2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #define KRB5_DEPRECATED /* uses v4 functions that will die */
40 static int version_flag
;
42 static const char *ktname
= HPROP_KEYTAB
;
43 static const char *database
;
44 static char *mkeyfile
;
46 static int verbose_flag
;
47 static int encrypt_flag
;
48 static int decrypt_flag
;
49 static hdb_master_key mkey5
;
51 static char *source_type
;
53 static char *afs_cell
;
54 static char *v4_realm
;
56 static int kaspecials_flag
;
57 static int ka_use_null_salt
;
59 static char *local_realm
=NULL
;
62 open_socket(krb5_context context
, const char *hostname
, const char *port
)
64 struct addrinfo
*ai
, *a
;
65 struct addrinfo hints
;
68 memset (&hints
, 0, sizeof(hints
));
69 hints
.ai_socktype
= SOCK_STREAM
;
70 hints
.ai_protocol
= IPPROTO_TCP
;
72 error
= getaddrinfo (hostname
, port
, &hints
, &ai
);
74 warnx ("%s: %s", hostname
, gai_strerror(error
));
78 for (a
= ai
; a
!= NULL
; a
= a
->ai_next
) {
81 s
= socket (a
->ai_family
, a
->ai_socktype
, a
->ai_protocol
);
84 if (connect (s
, a
->ai_addr
, a
->ai_addrlen
) < 0) {
85 warn ("connect(%s)", hostname
);
92 warnx ("failed to contact %s", hostname
);
98 v5_prop(krb5_context context
, HDB
*db
, hdb_entry_ex
*entry
, void *appdata
)
101 struct prop_data
*pd
= appdata
;
105 ret
= hdb_seal_keys_mkey(context
, &entry
->entry
, mkey5
);
107 krb5_warn(context
, ret
, "hdb_seal_keys_mkey");
112 ret
= hdb_unseal_keys_mkey(context
, &entry
->entry
, mkey5
);
114 krb5_warn(context
, ret
, "hdb_unseal_keys_mkey");
119 ret
= hdb_entry2value(context
, &entry
->entry
, &data
);
121 krb5_warn(context
, ret
, "hdb_entry2value");
126 ret
= krb5_write_message(context
, &pd
->sock
, &data
);
128 ret
= krb5_write_priv_message(context
, pd
->auth_context
,
130 krb5_data_free(&data
);
136 v4_prop(void *arg
, struct v4_principal
*p
)
138 struct prop_data
*pd
= arg
;
142 memset(&ent
, 0, sizeof(ent
));
144 ret
= krb5_425_conv_principal(pd
->context
, p
->name
, p
->instance
, v4_realm
,
145 &ent
.entry
.principal
);
147 krb5_warn(pd
->context
, ret
,
148 "krb5_425_conv_principal %s.%s@%s",
149 p
->name
, p
->instance
, v4_realm
);
155 krb5_unparse_name_short(pd
->context
, ent
.entry
.principal
, &s
);
156 krb5_warnx(pd
->context
, "%s.%s -> %s", p
->name
, p
->instance
, s
);
160 ent
.entry
.kvno
= p
->kvno
;
161 ent
.entry
.keys
.len
= 3;
162 ent
.entry
.keys
.val
= malloc(ent
.entry
.keys
.len
* sizeof(*ent
.entry
.keys
.val
));
163 if (ent
.entry
.keys
.val
== NULL
)
164 krb5_errx(pd
->context
, ENOMEM
, "malloc");
166 ent
.entry
.keys
.val
[0].mkvno
= malloc (sizeof(*ent
.entry
.keys
.val
[0].mkvno
));
167 if (ent
.entry
.keys
.val
[0].mkvno
== NULL
)
168 krb5_errx(pd
->context
, ENOMEM
, "malloc");
169 *(ent
.entry
.keys
.val
[0].mkvno
) = p
->mkvno
;
171 ent
.entry
.keys
.val
[0].mkvno
= NULL
;
172 ent
.entry
.keys
.val
[0].salt
= calloc(1, sizeof(*ent
.entry
.keys
.val
[0].salt
));
173 if (ent
.entry
.keys
.val
[0].salt
== NULL
)
174 krb5_errx(pd
->context
, ENOMEM
, "calloc");
175 ent
.entry
.keys
.val
[0].salt
->type
= KRB5_PADATA_PW_SALT
;
176 ent
.entry
.keys
.val
[0].key
.keytype
= ETYPE_DES_CBC_MD5
;
177 krb5_data_alloc(&ent
.entry
.keys
.val
[0].key
.keyvalue
, DES_KEY_SZ
);
178 memcpy(ent
.entry
.keys
.val
[0].key
.keyvalue
.data
, p
->key
, 8);
180 copy_Key(&ent
.entry
.keys
.val
[0], &ent
.entry
.keys
.val
[1]);
181 ent
.entry
.keys
.val
[1].key
.keytype
= ETYPE_DES_CBC_MD4
;
182 copy_Key(&ent
.entry
.keys
.val
[0], &ent
.entry
.keys
.val
[2]);
183 ent
.entry
.keys
.val
[2].key
.keytype
= ETYPE_DES_CBC_CRC
;
186 int life
= _krb5_krb_life_to_time(0, p
->max_life
);
187 if(life
== NEVERDATE
){
188 ent
.entry
.max_life
= NULL
;
190 /* clean up lifetime a bit */
192 life
= (life
+ 86399) / 86400 * 86400;
194 life
= (life
+ 3599) / 3600 * 3600;
195 ALLOC(ent
.entry
.max_life
);
196 *ent
.entry
.max_life
= life
;
200 ALLOC(ent
.entry
.valid_end
);
201 *ent
.entry
.valid_end
= p
->exp_date
;
203 ret
= krb5_make_principal(pd
->context
, &ent
.entry
.created_by
.principal
,
209 krb5_warn(pd
->context
, ret
, "krb5_make_principal");
213 ent
.entry
.created_by
.time
= time(NULL
);
214 ALLOC(ent
.entry
.modified_by
);
215 ret
= krb5_425_conv_principal(pd
->context
, p
->mod_name
, p
->mod_instance
,
216 v4_realm
, &ent
.entry
.modified_by
->principal
);
218 krb5_warn(pd
->context
, ret
, "%s.%s@%s", p
->name
, p
->instance
, v4_realm
);
219 ent
.entry
.modified_by
->principal
= NULL
;
223 ent
.entry
.modified_by
->time
= p
->mod_date
;
225 ent
.entry
.flags
.forwardable
= 1;
226 ent
.entry
.flags
.renewable
= 1;
227 ent
.entry
.flags
.proxiable
= 1;
228 ent
.entry
.flags
.postdate
= 1;
229 ent
.entry
.flags
.client
= 1;
230 ent
.entry
.flags
.server
= 1;
232 /* special case password changing service */
233 if(strcmp(p
->name
, "changepw") == 0 &&
234 strcmp(p
->instance
, "kerberos") == 0) {
235 ent
.entry
.flags
.forwardable
= 0;
236 ent
.entry
.flags
.renewable
= 0;
237 ent
.entry
.flags
.proxiable
= 0;
238 ent
.entry
.flags
.postdate
= 0;
239 ent
.entry
.flags
.initial
= 1;
240 ent
.entry
.flags
.change_pw
= 1;
243 ret
= v5_prop(pd
->context
, NULL
, &ent
, pd
);
245 if (strcmp (p
->name
, "krbtgt") == 0
246 && strcmp (v4_realm
, p
->instance
) != 0) {
247 krb5_free_principal (pd
->context
, ent
.entry
.principal
);
248 ret
= krb5_425_conv_principal (pd
->context
, p
->name
,
249 v4_realm
, p
->instance
,
250 &ent
.entry
.principal
);
252 ret
= v5_prop (pd
->context
, NULL
, &ent
, pd
);
256 hdb_free_entry(pd
->context
, &ent
);
263 /* read a `ka_entry' from `fd' at offset `pos' */
265 read_block(krb5_context context
, int fd
, int32_t pos
, void *buf
, size_t len
)
269 if((ret
= pread(fd
, buf
, len
, 64 + pos
)) < 0)
270 krb5_err(context
, 1, errno
, "pread(%u)", 64 + pos
);
272 if(lseek(fd
, 64 + pos
, SEEK_SET
) == (off_t
)-1)
273 krb5_err(context
, 1, errno
, "lseek(%u)", 64 + pos
);
274 ret
= read(fd
, buf
, len
);
276 krb5_err(context
, 1, errno
, "read(%lu)", (unsigned long)len
);
279 krb5_errx(context
, 1, "read(%lu) = %u", (unsigned long)len
, ret
);
285 ka_convert(struct prop_data
*pd
, int fd
, struct ka_entry
*ent
)
287 int32_t flags
= ntohl(ent
->flags
);
292 && (flags
& KAFNORMAL
) == 0) /* remove special entries */
294 memset(&hdb
, 0, sizeof(hdb
));
295 ret
= krb5_425_conv_principal(pd
->context
, ent
->name
, ent
->instance
,
296 v4_realm
, &hdb
.entry
.principal
);
298 krb5_warn(pd
->context
, ret
,
299 "krb5_425_conv_principal (%s.%s@%s)",
300 ent
->name
, ent
->instance
, v4_realm
);
303 hdb
.entry
.kvno
= ntohl(ent
->kvno
);
304 hdb
.entry
.keys
.len
= 3;
306 malloc(hdb
.entry
.keys
.len
* sizeof(*hdb
.entry
.keys
.val
));
307 if (hdb
.entry
.keys
.val
== NULL
)
308 krb5_errx(pd
->context
, ENOMEM
, "malloc");
309 hdb
.entry
.keys
.val
[0].mkvno
= NULL
;
310 hdb
.entry
.keys
.val
[0].salt
= calloc(1, sizeof(*hdb
.entry
.keys
.val
[0].salt
));
311 if (hdb
.entry
.keys
.val
[0].salt
== NULL
)
312 krb5_errx(pd
->context
, ENOMEM
, "calloc");
313 if (ka_use_null_salt
) {
314 hdb
.entry
.keys
.val
[0].salt
->type
= hdb_pw_salt
;
315 hdb
.entry
.keys
.val
[0].salt
->salt
.data
= NULL
;
316 hdb
.entry
.keys
.val
[0].salt
->salt
.length
= 0;
318 hdb
.entry
.keys
.val
[0].salt
->type
= hdb_afs3_salt
;
319 hdb
.entry
.keys
.val
[0].salt
->salt
.data
= strdup(afs_cell
);
320 if (hdb
.entry
.keys
.val
[0].salt
->salt
.data
== NULL
)
321 krb5_errx(pd
->context
, ENOMEM
, "strdup");
322 hdb
.entry
.keys
.val
[0].salt
->salt
.length
= strlen(afs_cell
);
325 hdb
.entry
.keys
.val
[0].key
.keytype
= ETYPE_DES_CBC_MD5
;
326 krb5_data_copy(&hdb
.entry
.keys
.val
[0].key
.keyvalue
,
329 copy_Key(&hdb
.entry
.keys
.val
[0], &hdb
.entry
.keys
.val
[1]);
330 hdb
.entry
.keys
.val
[1].key
.keytype
= ETYPE_DES_CBC_MD4
;
331 copy_Key(&hdb
.entry
.keys
.val
[0], &hdb
.entry
.keys
.val
[2]);
332 hdb
.entry
.keys
.val
[2].key
.keytype
= ETYPE_DES_CBC_CRC
;
334 ALLOC(hdb
.entry
.max_life
);
335 *hdb
.entry
.max_life
= ntohl(ent
->max_life
);
337 if(ntohl(ent
->valid_end
) != NEVERDATE
&& ntohl(ent
->valid_end
) != 0xffffffff) {
338 ALLOC(hdb
.entry
.valid_end
);
339 *hdb
.entry
.valid_end
= ntohl(ent
->valid_end
);
342 if (ntohl(ent
->pw_change
) != NEVERDATE
&&
343 ent
->pw_expire
!= 255 &&
344 ent
->pw_expire
!= 0) {
345 ALLOC(hdb
.entry
.pw_end
);
346 *hdb
.entry
.pw_end
= ntohl(ent
->pw_change
)
347 + 24 * 60 * 60 * ent
->pw_expire
;
350 ret
= krb5_make_principal(pd
->context
, &hdb
.entry
.created_by
.principal
,
355 hdb
.entry
.created_by
.time
= time(NULL
);
359 ALLOC(hdb
.entry
.modified_by
);
360 read_block(pd
->context
, fd
, ntohl(ent
->mod_ptr
), &mod
, sizeof(mod
));
362 krb5_425_conv_principal(pd
->context
, mod
.name
, mod
.instance
, v4_realm
,
363 &hdb
.entry
.modified_by
->principal
);
364 hdb
.entry
.modified_by
->time
= ntohl(ent
->mod_time
);
365 memset(&mod
, 0, sizeof(mod
));
368 hdb
.entry
.flags
.forwardable
= 1;
369 hdb
.entry
.flags
.renewable
= 1;
370 hdb
.entry
.flags
.proxiable
= 1;
371 hdb
.entry
.flags
.postdate
= 1;
372 /* XXX - AFS 3.4a creates krbtgt.REALMOFCELL as NOTGS+NOSEAL */
373 if (strcmp(ent
->name
, "krbtgt") == 0 &&
374 (flags
& (KAFNOTGS
|KAFNOSEAL
)) == (KAFNOTGS
|KAFNOSEAL
))
375 flags
&= ~(KAFNOTGS
|KAFNOSEAL
);
377 hdb
.entry
.flags
.client
= (flags
& KAFNOTGS
) == 0;
378 hdb
.entry
.flags
.server
= (flags
& KAFNOSEAL
) == 0;
380 ret
= v5_prop(pd
->context
, NULL
, &hdb
, pd
);
381 hdb_free_entry(pd
->context
, &hdb
);
386 ka_dump(struct prop_data
*pd
, const char *file
)
388 struct ka_header header
;
390 int fd
= open(file
, O_RDONLY
);
393 krb5_err(pd
->context
, 1, errno
, "open(%s)", file
);
394 read_block(pd
->context
, fd
, 0, &header
, sizeof(header
));
395 if(header
.version1
!= header
.version2
)
396 krb5_errx(pd
->context
, 1, "Version mismatch in header: %ld/%ld",
397 (long)ntohl(header
.version1
), (long)ntohl(header
.version2
));
398 if(ntohl(header
.version1
) != 5)
399 krb5_errx(pd
->context
, 1, "Unknown database version %ld (expected 5)",
400 (long)ntohl(header
.version1
));
401 for(i
= 0; i
< ntohl(header
.hashsize
); i
++){
402 int32_t pos
= ntohl(header
.hash
[i
]);
405 read_block(pd
->context
, fd
, pos
, &ent
, sizeof(ent
));
406 ka_convert(pd
, fd
, &ent
);
407 pos
= ntohl(ent
.next
);
415 struct getargs args
[] = {
416 { "master-key", 'm', arg_string
, &mkeyfile
, "v5 master key file", "file" },
417 { "database", 'd', arg_string
, &database
, "database", "file" },
418 { "source", 0, arg_string
, &source_type
, "type of database to read",
428 { "v4-realm", 'r', arg_string
, &v4_realm
, "v4 realm to use" },
430 { "cell", 'c', arg_string
, &afs_cell
, "name of AFS cell" },
432 { "kaspecials", 'S', arg_flag
, &kaspecials_flag
, "dump KASPECIAL keys"},
434 { "keytab", 'k', arg_string
, &ktname
, "keytab to use for authentication", "keytab" },
435 { "v5-realm", 'R', arg_string
, &local_realm
, "v5 realm to use" },
436 { "decrypt", 'D', arg_flag
, &decrypt_flag
, "decrypt keys" },
437 { "encrypt", 'E', arg_flag
, &encrypt_flag
, "encrypt keys" },
438 { "stdout", 'n', arg_flag
, &to_stdout
, "dump to stdout" },
439 { "verbose", 'v', arg_flag
, &verbose_flag
},
440 { "version", 0, arg_flag
, &version_flag
},
441 { "help", 'h', arg_flag
, &help_flag
}
444 static int num_args
= sizeof(args
) / sizeof(args
[0]);
449 arg_printusage (args
, num_args
, NULL
, "[host[:port]] ...");
454 get_creds(krb5_context context
, krb5_ccache
*cache
)
457 krb5_principal client
;
459 krb5_get_init_creds_opt
*init_opts
;
460 krb5_preauthtype preauth
= KRB5_PADATA_ENC_TIMESTAMP
;
463 ret
= krb5_kt_register(context
, &hdb_kt_ops
);
464 if(ret
) krb5_err(context
, 1, ret
, "krb5_kt_register");
466 ret
= krb5_kt_resolve(context
, ktname
, &keytab
);
467 if(ret
) krb5_err(context
, 1, ret
, "krb5_kt_resolve");
469 ret
= krb5_make_principal(context
, &client
, NULL
,
470 "kadmin", HPROP_NAME
, NULL
);
471 if(ret
) krb5_err(context
, 1, ret
, "krb5_make_principal");
473 ret
= krb5_get_init_creds_opt_alloc(context
, &init_opts
);
474 if(ret
) krb5_err(context
, 1, ret
, "krb5_get_init_creds_opt_alloc");
475 krb5_get_init_creds_opt_set_preauth_list(init_opts
, &preauth
, 1);
477 ret
= krb5_get_init_creds_keytab(context
, &creds
, client
, keytab
, 0, NULL
, init_opts
);
478 if(ret
) krb5_err(context
, 1, ret
, "krb5_get_init_creds");
480 krb5_get_init_creds_opt_free(context
, init_opts
);
482 ret
= krb5_kt_close(context
, keytab
);
483 if(ret
) krb5_err(context
, 1, ret
, "krb5_kt_close");
485 ret
= krb5_cc_new_unique(context
, krb5_cc_type_memory
, NULL
, cache
);
486 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_new_unique");
488 ret
= krb5_cc_initialize(context
, *cache
, client
);
489 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_initialize");
491 krb5_free_principal(context
, client
);
493 ret
= krb5_cc_store_cred(context
, *cache
, &creds
);
494 if(ret
) krb5_err(context
, 1, ret
, "krb5_cc_store_cred");
496 krb5_free_cred_contents(context
, &creds
);
506 #define IS_TYPE_V4(X) ((X) == HPROP_KRB4_DUMP || (X) == HPROP_KASERVER)
512 { HPROP_HEIMDAL
, "heimdal" },
513 { HPROP_KRB4_DUMP
, "krb4-dump" },
514 { HPROP_KASERVER
, "kaserver" },
515 { HPROP_MIT_DUMP
, "mit-dump" }
519 parse_source_type(const char *s
)
522 for(i
= 0; i
< sizeof(types
) / sizeof(types
[0]); i
++) {
523 if(strstr(types
[i
].name
, s
) == types
[i
].name
)
524 return types
[i
].type
;
530 iterate (krb5_context context
,
531 const char *database_name
,
534 struct prop_data
*pd
)
540 case HPROP_KRB4_DUMP
:
541 ret
= v4_prop_dump(pd
, database_name
);
543 krb5_warn(context
, ret
, "v4_prop_dump");
546 ret
= ka_dump(pd
, database_name
);
548 krb5_warn(context
, ret
, "ka_dump");
552 ret
= mit_prop_dump(pd
, database_name
);
554 krb5_warn(context
, ret
, "mit_prop_dump");
557 ret
= hdb_foreach(context
, db
, HDB_F_DECRYPT
, v5_prop
, pd
);
559 krb5_warn(context
, ret
, "hdb_foreach");
562 krb5_errx(context
, 1, "unknown prop type: %d", type
);
568 dump_database (krb5_context context
, int type
,
569 const char *database_name
, HDB
*db
)
575 pd
.context
= context
;
576 pd
.auth_context
= NULL
;
577 pd
.sock
= STDOUT_FILENO
;
579 ret
= iterate (context
, database_name
, db
, type
, &pd
);
581 krb5_errx(context
, 1, "iterate failure");
582 krb5_data_zero (&data
);
583 ret
= krb5_write_message (context
, &pd
.sock
, &data
);
585 krb5_err(context
, 1, ret
, "krb5_write_message");
591 propagate_database (krb5_context context
, int type
,
592 const char *database_name
,
593 HDB
*db
, krb5_ccache ccache
,
594 int optidx
, int argc
, char **argv
)
596 krb5_principal server
;
600 for(i
= optidx
; i
< argc
; i
++){
601 krb5_auth_context auth_context
;
606 char *port
, portstr
[NI_MAXSERV
];
607 char *host
= argv
[i
];
609 port
= strchr(host
, ':');
611 snprintf(portstr
, sizeof(portstr
), "%u",
612 ntohs(krb5_getportbyname (context
, "hprop", "tcp",
618 fd
= open_socket(context
, host
, port
);
621 krb5_warn (context
, errno
, "connect %s", host
);
625 ret
= krb5_sname_to_principal(context
, argv
[i
],
626 HPROP_NAME
, KRB5_NT_SRV_HST
, &server
);
629 krb5_warn(context
, ret
, "krb5_sname_to_principal(%s)", host
);
636 krb5_get_default_realm(context
,&my_realm
);
637 krb5_principal_set_realm(context
,server
,my_realm
);
638 krb5_xfree(my_realm
);
642 ret
= krb5_sendauth(context
,
648 AP_OPTS_MUTUAL_REQUIRED
| AP_OPTS_USE_SUBKEY
,
656 krb5_free_principal(context
, server
);
660 krb5_warn(context
, ret
, "krb5_sendauth (%s)", host
);
665 pd
.context
= context
;
666 pd
.auth_context
= auth_context
;
669 ret
= iterate (context
, database_name
, db
, type
, &pd
);
671 krb5_warnx(context
, "iterate to host %s failed", host
);
676 krb5_data_zero (&data
);
677 ret
= krb5_write_priv_message(context
, auth_context
, &fd
, &data
);
679 krb5_warn(context
, ret
, "krb5_write_priv_message");
684 ret
= krb5_read_priv_message(context
, auth_context
, &fd
, &data
);
686 krb5_warn(context
, ret
, "krb5_read_priv_message: %s", host
);
690 krb5_data_free (&data
);
693 krb5_auth_con_free(context
, auth_context
);
702 main(int argc
, char **argv
)
705 krb5_context context
;
706 krb5_ccache ccache
= NULL
;
712 setprogname(argv
[0]);
714 if(getarg(args
, num_args
, argc
, argv
, &optidx
))
725 ret
= krb5_init_context(&context
);
730 krb5_set_default_realm(context
, local_realm
);
732 if(v4_realm
== NULL
) {
733 ret
= krb5_get_default_realm(context
, &v4_realm
);
735 krb5_err(context
, 1, ret
, "krb5_get_default_realm");
738 if(afs_cell
== NULL
) {
739 afs_cell
= strdup(v4_realm
);
741 krb5_errx(context
, 1, "out of memory");
746 if(encrypt_flag
&& decrypt_flag
)
747 krb5_errx(context
, 1,
748 "only one of `--encrypt' and `--decrypt' is meaningful");
750 if(source_type
!= NULL
) {
751 type
= parse_source_type(source_type
);
753 krb5_errx(context
, 1, "unknown source type `%s'", source_type
);
755 type
= HPROP_HEIMDAL
;
758 get_creds(context
, &ccache
);
760 if(decrypt_flag
|| encrypt_flag
) {
761 ret
= hdb_read_master_key(context
, mkeyfile
, &mkey5
);
762 if(ret
&& ret
!= ENOENT
)
763 krb5_err(context
, 1, ret
, "hdb_read_master_key");
765 krb5_errx(context
, 1, "No master key file found");
768 if (IS_TYPE_V4(type
) && v4_realm
== NULL
)
769 krb5_errx(context
, 1, "Its a Kerberos 4 database "
770 "but no realm configured");
774 if (database
== NULL
)
775 database
= DEFAULT_DATABASE
;
776 ka_use_null_salt
= krb5_config_get_bool_default(context
, NULL
, FALSE
,
778 "afs_uses_null_salt",
782 case HPROP_KRB4_DUMP
:
783 if (database
== NULL
)
784 krb5_errx(context
, 1, "no dump file specified");
788 if (database
== NULL
)
789 krb5_errx(context
, 1, "no dump file specified");
792 ret
= hdb_create (context
, &db
, database
);
794 krb5_err(context
, 1, ret
, "hdb_create: %s", database
);
795 ret
= db
->hdb_open(context
, db
, O_RDONLY
, 0);
797 krb5_err(context
, 1, ret
, "db->hdb_open");
800 krb5_errx(context
, 1, "unknown dump type `%d'", type
);
805 exit_code
= dump_database (context
, type
, database
, db
);
807 exit_code
= propagate_database (context
, type
, database
,
808 db
, ccache
, optidx
, argc
, argv
);
811 krb5_cc_destroy(context
, ccache
);
814 (*db
->hdb_destroy
)(context
, db
);
816 krb5_free_context(context
);