardable",    'F', arg_negative_flag, &forwardable_flag,
 112       NP_("get tickets not forwardable", ""), NULL },
 113
 114     { NULL,             'f', arg_flag, &forwardable_flag,
 115       NP_("get forwardable tickets", ""), NULL },
 116
 117     { "keytab",         't', arg_string, &keytab_str,
 118       NP_("keytab to use", ""), "keytabname" },
 119
 120     { "lifetime",       'l', arg_string, &lifetime,
 121       NP_("lifetime of tickets", ""), "time" },
 122
 123     { "proxiable",      'p', arg_flag, &proxiable_flag,
 124       NP_("get proxiable tickets", ""), NULL },
 125
 126     { "renew",          'R', arg_flag, &renew_flag,
 127       NP_("renew TGT", ""), NULL },
 128
 129     { "renewable",      0,   arg_flag, &renewable_flag,
 130       NP_("get renewable tickets", ""), NULL },
 131
 132     { "renewable-life", 'r', arg_string, &renew_life,
 133       NP_("renewable lifetime of tickets", ""), "time" },
 134
 135     { "server",         'S', arg_string, &server_str,
 136       NP_("server to get ticket for", ""), "principal" },
 137
 138     { "start-time",     's', arg_string, &start_str,
 139       NP_("when ticket gets valid", ""), "time" },
 140
 141     { "use-keytab",     'k', arg_flag, &use_keytab,
 142       NP_("get key from keytab", ""), NULL },
 143
 144     { "validate",       'v', arg_flag, &validate_flag,
 145       NP_("validate TGT", ""), NULL },
 146
 147     { "enctypes",       'e', arg_strings, &etype_str,
 148       NP_("encryption types to use", ""), "enctypes" },
 149
 150     { "fcache-version", 0,   arg_integer, &fcache_version,
 151       NP_("file cache version to create", ""), NULL },
 152
 153     { "addresses",      'A',   arg_negative_flag,       &addrs_flag,
 154       NP_("request a ticket with no addresses", ""), NULL },
 155
 156     { "extra-addresses",'a', arg_strings,       &extra_addresses,
 157       NP_("include these extra addresses", ""), "addresses" },
 158
 159     { "anonymous",      'n',   arg_flag,        &anonymous_flag,
 160       NP_("request an anonymous ticket", ""), NULL },
 161
 162     { "request-pac",    0,   arg_flag,  &pac_flag,
 163       NP_("request a Windows PAC", ""), NULL },
 164
 165     { "password-file",  0,   arg_string, &password_file,
 166       NP_("read the password from a file", ""), NULL },
 167
 168     { "canonicalize",0,   arg_flag, &canonicalize_flag,
 169       NP_("canonicalize client principal", ""), NULL },
 170
 171     { "enterprise",0,   arg_flag, &enterprise_flag,
 172       NP_("parse principal as a KRB5-NT-ENTERPRISE name", ""), NULL },
 173 #ifdef PKINIT
 174     { "pk-enterprise",  0,      arg_flag,       &pk_enterprise_flag,
 175       NP_("use enterprise name from certificate", ""), NULL },
 176
 177     { "pk-user",        'C',    arg_string,     &pk_user_id,
 178       NP_("principal's public/private/certificate identifier", ""), "id" },
 179
 180     { "x509-anchors",   'D',  arg_string, &pk_x509_anchors,
 181       NP_("directory with CA certificates", ""), "directory" },
 182
 183     { "pk-use-enckey",  0,  arg_flag, &pk_use_enckey,
 184       NP_("Use RSA encrypted reply (instead of DH)", ""), NULL },
 185 #endif
 186 #ifndef NO_NTLM
 187     { "ntlm-domain",    0,  arg_string, &ntlm_domain,
 188       NP_("NTLM domain", ""), "domain" },
 189 #endif
 190
 191     { "change-default",  0,  arg_negative_flag, &switch_cache_flags,
 192       NP_("switch the default cache to the new credentials cache", ""), NULL },
 193
 194     { "ok-as-delegate", 0,  arg_flag, &ok_as_delegate_flag,
 195       NP_("honor ok-as-delegate on tickets", ""), NULL },
 196
 197     { "fast-armor-cache",       0,  arg_string, &fast_armor_cache_string,
 198       NP_("use this credential cache as FAST armor cache", ""), "cache" },
 199
 200     { "use-referrals",  0,  arg_flag, &use_referrals_flag,
 201       NP_("only use referrals, no dns canalisation", ""), NULL },
 202
 203     { "windows",        0,  arg_flag, &windows_flag,
 204       NP_("get windows behavior", ""), NULL },
 205
 206     { "version",        0,   arg_flag, &version_flag, NULL, NULL },
 207     { "help",           0,   arg_flag, &help_flag, NULL, NULL }
 208 };
 209
 210 static char *
 211 get_default_realm(krb5_context context);
 212
 213 static void
 214 usage(int ret)
 215 {
 216     arg_printusage_i18n(args, sizeof(args)/sizeof(*args), N_("Usage: ", ""),
 217                         NULL, "[principal [command]]", getarg_i18n);
 218     exit(ret);
 219 }
 220
 221 static krb5_error_code
 222 tgs_principal(krb5_context context,
 223           krb5_ccache cache,
 224           krb5_principal client,
 225           krb5_const_realm tgs_realm,
 226           krb5_principal *out_princ)
 227 {
 228     krb5_error_code ret;
 229     krb5_principal tgs_princ;
 230     krb5_creds creds;
 231     krb5_creds *tick;
 232     krb5_flags options;
 233
 234     ret = krb5_make_principal(context, &tgs_princ, tgs_realm,
 235                               KRB5_TGS_NAME, tgs_realm, NULL);
 236     if (ret)
 237         return ret;
 238
 239     /*
 240      * Don't fail-over to a different realm just because a TGT expired
 241      */
 242     options = KRB5_GC_CACHED | KRB5_GC_EXPIRED_OK;
 243
 244     memset(&creds, 0, sizeof(creds));
 245     creds.client = client;
 246     creds.server = tgs_princ;
 247     ret = krb5_get_credentials(context, options, cache, &creds, &tick);
 248     if (ret == 0) {
 249         krb5_free_creds(context, tick);
 250         *out_princ = tgs_princ;
 251     } else {
 252         krb5_free_principal(context, tgs_princ);
 253     }
 254
 255     return ret;
 256 }
 257
 258
 259 /*
 260  * Try TGS specified with '-S',
 261  * then TGS of client realm,
 262  * then if fallback is FALSE: fail,
 263  * otherwise try TGS of default realm,
 264  * and finally first TGT in ccache.
 265  */
 266 static krb5_error_code
 267 get_server(krb5_context context,
 268            krb5_ccache cache,
 269            krb5_principal client,
 270            const char *server,
 271            krb5_boolean fallback,
 272            krb5_principal *princ)
 273 {
 274     krb5_error_code ret = 0;
 275     krb5_const_realm realm;
 276     krb5_realm def_realm;
 277     krb5_cc_cursor cursor;
 278     krb5_creds creds;
 279     const char *pcomp;
 280
 281     if (tgs_service)
 282         goto done;
 283
 284     if (server) {
 285         ret = krb5_parse_name(context, server, &tgs_service);
 286         goto done;
 287     }
 288
 289     /* Try the client realm first */
 290     realm = krb5_principal_get_realm(context, client);
 291     ret = tgs_principal(context, cache, client, realm, &tgs_service);
 292     if (ret == 0 || ret != KRB5_CC_NOTFOUND)
 293         goto done;
 294
 295     if (!fallback)
 296         return ret;
 297
 298     /* Next try the default realm */
 299     ret = krb5_get_default_realm(context, &def_realm);
 300     if (ret)
 301         return ret;
 302     ret = tgs_principal(context, cache, client, def_realm, &tgs_service);
 303     free(def_realm);
 304     if (ret == 0 || ret != KRB5_CC_NOTFOUND)
 305         goto done;
 306
 307     /* Finally try the first TGT with instance == realm in the cache */
 308     ret = krb5_cc_start_seq_get(context, cache, &cursor);
 309     if (ret)
 310         return ret;
 311
 312     for (/**/; ret == 0; krb5_free_cred_contents (context, &creds)) {
 313
 314         ret = krb5_cc_next_cred(context, cache, &cursor, &creds);
 315         if (ret)
 316             break;
 317         if (creds.server->name.name_string.len != 2)
 318             continue;
 319         pcomp = krb5_principal_get_comp_string(context, creds.server, 0);
 320         if (strcmp(pcomp, KRB5_TGS_NAME) != 0)
 321             continue;
 322         realm = krb5_principal_get_realm(context, creds.server);
 323         pcomp = krb5_principal_get_comp_string(context, creds.server, 1);
 324         if (strcmp(realm, pcomp) != 0)
 325             continue;
 326         ret = krb5_copy_principal(context, creds.server, &tgs_service);
 327         break;
 328     }
 329     if (ret == KRB5_CC_END) {
 330         ret = KRB5_CC_NOTFOUND;
 331         krb5_set_error_message(context, ret,
 332                                N_("Credential cache contains no TGTs", ""));
 333     }
 334     krb5_cc_end_seq_get(context, cache, &cursor);
 335
 336 done:
 337     if (!ret)
 338         ret = krb5_copy_principal(context, tgs_service, princ);
 339     return ret;
 340 }
 341
 342 static krb5_error_code
 343 copy_configs(krb5_context context,
 344              krb5_ccache dst,
 345              krb5_ccache src,
 346              krb5_principal start_ticket_server)
 347 {
 348     krb5_error_code ret;
 349     const char *cfg_names[] = {"realm-config", "FriendlyName", "anon_pkinit_realm", NULL};
 350     const char *cfg_names_w_pname[] = {"fast_avail", NULL};
 351     krb5_data cfg_data;
 352     size_t i;
 353
 354     for (i = 0; cfg_names[i]; i++) {
 355         ret = krb5_cc_get_config(context, src, NULL, cfg_names[i], &cfg_data);
 356         if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
 357             continue;
 358         } else if (ret) {
 359             krb5_warn(context, ret, "krb5_cc_get_config");
 360             return ret;
 361         }
 362         ret = krb5_cc_set_config(context, dst, NULL, cfg_names[i], &cfg_data);
 363         if (ret)
 364             krb5_warn(context, ret, "krb5_cc_set_config");
 365     }
 366     for (i = 0; start_ticket_server && cfg_names_w_pname[i]; i++) {
 367         ret = krb5_cc_get_config(context, src, start_ticket_server,
 368                                  cfg_names_w_pname[i], &cfg_data);
 369         if (ret == KRB5_CC_NOTFOUND || ret == KRB5_CC_END) {
 370             continue;
 371         } else if (ret) {
 372             krb5_warn(context, ret, "krb5_cc_get_config");
 373             return ret;
 374         }
 375         ret = krb5_cc_set_config(context, dst, start_ticket_server,
 376                                  cfg_names_w_pname[i], &cfg_data);
 377         if (ret && ret != KRB5_CC_NOTFOUND)
 378             krb5_warn(context, ret, "krb5_cc_set_config");
 379     }
 380     /*
 381      * We don't copy cc configs for any other principals though (mostly
 382      * those are per-target time offsets and the like, so it's bad to
 383      * lose them, but hardly the end of the world, and as they may not
 384      * expire anyways, it's good to let them go).
 385      */
 386     return 0;
 387 }
 388
 389 static krb5_error_code
 390 get_anon_pkinit_tgs_name(krb5_context context,
 391                          krb5_ccache ccache,
 392                          krb5_principal *tgs_name)
 393 {
 394     krb5_error_code ret;
 395     krb5_data data;
 396     char *realm;
 397
 398     ret = krb5_cc_get_config(context, ccache, NULL, "anon_pkinit_realm", &data);
 399     if (ret == 0)
 400         realm = strndup(data.data, data.length);
 401     else
 402         realm = get_default_realm(context);
 403
 404     krb5_data_free(&data);
 405
 406     if (realm == NULL)
 407         return krb5_enomem(context);
 408
 409     ret = krb5_make_principal(context, tgs_name, realm,
 410                               KRB5_TGS_NAME, realm, NULL);
 411
 412     free(realm);
 413
 414     return ret;
 415 }
 416
 417 static krb5_error_code
 418 renew_validate(krb5_context context,
 419                int renew,
 420                int validate,
 421                krb5_ccache cache,
 422                const char *server,
 423                krb5_deltat life)
 424 {
 425     krb5_error_code ret;
 426     krb5_ccache tempccache = NULL;
 427     krb5_creds in, *out = NULL;
 428     krb5_kdc_flags flags;
 429
 430     memset(&in, 0, sizeof(in));
 431
 432     ret = krb5_cc_get_principal(context, cache, &in.client);
 433     if (ret) {
 434         krb5_warn(context, ret, "krb5_cc_get_principal");
 435         return ret;
 436     }
 437
 438     if (server == NULL &&
 439         krb5_principal_is_anonymous(context, in.client,
 440                                     KRB5_ANON_MATCH_UNAUTHENTICATED))
 441         ret = get_anon_pkinit_tgs_name(context, cache, &in.server);
 442     else
 443         ret = get_server(context, cache, in.client, server, TRUE, &in.server);
 444     if (ret) {
 445         krb5_warn(context, ret, "get_server");
 446         goto out;
 447     }
 448
 449     if (renew) {
 450         /*
 451          * no need to check the error here, it's only to be
 452          * friendly to the user
 453          */
 454         krb5_get_credentials(context, KRB5_GC_CACHED, cache, &in, &out);
 455     }
 456
 457     flags.i = 0;
 458     flags.b.renewable         = flags.b.renew = renew;
 459     flags.b.validate          = validate;
 460
 461     if (forwardable_flag != -1)
 462         flags.b.forwardable       = forwardable_flag;
 463     else if (out)
 464         flags.b.forwardable       = out->flags.b.forwardable;
 465
 466     if (proxiable_flag != -1)
 467         flags.b.proxiable         = proxiable_flag;
 468     else if (out)
 469         flags.b.proxiable         = out->flags.b.proxiable;
 470
 471     if (anonymous_flag)
 472         flags.b.request_anonymous = anonymous_flag;
 473     if (life)
 474         in.times.endtime = time(NULL) + life;
 475
 476     if (out) {
 477         krb5_free_creds(context, out);
 478         out = NULL;
 479     }
 480
 481
 482     ret = krb5_get_kdc_cred(context,
 483                             cache,
 484                             flags,
 485                             NULL,
 486                             NULL,
 487                             &in,
 488                             &out);
 489     if (ret) {
 490         krb5_warn(context, ret, "krb5_get_kdc_cred");
 491         goto out;
 492     }
 493
 494     ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, cache),
 495                              NULL, &tempccache);
 496     if (ret) {
 497         krb5_warn(context, ret, "krb5_cc_new_unique");
 498         goto out;
 499     }
 500
 501     ret = krb5_cc_initialize(context, tempccache, in.client);
 502     if (ret) {
 503         krb5_warn(context, ret, "krb5_cc_initialize");
 504         goto out;
 505     }
 506
 507     ret = krb5_cc_store_cred(context, tempccache, out);
 508     if (ret) {
 509         krb5_warn(context, ret, "krb5_cc_store_cred");
 510         goto out;
 511     }
 512
 513     /*
 514      * We want to preserve cc configs as some are security-relevant, and
 515      * anyways it's the friendly thing to do.
 516      */
 517     ret = copy_configs(context, tempccache, cache, out->server);
 518     if (ret)
 519         goto out;
 520
 521     ret = krb5_cc_move(context, tempccache, cache);
 522     if (ret) {
 523         krb5_warn(context, ret, "krb5_cc_move");
 524         goto out;
 525     }
 526     tempccache = NULL;
 527
 528 out:
 529     if (tempccache)
 530         krb5_cc_destroy(context, tempccache);
 531     if (out)
 532         krb5_free_creds(context, out);
 533     krb5_free_cred_contents(context, &in);
 534     return ret;
 535 }
 536
 537 #ifndef NO_NTLM
 538
 539 static krb5_error_code
 540 store_ntlmkey(krb5_context context, krb5_ccache id,
 541               const char *domain, struct ntlm_buf *buf)
 542 {
 543     krb5_error_code ret;
 544     krb5_data data;
 545     char *name;
 546     int aret;
 547
 548     ret = krb5_cc_get_config(context, id, NULL, "default-ntlm-domain", &data);
 549     if (ret == 0) {
 550         krb5_data_free(&data);
 551     } else {
 552         data.length = strlen(domain);
 553         data.data = rk_UNCONST(domain);
 554         ret = krb5_cc_set_config(context, id, NULL, "default-ntlm-domain", &data);
 555         if (ret != 0)
 556             return ret;
 557     }
 558
 559     aret = asprintf(&name, "ntlm-key-%s", domain);
 560     if (aret == -1 || name == NULL)
 561         return krb5_enomem(context);
 562
 563     data.length = buf->length;
 564     data.data = buf->data;
 565
 566     ret = krb5_cc_set_config(context, id, NULL, name, &data);
 567     free(name);
 568     return ret;
 569 }
 570 #endif
 571
 572 static krb5_error_code
 573 get_new_tickets(krb5_context context,
 574                 krb5_principal principal,
 575                 krb5_ccache ccache,
 576                 krb5_deltat ticket_life,
 577                 int interactive,
 578                 int anonymous_pkinit)
 579 {
 580     krb5_error_code ret;
 581     krb5_creds cred;
 582     char passwd[256];
 583     krb5_deltat start_time = 0;
 584     krb5_deltat renew = 0;
 585     const char *renewstr = NULL;
 586     krb5_enctype *enctype = NULL;
 587     krb5_ccache tempccache = NULL;
 588     krb5_init_creds_context ctx = NULL;
 589     krb5_get_init_creds_opt *opt = NULL;
 590     krb5_prompter_fct prompter = krb5_prompter_posix;
 591 #ifndef NO_NTLM
 592     struct ntlm_buf ntlmkey;
 593     memset(&ntlmkey, 0, sizeof(ntlmkey));
 594 #endif
 595     passwd[0] = '\0';
 596
 597     if (!interactive)
 598         prompter = NULL;
 599
 600     if (password_file) {
 601         FILE *f;
 602
 603         if (strcasecmp("STDIN", password_file) == 0)
 604             f = stdin;
 605         else
 606             f = fopen(password_file, "r");
 607         if (f == NULL) {
 608             krb5_warnx(context, N_("Failed to open the password file %s", ""),
 609                        password_file);
 610             return errno;
 611         }
 612
 613         if (fgets(passwd, sizeof(passwd), f) == NULL) {
 614             krb5_warnx(context, N_("Failed to read password from file %s", ""),
 615                        password_file);
 616             if (f != stdin)
 617                 fclose(f);
 618             return EINVAL; /* XXX Need a better error */
 619         }
 620         if (f != stdin)
 621             fclose(f);
 622         passwd[strcspn(passwd, "\n")] = '\0';
 623     }
 624
 625 #ifdef HAVE_FRAMEWORK_SECURITY
 626     if (passwd[0] == '\0') {
 627         const char *realm;
 628         OSStatus osret;
 629         UInt32 length;
 630         void *buffer;
 631         char *name;
 632
 633         realm = krb5_principal_get_realm(context, principal);
 634
 635         ret = krb5_unparse_name_flags(context, principal,
 636                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &name);
 637         if (ret)
 638             goto nopassword;
 639
 640         osret = SecKeychainFindGenericPassword(NULL, strlen(realm), realm,
 641                                                strlen(name), name,
 642                                                &length, &buffer, NULL);
 643         free(name);
 644         if (osret == noErr && length < sizeof(passwd) - 1) {
 645             memcpy(passwd, buffer, length);
 646             passwd[length] = '\0';
 647         }
 648     nopassword:
 649         do { } while(0);
 650     }
 651 #endif
 652
 653     memset(&cred, 0, sizeof(cred));
 654
 655     ret = krb5_get_init_creds_opt_alloc(context, &opt);
 656     if (ret) {
 657         krb5_warn(context, ret, "krb5_get_init_creds_opt_alloc");
 658         goto out;
 659     }
 660
 661     krb5_get_init_creds_opt_set_default_flags(context, "kinit",
 662         krb5_principal_get_realm(context, principal), opt);
 663
 664     if (forwardable_flag != -1)
 665         krb5_get_init_creds_opt_set_forwardable(opt, forwardable_flag);
 666     if (proxiable_flag != -1)
 667         krb5_get_init_creds_opt_set_proxiable(opt, proxiable_flag);
 668     if (anonymous_flag)
 669         krb5_get_init_creds_opt_set_anonymous(opt, anonymous_flag);
 670     if (pac_flag != -1)
 671         krb5_get_init_creds_opt_set_pac_request(context, opt,
 672                                                 pac_flag ? TRUE : FALSE);
 673     if (canonicalize_flag)
 674         krb5_get_init_creds_opt_set_canonicalize(context, opt, TRUE);
 675     if (pk_enterprise_flag || enterprise_flag || canonicalize_flag || windows_flag)
 676         krb5_get_init_creds_opt_set_win2k(context, opt, TRUE);
 677     if (pk_user_id || ent_user_id || anonymous_pkinit) {
 678         ret = krb5_get_init_creds_opt_set_pkinit(context, opt,
 679                                                  principal,
 680                                                  pk_user_id,
 681                                                  pk_x509_anchors,
 682                                                  NULL,
 683                                                  NULL,
 684                                                  pk_use_enckey ? KRB5_GIC_OPT_PKINIT_USE_ENCKEY : 0 |
 685                                                  anonymous_pkinit ? KRB5_GIC_OPT_PKINIT_ANONYMOUS : 0,
 686                                                  prompter,
 687                                                  NULL,
 688                                                  passwd);
 689         if (ret) {
 690             krb5_warn(context, ret, "krb5_get_init_creds_opt_set_pkinit");
 691             goto out;
 692         }
 693         if (ent_user_id)
 694             krb5_get_init_creds_opt_set_pkinit_user_certs(context, opt, ent_user_id);
 695     }
 696
 697     if (addrs_flag != -1)
 698         krb5_get_init_creds_opt_set_addressless(context, opt,
 699                                                 addrs_flag ? FALSE : TRUE);
 700
 701     if (renew_life == NULL && renewable_flag)
 702         renewstr = "6 months";
 703     if (renew_life)
 704         renewstr = renew_life;
 705     if (renewstr) {
 706         renew = parse_time(renewstr, "s");
 707         if (renew < 0)
 708             errx(1, "unparsable time: %s", renewstr);
 709
 710         krb5_get_init_creds_opt_set_renew_life(opt, renew);
 711     }
 712
 713     if (ticket_life != 0)
 714         krb5_get_init_creds_opt_set_tkt_life(opt, ticket_life);
 715
 716     if (start_str) {
 717         int tmp = parse_time(start_str, "s");
 718         if (tmp < 0)
 719             errx(1, N_("unparsable time: %s", ""), start_str);
 720
 721         start_time = tmp;
 722     }
 723
 724     if (etype_str.num_strings) {
 725         int i;
 726
 727         enctype = malloc(etype_str.num_strings * sizeof(*enctype));
 728         if (enctype == NULL)
 729             errx(1, "out of memory");
 730         for(i = 0; i < etype_str.num_strings; i++) {
 731             ret = krb5_string_to_enctype(context,
 732                                          etype_str.strings[i],
 733                                          &enctype[i]);
 734             if (ret)
 735                 errx(1, "unrecognized enctype: %s", etype_str.strings[i]);
 736         }
 737         krb5_get_init_creds_opt_set_etype_list(opt, enctype,
 738                                                etype_str.num_strings);
 739     }
 740
 741     ret = krb5_init_creds_init(context, principal, prompter, NULL, start_time, opt, &ctx);
 742     if (ret) {
 743         krb5_warn(context, ret, "krb5_init_creds_init");
 744         goto out;
 745     }
 746
 747     if (server_str) {
 748         ret = krb5_init_creds_set_service(context, ctx, server_str);
 749         if (ret) {
 750             krb5_warn(context, ret, "krb5_init_creds_set_service");
 751             goto out;
 752         }
 753     }
 754
 755     if (fast_armor_cache_string) {
 756         krb5_ccache fastid;
 757
 758         ret = krb5_cc_resolve(context, fast_armor_cache_string, &fastid);
 759         if (ret) {
 760             krb5_warn(context, ret, "krb5_cc_resolve(FAST cache)");
 761             goto out;
 762         }
 763
 764         ret = krb5_init_creds_set_fast_ccache(context, ctx, fastid);
 765         if (ret) {
 766             krb5_warn(context, ret, "krb5_init_creds_set_fast_ccache");
 767             goto out;
 768         }
 769     }
 770
 771     if (use_keytab || keytab_str) {
 772         ret = krb5_init_creds_set_keytab(context, ctx, kt);
 773         if (ret) {
 774             krb5_warn(context, ret, "krb5_init_creds_set_keytab");
 775             goto out;
 776         }
 777     } else if (pk_user_id || ent_user_id ||
 778                krb5_principal_is_anonymous(context, principal, KRB5_ANON_MATCH_ANY)) {
 779         /* nop */;
 780     } else if (!interactive && passwd[0] == '\0') {
 781         static int already_warned = 0;
 782
 783         if (!already_warned)
 784             krb5_warnx(context, "Not interactive, failed to get "
 785               "initial ticket");
 786         krb5_get_init_creds_opt_free(context, opt);
 787         already_warned = 1;
 788         return 0;
 789     } else {
 790
 791         if (passwd[0] == '\0') {
 792             char *p, *prompt;
 793             int aret = 0;
 794
 795             ret = krb5_unparse_name(context, principal, &p);
 796             if (ret)
 797                 errx(1, "failed to generate passwd prompt: not enough memory");
 798
 799             aret = asprintf(&prompt, N_("%s's Password: ", ""), p);
 800             free(p);
 801             if (aret == -1)
 802                 errx(1, "failed to generate passwd prompt: not enough memory");
 803
 804             if (UI_UTIL_read_pw_string(passwd, sizeof(passwd)-1, prompt, 0)){
 805                 memset(passwd, 0, sizeof(passwd));
 806                 errx(1, "failed to read password");
 807             }
 808             free(prompt);
 809         }
 810
 811         if (passwd[0]) {
 812             ret = krb5_init_creds_set_password(context, ctx, passwd);
 813             if (ret) {
 814                 krb5_warn(context, ret, "krb5_init_creds_set_password");
 815                 goto out;
 816             }
 817         }
 818     }
 819
 820     ret = krb5_init_creds_get(context, ctx);
 821
 822 #ifndef NO_NTLM
 823     if (ntlm_domain && passwd[0])
 824         heim_ntlm_nt_key(passwd, &ntlmkey);
 825 #endif
 826     memset_s(passwd, sizeof(passwd), 0, sizeof(passwd));
 827
 828     switch(ret){
 829     case 0:
 830         break;
 831     case KRB5_LIBOS_PWDINTR: /* don't print anything if it was just C-c:ed */
 832         exit(1);
 833     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 834     case KRB5KRB_AP_ERR_MODIFIED:
 835     case KRB5KDC_ERR_PREAUTH_FAILED:
 836     case KRB5_GET_IN_TKT_LOOP:
 837         krb5_warnx(context, N_("Password incorrect", ""));
 838         goto out;
 839     case KRB5KRB_AP_ERR_V4_REPLY:
 840         krb5_warnx(context, N_("Looks like a Kerberos 4 reply", ""));
 841         goto out;
 842     case KRB5KDC_ERR_KEY_EXPIRED:
 843         krb5_warnx(context, N_("Password expired", ""));
 844         goto out;
 845     default:
 846         krb5_warn(context, ret, "krb5_get_init_creds");
 847         goto out;
 848     }
 849
 850     krb5_process_last_request(context, opt, ctx);
 851
 852     ret = krb5_init_creds_get_creds(context, ctx, &cred);
 853     if (ret) {
 854         krb5_warn(context, ret, "krb5_init_creds_get_creds");
 855         goto out;
 856     }
 857
 858     if (ticket_life != 0) {
 859         if (labs(cred.times.endtime - cred.times.starttime - ticket_life) > 30) {
 860             char life[64];
 861             unparse_time_approx(cred.times.endtime - cred.times.starttime,
 862                                 life, sizeof(life));
 863             krb5_warnx(context, N_("NOTICE: ticket lifetime is %s", ""), life);
 864         }
 865     }
 866     if (renew_life) {
 867         if (labs(cred.times.renew_till - cred.times.starttime - renew) > 30) {
 868             char life[64];
 869             unparse_time_approx(cred.times.renew_till - cred.times.starttime,
 870                                 life, sizeof(life));
 871             krb5_warnx(context,
 872                        N_("NOTICE: ticket renewable lifetime is %s", ""),
 873                        life);
 874         }
 875     }
 876     krb5_free_cred_contents(context, &cred);
 877
 878     ret = krb5_cc_new_unique(context, krb5_cc_get_type(context, ccache),
 879                              NULL, &tempccache);
 880     if (ret) {
 881         krb5_warn(context, ret, "krb5_cc_new_unique");
 882         goto out;
 883     }
 884
 885     ret = krb5_init_creds_store(context, ctx, tempccache);
 886     if (ret) {
 887         krb5_warn(context, ret, "krb5_init_creds_store");
 888         goto out;
 889     }
 890
 891     krb5_init_creds_free(context, ctx);
 892     ctx = NULL;
 893
 894     ret = krb5_cc_move(context, tempccache, ccache);
 895     if (ret) {
 896         krb5_warn(context, ret, "krb5_cc_move");
 897         goto out;
 898     }
 899     tempccache = NULL;
 900
 901     if (switch_cache_flags)
 902         krb5_cc_switch(context, ccache);
 903
 904 #ifndef NO_NTLM
 905     if (ntlm_domain && ntlmkey.data)
 906         store_ntlmkey(context, ccache, ntlm_domain, &ntlmkey);
 907 #endif
 908
 909     if (ok_as_delegate_flag || windows_flag || use_referrals_flag) {
 910         unsigned char d = 0;
 911         krb5_data data;
 912
 913         if (ok_as_delegate_flag || windows_flag)
 914             d |= 1;
 915         if (use_referrals_flag || windows_flag)
 916             d |= 2;
 917
 918         data.length = 1;
 919         data.data = &d;
 920
 921         krb5_cc_set_config(context, ccache, NULL, "realm-config", &data);
 922     }
 923
 924     if (anonymous_pkinit) {
 925         krb5_data data;
 926
 927         data.length = strlen(principal->realm);
 928         data.data = principal->realm;
 929
 930         krb5_cc_set_config(context, ccache, NULL, "anon_pkinit_realm", &data);
 931     }
 932
 933 out:
 934     krb5_get_init_creds_opt_free(context, opt);
 935     if (ctx)
 936         krb5_init_creds_free(context, ctx);
 937     if (tempccache)
 938         krb5_cc_destroy(context, tempccache);
 939
 940     if (enctype)
 941         free(enctype);
 942
 943     return ret;
 944 }
 945
 946 static time_t
 947 ticket_lifetime(krb5_context context, krb5_ccache cache, krb5_principal client,
 948                 const char *server, time_t *renew)
 949 {
 950     krb5_creds in_cred, *cred;
 951     krb5_error_code ret;
 952     time_t timeout;
 953     time_t curtime;
 954
 955     memset(&in_cred, 0, sizeof(in_cred));
 956
 957     if (renew != NULL)
 958         *renew = 0;
 959
 960     ret = krb5_cc_get_principal(context, cache, &in_cred.client);
 961     if (ret) {
 962         krb5_warn(context, ret, "krb5_cc_get_principal");
 963         return 0;
 964     }
 965
 966     /* Determine TGS principal without fallback */
 967     ret = get_server(context, cache, in_cred.client, server, FALSE,
 968                      &in_cred.server);
 969     if (ret) {
 970         krb5_free_principal(context, in_cred.client);
 971         krb5_warn(context, ret, "get_server");
 972         return 0;
 973     }
 974
 975     ret = krb5_get_credentials(context, KRB5_GC_CACHED,
 976                                cache, &in_cred, &cred);
 977     krb5_free_principal(context, in_cred.client);
 978     krb5_free_principal(context, in_cred.server);
 979     if (ret) {
 980         krb5_warn(context, ret, "krb5_get_credentials");
 981         return 0;
 982     }
 983     curtime = time(NULL);
 984     timeout = cred->times.endtime - curtime;
 985     if (timeout < 0)
 986         timeout = 0;
 987     if (renew) {
 988         *renew = cred->times.renew_till - curtime;
 989         if (*renew < 0)
 990             *renew = 0;
 991     }
 992     krb5_free_creds(context, cred);
 993     return timeout;
 994 }
 995
 996 static time_t expire;
 997
 998 static char siginfo_msg[1024] = "No credentials\n";
 999
1000 static void
1001 update_siginfo_msg(time_t exp, const char *srv)
1002 {
1003     /* Note that exp is relative time */
1004     memset(siginfo_msg, 0, sizeof(siginfo_msg));
1005     memcpy(&siginfo_msg, "Updating...\n", sizeof("Updating...\n"));
1006     if (exp) {
1007         if (srv == NULL) {
1008             snprintf(siginfo_msg, sizeof(siginfo_msg),
1009                      N_("kinit: TGT expires in %llu seconds\n", ""),
1010                      (unsigned long long)expire);
1011         } else {
1012             snprintf(siginfo_msg, sizeof(siginfo_msg),
1013                      N_("kinit: Ticket for %s expired\n", ""), srv);
1014         }
1015         return;
1016     }
1017
1018     /* Expired creds */
1019     if (srv == NULL) {
1020         snprintf(siginfo_msg, sizeof(siginfo_msg),
1021                  N_("kinit: TGT expired\n", ""));
1022     } else {
1023         snprintf(siginfo_msg, sizeof(siginfo_msg),
1024                  N_("kinit: Ticket for %s expired\n", ""), srv);
1025     }
1026 }
1027
1028 #ifdef HAVE_SIGACTION
1029 static void
1030 handle_siginfo(int sig)
1031 {
1032     struct iovec iov[2];
1033
1034     iov[0].iov_base = rk_UNCONST(siginfo_msg);
1035     iov[0].iov_len = strlen(siginfo_msg);
1036     iov[1].iov_base = "\n";
1037     iov[1].iov_len = 1;
1038
1039     writev(STDERR_FILENO, iov, sizeof(iov)/sizeof(iov[0]));
1040 }
1041 #endif
1042
1043 struct renew_ctx {
1044     krb5_context context;
1045     krb5_ccache  ccache;
1046     krb5_principal principal;
1047     krb5_deltat ticket_life;
1048     krb5_deltat timeout;
1049 };
1050
1051 static time_t
1052 renew_func(void *ptr)
1053 {
1054     krb5_error_code ret;
1055     struct renew_ctx *ctx = ptr;
1056     time_t renew_expire;
1057     static time_t exp_delay = 1;
1058
1059     /*
1060      * NOTE: We count on the ccache implementation to notice changes to the
1061      * actual ccache filesystem/whatever objects.  There should be no ccache
1062      * types for which this is not the case, but it might not hurt to
1063      * re-krb5_cc_resolve() after each successful renew_validate()/
1064      * get_new_tickets() call.
1065      */
1066
1067     expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
1068                              server_str, &renew_expire);
1069
1070     /*
1071      * When a keytab is available to obtain new tickets, if we are within
1072      * half of the original ticket lifetime of the renew limit, get a new
1073      * TGT instead of renewing the existing TGT.  Note, ctx->ticket_life
1074      * is zero by default (without a '-l' option) and cannot be used to
1075      * set the time scale on which we decide whether we're "close to the
1076      * renew limit".
1077      */
1078     if (use_keytab || keytab_str)
1079         expire += ctx->timeout;
1080     if (renew_expire > expire) {
1081         ret = renew_validate(ctx->context, 1, validate_flag, ctx->ccache,
1082                        server_str, ctx->ticket_life);
1083     } else {
1084         ret = get_new_tickets(ctx->context, ctx->principal, ctx->ccache,
1085                               ctx->ticket_life, 0, 0);
1086     }
1087     expire = ticket_lifetime(ctx->context, ctx->ccache, ctx->principal,
1088                              server_str, &renew_expire);
1089
1090 #ifndef NO_AFS
1091     if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
1092         krb5_afslog(ctx->context, ctx->ccache, NULL, NULL);
1093 #endif
1094
1095     update_siginfo_msg(expire, server_str);
1096
1097     /*
1098      * If our tickets have expired and we been able to either renew them
1099      * or obtain new tickets, then we still call this function but we use
1100      * an exponential backoff.  This should take care of the case where
1101      * we are using stored credentials but the KDC has been unavailable
1102      * for some reason...
1103      */
1104
1105     if (expire < 1) {
1106         /*
1107          * We can't ask to keep spamming stderr but not syslog, so we warn
1108          * only once.
1109          */
1110         if (exp_delay == 1) {
1111             krb5_warnx(ctx->context, N_("NOTICE: Could not renew/refresh "
1112                                         "tickets", ""));
1113         }
1114         if (exp_delay < 7200)
1115             exp_delay += exp_delay / 2 + 1;
1116         return exp_delay;
1117     }
1118     exp_delay = 1;
1119
1120     return expire / 2 + 1;
1121 }
1122
1123 static void
1124 set_princ_realm(krb5_context context,
1125                 krb5_principal principal,
1126                 const char *realm)
1127 {
1128     krb5_error_code ret;
1129
1130     if ((ret = krb5_principal_set_realm(context, principal, realm)) != 0)
1131         krb5_err(context, 1, ret, "krb5_principal_set_realm");
1132 }
1133
1134 static void
1135 parse_name_realm(krb5_context context,
1136                  const char *name,
1137                  int flags,
1138                  const char *realm,
1139                  krb5_principal *princ)
1140 {
1141     krb5_error_code ret;
1142
1143     if (realm)
1144         flags |= KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
1145     if ((ret = krb5_parse_name_flags(context, name, flags, princ)) != 0)
1146         krb5_err(context, 1, ret, "krb5_parse_name_flags");
1147     if (realm && krb5_principal_get_realm(context, *princ) == NULL)
1148         set_princ_realm(context, *princ, realm);
1149 }
1150
1151 static char *
1152 get_default_realm(krb5_context context)
1153 {
1154     char *realm;
1155     krb5_error_code ret;
1156
1157     if ((ret = krb5_get_default_realm(context, &realm)) != 0)
1158         krb5_err(context, 1, ret, "krb5_get_default_realm");
1159     return realm;
1160 }
1161
1162 static void
1163 get_default_principal(krb5_context context, krb5_principal *princ)
1164 {
1165     krb5_error_code ret;
1166
1167     if ((ret = krb5_get_default_principal(context, princ)) != 0)
1168         krb5_err(context, 1, ret, "krb5_get_default_principal");
1169 }
1170
1171 static char *
1172 get_user_realm(krb5_context context)
1173 {
1174     krb5_error_code ret;
1175     char *user_realm = NULL;
1176
1177     /*
1178      * If memory allocation fails, we don't try to use the wrong realm,
1179      * that will trigger misleading error messages complicate support.
1180      */
1181     krb5_appdefault_string(context, "kinit", NULL, "user_realm", "",
1182                            &user_realm);
1183     if (user_realm == NULL) {
1184         ret = krb5_enomem(context);
1185         krb5_err(context, 1, ret, "krb5_appdefault_string");
1186     }
1187
1188     if (*user_realm == 0) {
1189         free(user_realm);
1190         user_realm = NULL;
1191     }
1192
1193     return user_realm;
1194 }
1195
1196 static void
1197 get_princ(krb5_context context, krb5_principal *principal, const char *name)
1198 {
1199     krb5_error_code ret;
1200     krb5_principal tmp;
1201     int parseflags = 0;
1202     char *user_realm;
1203
1204     if (name == NULL) {
1205         krb5_ccache ccache;
1206
1207         /* If credential cache provides a client principal, use that. */
1208         if (krb5_cc_default(context, &ccache) == 0) {
1209             ret = krb5_cc_get_principal(context, ccache, principal);
1210             krb5_cc_close(context, ccache);
1211             if (ret == 0)
1212                 return;
1213         }
1214     }
1215
1216     user_realm = get_user_realm(context);
1217
1218     if (name) {
1219         if (enterprise_flag)
1220             parseflags |= KRB5_PRINCIPAL_PARSE_ENTERPRISE;
1221
1222         parse_name_realm(context, name, parseflags, user_realm, &tmp);
1223
1224         if (user_realm && krb5_principal_get_num_comp(context, tmp) > 1) {
1225             /* Principal is instance qualified, reparse with default realm. */
1226             krb5_free_principal(context, tmp);
1227             parse_name_realm(context, name, parseflags, NULL, principal);
1228         } else {
1229             *principal = tmp;
1230         }
1231     } else {
1232         get_default_principal(context, principal);
1233         if (user_realm)
1234             set_princ_realm(context, *principal, user_realm);
1235     }
1236
1237     if (user_realm)
1238         free(user_realm);
1239 }
1240
1241 static void
1242 get_princ_kt(krb5_context context,
1243              krb5_principal *principal,
1244              char *name)
1245 {
1246     krb5_error_code ret;
1247     krb5_principal tmp;
1248     krb5_ccache ccache;
1249     krb5_kt_cursor cursor;
1250     krb5_keytab_entry entry;
1251     char *def_realm;
1252
1253     if (name == NULL) {
1254         /*
1255          * If the credential cache exists and specifies a client principal,
1256          * use that.
1257          */
1258         if (krb5_cc_default(context, &ccache) == 0) {
1259             ret = krb5_cc_get_principal(context, ccache, principal);
1260             krb5_cc_close(context, ccache);
1261             if (ret == 0)
1262                 return;
1263         }
1264     }
1265
1266     if (name) {
1267         /* If the principal specifies an explicit realm, just use that. */
1268         int parseflags = KRB5_PRINCIPAL_PARSE_NO_DEF_REALM;
1269
1270         parse_name_realm(context, name, parseflags, NULL, &tmp);
1271         if (krb5_principal_get_realm(context, tmp) != NULL) {
1272             *principal = tmp;
1273             return;
1274         }
1275     } else {
1276         /* Otherwise, search keytab for bare name of the default principal. */
1277         get_default_principal(context, &tmp);
1278         set_princ_realm(context, tmp, NULL);
1279     }
1280
1281     def_realm = get_default_realm(context);
1282
1283     ret = krb5_kt_start_seq_get(context, kt, &cursor);
1284     if (ret)
1285         krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
1286
1287     while (ret == 0 &&
1288            krb5_kt_next_entry(context, kt, &entry, &cursor) == 0) {
1289         const char *realm;
1290
1291         if (!krb5_principal_compare_any_realm(context, tmp, entry.principal))
1292             continue;
1293         if (*principal &&
1294             krb5_principal_compare(context, *principal, entry.principal))
1295             continue;
1296         /* The default realm takes precedence */
1297         realm = krb5_principal_get_realm(context, entry.principal);
1298         if (*principal && strcmp(def_realm, realm) == 0) {
1299             krb5_free_principal(context, *principal);
1300             ret = krb5_copy_principal(context, entry.principal, principal);
1301             break;
1302         }
1303         if (!*principal)
1304             ret = krb5_copy_principal(context, entry.principal, principal);
1305     }
1306     if (ret != 0 || (ret = krb5_kt_end_seq_get(context, kt, &cursor)) != 0)
1307         krb5_err(context, 1, ret, "get_princ_kt");
1308     if (!*principal) {
1309         if (name)
1310             parse_name_realm(context, name, 0, NULL, principal);
1311         else
1312             krb5_err(context, 1, KRB5_CC_NOTFOUND, "get_princ_kt");
1313     }
1314
1315     krb5_free_principal(context, tmp);
1316     free(def_realm);
1317 }
1318
1319 static krb5_error_code
1320 get_switched_ccache(krb5_context context,
1321                     const char * type,
1322                     krb5_principal principal,
1323                     krb5_ccache *ccache)
1324 {
1325     krb5_error_code ret;
1326
1327 #ifdef _WIN32
1328     if (strcmp(type, "API") == 0) {
1329         /*
1330          * Windows stores the default ccache name in the
1331          * registry which is shared across multiple logon
1332          * sessions for the same user.  The API credential
1333          * cache provides a unique name space per logon
1334          * session.  Therefore there is no need to generate
1335          * a unique ccache name.  Instead use the principal
1336          * name.  This provides a friendlier user experience.
1337          */
1338         char * unparsed_name;
1339         char * cred_cache;
1340
1341         ret = krb5_unparse_name(context, principal,
1342                                 &unparsed_name);
1343         if (ret)
1344             krb5_err(context, 1, ret,
1345                      N_("unparsing principal name", ""));
1346
1347         ret = asprintf(&cred_cache, "API:%s", unparsed_name);
1348         krb5_free_unparsed_name(context, unparsed_name);
1349         if (ret == -1 || cred_cache == NULL)
1350             krb5_err(context, 1, ret,
1351                       N_("building credential cache name", ""));
1352
1353         ret = krb5_cc_resolve(context, cred_cache, ccache);
1354         free(cred_cache);
1355     } else if (strcmp(type, "MSLSA") == 0) {
1356         /*
1357          * The Windows MSLSA cache when it is writeable
1358          * stores tickets for multiple client principals
1359          * in a single credential cache.
1360          */
1361         ret = krb5_cc_resolve(context, "MSLSA:", ccache);
1362     } else {
1363         ret = krb5_cc_new_unique(context, type, NULL, ccache);
1364     }
1365 #else /* !_WIN32 */
1366     ret = krb5_cc_new_unique(context, type, NULL, ccache);
1367 #endif /* _WIN32 */
1368
1369     return ret;
1370 }
1371
1372 int
1373 main(int argc, char **argv)
1374 {
1375     krb5_error_code ret;
1376     krb5_context context;
1377     krb5_ccache  ccache;
1378     krb5_principal principal = NULL;
1379     int optidx = 0;
1380     krb5_deltat ticket_life = 0;
1381 #ifdef HAVE_SIGACTION
1382     struct sigaction sa;
1383 #endif
1384     krb5_boolean unique_ccache = FALSE;
1385     krb5_boolean historical_anon_pkinit = FALSE;
1386     int anonymous_pkinit = FALSE;
1387
1388     setprogname(argv[0]);
1389
1390     setlocale(LC_ALL, "");
1391     bindtextdomain("heimdal_kuser", HEIMDAL_LOCALEDIR);
1392     textdomain("heimdal_kuser");
1393
1394     ret = krb5_init_context(&context);
1395     if (ret == KRB5_CONFIG_BADFORMAT)
1396         errx(1, "krb5_init_context failed to parse configuration file");
1397     else if (ret)
1398         errx(1, "krb5_init_context failed: %d", ret);
1399
1400     if (getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optidx))
1401         usage(1);
1402
1403     if (help_flag)
1404         usage(0);
1405
1406     if (version_flag) {
1407         print_version(NULL);
1408         exit(0);
1409     }
1410
1411     argc -= optidx;
1412     argv += optidx;
1413
1414     krb5_appdefault_boolean(context, "kinit", NULL, "historical_anon_pkinit",
1415                             FALSE, &historical_anon_pkinit);
1416
1417     /*
1418      * Open the keytab now, we use the keytab to determine the principal's
1419      * realm when the requested principal has no realm.
1420      */
1421     if (use_keytab || keytab_str) {
1422         if (keytab_str)
1423             ret = krb5_kt_resolve(context, keytab_str, &kt);
1424         else
1425             ret = krb5_kt_default(context, &kt);
1426         if (ret)
1427             krb5_err(context, 1, ret, "resolving keytab");
1428     }
1429
1430     if (pk_enterprise_flag) {
1431         ret = krb5_pk_enterprise_cert(context, pk_user_id,
1432                                       argv[0], &principal,
1433                                       &ent_user_id);
1434         if (ret)
1435             krb5_err(context, 1, ret, "krb5_pk_enterprise_certs");
1436
1437         pk_user_id = NULL;
1438
1439     } else if (anonymous_flag && argc && argv[0][0] == '@') {
1440         /* If principal argument as @REALM, try anonymous PKINIT */
1441
1442         ret = krb5_make_principal(context, &principal, &argv[0][1],
1443                                   KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME,
1444                                   NULL);
1445         if (ret)
1446             krb5_err(context, 1, ret, "krb5_make_principal");
1447         krb5_principal_set_type(context, principal, KRB5_NT_WELLKNOWN);
1448         anonymous_pkinit = TRUE;
1449     } else if (anonymous_flag && historical_anon_pkinit) {
1450         char *realm = argc == 0 ? get_default_realm(context) :
1451                       argv[0][0] == '@' ? &argv[0][1] : argv[0];
1452
1453         ret = krb5_make_principal(context, &principal, realm,
1454                                   KRB5_WELLKNOWN_NAME, KRB5_ANON_NAME, NULL);
1455         if (ret)
1456             krb5_err(context, 1, ret, "krb5_make_principal");
1457         krb5_principal_set_type(context, principal, KRB5_NT_WELLKNOWN);
1458         anonymous_pkinit = TRUE;
1459     } else if (use_keytab || keytab_str) {
1460         get_princ_kt(context, &principal, argv[0]);
1461     } else {
1462         get_princ(context, &principal, argv[0]);
1463     }
1464
1465     if (fcache_version)
1466         krb5_set_fcache_version(context, fcache_version);
1467
1468     if (renewable_flag == -1)
1469         /* this seems somewhat pointless, but whatever */
1470         krb5_appdefault_boolean(context, "kinit",
1471                                 krb5_principal_get_realm(context, principal),
1472                                 "renewable", FALSE, &renewable_flag);
1473     if (do_afslog == -1)
1474         krb5_appdefault_boolean(context, "kinit",
1475                                 krb5_principal_get_realm(context, principal),
1476                                 "afslog", TRUE, &do_afslog);
1477
1478     if (cred_cache)
1479         ret = krb5_cc_resolve(context, cred_cache, &ccache);
1480     else {
1481         if (argc > 1) {
1482             char s[1024];
1483             ret = krb5_cc_new_unique(context, NULL, NULL, &ccache);
1484             if (ret)
1485                 krb5_err(context, 1, ret, "creating cred cache");
1486             snprintf(s, sizeof(s), "%s:%s",
1487                      krb5_cc_get_type(context, ccache),
1488                      krb5_cc_get_name(context, ccache));
1489             setenv("KRB5CCNAME", s, 1);
1490             unique_ccache = TRUE;
1491         } else {
1492             ret = krb5_cc_cache_match(context, principal, &ccache);
1493             if (ret) {
1494                 const char *type;
1495                 ret = krb5_cc_default(context, &ccache);
1496                 if (ret)
1497                     krb5_err(context, 1, ret,
1498                              N_("resolving credentials cache", ""));
1499
1500                 /*
1501                  * Check if the type support switching, and we do,
1502                  * then do that instead over overwriting the current
1503                  * default credential
1504                  */
1505                 type = krb5_cc_get_type(context, ccache);
1506                 if (krb5_cc_support_switch(context, type)) {
1507                     krb5_cc_close(context, ccache);
1508                     ret = get_switched_ccache(context, type, principal,
1509                                               &ccache);
1510                     if (ret == 0)
1511                         unique_ccache = TRUE;
1512                 }
1513             }
1514         }
1515     }
1516     if (ret)
1517         krb5_err(context, 1, ret, N_("resolving credentials cache", ""));
1518
1519 #ifndef NO_AFS
1520     if (argc > 1 && k_hasafs())
1521         k_setpag();
1522 #endif
1523
1524     if (lifetime) {
1525         int tmp = parse_time(lifetime, "s");
1526         if (tmp < 0)
1527             errx(1, N_("unparsable time: %s", ""), lifetime);
1528
1529         ticket_life = tmp;
1530     }
1531
1532     if (addrs_flag == 0 && extra_addresses.num_strings > 0)
1533         krb5_errx(context, 1,
1534                   N_("specifying both extra addresses and "
1535                      "no addresses makes no sense", ""));
1536     {
1537         int i;
1538         krb5_addresses addresses;
1539         memset(&addresses, 0, sizeof(addresses));
1540         for(i = 0; i < extra_addresses.num_strings; i++) {
1541             ret = krb5_parse_address(context, extra_addresses.strings[i],
1542                                      &addresses);
1543             if (ret == 0) {
1544                 krb5_add_extra_addresses(context, &addresses);
1545                 krb5_free_addresses(context, &addresses);
1546             }
1547         }
1548         free_getarg_strings(&extra_addresses);
1549     }
1550
1551     if (renew_flag || validate_flag) {
1552         ret = renew_validate(context, renew_flag, validate_flag,
1553                              ccache, server_str, ticket_life);
1554
1555 #ifndef NO_AFS
1556         if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
1557             krb5_afslog(context, ccache, NULL, NULL);
1558 #endif
1559
1560         if (unique_ccache)
1561             krb5_cc_destroy(context, ccache);
1562         exit(ret != 0);
1563     }
1564
1565     ret = get_new_tickets(context, principal, ccache, ticket_life,
1566                           1, anonymous_pkinit);
1567     if (ret) {
1568         if (unique_ccache)
1569             krb5_cc_destroy(context, ccache);
1570         exit(1);
1571     }
1572
1573 #ifndef NO_AFS
1574     if (ret == 0 && server_str == NULL && do_afslog && k_hasafs())
1575         krb5_afslog(context, ccache, NULL, NULL);
1576 #endif
1577
1578     if (argc > 1) {
1579         struct renew_ctx ctx;
1580         time_t timeout;
1581
1582         timeout = ticket_lifetime(context, ccache, principal,
1583                                   server_str, NULL) / 2;
1584
1585         ctx.context = context;
1586         ctx.ccache = ccache;
1587         ctx.principal = principal;
1588         ctx.ticket_life = ticket_life;
1589         ctx.timeout = timeout;
1590
1591 #ifdef HAVE_SIGACTION
1592         memset(&sa, 0, sizeof(sa));
1593         sigemptyset(&sa.sa_mask);
1594         sa.sa_handler = handle_siginfo;
1595
1596         sigaction(SIGINFO, &sa, NULL);
1597 #endif
1598
1599         ret = simple_execvp_timed(argv[1], argv+1,
1600                                   renew_func, &ctx, timeout);
1601 #define EX_NOEXEC       126
1602 #define EX_NOTFOUND     127
1603         if (ret == EX_NOEXEC)
1604             krb5_warnx(context, N_("permission denied: %s", ""), argv[1]);
1605         else if (ret == EX_NOTFOUND)
1606             krb5_warnx(context, N_("command not found: %s", ""), argv[1]);
1607
1608         krb5_cc_destroy(context, ccache);
1609 #ifndef NO_AFS
1610         if (k_hasafs())
1611             k_unlog();
1612 #endif
1613     } else {
1614         krb5_cc_close(context, ccache);
1615         ret = 0;
1616     }
1617     krb5_free_principal(context, principal);
1618     if (kt)
1619         krb5_kt_close(context, kt);
1620     krb5_free_context(context);
1621     return ret;
1622 }