* or implied warranty.
*/
+/*
+ * Copyright (c) 2007 Secure Endpoints Inc.
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Neither the name of the Secure Endpoints Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _WIN64
+#define HAVE_KRB4
+#endif
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <errno.h>
#include <afs/stds.h>
+#ifdef HAVE_KRB4
#include <krb.h>
+#else
+#define REALM_SZ 64
+#define ANAME_SZ 64
+#define INST_SZ 64
+#define KSUCCESS 0
+
+#define CREDENTIALS void
+#endif
#include <krb5.h>
#include <afs/ptserver.h>
+#include <afs/ptuser.h>
#ifdef WIN32
#include <windows.h>
#define DONT_HAVE_GET_AD_TKT
#define MAXSYMLINKS 255
+#ifdef HAVE_KRB4
/* Win32 uses get_krb_err_txt_entry(status) instead of krb_err_txt[status],
* so we use a bit of indirection like the GNU CVS sources.
*/
#define krb_err_text(status) get_krb_err_txt_entry(status)
+#endif
#define DRIVECOLON ':' /* Drive letter separator */
#define BDIR '\\' /* Other character that divides directories */
#define AKLOG_TOKEN 5
#define AKLOG_BADPATH 6
#define AKLOG_MISC 7
+#define AKLOG_KFW_NOT_INSTALLED 8
#ifndef NULL
#define NULL 0
static int usev5 = TRUE; /* use kerberos 5? */
static int use524 = FALSE; /* use krb524? */
+static krb5_context context = 0;
static krb5_ccache _krb425_ccache;
+void akexit(int exit_code)
+{
+ if (_krb425_ccache)
+ krb5_cc_close(context, _krb425_ccache);
+ if (context)
+ krb5_free_context(context);
+ exit(exit_code);
+}
+
long GetLocalCell(struct afsconf_dir **pconfigdir, char *local_cell)
{
if (!(*pconfigdir = afsconf_Open(AFSDIR_CLIENT_ETC_DIRPATH)))
{
fprintf(stderr, "%s: can't get afs configuration (afsconf_Open(%s))\n",
progname, AFSDIR_CLIENT_ETC_DIRPATH);
- exit(AKLOG_AFS);
+ akexit(AKLOG_AFS);
}
return afsconf_GetLocalCell(*pconfigdir, local_cell, MAXCELLCHARS);
static char lastcell[MAXCELLCHARS+1] = { 0 };
static char confname[512] = { 0 };
char username_copy[BUFSIZ];
- long viceId; /* AFS uid of user */
+ afs_int32 viceId; /* AFS uid of user */
#ifdef ALLOW_REGISTER
afs_int32 id;
#endif /* ALLOW_REGISTER */
if (dflag)
printf("About to resolve name %s to id\n", username);
- /*
- * Talk about DUMB! It turns out that there is a bug in
- * pr_Initialize -- even if you give a different cell name
- * to it, it still uses a connection to a previous AFS server
- * if one exists. The way to fix this is to change the
- * _filename_ argument to pr_Initialize - that forces it to
- * re-initialize the connection. We do this by adding and
- * removing a "/" on the end of the configuration directory name.
- */
-
- if (lastcell[0] != '\0' && (strcmp(lastcell, aserver->cell) != 0)) {
- int i = strlen(confname);
- if (confname[i - 1] == '/') {
- confname[i - 1] = '\0';
- } else {
- confname[i] = '/';
- confname[i + 1] = '\0';
- }
- }
-
strcpy(lastcell, aserver->cell);
- if (!pr_Initialize (0, confname, aserver->cell))
- *status = pr_SNameToId (username, &viceId);
+ if (!pr_Initialize (0, confname, aserver->cell)) {
+ char sname[PR_MAXNAMELEN], *at;
+
+ strncpy(sname, username, PR_MAXNAMELEN);
+ sname[PR_MAXNAMELEN-1] = '\0';
+
+ at = strchr(sname, '@');
+ if (at && !stricmp(at+1, realm_of_cell))
+ *at = '\0';
+ *status = pr_SNameToId (sname, &viceId);
+ }
if (dflag)
{
}
/*
- * This is a crock, but it is Transarc's crock, so
- * we have to play along in order to get the
- * functionality. The way the afs id is stored is
- * as a string in the username field of the token.
- * Contrary to what you may think by looking at
- * the code for tokens, this hack (AFS ID %d) will
- * not work if you change %d to something else.
- */
-
- /*
* This code is taken from cklog -- it lets people
* automatically register with the ptserver in foreign cells
*/
}
#ifdef ALLOW_REGISTER
} else if (strcmp(realm_of_user, realm_of_cell) != 0) {
+ int i;
if (dflag) {
printf("doing first-time registration of %s "
"at %s\n", username, cell_to_use);
}
id = 0;
strncpy(aclient->name, username, MAXKTCNAMELEN - 1);
+ aclient->name[MAXKTCNAMELEN - 1] = '\0';
strcpy(aclient->instance, "");
- strncpy(aclient->cell, c->realm, MAXKTCREALMLEN - 1);
+ strncpy(aclient->cell, cell_to_use, MAXKTCREALMLEN - 1);
+ aclient->cell[MAXKTCREALMLEN - 1] = '\0';
+
+ for ( i=0; aclient->cell[i]; i++ ) {
+ if ( islower(aclient->cell[i]) )
+ aclient->cell[i] = toupper(aclient->cell[i]);
+ }
+
if ((*status = ktc_SetToken(aserver, atoken, aclient, 0))) {
- printf("%s: unable to obtain tokens for cell %s "
- "(status: %d).\n", progname, cell_to_use, status);
+ printf("%s: unable to set tokens for cell %s "
+ "(status: %d).\n", progname, cell_to_use, *status);
*status = AKLOG_TOKEN;
return ;
}
* level
*/
- if ((*status = pr_Initialize(1L, confname, aserver->cell, 0))) {
- printf("Error %d\n", status);
+ if ((*status = pr_Initialize(1L, confname, aserver->cell))) {
+ printf("Error %d\n", *status);
return;
}
- if ((*status = pr_CreateUser(username, &id))) {
+ /* copy the name because pr_CreateUser lowercases the realm */
+ strncpy(username_copy, username, BUFSIZ);
+
+ *status = pr_CreateUser(username, &id);
+
+ /* and restore the name to the original state */
+ strncpy(username, username_copy, BUFSIZ);
+
+ if (*status) {
printf("%s: unable to create remote PTS "
"user %s in cell %s (status: %d).\n", progname,
username, cell_to_use, *status);
} else {
- printf("created cross-cell entry for %s at %s\n",
- username, cell_to_use);
+ printf("created cross-cell entry for %s (Id %d) at %s\n",
+ username, viceId, cell_to_use);
#ifdef AFS_ID_TO_NAME
- strncpy(username_copy, username, BUFSIZ);
snprintf (username, BUFSIZ, "%s (AFS ID %d)", username_copy, (int) viceId);
#endif /* AFS_ID_TO_NAME */
}
int des_pcbc_init()
{
abort();
+ return 0; /* avoid warning */
}
+#ifdef HAVE_KRB4
static int get_cred(char *name, char *inst, char *realm, CREDENTIALS *c)
{
int status;
return (status);
}
+#endif
static int get_v5cred(krb5_context context,
char *name, char *inst, char *realm, CREDENTIALS *c,
krb5_error_code r;
static krb5_principal client_principal = 0;
+ if (client_principal) {
+ krb5_free_principal(context, client_principal);
+ client_principal = 0;
+ }
+
memset((char *)&increds, 0, sizeof(increds));
- if ((r = krb5_build_principal(context, &increds.server,
- strlen(realm), realm,
- name,
- (inst && strlen(inst)) ? inst : 0,
- 0))) {
+ if ((r = krb5_build_principal(context, &increds.server,
+ (int)strlen(realm), realm,
+ name,
+ (inst && strlen(inst)) ? inst : 0,
+ 0))) {
return((int)r);
}
- if (!_krb425_ccache)
- krb5_cc_default(context, &_krb425_ccache);
- if (!client_principal)
- krb5_cc_get_principal(context, _krb425_ccache, &client_principal);
+ if (!_krb425_ccache) {
+ if ((r = krb5_cc_default(context, &_krb425_ccache)))
+ return ((int)r);
+ }
+ if (!client_principal) {
+ if ((r = krb5_cc_get_principal(context, _krb425_ccache, &client_principal))) {
+ krb5_cc_close(context, _krb425_ccache);
+ return ((int)r);
+ }
+ }
increds.client = client_principal;
increds.times.endtime = 0;
increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
r = krb5_get_credentials(context, 0, _krb425_ccache, &increds, creds);
- if (r)
+ if (r) {
return((int)r);
-
+ }
/* This requires krb524d to be running with the KDC */
if (c != NULL)
r = krb5_524_convert_creds(context, *creds, c);
+
return((int)r);
}
+#ifdef HAVE_KRB4
/* There is no header for this function. It is supposed to be private */
int krb_get_admhst(char *h,char *r, int n);
static char *afs_realm_of_cell(struct afsconf_cell *cellconfig)
{
- char krbhst[MAX_HSTNM];
- static char krbrlm[REALM_SZ+1];
+ char krbhst[MAX_HSTNM];
+ static char krbrlm[REALM_SZ+1];
+
+ if (!cellconfig)
+ return 0;
- if (!cellconfig)
- return 0;
+ strcpy(krbrlm, (char *) krb_realmofhost(cellconfig->hostName[0]));
- strcpy(krbrlm, (char *) krb_realmofhost(cellconfig->hostName[0]));
+ if (krb_get_admhst(krbhst, krbrlm, 1) != KSUCCESS)
+ {
+ char *s = krbrlm;
+ char *t = cellconfig->name;
+ int c;
- if (krb_get_admhst(krbhst, krbrlm, 1) != KSUCCESS)
+ while (c = *t++)
{
- char *s = krbrlm;
- char *t = cellconfig->name;
- int c;
-
- while (c = *t++)
- {
- if (islower(c))
- c = toupper(c);
- *s++ = c;
- }
- *s++ = 0;
+ if (islower(c))
+ c = toupper(c);
+ *s++ = c;
}
- return krbrlm;
+ *s++ = 0;
+ }
+ return krbrlm;
}
+#endif
-static char *afs_realm_of_cell5(krb5_context context, struct afsconf_cell *cellconfig)
+/* As of MIT Kerberos 1.6, krb5_get_host_realm() will return the NUL-string
+ * if there is no domain_realm mapping for the hostname's domain. This is
+ * used as a trigger indicating that referrals should be used within the
+ * krb5_get_credentials() call. However, if the KDC does not support referrals
+ * that will result in a KRB5_ERR_HOST_REALM_UNKNOWN error and we will have
+ * to manually fallback to mapping the domain of the host as a realm name.
+ * Hence, the new fallback parameter.
+ */
+static char *afs_realm_of_cell5(krb5_context context, struct afsconf_cell *cellconfig, int fallback)
{
- char ** krbrlms = 0;
- static char krbrlm[REALM_SZ+1];
- krb5_error_code status;
+ char ** krbrlms = 0;
+ static char krbrlm[REALM_SZ+1];
+ krb5_error_code status;
- if (!cellconfig)
- return 0;
+ if (!cellconfig)
+ return 0;
+ if (fallback) {
+ char * p;
+ p = strchr(cellconfig->hostName[0], '.');
+ if (p++)
+ strcpy(krbrlm, p);
+ else
+ strcpy(krbrlm, cellconfig->name);
+ strupr(krbrlm);
+ } else {
status = krb5_get_host_realm( context, cellconfig->hostName[0], &krbrlms );
-
if (status == 0 && krbrlms && krbrlms[0]) {
- strcpy(krbrlm, krbrlms[0]);
- } else {
- strcpy(krbrlm, cellconfig->name);
- strupr(krbrlm);
+ strcpy(krbrlm, krbrlms[0]);
+ } else {
+ strcpy(krbrlm, cellconfig->name);
+ strupr(krbrlm);
}
if (krbrlms)
- krb5_free_host_realm( context, krbrlms );
-
- return krbrlm;
-}
+ krb5_free_host_realm( context, krbrlms );
+ }
+ return krbrlm;
+}
static char *copy_cellinfo(cellinfo_t *cellinfo)
{
- cellinfo_t *new_cellinfo;
+ cellinfo_t *new_cellinfo;
- if (new_cellinfo = (cellinfo_t *)malloc(sizeof(cellinfo_t)))
- memcpy(new_cellinfo, cellinfo, sizeof(cellinfo_t));
+ if (new_cellinfo = (cellinfo_t *)malloc(sizeof(cellinfo_t)))
+ memcpy(new_cellinfo, cellinfo, sizeof(cellinfo_t));
- return ((char *)new_cellinfo);
+ return ((char *)new_cellinfo);
}
static char *copy_string(char *string)
{
- char *new_string;
+ char *new_string;
- if (new_string = (char *)calloc(strlen(string) + 1, sizeof(char)))
- (void) strcpy(new_string, string);
+ if (new_string = (char *)calloc(strlen(string) + 1, sizeof(char)))
+ (void) strcpy(new_string, string);
- return (new_string);
-}
+ return (new_string);
+}
static int get_cellconfig(char *cell, struct afsconf_cell *cellconfig,
char *local_cell)
{
- int status = AKLOG_SUCCESS;
- struct afsconf_dir *configdir = 0;
+ int status = AKLOG_SUCCESS;
+ struct afsconf_dir *configdir = 0;
- memset(local_cell, 0, sizeof(local_cell));
- memset(cellconfig, 0, sizeof(*cellconfig));
+ memset(local_cell, 0, sizeof(local_cell));
+ memset(cellconfig, 0, sizeof(*cellconfig));
- if (GetLocalCell(&configdir, local_cell))
- {
- fprintf(stderr, "%s: can't determine local cell.\n", progname);
- exit(AKLOG_AFS);
- }
+ if (GetLocalCell(&configdir, local_cell))
+ {
+ fprintf(stderr, "%s: can't determine local cell.\n", progname);
+ akexit(AKLOG_AFS);
+ }
- if ((cell == NULL) || (cell[0] == 0))
- cell = local_cell;
+ if ((cell == NULL) || (cell[0] == 0))
+ cell = local_cell;
- if (GetCellInfo(&configdir, cell, &cellconfig))
- {
- fprintf(stderr, "%s: Can't get information about cell %s.\n",
- progname, cell);
- status = AKLOG_AFS;
- }
+ if (GetCellInfo(&configdir, cell, &cellconfig))
+ {
+ fprintf(stderr, "%s: Can't get information about cell %s.\n",
+ progname, cell);
+ status = AKLOG_AFS;
+ }
- CloseConf(&configdir);
+ CloseConf(&configdir);
- return(status);
+ return(status);
}
static int get_v5_user_realm(krb5_context context,char *realm)
static int auth_to_cell(krb5_context context, char *cell, char *realm)
{
int status = AKLOG_SUCCESS;
- char username[BUFSIZ]; /* To hold client username structure */
+ char username[BUFSIZ]; /* To hold client username structure */
- char name[ANAME_SZ]; /* Name of afs key */
- char instance[INST_SZ]; /* Instance of afs key */
+ char name[ANAME_SZ]; /* Name of afs key */
+ char instance[INST_SZ]; /* Instance of afs key */
char realm_of_user[REALM_SZ]; /* Kerberos realm of user */
char realm_of_cell[REALM_SZ]; /* Kerberos realm of cell */
char local_cell[MAXCELLCHARS+1];
char cell_to_use[MAXCELLCHARS+1]; /* Cell to authenticate to */
krb5_creds *v5cred = NULL;
+#ifdef HAVE_KRB4
CREDENTIALS c;
+#endif
struct ktc_principal aserver;
struct ktc_principal aclient;
struct ktc_token atoken, btoken;
-
+ int i;
/* try to avoid an expensive call to get_cellconfig */
if (cell && ll_string_check(&authedcells, cell))
if (dflag)
printf("Authenticating to cell %s.\n", cell_to_use);
- if (realm && realm[0])
- strcpy(realm_of_cell, realm);
- else
- strcpy(realm_of_cell,
- (usev5)?
- afs_realm_of_cell5(context, &ak_cellconfig) :
- afs_realm_of_cell(&ak_cellconfig));
-
/* We use the afs.<cellname> convention here... */
strcpy(name, AFSKEY);
strncpy(instance, cell_to_use, sizeof(instance));
if (usev5)
{ /* using krb5 */
int retry = 1;
+ int realm_fallback = 0;
+
+ if ( strchr(name,'.') != NULL ) {
+ fprintf(stderr, "%s: Can't support principal names including a dot.\n",
+ progname);
+ return(AKLOG_MISC);
+ }
try_v5:
- if (dflag)
+ if (realm && realm[0])
+ strcpy(realm_of_cell, realm);
+ else
+ strcpy(realm_of_cell,
+ afs_realm_of_cell5(context, &ak_cellconfig, realm_fallback));
+
+ if (dflag)
printf("Getting v5 tickets: %s/%s@%s\n", name, instance, realm_of_cell);
status = get_v5cred(context, name, instance, realm_of_cell,
- use524 ? &c : NULL, &v5cred);
- if (status == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
+#ifdef HAVE_KRB4
+ use524 ? &c : NULL,
+#else
+ NULL,
+#endif
+ &v5cred);
+
+ if (status == 0 && strcmp(realm_of_cell, "") == 0) {
+ krb5_error_code code;
+ krb5_ticket *ticket;
+
+ code = krb5_decode_ticket(&v5cred->ticket, &ticket);
+
+ if (code != 0) {
+ fprintf(stderr,
+ "%s: Couldn't decode ticket to determine realm for "
+ "cell %s.\n",
+ progname, cell_to_use);
+ } else {
+ int len = krb5_princ_realm(context, ticket->server)->length;
+ /* This really shouldn't happen. */
+ if (len > REALM_SZ-1)
+ len = REALM_SZ-1;
+
+ strncpy(realm_of_cell, krb5_princ_realm(context, ticket->server)->data, len);
+ realm_of_cell[len] = 0;
+
+ krb5_free_ticket(context, ticket);
+ }
+ }
+
+ if (status == KRB5_ERR_HOST_REALM_UNKNOWN) {
+ realm_fallback = 1;
+ goto try_v5;
+ } else if (status == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN) {
+ if (!realm_of_cell[0]) {
+ realm_fallback = 1;
+ goto try_v5;
+ }
if (dflag)
printf("Getting v5 tickets: %s@%s\n", name, realm_of_cell);
status = get_v5cred(context, name, "", realm_of_cell,
- use524 ? &c : NULL, &v5cred);
- }
+#ifdef HAVE_KRB4
+ use524 ? &c : NULL,
+#else
+ NULL,
+#endif
+ &v5cred);
+ }
if ( status == KRB5KRB_AP_ERR_MSG_TYPE && retry ) {
retry = 0;
+ realm_fallback = 0;
goto try_v5;
}
}
else
{
- /*
+#ifdef HAVE_KRB4
+ if (realm && realm[0])
+ strcpy(realm_of_cell, realm);
+ else
+ strcpy(realm_of_cell, afs_realm_of_cell(&ak_cellconfig));
+
+ /*
* Try to obtain AFS tickets. Because there are two valid service
* names, we will try both, but trying the more specific first.
*
printf("Getting tickets: %s@%s\n", name, realm_of_cell);
status = get_cred(name, "", realm_of_cell, &c);
}
+#else
+ return(AKLOG_MISC);
+#endif
}
/* TODO: get k5 error text */
printf("Kerberos error code returned by get_cred: %d\n", status);
fprintf(stderr, "%s: Couldn't get %s AFS tickets: %s\n",
progname, cell_to_use,
- (usev5)?"":
- krb_err_text(status));
+#ifdef HAVE_KRB4
+ (usev5)?"":krb_err_text(status)
+#else
+ ""
+#endif
+ );
return(AKLOG_KERBEROS);
}
atoken.ticketLen = v5cred->ticket.length;
memcpy(atoken.ticket, v5cred->ticket.data, atoken.ticketLen);
} else {
+#ifdef HAVE_KRB4
strcpy (username, c.pname);
if (c.pinst[0])
{
memcpy(&atoken.sessionKey, c.session, 8);
atoken.ticketLen = c.ticket_st.length;
memcpy(atoken.ticket, c.ticket_st.dat, atoken.ticketLen);
+#else
+ return(AKLOG_MISC);
+#endif
}
if (!force &&
return(AKLOG_KERBEROS);
}
} else {
+#ifdef HAVE_KRB4
if ((status = krb_get_tf_realm(TKT_FILE, realm_of_user)) != KSUCCESS)
{
fprintf(stderr, "%s: Couldn't determine realm of user: %s)",
progname, krb_err_text(status));
return(AKLOG_KERBEROS);
}
+#else
+ return(AKLOG_MISC);
+#endif
}
- if (strcmp(realm_of_user, realm_of_cell))
+ /* For Khimaira we want to always append the realm to the name */
+ if (1 /* strcmp(realm_of_user, realm_of_cell) */)
{
strcat(username, "@");
strcat(username, realm_of_user);
}
- ViceIDToUsername(username, realm_of_user, realm_of_cell, cell_to_use, &c, &status, &aclient, &aserver, &atoken);
+ ViceIDToUsername(username, realm_of_user, realm_of_cell, cell_to_use,
+#ifdef HAVE_KRB4
+ &c,
+#else
+ NULL,
+#endif
+ &status, &aclient, &aserver, &atoken);
}
if (dflag)
int len = min(v5cred->client->realm.length,MAXKTCNAMELEN - 1);
strncpy(aclient.cell, v5cred->client->realm.data, len);
aclient.cell[len] = '\0';
- } else
+ }
+#ifdef HAVE_KRB4
+ else
strncpy(aclient.cell, c.realm, MAXKTCREALMLEN - 1);
+#endif
+
+ for ( i=0; aclient.cell[i]; i++ ) {
+ if ( islower(aclient.cell[i]) )
+ aclient.cell[i] = toupper(aclient.cell[i]);
+ }
if (dflag)
printf("Getting tokens.\n");
if (++symlinkcount > MAXSYMLINKS)
{
fprintf(stderr, "%s: %s\n", progname, strerror(ELOOP));
- exit(AKLOG_BADPATH);
+ akexit(AKLOG_BADPATH);
}
memset(tmpbuf, 0, sizeof(tmpbuf));
if (elast_comp)
fprintf(stderr, "Unable to find current working directory:\n");
fprintf(stderr, "%s\n", pathtocheck);
fprintf(stderr, "Try an absolute pathname.\n");
- exit(AKLOG_BADPATH);
+ akexit(AKLOG_BADPATH);
}
else
{
"[-d] [[-cell | -c] cell [-k krb_realm]] ",
"[[-p | -path] pathname]\n",
" [-noprdb] [-force]\n",
+#ifdef HAVE_KRB4
" [-5 [-m]| -4]\n"
+#else
+ " [-5]\n"
+#endif
);
fprintf(stderr, " -d gives debugging information.\n");
fprintf(stderr, " krb_realm is the kerberos realm of a cell.\n");
fprintf(stderr, " pathname is the name of a directory to which ");
fprintf(stderr, "you wish to authenticate.\n");
fprintf(stderr, " -noprdb means don't try to determine AFS ID.\n");
- fprintf(stderr, " -5 or -4 selects whether to use Kerberos V or Kerberos IV.\n"
- " (default is Kerberos V)\n");
- fprintf(stderr, " -m means use krb524d to convert Kerberos V tickets.\n");
+#ifdef HAVE_KRB4
+ fprintf(stderr, " -5 or -4 selects whether to use Kerberos v5 or Kerberos v4.\n"
+ " (default is Kerberos v5)\n");
+ fprintf(stderr, " -m means use krb524d to convert Kerberos v5 tickets.\n");
+#else
+ fprintf(stderr, " -5 use Kerberos v5.\n"
+ " (only Kerberos v5 is available)\n");
+#endif
fprintf(stderr, " No commandline arguments means ");
fprintf(stderr, "authenticate to the local cell.\n");
fprintf(stderr, "\n");
- exit(AKLOG_USAGE);
+ akexit(AKLOG_USAGE);
+}
+
+void
+validate_krb5_availability(void)
+{
+#ifndef _WIN64
+#define KRB5LIB "krb5_32.dll"
+#else
+#define KRB5LIB "krb5_64.dll"
+#endif
+ HINSTANCE h = LoadLibrary(KRB5LIB);
+ if (h)
+ FreeLibrary(h);
+ else {
+ fprintf(stderr, "Kerberos for Windows library %s is not available.\n", KRB5LIB);
+ akexit(AKLOG_KFW_NOT_INSTALLED);
+ }
+}
+
+void
+validate_krb4_availability(void)
+{
+#ifdef HAVE_KRB4
+ HINSTANCE h = LoadLibrary("krbv4w32.dll");
+ if (h)
+ FreeLibrary(h);
+ else {
+ fprintf(stderr, "Kerberos for Windows library krbv4w32.dll is not available.\n");
+ akexit(AKLOG_KFW_NOT_INSTALLED);
+ }
+#else
+ fprintf(stderr, "Kerberos v4 is not available in this build of aklog.\n");
+ akexit(AKLOG_USAGE);
+#endif
}
int main(int argc, char *argv[])
linked_list paths; /* List of paths to log to */
ll_node *cur_node;
- krb5_context context = 0;
-
memset(&cellinfo, 0, sizeof(cellinfo));
memset(realm, 0, sizeof(realm));
dflag++;
else if (strcmp(argv[i], "-5") == 0)
usev5++;
+#ifdef HAVE_KRB4
else if (strcmp(argv[i], "-m") == 0)
use524++;
else if (strcmp(argv[i], "-4") == 0)
usev5 = 0;
+#endif
else if (strcmp(argv[i], "-noprdb") == 0)
noprdb++;
else if (strcmp(argv[i], "-force") == 0)
else
{
fprintf(stderr, "%s: failure copying cellinfo.\n", progname);
- exit(AKLOG_MISC);
+ akexit(AKLOG_MISC);
}
}
else
{
fprintf(stderr, "%s: failure adding cell to cells list.\n",
progname);
- exit(AKLOG_MISC);
+ akexit(AKLOG_MISC);
}
memset(&cellinfo, 0, sizeof(cellinfo));
cmode = FALSE;
{
fprintf(stderr, "%s: failure copying path name.\n",
progname);
- exit(AKLOG_MISC);
+ akexit(AKLOG_MISC);
}
}
else
{
fprintf(stderr, "%s: failure adding path to paths list.\n",
progname);
- exit(AKLOG_MISC);
+ akexit(AKLOG_MISC);
}
pmode = FALSE;
memset(path, 0, sizeof(path));
}
}
+ if (usev5)
+ validate_krb5_availability();
+ else
+ validate_krb4_availability();
+
if(usev5)
krb5_init_context(&context);
status = AKLOG_SOMETHINGSWRONG;
}
- if(usev5)
- krb5_free_context(context);
-
- exit(status);
+ akexit(status);
}
git://git.openafs.org / openafs.git / blobdiff