lib/kadm5/init_c.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "kadm5_locl.h"
  35 #include <sys/types.h>
  36 #ifdef HAVE_SYS_SOCKET_H
  37 #include <sys/socket.h>
  38 #endif
  39 #ifdef HAVE_NETINET_IN_H
  40 #include <netinet/in.h>
  41 #endif
  42 #ifdef HAVE_NETDB_H
  43 #include <netdb.h>
  44 #endif
  45
  46 RCSID("$Id$");
  47
  48 static kadm5_ret_t
  49 kadm5_c_lock(void *server_handle)
  50 {
  51     return ENOTSUP;
  52 }
  53
  54 static kadm5_ret_t
  55 kadm5_c_unlock(void *server_handle)
  56 {
  57     return ENOTSUP;
  58 }
  59
  60 static void
  61 set_funcs(kadm5_client_context *c)
  62 {
  63 #define SET(C, F) (C)->funcs.F = kadm5 ## _c_ ## F
  64 #define SETNOTIMP(C, F) (C)->funcs.F = 0
  65     SET(c, chpass_principal);
  66     SET(c, chpass_principal_with_key);
  67     SET(c, create_principal);
  68     SET(c, delete_principal);
  69     SET(c, destroy);
  70     SET(c, flush);
  71     SET(c, get_principal);
  72     SET(c, get_principals);
  73     SET(c, get_privs);
  74     SET(c, modify_principal);
  75     SET(c, prune_principal);
  76     SET(c, randkey_principal);
  77     SET(c, rename_principal);
  78     SET(c, lock);
  79     SET(c, unlock);
  80     SETNOTIMP(c, setkey_principal_3);
  81     SET(c, iter_principals);
  82     SET(c, dup_context);
  83 }
  84
  85 kadm5_ret_t
  86 _kadm5_c_init_context(kadm5_client_context **ctx,
  87                       kadm5_config_params *params,
  88                       krb5_context context)
  89 {
  90     krb5_error_code ret;
  91     char *colon;
  92
  93     *ctx = malloc(sizeof(**ctx));
  94     if (*ctx == NULL)
  95         return krb5_enomem(context);
  96     memset(*ctx, 0, sizeof(**ctx));
  97     krb5_add_et_list(context, initialize_kadm5_error_table_r);
  98     set_funcs(*ctx);
  99     (*ctx)->context = context;
 100     if (params->mask & KADM5_CONFIG_REALM) {
 101         ret = 0;
 102         (*ctx)->realm = strdup(params->realm);
 103         if ((*ctx)->realm == NULL)
 104             ret = krb5_enomem(context);
 105     } else
 106         ret = krb5_get_default_realm((*ctx)->context, &(*ctx)->realm);
 107     if (ret) {
 108         free(*ctx);
 109         return ret;
 110     }
 111
 112     /*
 113      * FIXME: If we have a hostlist, we should use the hostlist so that if we
 114      *        can't reach one server we try another.
 115      */
 116     if (params->mask & KADM5_CONFIG_ADMIN_SERVER)
 117         (*ctx)->admin_server = strdup(params->admin_server);
 118     else {
 119         char **hostlist;
 120
 121         ret = krb5_get_krb_admin_hst(context, &(*ctx)->realm, &hostlist);
 122         if (ret) {
 123             free((*ctx)->realm);
 124             free(*ctx);
 125             return ret;
 126         }
 127         (*ctx)->admin_server = strdup(*hostlist);
 128         krb5_free_krbhst(context, hostlist);
 129     }
 130
 131     if ((*ctx)->admin_server == NULL) {
 132         free((*ctx)->realm);
 133         free(*ctx);
 134         return krb5_enomem(context);
 135     }
 136     colon = strchr((*ctx)->admin_server, ':');
 137     if (colon != NULL)
 138         *colon++ = '\0';
 139
 140     (*ctx)->kadmind_port = 0;
 141
 142     if (params->mask & KADM5_CONFIG_KADMIND_PORT)
 143         (*ctx)->kadmind_port = params->kadmind_port;
 144     else if (colon != NULL) {
 145         char *end;
 146
 147         (*ctx)->kadmind_port = htons(strtol(colon, &end, 0));
 148     }
 149     if ((*ctx)->kadmind_port == 0)
 150         (*ctx)->kadmind_port = krb5_getportbyname(context, "kerberos-adm",
 151                                                   "tcp", 749);
 152
 153     if (params->mask & KADM5_CONFIG_READONLY_ADMIN_SERVER) {
 154         (*ctx)->readonly_admin_server = strdup(params->readonly_admin_server);
 155         if ((*ctx)->readonly_admin_server == NULL) {
 156             free((*ctx)->realm);
 157             free(*ctx);
 158             return krb5_enomem(context);
 159         }
 160     } else {
 161         char **hostlist;
 162
 163         ret = krb5_get_krb_readonly_admin_hst(context, &(*ctx)->realm,
 164                                               &hostlist);
 165         if (ret == 0) {
 166             (*ctx)->readonly_admin_server = strdup(*hostlist);
 167             krb5_free_krbhst(context, hostlist);
 168             if ((*ctx)->readonly_admin_server == NULL) {
 169                 free((*ctx)->realm);
 170                 free(*ctx);
 171                 return krb5_enomem(context);
 172             }
 173         }
 174     }
 175     if ((*ctx)->readonly_admin_server) {
 176         colon = strchr((*ctx)->readonly_admin_server, ':');
 177         if (colon != NULL)
 178             *colon++ = '\0';
 179
 180     } else {
 181         colon = NULL;
 182     }
 183
 184     (*ctx)->readonly_kadmind_port = 0;
 185     if (params->mask & KADM5_CONFIG_READONLY_KADMIN_PORT)
 186         (*ctx)->readonly_kadmind_port = params->readonly_kadmind_port;
 187     else if (colon != NULL) {
 188         char *end;
 189
 190         (*ctx)->readonly_kadmind_port = htons(strtol(colon, &end, 0));
 191     }
 192     if ((*ctx)->readonly_kadmind_port == 0)
 193         (*ctx)->readonly_kadmind_port = (*ctx)->kadmind_port;
 194     return 0;
 195 }
 196
 197 kadm5_ret_t
 198 kadm5_c_dup_context(void *vin, void **out)
 199 {
 200     krb5_error_code ret;
 201     kadm5_client_context *in = vin;
 202     krb5_context context = in->context;
 203     kadm5_client_context *ctx;
 204
 205     *out = NULL;
 206     ctx = malloc(sizeof(*ctx));
 207     if (ctx == NULL)
 208         return krb5_enomem(in->context);
 209
 210
 211     memset(ctx, 0, sizeof(*ctx));
 212     set_funcs(ctx);
 213     ctx->readonly_kadmind_port = in->readonly_kadmind_port;
 214     ctx->kadmind_port = in->kadmind_port;
 215
 216     ret = krb5_copy_context(context, &(ctx->context));
 217     if (ret == 0) {
 218         ctx->my_context = TRUE;
 219         ret = krb5_add_et_list(ctx->context, initialize_kadm5_error_table_r);
 220     }
 221     if (ret == 0 && (ctx->realm = strdup(in->realm)) == NULL)
 222         ret = krb5_enomem(context);
 223     if (ret == 0 &&
 224         (ctx->admin_server = strdup(in->admin_server)) == NULL)
 225         ret = krb5_enomem(context);
 226     if (in->readonly_admin_server &&
 227         (ctx->readonly_admin_server = strdup(in->readonly_admin_server)) == NULL)
 228         ret = krb5_enomem(context);
 229     if (in->keytab && (ctx->keytab = strdup(in->keytab)) == NULL)
 230         ret = krb5_enomem(context);
 231     if (in->ccache) {
 232         char *fullname = NULL;
 233
 234         ret = krb5_cc_get_full_name(context, in->ccache, &fullname);
 235         if (ret == 0)
 236             ret = krb5_cc_resolve(context, fullname, &ctx->ccache);
 237         free(fullname);
 238     }
 239     ctx->sock = -1;
 240     if (ret == 0)
 241         *out = ctx;
 242     else
 243         kadm5_c_destroy(ctx);
 244     return ret;
 245 }
 246
 247 static krb5_error_code
 248 get_kadm_ticket(krb5_context context,
 249                 krb5_ccache id,
 250                 krb5_principal client,
 251                 const char *server_name)
 252 {
 253     krb5_error_code ret;
 254     krb5_creds in, *out;
 255
 256     memset(&in, 0, sizeof(in));
 257     in.client = client;
 258     ret = krb5_parse_name(context, server_name, &in.server);
 259     if(ret)
 260         return ret;
 261     ret = krb5_get_credentials(context, 0, id, &in, &out);
 262     if(ret == 0)
 263         krb5_free_creds(context, out);
 264     krb5_free_principal(context, in.server);
 265     return ret;
 266 }
 267
 268 static krb5_error_code
 269 get_new_cache(krb5_context context,
 270               krb5_principal client,
 271               const char *password,
 272               krb5_prompter_fct prompter,
 273               const char *keytab,
 274               const char *server_name,
 275               krb5_ccache *ret_cache)
 276 {
 277     krb5_error_code ret;
 278     krb5_creds cred;
 279     krb5_get_init_creds_opt *opt;
 280     krb5_ccache id;
 281
 282     ret = krb5_get_init_creds_opt_alloc (context, &opt);
 283     if (ret)
 284         return ret;
 285
 286     krb5_get_init_creds_opt_set_default_flags(context, "kadmin",
 287                                               krb5_principal_get_realm(context,
 288                                                                        client),
 289                                               opt);
 290
 291
 292     krb5_get_init_creds_opt_set_forwardable (opt, FALSE);
 293     krb5_get_init_creds_opt_set_proxiable (opt, FALSE);
 294
 295     if(password == NULL && prompter == NULL) {
 296         krb5_keytab kt;
 297         if(keytab == NULL)
 298             ret = krb5_kt_default(context, &kt);
 299         else
 300             ret = krb5_kt_resolve(context, keytab, &kt);
 301         if(ret) {
 302             krb5_get_init_creds_opt_free(context, opt);
 303             return ret;
 304         }
 305         ret = krb5_get_init_creds_keytab (context,
 306                                           &cred,
 307                                           client,
 308                                           kt,
 309                                           0,
 310                                           server_name,
 311                                           opt);
 312         krb5_kt_close(context, kt);
 313     } else {
 314         ret = krb5_get_init_creds_password (context,
 315                                             &cred,
 316                                             client,
 317                                             password,
 318                                             prompter,
 319                                             NULL,
 320                                             0,
 321                                             server_name,
 322                                             opt);
 323     }
 324     krb5_get_init_creds_opt_free(context, opt);
 325     switch(ret){
 326     case 0:
 327         break;
 328     case KRB5_LIBOS_PWDINTR:    /* don't print anything if it was just C-c:ed */
 329     case KRB5KRB_AP_ERR_BAD_INTEGRITY:
 330     case KRB5KRB_AP_ERR_MODIFIED:
 331         return KADM5_BAD_PASSWORD;
 332     default:
 333         return ret;
 334     }
 335     ret = krb5_cc_new_unique(context, krb5_cc_type_memory, NULL, &id);
 336     if(ret)
 337         return ret;
 338     ret = krb5_cc_initialize (context, id, cred.client);
 339     if (ret)
 340         return ret;
 341     ret = krb5_cc_store_cred (context, id, &cred);
 342     if (ret)
 343         return ret;
 344     krb5_free_cred_contents (context, &cred);
 345     *ret_cache = id;
 346     return 0;
 347 }
 348
 349 /*
 350  * Check the credential cache `id´ to figure out what principal to use
 351  * when talking to the kadmind. If there is a initial kadmin/admin@
 352  * credential in the cache, use that client principal. Otherwise, use
 353  * the client principals first component and add /admin to the
 354  * principal.
 355  */
 356
 357 static krb5_error_code
 358 get_cache_principal(krb5_context context,
 359                     krb5_ccache *id,
 360                     krb5_principal *client)
 361 {
 362     krb5_error_code ret;
 363     const char *name, *inst;
 364     krb5_principal p1, p2;
 365
 366     ret = krb5_cc_default(context, id);
 367     if(ret) {
 368         *id = NULL;
 369         return ret;
 370     }
 371
 372     ret = krb5_cc_get_principal(context, *id, &p1);
 373     if(ret) {
 374         krb5_cc_close(context, *id);
 375         *id = NULL;
 376         return ret;
 377     }
 378
 379     ret = krb5_make_principal(context, &p2, NULL,
 380                               "kadmin", "admin", NULL);
 381     if (ret) {
 382         krb5_cc_close(context, *id);
 383         *id = NULL;
 384         krb5_free_principal(context, p1);
 385         return ret;
 386     }
 387
 388     {
 389         krb5_creds in, *out;
 390         krb5_kdc_flags flags;
 391
 392         flags.i = 0;
 393         memset(&in, 0, sizeof(in));
 394
 395         in.client = p1;
 396         in.server = p2;
 397
 398         /* check for initial ticket kadmin/admin */
 399         ret = krb5_get_credentials_with_flags(context, KRB5_GC_CACHED, flags,
 400                                               *id, &in, &out);
 401         krb5_free_principal(context, p2);
 402         if (ret == 0) {
 403             if (out->flags.b.initial) {
 404                 *client = p1;
 405                 krb5_free_creds(context, out);
 406                 return 0;
 407             }
 408             krb5_free_creds(context, out);
 409         }
 410     }
 411     krb5_cc_close(context, *id);
 412     *id = NULL;
 413
 414     name = krb5_principal_get_comp_string(context, p1, 0);
 415     inst = krb5_principal_get_comp_string(context, p1, 1);
 416     if(inst == NULL || strcmp(inst, "admin") != 0) {
 417         ret = krb5_make_principal(context, &p2, NULL, name, "admin", NULL);
 418         krb5_free_principal(context, p1);
 419         if(ret != 0)
 420             return ret;
 421
 422         *client = p2;
 423         return 0;
 424     }
 425
 426     *client = p1;
 427
 428     return 0;
 429 }
 430
 431 krb5_error_code
 432 _kadm5_c_get_cred_cache(krb5_context context,
 433                         const char *client_name,
 434                         const char *server_name,
 435                         const char *password,
 436                         krb5_prompter_fct prompter,
 437                         const char *keytab,
 438                         krb5_ccache ccache,
 439                         krb5_ccache *ret_cache)
 440 {
 441     krb5_error_code ret;
 442     krb5_ccache id = NULL;
 443     krb5_principal default_client = NULL, client = NULL;
 444
 445     /* treat empty password as NULL */
 446     if(password && *password == '\0')
 447         password = NULL;
 448     if(server_name == NULL)
 449         server_name = KADM5_ADMIN_SERVICE;
 450
 451     if(client_name != NULL) {
 452         ret = krb5_parse_name(context, client_name, &client);
 453         if(ret)
 454             return ret;
 455     }
 456
 457     if(ccache != NULL) {
 458         id = ccache;
 459         ret = krb5_cc_get_principal(context, id, &client);
 460         if(ret)
 461             return ret;
 462     } else {
 463         /* get principal from default cache, ok if this doesn't work */
 464
 465         ret = get_cache_principal(context, &id, &default_client);
 466         if (ret) {
 467             /*
 468              * No client was specified by the caller and we cannot
 469              * determine the client from a credentials cache.
 470              */
 471             char userbuf[128];
 472             const char *user = NULL;
 473
 474 #ifndef WIN32
 475             if (geteuid() == 0)
 476                 user = roken_get_loginname(userbuf, sizeof(userbuf));
 477 #endif
 478             if (user == NULL)
 479                 user = roken_get_username(userbuf, sizeof(userbuf));
 480             if (user == NULL) {
 481                 krb5_set_error_message(context, KADM5_FAILURE, "Unable to find local user name");
 482                 krb5_free_principal(context, client);
 483                 return KADM5_FAILURE;
 484             }
 485             ret = krb5_make_principal(context, &default_client,
 486                                       NULL, user, "admin", NULL);
 487             if (ret) {
 488                 krb5_free_principal(context, client);
 489                 return ret;
 490             }
 491         }
 492     }
 493
 494
 495     /*
 496      * No client was specified by the caller, but we have a client
 497      * from the default credentials cache.
 498      */
 499     if (client == NULL && default_client != NULL)
 500         client = default_client;
 501
 502
 503     if(id && client && (default_client == NULL ||
 504               krb5_principal_compare(context, client, default_client) != 0)) {
 505         ret = get_kadm_ticket(context, id, client, server_name);
 506         if(ret == 0) {
 507             *ret_cache = id;
 508             krb5_free_principal(context, default_client);
 509             if (default_client != client)
 510                 krb5_free_principal(context, client);
 511             return 0;
 512         }
 513         if(ccache != NULL)
 514             /* couldn't get ticket from cache */
 515             return -1;
 516     }
 517     /* get creds via AS request */
 518     if(id && (id != ccache))
 519         krb5_cc_close(context, id);
 520     if (client != default_client)
 521         krb5_free_principal(context, default_client);
 522
 523     ret = get_new_cache(context, client, password, prompter, keytab,
 524                         server_name, ret_cache);
 525     krb5_free_principal(context, client);
 526     return ret;
 527 }
 528
 529 static kadm5_ret_t
 530 kadm_connect(kadm5_client_context *ctx)
 531 {
 532     kadm5_ret_t ret;
 533     krb5_principal server = NULL;
 534     krb5_ccache cc = NULL;
 535     rk_socket_t s = rk_INVALID_SOCKET;
 536     struct addrinfo *ai, *a;
 537     struct addrinfo hints;
 538     int free_ai = 0;
 539     int error;
 540     int kadmin_port = 0;
 541     const char *admin_server = NULL;
 542     char portstr[NI_MAXSERV];
 543     const char *hostname, *slash;
 544     char *service_name = NULL;
 545     krb5_context context = ctx->context;
 546     int writable = 0;
 547
 548     if (ctx->ac)
 549         krb5_auth_con_free(context, ctx->ac);
 550     ctx->ac = NULL;
 551
 552     if (!ctx->want_write) {
 553         admin_server = ctx->readonly_admin_server;
 554         kadmin_port = ctx->readonly_kadmind_port;
 555     }
 556     if (admin_server == NULL) {
 557         admin_server = ctx->admin_server;
 558         writable = 1;
 559     }
 560     if (kadmin_port < 1)
 561         kadmin_port = ctx->kadmind_port;
 562
 563     memset(&hints, 0, sizeof(hints));
 564     hints.ai_socktype = SOCK_STREAM;
 565     hints.ai_protocol = IPPROTO_TCP;
 566
 567     snprintf(portstr, sizeof(portstr), "%u", ntohs(kadmin_port));
 568
 569     hostname = admin_server;
 570     slash = strchr(hostname, '/');
 571     if (slash != NULL)
 572         hostname = slash + 1;
 573
 574     if (krb5_config_get_bool(context, NULL, "libdefaults", "block_dns",
 575             NULL)) {
 576         hints.ai_flags &= ~AI_CANONNAME;
 577         hints.ai_flags |= AI_NUMERICHOST|AI_NUMERICSERV;
 578     }
 579     error = getaddrinfo(hostname, portstr, &hints, &ai);
 580     if (error) {
 581         ret = KADM5_BAD_SERVER_NAME;
 582         goto out;
 583     }
 584
 585     free_ai = 1;
 586     for (a = ai; a != NULL; a = a->ai_next) {
 587         s = socket(a->ai_family, a->ai_socktype, a->ai_protocol);
 588         if (s < 0)
 589             continue;
 590         if (connect(s, a->ai_addr, a->ai_addrlen) < 0) {
 591             krb5_warn(context, errno, "connect(%s)", hostname);
 592             rk_closesocket(s);
 593             s = rk_INVALID_SOCKET;
 594             continue;
 595         }
 596         break;
 597     }
 598     if (a == NULL) {
 599         krb5_set_error_message(context, ret = KADM5_FAILURE,
 600                                "failed to contact %s", hostname);
 601         goto out;
 602     }
 603     ret = _kadm5_c_get_cred_cache(context,
 604                                   ctx->client_name,
 605                                   ctx->service_name,
 606                                   NULL, ctx->prompter, ctx->keytab,
 607                                   ctx->ccache, &cc);
 608     if (ret)
 609         goto out;
 610
 611     if (ctx->realm)
 612         error = asprintf(&service_name, "%s@%s", KADM5_ADMIN_SERVICE,
 613                          ctx->realm);
 614     else
 615         error = asprintf(&service_name, "%s", KADM5_ADMIN_SERVICE);
 616
 617     if (error == -1 || service_name == NULL) {
 618         ret = krb5_enomem(context);
 619         goto out;
 620     }
 621
 622     ret = krb5_parse_name(context, service_name, &server);
 623     if (ret)
 624         goto out;
 625
 626     ret = krb5_sendauth(context, &ctx->ac, &s,
 627                         KADMIN_APPL_VERSION, NULL,
 628                         server, AP_OPTS_MUTUAL_REQUIRED,
 629                         NULL, NULL, cc, NULL, NULL, NULL);
 630     if (ret == 0) {
 631         krb5_data params;
 632         kadm5_config_params p;
 633         memset(&p, 0, sizeof(p));
 634         if(ctx->realm) {
 635             p.mask |= KADM5_CONFIG_REALM;
 636             p.realm = ctx->realm;
 637         }
 638         ret = _kadm5_marshal_params(context, &p, &params);
 639         if (ret == 0) {
 640             ret = krb5_write_priv_message(context, ctx->ac, &s, &params);
 641             krb5_data_free(&params);
 642         }
 643     }
 644
 645     if (ret == 0) {
 646         ctx->sock = s;
 647         ctx->connected_to_writable = !!writable;
 648     }
 649
 650 out:
 651     free(service_name);
 652     krb5_cc_close(context, cc);
 653     krb5_free_principal(context, server);
 654     if (free_ai)
 655         freeaddrinfo(ai);
 656     if (ret) {
 657         if (s != rk_INVALID_SOCKET)
 658             rk_closesocket(s);
 659         krb5_auth_con_free(context, ctx->ac);
 660         ctx->ac = NULL;
 661     }
 662     return ret;
 663 }
 664
 665 kadm5_ret_t
 666 _kadm5_connect(void *handle, int want_write)
 667 {
 668     kadm5_client_context *ctx = handle;
 669
 670     /*
 671      * Reconnect?  Note that we don't reconnect to read-only kadmin servers if
 672      * we're already connected to a writable kadmin server because we sometimes
 673      * get a principal record after writing it.  We really need the application
 674      * upstairs to tell us when to stop hogging writable kadmin servers.
 675      *
 676      * FIXME: Add an API for marking a kadm5_client_context as not needing to
 677      * connect to writable kadmin servers.
 678      */
 679     ctx->want_write = !!want_write;
 680     if (ctx->sock != rk_INVALID_SOCKET && want_write &&
 681         !ctx->connected_to_writable) {
 682         rk_closesocket(ctx->sock);
 683         ctx->sock = rk_INVALID_SOCKET;
 684     }
 685     if (ctx->sock == rk_INVALID_SOCKET)
 686         return kadm_connect(ctx);
 687     return 0;
 688 }
 689
 690 static kadm5_ret_t
 691 kadm5_c_init_with_context(krb5_context context,
 692                           const char *client_name,
 693                           const char *password,
 694                           krb5_prompter_fct prompter,
 695                           const char *keytab,
 696                           krb5_ccache ccache,
 697                           const char *service_name,
 698                           kadm5_config_params *realm_params,
 699                           unsigned long struct_version,
 700                           unsigned long api_version,
 701                           void **server_handle)
 702 {
 703     kadm5_ret_t ret;
 704     kadm5_client_context *ctx = NULL;
 705     krb5_ccache cc;
 706
 707     ret = _kadm5_c_init_context(&ctx, realm_params, context);
 708     if (ret)
 709         return ret;
 710
 711     if (password != NULL && *password != '\0') {
 712         ret = _kadm5_c_get_cred_cache(context,
 713                                       client_name,
 714                                       service_name,
 715                                       password, prompter, keytab, ccache, &cc);
 716         if (ret) {
 717             kadm5_c_destroy(ctx);
 718             return ret;
 719         }
 720         ccache = cc;
 721     }
 722
 723
 724     if (client_name != NULL)
 725         ctx->client_name = strdup(client_name);
 726     else
 727         ctx->client_name = NULL;
 728     if (service_name != NULL)
 729         ctx->service_name = strdup(service_name);
 730     else
 731         ctx->service_name = NULL;
 732     ctx->prompter = prompter;
 733     ctx->keytab = keytab;
 734     ctx->ccache = ccache;
 735     /* maybe we should copy the params here */
 736     ctx->sock = -1;
 737
 738     *server_handle = ctx;
 739     return 0;
 740 }
 741
 742 static kadm5_ret_t
 743 init_context(const char *client_name,
 744              const char *password,
 745              krb5_prompter_fct prompter,
 746              const char *keytab,
 747              krb5_ccache ccache,
 748              const char *service_name,
 749              kadm5_config_params *realm_params,
 750              unsigned long struct_version,
 751              unsigned long api_version,
 752              void **server_handle)
 753 {
 754     krb5_context context;
 755     kadm5_ret_t ret;
 756     kadm5_server_context *ctx;
 757
 758     ret = krb5_init_context(&context);
 759     if (ret)
 760         return ret;
 761     ret = kadm5_c_init_with_context(context,
 762                                     client_name,
 763                                     password,
 764                                     prompter,
 765                                     keytab,
 766                                     ccache,
 767                                     service_name,
 768                                     realm_params,
 769                                     struct_version,
 770                                     api_version,
 771                                     server_handle);
 772     if(ret){
 773         krb5_free_context(context);
 774         return ret;
 775     }
 776     ctx = *server_handle;
 777     ctx->my_context = 1;
 778     return 0;
 779 }
 780
 781 kadm5_ret_t
 782 kadm5_c_init_with_password_ctx(krb5_context context,
 783                                const char *client_name,
 784                                const char *password,
 785                                const char *service_name,
 786                                kadm5_config_params *realm_params,
 787                                unsigned long struct_version,
 788                                unsigned long api_version,
 789                                void **server_handle)
 790 {
 791     return kadm5_c_init_with_context(context,
 792                                      client_name,
 793                                      password,
 794                                      krb5_prompter_posix,
 795                                      NULL,
 796                                      NULL,
 797                                      service_name,
 798                                      realm_params,
 799                                      struct_version,
 800                                      api_version,
 801                                      server_handle);
 802 }
 803
 804 kadm5_ret_t
 805 kadm5_c_init_with_password(const char *client_name,
 806                            const char *password,
 807                            const char *service_name,
 808                            kadm5_config_params *realm_params,
 809                            unsigned long struct_version,
 810                            unsigned long api_version,
 811                            void **server_handle)
 812 {
 813     return init_context(client_name,
 814                         password,
 815                         krb5_prompter_posix,
 816                         NULL,
 817                         NULL,
 818                         service_name,
 819                         realm_params,
 820                         struct_version,
 821                         api_version,
 822                         server_handle);
 823 }
 824
 825 kadm5_ret_t
 826 kadm5_c_init_with_skey_ctx(krb5_context context,
 827                            const char *client_name,
 828                            const char *keytab,
 829                            const char *service_name,
 830                            kadm5_config_params *realm_params,
 831                            unsigned long struct_version,
 832                            unsigned long api_version,
 833                            void **server_handle)
 834 {
 835     return kadm5_c_init_with_context(context,
 836                                      client_name,
 837                                      NULL,
 838                                      NULL,
 839                                      keytab,
 840                                      NULL,
 841                                      service_name,
 842                                      realm_params,
 843                                      struct_version,
 844                                      api_version,
 845                                      server_handle);
 846 }
 847
 848
 849 kadm5_ret_t
 850 kadm5_c_init_with_skey(const char *client_name,
 851                      const char *keytab,
 852                      const char *service_name,
 853                      kadm5_config_params *realm_params,
 854                      unsigned long struct_version,
 855                      unsigned long api_version,
 856                      void **server_handle)
 857 {
 858     return init_context(client_name,
 859                         NULL,
 860                         NULL,
 861                         keytab,
 862                         NULL,
 863                         service_name,
 864                         realm_params,
 865                         struct_version,
 866                         api_version,
 867                         server_handle);
 868 }
 869
 870 kadm5_ret_t
 871 kadm5_c_init_with_creds_ctx(krb5_context context,
 872                             const char *client_name,
 873                             krb5_ccache ccache,
 874                             const char *service_name,
 875                             kadm5_config_params *realm_params,
 876                             unsigned long struct_version,
 877                             unsigned long api_version,
 878                             void **server_handle)
 879 {
 880     return kadm5_c_init_with_context(context,
 881                                      client_name,
 882                                      NULL,
 883                                      NULL,
 884                                      NULL,
 885                                      ccache,
 886                                      service_name,
 887                                      realm_params,
 888                                      struct_version,
 889                                      api_version,
 890                                      server_handle);
 891 }
 892
 893 kadm5_ret_t
 894 kadm5_c_init_with_creds(const char *client_name,
 895                         krb5_ccache ccache,
 896                         const char *service_name,
 897                         kadm5_config_params *realm_params,
 898                         unsigned long struct_version,
 899                         unsigned long api_version,
 900                         void **server_handle)
 901 {
 902     return init_context(client_name,
 903                         NULL,
 904                         NULL,
 905                         NULL,
 906                         ccache,
 907                         service_name,
 908                         realm_params,
 909                         struct_version,
 910                         api_version,
 911                         server_handle);
 912 }
 913
 914 #if 0
 915 kadm5_ret_t
 916 kadm5_init(char *client_name, char *pass,
 917            char *service_name,
 918            kadm5_config_params *realm_params,
 919            unsigned long struct_version,
 920            unsigned long api_version,
 921            void **server_handle)
 922 {
 923 }
 924 #endif
 925