*/
#include <afsconfig.h>
+#include <afs/param.h>
+#include <afs/stds.h>
-#include <stdio.h>
-#include <string.h>
-#include <ctype.h>
-#include <sys/types.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#ifdef HAVE_STDLIB_H
-#include <stdlib.h>
-#endif
-#ifdef HAVE_MEMORY_H
-#include <memory.h>
-#endif
-#include <errno.h>
-
-#include <sys/stat.h>
-#include <fcntl.h>
+#include <roken.h>
-#include <sys/param.h>
-#include <sys/errno.h>
-#include <netdb.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <pwd.h>
+#include <ctype.h>
-#include <afs/stds.h>
#include <afs/ktc.h>
#include <afs/token.h>
#include <afs/com_err.h>
#endif
-#include <afs/param.h>
#ifdef AFS_SUN5_ENV
#include <sys/ioccom.h>
#endif
-/* Prevent inclusion of des.h to avoid conflicts with des types */
-#define NO_DES_H_INCLUDE
-
#include <afs/auth.h>
#include <afs/cellconfig.h>
#include <afs/vice.h>
#define AKLOG_BADPATH 6
#define AKLOG_MISC 7
-#ifndef NULL
-#define NULL 0
-#endif
-
#ifndef TRUE
#define TRUE 1
#endif
#error "Must have either keyblock or session member of krb5_creds"
#endif
-#if !defined(HAVE_KRB5_524_CONVERT_CREDS) && defined(HAVE_KRB524_CONVERT_CREDS_KDC)
+#ifdef AFS_DARWIN110_ENV
+#define HAVE_NO_KRB5_524 /* MITKerberosShim logs but returns success */
+#elif !defined(HAVE_KRB5_524_CONVERT_CREDS) && defined(HAVE_KRB524_CONVERT_CREDS_KDC)
#define krb5_524_convert_creds krb524_convert_creds_kdc
#elif !defined(HAVE_KRB5_524_CONVERT_CREDS) && !defined(HAVE_KRB524_CONVERT_CREDS_KDC)
#define HAVE_NO_KRB5_524
if (strncmp(str, "unknown", strlen("unknown")) == 0) {
#ifdef HAVE_KRB5_SVC_GET_MSG
krb5_svc_get_msg(code,&str);
-#else
+#elif defined(HAVE_ERROR_MESSAGE)
str = error_message(code);
+#else
+ ; /* IRIX apparently has neither: use the string we have */
#endif
}
fputs(str, stderr);
static int
-get_cellconfig(char *cell, struct afsconf_cell *cellconfig, char **local_cell)
+get_cellconfig(const char *config, char *cell,
+ struct afsconf_cell *cellconfig, char **local_cell)
{
int status = AKLOG_SUCCESS;
struct afsconf_dir *configdir;
exit(AKLOG_AFS);
}
- if (!(configdir = afsconf_Open(AFSDIR_CLIENT_ETC_DIRPATH))) {
+ if (!(configdir = afsconf_Open(config))) {
fprintf(stderr,
"%s: can't get afs configuration (afsconf_Open(%s))\n",
- progname, AFSDIR_CLIENT_ETC_DIRPATH);
+ progname, config);
exit(AKLOG_AFS);
}
fprintf(stderr, "%s: Couldn't get %s AFS tickets:\n",
progname, cell->name);
afs_com_err(progname, status, "while getting AFS tickets");
+#ifdef KRB5_CC_NOT_KTYPE
+ if (status == KRB5_CC_NOT_KTYPE) {
+ fprintf(stderr, "allow_weak_enctypes may be required in the Kerberos configuration\n");
+ }
+#endif
status = AKLOG_KERBEROS;
goto out;
}
} else {
len = strlen(username)+strlen(realmUsed)+2;
*authuser = malloc(len);
- afs_snprintf(*authuser, len, "%s@%s", username, realmUsed);
+ snprintf(*authuser, len, "%s@%s", username, realmUsed);
*foreign = 1;
}
* to.
*/
static int
-auth_to_cell(krb5_context context, char *cell, char *realm, char **linkedcell)
+auth_to_cell(krb5_context context, const char *config,
+ char *cell, char *realm, char **linkedcell)
{
int status = AKLOG_SUCCESS;
int isForeign = 0;
struct afsconf_cell cellconf;
/* NULL or empty cell returns information on local cell */
- if ((status = get_cellconfig(cell, &cellconf, &local_cell)))
+ if ((status = get_cellconfig(config, cell, &cellconf, &local_cell)))
return(status);
if (linkedcell != NULL) {
* every cell it encounters along the way.
*/
static int
-auth_to_path(krb5_context context, char *path)
+auth_to_path(krb5_context context, const char *config, char *path)
{
int status = AKLOG_SUCCESS;
int auth_status = AKLOG_SUCCESS;
add_hosts(pathtocheck);
if ((endofcell = strchr(mountpoint, VOLMARKER))) {
*endofcell = '\0';
- if ((auth_status = auth_to_cell(context, cell, NULL, NULL))) {
+ auth_status = auth_to_cell(context, config, cell, NULL, NULL);
+ if (auth_status) {
if (status == AKLOG_SUCCESS)
status = auth_status;
else if (status != auth_status)
linked_list paths; /* List of paths to log to */
ll_node *cur_node;
char *linkedcell;
+ const char *config = AFSDIR_CLIENT_ETC_DIRPATH;
memset(&cellinfo, 0, sizeof(cellinfo));
else
progname = argv[0];
- krb5_init_context(&context);
+#if defined(KRB5_PROG_ETYPE_NOSUPP) && !(defined(HAVE_KRB5_ENCTYPE_ENABLE) || defined(HAVE_KRB5_ALLOW_WEAK_CRYPTO))
+ {
+ char *filepath = NULL, *newpath = NULL;
+#ifndef AFS_DARWIN_ENV
+ char *defaultpath = "/etc/krb5.conf";
+#else
+ char *defaultpath = "~/Library/Preferences/edu.mit.Kerberos:/Library/Preferences/edu.mit.Kerberos";
+#endif
+ filepath = getenv("KRB5_CONFIG");
+ asprintf(&newpath, "%s:%s/krb5-weak.conf",
+ filepath ? filepath : defaultpath,
+ AFSDIR_CLIENT_ETC_DIRPATH);
+ setenv("KRB5_CONFIG", newpath, 1);
+#endif
+ krb5_init_context(&context);
+
+#if defined(KRB5_PROG_ETYPE_NOSUPP) && !(defined(HAVE_KRB5_ENCTYPE_ENABLE) || defined(HAVE_KRB5_ALLOW_WEAK_CRYPTO))
+ free(newpath);
+ if (filepath)
+ setenv("KRB5_CONFIG", filepath, 1);
+ else
+ unsetenv("KRB5_CONFIG");
+ }
+#endif
initialize_KTC_error_table ();
initialize_U_error_table();
initialize_RXK_error_table();
}
else
usage();
-
+ else if (strcmp(argv[i], "-config") == 0)
+ if (++i < argc) {
+ config = argv[i];
+ }
+ else
+ usage();
else if (argv[i][0] == '-')
usage();
else if (!pmode && !cmode) {
if ((cells.nelements + paths.nelements) == 0) {
struct passwd *pwd;
- status = auth_to_cell(context, NULL, NULL, &linkedcell);
+ status = auth_to_cell(context, config, NULL, NULL, &linkedcell);
/* If this cell is linked to a DCE cell, and user requested -linked,
* get tokens for both. This is very useful when the AFS cell is
if (!status && linked && linkedcell != NULL) {
afs_dprintf("Linked cell: %s\n", linkedcell);
- status = auth_to_cell(context, linkedcell, NULL, NULL);
+ status = auth_to_cell(context, config, linkedcell, NULL, NULL);
}
if (linkedcell) {
free(linkedcell);
afs_dprintf("Found cell %s in %s.\n", fcell, xlog_path);
- auth_status = auth_to_cell(context, fcell, NULL, NULL);
+ auth_status = auth_to_cell(context, config, fcell, NULL, NULL);
if (status == AKLOG_SUCCESS)
status = auth_status;
else
/* Log to all cells in the cells list first */
for (cur_node = cells.first; cur_node; cur_node = cur_node->next) {
memcpy((char *)&cellinfo, cur_node->data, sizeof(cellinfo));
- if ((status = auth_to_cell(context, cellinfo.cell, cellinfo.realm,
- &linkedcell)))
+ status = auth_to_cell(context, config, cellinfo.cell,
+ cellinfo.realm, &linkedcell);
+ if (status) {
somethingswrong++;
- else {
+ } else {
if (linked && linkedcell != NULL) {
afs_dprintf("Linked cell: %s\n", linkedcell);
- if ((status = auth_to_cell(context, linkedcell,
- cellinfo.realm, NULL)))
+ status = auth_to_cell(context, config, linkedcell,
+ cellinfo.realm, NULL);
+ if (status)
somethingswrong++;
}
if (linkedcell != NULL) {
/* Then, log to all paths in the paths list */
for (cur_node = paths.first; cur_node; cur_node = cur_node->next) {
- if ((status = auth_to_path(context, cur_node->data)))
+ status = auth_to_path(context, config, cur_node->data);
+ if (status)
somethingswrong++;
}
*realm = NULL;
- if (!_krb425_ccache)
- krb5_cc_default(context, &_krb425_ccache);
+ if (!_krb425_ccache) {
+ r = krb5_cc_default(context, &_krb425_ccache);
+ if (r)
+ return r;
+ }
if (!client_principal) {
if (client) {
r = krb5_parse_name(context, client, &client_principal);