xref: /illumos-gate/usr/src/cmd/krb5/slave/kprop.c (revision 0d8b5334)
1 /*
2  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * slave/kprop.c
10  *
11  * Copyright 1990,1991 by the Massachusetts Institute of Technology.
12  * All Rights Reserved.
13  *
14  * Export of this software from the United States of America may
15  *   require a specific license from the United States Government.
16  *   It is the responsibility of any person or organization contemplating
17  *   export to obtain such a license before exporting.
18  *
19  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
20  * distribute this software and its documentation for any purpose and
21  * without fee is hereby granted, provided that the above copyright
22  * notice appear in all copies and that both that copyright notice and
23  * this permission notice appear in supporting documentation, and that
24  * the name of M.I.T. not be used in advertising or publicity pertaining
25  * to distribution of the software without specific, written prior
26  * permission.  Furthermore if you modify this software you must label
27  * your software as modified software and not distribute it in such a
28  * fashion that it might be confused with the original M.I.T. software.
29  * M.I.T. makes no representations about the suitability of
30  * this software for any purpose.  It is provided "as is" without express
31  * or implied warranty.
32  *
33  *
34  */
35 
36 
37 #include <errno.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <ctype.h>
41 #include <sys/file.h>
42 #include <signal.h>
43 #include <string.h>
44 #include <sys/types.h>
45 #include <sys/time.h>
46 #include <sys/stat.h>
47 #include <sys/socket.h>
48 #include <netinet/in.h>
49 #include <sys/param.h>
50 #include <netdb.h>
51 #include <fcntl.h>
52 #include <libintl.h>
53 #include <locale.h>
54 #include <k5-int.h>
55 #include "com_err.h"
56 #include "kprop.h"
57 static char *kprop_version = KPROP_PROT_VERSION;
58 
59 char	*progname = 0;
60 int     debug = 0;
61 char	*srvtab = 0;
62 char	*slave_host;
63 char	*realm = 0;
64 char	*file = KPROP_DEFAULT_FILE;
65 short	port = 0;
66 
67 krb5_principal	my_principal;		/* The Kerberos principal we'll be */
68 				/* running under, initialized in */
69 				/* get_tickets() */
70 krb5_ccache	ccache;		/* Credentials cache which we'll be using */
71 /* krb5_creds 	my_creds;	/* My credentials */
72 krb5_creds	creds;
73 krb5_address	sender_addr;
74 krb5_address	receiver_addr;
75 
76 void	PRS
77 	 (int, char **);
78 void	get_tickets
79 	 (krb5_context);
80 static void usage
81 	 (void);
82 krb5_error_code open_connection
83 	(char *, int *, char *, int);
84 void	kerberos_authenticate
85 	 (krb5_context, krb5_auth_context *,
86 		   int, krb5_principal, krb5_creds **);
87 int	open_database
88 	 (krb5_context, char *, int *);
89 void	close_database
90 	 (krb5_context, int);
91 void	xmit_database
92 	 (krb5_context, krb5_auth_context, krb5_creds *,
93 		   int, int, int);
94 void	send_error
95 	 (krb5_context, krb5_creds *, int, char *, krb5_error_code);
96 void	update_last_prop_file
97 	 (char *, char *);
98 
99 static void usage()
100 {
101 	fprintf(stderr,
102 		gettext
103 		("\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n"),
104 		progname);
105 	exit(1);
106 }
107 
108 int
109 main(argc, argv)
110 	int	argc;
111 	char	**argv;
112 {
113 	int	fd, database_fd, database_size;
114 	krb5_error_code	retval;
115 	krb5_context context;
116 	krb5_creds *my_creds;
117 	krb5_auth_context auth_context;
118 #define	ERRMSGSIZ	256
119 	char	Errmsg[ERRMSGSIZ];
120 
121 	(void) setlocale(LC_ALL, "");
122 
123 #if !defined(TEXT_DOMAIN)		/* Should be defined by cc -D */
124 #define	TEXT_DOMAIN	"KPROP_TEST"	/* Use this only if it weren't */
125 #endif
126 
127 	(void) textdomain(TEXT_DOMAIN);
128 
129 	retval = krb5_init_context(&context);
130 	if (retval) {
131 		com_err(argv[0], retval, gettext("while initializing krb5"));
132 		exit(1);
133 	}
134 	PRS(argc, argv);
135 	get_tickets(context);
136 
137 	database_fd = open_database(context, file, &database_size);
138 	if (retval = open_connection(slave_host, &fd, Errmsg, sizeof(Errmsg))) {
139 		com_err(progname, retval, gettext("%s while opening connection to %s"),
140 			Errmsg, slave_host);
141 		exit(1);
142 	}
143 	if (fd < 0) {
144 		fprintf(stderr,
145 			gettext("%s: %s while opening connection to %s\n"),
146 			progname, Errmsg, slave_host);
147 		exit(1);
148 	}
149 	kerberos_authenticate(context, &auth_context, fd, my_principal,
150 			      &my_creds);
151 	xmit_database(context, auth_context, my_creds, fd, database_fd,
152 		      database_size);
153 	update_last_prop_file(slave_host, file);
154 	printf(gettext("Database propagation to %s: SUCCEEDED\n"), slave_host);
155 	krb5_free_cred_contents(context, my_creds);
156 	close_database(context, database_fd);
157 	exit(0);
158 }
159 void PRS(argc, argv)
160 	int	argc;
161 	char	**argv;
162 {
163 	int c;
164 	register char	*word, ch;
165 	extern int optind;
166 	extern char *optarg;
167 
168 	progname = argv[0];
169 	while ((c= getopt(argc, argv, "r:f:dP:s:h:")) != EOF) {
170 		switch (c) {
171 				case 'r':
172 			realm = optarg;
173 					if (!realm)
174 						usage();
175 					break;
176 				case 'f':
177 			file = optarg;
178 					if (!file)
179 						usage();
180 					break;
181 				case 'd':
182 					debug++;
183 					break;
184 				case 'P':
185 			port = atoi(optarg);
186 					if (!port)
187 						usage();
188 					break;
189 				case 's':
190 			srvtab = optarg;
191 					if (!srvtab)
192 						usage();
193 					break;
194 		case '?':
195 				default:
196 			printf (gettext("Error \n"));
197 					usage();
198 				}
199 			}
200 	argc -= optind;
201 	argv = &argv[optind];
202 	if (*argv)
203 		slave_host = *argv;
204 			else
205 		usage();
206 
207 }
208 
209 void get_tickets(context)
210     krb5_context context;
211 {
212 	char   my_host_name[MAXHOSTNAMELEN];
213 	char   buf[BUFSIZ];
214 	char   *cp;
215 	struct hostent *hp;
216 	krb5_error_code retval;
217 	static char tkstring[] = "/tmp/kproptktXXXXXX";
218 	krb5_keytab keytab = NULL;
219 	krb5_get_init_creds_opt opt;
220 	char *svcname = NULL;
221 	char *def_realm = NULL;
222 	char *master_host = NULL;
223 
224 
225 	/*
226 	 * Figure out what tickets we'll be using to send stuff
227 	 */
228 	if (realm) {
229 	    if ((def_realm = strdup(realm)) == NULL) {
230 	      com_err(progname, ENOMEM,
231 		      gettext("while allocating default realm name '%s'"),
232 		      realm);
233 	      exit(1);
234 	    }
235 	} else {
236 	    retval = krb5_get_default_realm(context, &def_realm);
237 	    if (retval) {
238 	        com_err(progname, retval,
239 			gettext("while getting default realm"));
240 	        exit(1);
241 	    }
242 	}
243 
244 	/*
245 	 * Always pick up the master hostname from krb5.conf, as
246 	 * opposed to picking up the localhost, so we do not get bit
247 	 * if the master KDC is HA and hence points to a logicalhost.
248 	 */
249 	retval = kadm5_get_master(context, def_realm, &master_host);
250 	if (retval) {
251 	    free(def_realm);
252 	    com_err(progname, retval,
253 		gettext("while getting admin server fqdn"));
254 	    exit(1);
255 	}
256 
257 	retval = krb5_sname_to_principal(context, master_host, NULL,
258 					 KRB5_NT_SRV_HST, &my_principal);
259 
260 	free(def_realm);
261 	free(master_host);
262 	if (retval) {
263 	    com_err(progname, errno, gettext("while setting client principal name"));
264 	    exit(1);
265 	}
266 
267 	if (realm) {
268 	    (void) krb5_xfree(krb5_princ_realm(context, my_principal)->data);
269 	    krb5_princ_set_realm_length(context, my_principal, strlen(realm));
270 	    krb5_princ_set_realm_data(context, my_principal, strdup(realm));
271 	}
272 #if 0
273 	krb5_princ_type(context, my_principal) = KRB5_NT_PRINCIPAL;
274 #endif
275 
276 	/*
277 	 * Initialize cache file which we're going to be using
278 	 */
279 	(void) mktemp(tkstring);
280 	snprintf(buf, sizeof (buf), gettext("FILE:%s"), tkstring);
281 	if (retval = krb5_cc_resolve(context, buf, &ccache)) {
282 		com_err(progname, retval, gettext("while opening credential cache %s"),
283 			buf);
284 		exit(1);
285 	}
286 	if (retval = krb5_cc_initialize(context, ccache, my_principal)) {
287 		com_err (progname, retval, gettext("when initializing cache %s"),
288 			 buf);
289 		exit(1);
290 	}
291 
292 	/*
293 	 * Get the tickets we'll need.
294 	 *
295 	 * Construct the principal name for the slave host.
296 	 */
297 	memset((char *)&creds, 0, sizeof(creds));
298 	retval = krb5_sname_to_principal(context,
299 					 slave_host, KPROP_SERVICE_NAME,
300 					 KRB5_NT_SRV_HST, &creds.server);
301 	if (retval) {
302 	    com_err(progname, errno, gettext("while setting server principal name"));
303 	    (void) krb5_cc_destroy(context, ccache);
304 	    exit(1);
305 	}
306 	if (realm) {
307 	    (void) krb5_xfree(krb5_princ_realm(context, creds.server)->data);
308 	    krb5_princ_set_realm_length(context, creds.server, strlen(realm));
309 	    krb5_princ_set_realm_data(context, creds.server, strdup(realm));
310 	}
311 
312 	/*
313 	 * Now fill in the client....
314 	 */
315 	if (retval = krb5_copy_principal(context, my_principal, &creds.client)) {
316 		com_err(progname, retval, gettext("While copying client principal"));
317 		(void) krb5_cc_destroy(context, ccache);
318 		exit(1);
319 	}
320 	if (srvtab) {
321 		if (retval = krb5_kt_resolve(context, srvtab, &keytab)) {
322 			com_err(progname, retval, gettext("while resolving keytab"));
323 			(void) krb5_cc_destroy(context, ccache);
324 			exit(1);
325 		}
326 	}
327 	(void) memset(&opt, 0, sizeof (opt));
328 	krb5_get_init_creds_opt_init(&opt);
329 	retval = krb5_unparse_name(context,  creds.server, &svcname);
330 	if (retval) {
331 		com_err(progname, errno, gettext("while parsing svc principal name"));
332 		(void) krb5_cc_destroy(context, ccache);
333 		exit (1);
334 	}
335 	retval = krb5_get_init_creds_keytab(context, &creds, creds.client,
336 				keytab,  0, svcname, &opt);
337 
338 	if (svcname)
339 		free(svcname);
340 
341 	if (retval) {
342 		com_err(progname, retval, gettext("while getting initial ticket\n"));
343 		(void) krb5_cc_destroy(context, ccache);
344 		exit(1);
345 	}
346 
347 	if (keytab)
348 	    (void) krb5_kt_close(context, keytab);
349 
350 	/*
351 	 * Now destroy the cache right away --- the credentials we
352 	 * need will be in my_creds.
353 	 */
354 	if (retval = krb5_cc_destroy(context, ccache)) {
355 		com_err(progname, retval, gettext("while destroying ticket cache"));
356 		exit(1);
357 	}
358 }
359 
360 krb5_error_code
361 open_connection(host, fd, Errmsg, ErrmsgSz)
362 	char	*host;
363 	int	*fd;
364 	char	*Errmsg;
365 	int	 ErrmsgSz;
366 {
367 	int	s;
368 	krb5_error_code	retval;
369 
370 	int	socket_length;
371 	struct addrinfo hints, *ai, *aitop;
372 	struct sockaddr_storage	  ss;
373 	char serv_or_port[NI_MAXSERV];
374 	enum err_types {SOCKET, CONNECT};
375 	int which_err;
376 
377 	memset(&hints, 0, sizeof(hints));
378 	hints.ai_family = AF_UNSPEC;    /* go for either IPv4 or v6 */
379 	hints.ai_socktype = SOCK_STREAM;
380 
381 	if (port != 0)
382 		(void) snprintf(serv_or_port, sizeof(serv_or_port), ("%hu"),
383 				port);
384 	else
385 		strncpy(serv_or_port, KPROP_SERVICE, sizeof(serv_or_port));
386 
387 	if (getaddrinfo(host, serv_or_port, &hints, &aitop) != 0) {
388 		(void) snprintf(Errmsg, ERRMSGSIZ, gettext("%s: unknown host"),
389 				host);
390 		*fd = -1;
391 		return(0);
392 	}
393 
394 	for (ai = aitop; ai; ai = ai->ai_next) {
395 		if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
396 			continue;
397 
398 		s = socket(ai->ai_family, SOCK_STREAM, 0);
399 		if (s < 0) {
400 			which_err = SOCKET;
401 			retval = errno;
402 			continue;
403 		}
404 
405 		if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
406 		    errno != EINPROGRESS) {
407 			which_err = CONNECT;
408 			retval = errno;
409 			close(s);
410 			continue;	/* fail -- try next */
411 		}
412 
413 		break; /* success */
414 	}
415 
416 	if (ai == NULL) {
417 		switch (which_err) {
418 			case SOCKET:
419 				(void) snprintf(Errmsg, ERRMSGSIZ,
420 						gettext("in call to socket"));
421 				break;
422 			case CONNECT:
423 				(void) snprintf(Errmsg, ERRMSGSIZ,
424 						gettext("in call to connect"));
425 				break;
426 			default :
427 				retval = -1; /* generic error */
428 				(void) snprintf(Errmsg, ERRMSGSIZ,
429 					gettext("could not setup network"));
430 				break;
431 		}
432 		if (aitop != NULL)
433 			freeaddrinfo(aitop);
434 		return(retval);
435 	}
436 
437 	*fd = s;
438 
439 	/*
440 	 * Set receiver_addr and sender_addr.
441 	 */
442 	if (cvtkaddr((struct sockaddr_storage *)ai->ai_addr, &receiver_addr)
443 			== NULL) {
444 		retval = errno;
445 		com_err(progname, errno,
446 			gettext("while converting socket address"));
447 		if (aitop != NULL)
448 			freeaddrinfo(aitop);
449 		return(retval);
450 	}
451 	if (aitop != NULL)
452 		freeaddrinfo(aitop);
453 
454 	socket_length = sizeof(ss);
455 	if (getsockname(s, (struct sockaddr *)&ss, &socket_length) < 0) {
456 		retval = errno;
457 		close(s);
458 		(void) snprintf(Errmsg, ERRMSGSIZ,
459 				gettext("in call to getsockname"));
460 		return(retval);
461 	}
462 
463 	if (cvtkaddr(&ss, &sender_addr) == NULL) {
464 		retval = errno;
465 		com_err(progname, errno,
466 			gettext("while converting socket address"));
467 		return(retval);
468 	}
469 
470 	return(0);
471 }
472 
473 
474 void kerberos_authenticate(context, auth_context, fd, me, new_creds)
475     krb5_context context;
476     krb5_auth_context *auth_context;
477     int	fd;
478     krb5_principal me;
479     krb5_creds ** new_creds;
480 {
481 	krb5_error_code	retval;
482 	krb5_error	*error = NULL;
483 	krb5_ap_rep_enc_part	*rep_result;
484 
485     if (retval = krb5_auth_con_init(context, auth_context))
486 	exit(1);
487 
488     krb5_auth_con_setflags(context, *auth_context,
489 			   KRB5_AUTH_CONTEXT_DO_SEQUENCE);
490 
491     if (retval = krb5_auth_con_setaddrs(context, *auth_context, &sender_addr,
492 				        &receiver_addr)) {
493 	com_err(progname, retval, gettext("in krb5_auth_con_setaddrs"));
494 	exit(1);
495     }
496 
497 	if (retval = krb5_sendauth(context, auth_context, (void *)&fd,
498 				   kprop_version, me, creds.server,
499 				   AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
500 				   &error, &rep_result, new_creds)) {
501 		com_err(progname, retval, gettext("while authenticating to server"));
502 		if (error) {
503 			if (error->error == KRB_ERR_GENERIC) {
504 				if (error->text.data)
505 					fprintf(stderr,
506 						gettext("Generic remote error: %s\n"),
507 						error->text.data);
508 			} else if (error->error) {
509 				com_err(progname,
510 					error->error + ERROR_TABLE_BASE_krb5,
511 					gettext("signalled from server"));
512 				if (error->text.data)
513 					fprintf(stderr,
514 					gettext("Error text from server: %s\n"),
515 						error->text.data);
516 			}
517 			krb5_free_error(context, error);
518 		}
519 		exit(1);
520 	}
521 	krb5_free_ap_rep_enc_part(context, rep_result);
522 }
523 
524 char * dbpathname;
525 /*
526  * Open the Kerberos database dump file.  Takes care of locking it
527  * and making sure that the .ok file is more recent that the database
528  * dump file itself.
529  *
530  * Returns the file descriptor of the database dump file.  Also fills
531  * in the size of the database file.
532  */
533 int
534 open_database(context, data_fn, size)
535     krb5_context context;
536     char *data_fn;
537     int	*size;
538 {
539 	int		fd;
540 	int		err;
541 	struct stat 	stbuf, stbuf_ok;
542 	char		*data_ok_fn;
543 	static char ok[] = ".dump_ok";
544 
545 	dbpathname = strdup(data_fn);
546 	if (!dbpathname) {
547  	    com_err(progname, ENOMEM, gettext("allocating database file name '%s'"),
548  		    data_fn);
549  	    exit(1);
550  	}
551 	if ((fd = open(dbpathname, O_RDONLY)) < 0) {
552 		com_err(progname, errno, gettext("while trying to open %s"),
553 			dbpathname);
554 		exit(1);
555 	}
556 
557 	err = krb5_lock_file(context, fd,
558 			     KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
559 	if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
560 	    com_err(progname, 0, gettext("database locked"));
561 	    exit(1);
562 	} else if (err) {
563 	    com_err(progname, err, gettext("while trying to lock '%s'"), dbpathname);
564 	    exit(1);
565 	}
566 	if (fstat(fd, &stbuf)) {
567 		com_err(progname, errno, gettext("while trying to stat %s"),
568 			data_fn);
569 		exit(1);
570 	}
571 	if ((data_ok_fn = (char *) malloc(strlen(data_fn)+strlen(ok)+1))
572 	    == NULL) {
573 		com_err(progname, ENOMEM, gettext("while trying to malloc data_ok_fn"));
574 		exit(1);
575 	}
576 	strcpy(data_ok_fn, data_fn);
577 	strcat(data_ok_fn, ok);
578 	if (stat(data_ok_fn, &stbuf_ok)) {
579 		com_err(progname, errno, gettext("while trying to stat %s"),
580 			data_ok_fn);
581 		free(data_ok_fn);
582 		exit(1);
583 	}
584 	free(data_ok_fn);
585 	if (stbuf.st_mtime > stbuf_ok.st_mtime) {
586 		com_err(progname, 0, gettext("'%s' more recent than '%s'."),
587 			data_fn, data_ok_fn);
588 		exit(1);
589 	}
590 	*size = stbuf.st_size;
591 	return(fd);
592 }
593 
594 void
595 close_database(context, fd)
596     krb5_context context;
597     int fd;
598 {
599     int err;
600     if (err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK))
601 	com_err(progname, err, gettext("while unlocking database '%s'"), dbpathname);
602     free(dbpathname);
603     (void)close(fd);
604     return;
605 }
606 
607 /*
608  * Now we send over the database.  We use the following protocol:
609  * Send over a KRB_SAFE message with the size.  Then we send over the
610  * database in blocks of KPROP_BLKSIZE, encrypted using KRB_PRIV.
611  * Then we expect to see a KRB_SAFE message with the size sent back.
612  *
613  * At any point in the protocol, we may send a KRB_ERROR message; this
614  * will abort the entire operation.
615  */
616 void
617 xmit_database(context, auth_context, my_creds, fd, database_fd, database_size)
618     krb5_context context;
619     krb5_auth_context auth_context;
620     krb5_creds *my_creds;
621     int	fd;
622     int	database_fd;
623     int	database_size;
624 {
625 	krb5_int32	send_size, sent_size, n;
626 	krb5_data	inbuf, outbuf;
627 	char		buf[KPROP_BUFSIZ];
628 	krb5_error_code	retval;
629 	krb5_error	*error;
630 
631 	/*
632 	 * Send over the size
633 	 */
634 	send_size = htonl(database_size);
635 	inbuf.data = (char *) &send_size;
636 	inbuf.length = sizeof(send_size); /* must be 4, really */
637 	/* KPROP_CKSUMTYPE */
638 	if (retval = krb5_mk_safe(context, auth_context, &inbuf,
639 				  &outbuf, NULL)) {
640 		com_err(progname, retval, gettext("while encoding database size"));
641 		send_error(context, my_creds, fd, gettext("while encoding database size"), retval);
642 		exit(1);
643 	}
644 	if (retval = krb5_write_message(context, (void *) &fd, &outbuf)) {
645 		krb5_free_data_contents(context, &outbuf);
646 		com_err(progname, retval, gettext("while sending database size"));
647 		exit(1);
648 	}
649 	krb5_free_data_contents(context, &outbuf);
650     /*
651      * Initialize the initial vector.
652      */
653     if (retval = krb5_auth_con_initivector(context, auth_context)) {
654 	send_error(context, my_creds, fd,
655 		   gettext("failed while initializing i_vector"), retval);
656 	com_err(progname, retval, gettext("while allocating i_vector"));
657 	exit(1);
658     }
659 	/*
660 	 * Send over the file, block by block....
661 	 */
662 	inbuf.data = buf;
663 	sent_size = 0;
664 	while (n = read(database_fd, buf, sizeof(buf))) {
665 		inbuf.length = n;
666 		if (retval = krb5_mk_priv(context, auth_context, &inbuf,
667 					  &outbuf, NULL)) {
668 			snprintf(buf, sizeof (buf),
669 				gettext("while encoding database block starting at %d"),
670 				sent_size);
671 			com_err(progname, retval, buf);
672 			send_error(context, my_creds, fd, buf, retval);
673 			exit(1);
674 		}
675 		if (retval = krb5_write_message(context, (void *)&fd,&outbuf)) {
676 			krb5_free_data_contents(context, &outbuf);
677 			com_err(progname, retval,
678 				gettext("while sending database block starting at %d"),
679 				sent_size);
680 			exit(1);
681 		}
682 		krb5_free_data_contents(context, &outbuf);
683 		sent_size += n;
684 		if (debug)
685 			printf(gettext("%d bytes sent.\n"), sent_size);
686 	}
687 	if (sent_size != database_size) {
688 		com_err(progname, 0, gettext("Premature EOF found for database file!"));
689 		send_error(context, my_creds, fd,gettext("Premature EOF found for database file!"),
690 			   KRB5KRB_ERR_GENERIC);
691 		exit(1);
692 	}
693 	/*
694 	 * OK, we've sent the database; now let's wait for a success
695 	 * indication from the remote end.
696 	 */
697 	if (retval = krb5_read_message(context, (void *) &fd, &inbuf)) {
698 		com_err(progname, retval,
699 			gettext("while reading response from server"));
700 		exit(1);
701 	}
702 	/*
703 	 * If we got an error response back from the server, display
704 	 * the error message
705 	 */
706 	if (krb5_is_krb_error(&inbuf)) {
707 		if (retval = krb5_rd_error(context, &inbuf, &error)) {
708 			com_err(progname, retval,
709 				gettext("while decoding error response from server"));
710 			exit(1);
711 		}
712 		if (error->error == KRB_ERR_GENERIC) {
713 			if (error->text.data)
714 				fprintf(stderr,
715 				gettext("Generic remote error: %s\n"),
716 					error->text.data);
717 		} else if (error->error) {
718 			com_err(progname, error->error + ERROR_TABLE_BASE_krb5,
719 				gettext("signalled from server"));
720 			if (error->text.data)
721 				fprintf(stderr,
722 				gettext("Error text from server: %s\n"),
723 					error->text.data);
724 		}
725 		krb5_free_error(context, error);
726 		exit(1);
727 	}
728 	if (retval = krb5_rd_safe(context,auth_context,&inbuf,&outbuf,NULL)) {
729 		com_err(progname, retval,
730 			gettext("while decoding final size packet from server"));
731 		exit(1);
732 	}
733 	memcpy((char *)&send_size, outbuf.data, sizeof(send_size));
734 	send_size = ntohl(send_size);
735 	if (send_size != database_size) {
736 		com_err(progname, 0,
737 			gettext("Kpropd sent database size %d, expecting %d"),
738 			send_size, database_size);
739 		exit(1);
740 	}
741 	free(outbuf.data);
742 	free(inbuf.data);
743 }
744 
745 void
746 send_error(context, my_creds, fd, err_text, err_code)
747     krb5_context context;
748     krb5_creds *my_creds;
749     int	fd;
750     char	*err_text;
751     krb5_error_code	err_code;
752 {
753 	krb5_error	error;
754 	const char	*text;
755 	krb5_data	outbuf;
756 
757 	memset((char *)&error, 0, sizeof(error));
758 	krb5_us_timeofday(context, &error.ctime, &error.cusec);
759 	error.server = my_creds->server;
760 	error.client = my_principal;
761 	error.error = err_code - ERROR_TABLE_BASE_krb5;
762 	if (error.error > 127)
763 		error.error = KRB_ERR_GENERIC;
764 	if (err_text)
765 		text = err_text;
766 	else
767 		text = error_message(err_code);
768 	error.text.length = strlen(text) + 1;
769 	if (error.text.data = malloc(error.text.length)) {
770 		strcpy(error.text.data, text);
771 		if (!krb5_mk_error(context, &error, &outbuf)) {
772 			(void) krb5_write_message(context, (void *)&fd,&outbuf);
773 			krb5_free_data_contents(context, &outbuf);
774 		}
775 		free(error.text.data);
776 	}
777 }
778 
779 void update_last_prop_file(hostname, file_name)
780 	char *hostname;
781 	char *file_name;
782 {
783 	/* handle slave locking/failure stuff */
784 	char *file_last_prop;
785 	int fd;
786 	static char last_prop[]=".last_prop";
787 
788 	if ((file_last_prop = (char *)malloc(strlen(file_name) +
789 					     strlen(hostname) + 1 +
790 					     strlen(last_prop) + 1)) == NULL) {
791 		com_err(progname, ENOMEM,
792 			gettext("while allocating filename for update_last_prop_file"));
793 		return;
794 	}
795 	strcpy(file_last_prop, file_name);
796 
797 	/*
798 	 * If a nondefault file name was specified then we should not add an
799 	 * extraneous host name to the file name given that a file name could
800 	 * have already specified a host name and therefore would be redundant.
801 	 */
802 	if (strcmp(file_name, KPROP_DEFAULT_FILE) == 0) {
803 		strcat(file_last_prop, ".");
804 		strcat(file_last_prop, hostname);
805 	}
806 	strcat(file_last_prop, last_prop);
807 	if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
808 		com_err(progname, errno,
809 			gettext("while creating 'last_prop' file, '%s'"),
810 			file_last_prop);
811 		free(file_last_prop);
812 		return;
813 	}
814 	write(fd, "", 1);
815 	free(file_last_prop);
816 	close(fd);
817 	return;
818 }
819