krb5/kinit/kinit.c

/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */


/*
 * clients/kinit/kinit.c
 *
 * Copyright 1990 by the Massachusetts Institute of Technology.
 * All Rights Reserved.
 *
 * Export of this software from the United States of America may
 *   require a specific license from the United States Government.
 *   It is the responsibility of any person or organization contemplating
 *   export to obtain such a license before exporting.
 *
 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
 * distribute this software and its documentation for any purpose and
 * without fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright notice and
 * this permission notice appear in supporting documentation, and that
 * the name of M.I.T. not be used in advertising or publicity pertaining
 * to distribution of the software without specific, written prior
 * permission.  Furthermore if you modify this software you must label
 * your software as modified software and not distribute it in such a
 * fashion that it might be confused with the original M.I.T. software.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is" without express
 * or implied warranty.
 *
 *
 * Initialize a credentials cache.
 */
#include <k5-int.h>
#include <profile/prof_int.h>
#include <com_err.h>
#include <libintl.h>

#include <krb5.h>
#ifdef KRB5_KRB4_COMPAT
#include <kerberosIV/krb.h>
#define HAVE_KRB524
#else
#undef HAVE_KRB524
#endif
#include <string.h>
#include <stdio.h>
#include <time.h>
#include <errno.h>
#include <com_err.h>
#include <netdb.h>
#include <locale.h>

#ifdef GETOPT_LONG
#include <getopt.h>
#else
#ifdef HAVE_UNISTD_H
#include <unistd.h>
#ifdef sun
/* SunOS4 unistd didn't declare these; okay to make unconditional?  */
extern int optind;
extern char *optarg;
#endif /* sun */
#else
extern int optind;
extern char *optarg;
extern int getopt();
#endif /* HAVE_UNISTD_H */
#endif /* GETOPT_LONG */

#ifndef _WIN32
#define GET_PROGNAME(x) (strrchr((x), '/') ? strrchr((x), '/')+1 : (x))
#else
#define GET_PROGNAME(x) max(max(strrchr((x), '/'), strrchr((x), '\\')) + 1,(x))
#endif

#ifdef HAVE_PWD_H
#include <pwd.h>
static
char * get_name_from_os()
{
    struct passwd *pw;
    if ((pw = getpwuid((int) getuid())))
    return pw->pw_name;
    return 0;
}
#else /* HAVE_PWD_H */
#ifdef _WIN32
static
char * get_name_from_os()
{
    static char name[1024];
    DWORD name_size = sizeof(name);
    if (GetUserName(name, &name_size)) {
    name[sizeof(name)-1] = 0; /* Just to be extra safe */
    return name;
    } else {
    return 0;
    }
}
#else /* _WIN32 */
static
char * get_name_from_os()
{
    return 0;
}
#endif /* _WIN32 */
#endif /* HAVE_PWD_H */

static char* progname_v5 = 0;
#ifdef KRB5_KRB4_COMPAT
static char* progname_v4 = 0;
static char* progname_v524 = 0;
#endif
#include <locale.h>

static int got_k5 = 0;
static int got_k4 = 0;

static int default_k5 = 1;
#if defined(KRB5_KRB4_COMPAT) && defined(KINIT_DEFAULT_BOTH)
static int default_k4 = 1;
#else
static int default_k4 = 0;
#endif

static int authed_k5 = 0;
static int authed_k4 = 0;

#define KRB4_BACKUP_DEFAULT_LIFE_SECS 24*60*60 /* 1 day */
#define ROOT_UNAME  "root"

typedef enum { INIT_PW, INIT_KT, RENEW, VALIDATE } action_type;

struct k_opts
{
    /* in seconds */
    krb5_deltat starttime;
    krb5_deltat lifetime;
    krb5_deltat rlife;

    int forwardable;
    int proxiable;
    int addresses;

    int not_forwardable;
    int not_proxiable;
    int no_addresses;

    int verbose;

    char* principal_name;
    char* service_name;
    char* keytab_name;
    char* k5_cache_name;
    char* k4_cache_name;

    action_type action;

    int num_pa_opts;
    krb5_gic_opt_pa_data *pa_opts;
};

int forwardable_flag = 0;
int renewable_flag = 0;
int proxiable_flag = 0;
int no_address_flag = 0;
profile_options_boolean config_option[] = {
    { "forwardable",    &forwardable_flag,  0 },
    { "renewable",      &renewable_flag,    0 },
    { "proxiable",      &proxiable_flag,    0 },
    { "no_addresses",   &no_address_flag,   0 },
    { NULL,         NULL,           0 }
};

char    *renew_timeval=NULL;
char    *life_timeval=NULL;
int lifetime_specified;
int renewtime_specified;
profile_option_strings  config_times[] = {
    { "max_life",       &life_timeval,  0 },
    { "max_renewable_life", &renew_timeval, 0 },
    { NULL,         NULL,       0 }
};

struct k5_data
{
    krb5_context ctx;
    krb5_ccache cc;
    krb5_principal me;
    char* name;
};

struct k4_data
{
    krb5_deltat lifetime;
#ifdef KRB5_KRB4_COMPAT
    char aname[ANAME_SZ + 1];
    char inst[INST_SZ + 1];
    char realm[REALM_SZ + 1];
    char name[ANAME_SZ + 1 + INST_SZ + 1 + REALM_SZ + 1];
#endif
};

char    *realmdef[] = { "realms", NULL, "kinit", NULL };
char    *appdef[] = { "appdefaults", "kinit", NULL };

#define krb_realm       (*(realmdef + 1))

#define lifetime_specified  config_times[0].found
#define renewtime_specified config_times[1].found

/*
 * Try no preauthentication first; then try the encrypted timestamp
 */
krb5_preauthtype * preauth = NULL;
krb5_preauthtype preauth_list[2] = { 0, -1 };

static void _kwarnd_add_warning(char *, char *, time_t);
static void _kwarnd_del_warning(char *, char *);

#ifdef GETOPT_LONG
/* if struct[2] == NULL, then long_getopt acts as if the short flag
   struct[3] was specified.  If struct[2] != NULL, then struct[3] is
   stored in *(struct[2]), the array index which was specified is
   stored in *index, and long_getopt() returns 0. */

struct option long_options[] = {
    { "noforwardable", 0, NULL, 'F' },
    { "noproxiable", 0, NULL, 'P' },
    { "addresses", 0, NULL, 'a'},
    { "forwardable", 0, NULL, 'f' },
    { "proxiable", 0, NULL, 'p' },
    { "noaddresses", 0, NULL, 'A' },
    { NULL, 0, NULL, 0 }
};

#define GETOPT(argc, argv, str) getopt_long(argc, argv, str, long_options, 0)
#else
#define GETOPT(argc, argv, str) getopt(argc, argv, str)
#endif

static void
usage(progname)
     char *progname;
{
#define USAGE_BREAK "\n\t"

#ifdef GETOPT_LONG
#define USAGE_LONG_FORWARDABLE " | --forwardable | --noforwardable"
#define USAGE_LONG_PROXIABLE   " | --proxiable | --noproxiable"
#define USAGE_LONG_ADDRESSES   " | --addresses | --noaddresses"
#define USAGE_BREAK_LONG       USAGE_BREAK
#else
#define USAGE_LONG_FORWARDABLE ""
#define USAGE_LONG_PROXIABLE   ""
#define USAGE_LONG_ADDRESSES   ""
#define USAGE_BREAK_LONG       ""
#endif

    fprintf(stderr, "%s : %s  [-V] "
        "[-l lifetime] [-s start_time] "
        USAGE_BREAK
        "[-r renewable_life] "
        "[-f | -F" USAGE_LONG_FORWARDABLE "] "
        USAGE_BREAK_LONG
        "[-p | -P" USAGE_LONG_PROXIABLE "] "
        USAGE_BREAK_LONG
        "[-a | -A" USAGE_LONG_ADDRESSES "] "
        USAGE_BREAK
        "[-v] [-R] "
        "[-k [-t keytab_file]] "
        "[-c cachename] "
        USAGE_BREAK
        "[-S service_name]"
        "[-X <attribute>[=<value>]] [principal]"
        "\n\n",
        gettext("Usage"), progname);

#define KRB_AVAIL_STRING(x) ((x)?gettext("available"):gettext("not available"))

#define OPTTYPE_KRB5   "5"
#define OPTTYPE_KRB4   "4"
#define OPTTYPE_EITHER "Either 4 or 5"
#ifdef HAVE_KRB524
#define OPTTYPE_BOTH "5, or both 5 and 4"
#else
#define OPTTYPE_BOTH "5"
#endif

#ifdef KRB5_KRB4_COMPAT
#define USAGE_OPT_FMT "%s%-50s%s\n"
#define ULINE(indent, col1, col2) \
fprintf(stderr, USAGE_OPT_FMT, indent, col1, col2)
#else
#define USAGE_OPT_FMT "%s%s\n"
#define ULINE(indent, col1, col2) \
fprintf(stderr, USAGE_OPT_FMT, indent, col1)
#endif

    ULINE("    ", "options:", "valid with Kerberos:");
    fprintf(stderr, "\t-5 Kerberos 5 (%s)\n", KRB_AVAIL_STRING(got_k5));
    fprintf(stderr, "\t-4 Kerberos 4 (%s)\n", KRB_AVAIL_STRING(got_k4));
    fprintf(stderr, "\t   (Default behavior is to try %s%s%s%s)\n",
        default_k5?"Kerberos 5":"",
        (default_k5 && default_k4)?gettext(" and "):"",
        default_k4?"Kerberos 4":"",
        (!default_k5 && !default_k4)?gettext("neither"):"");
    ULINE("\t", gettext("-V verbose"),                   OPTTYPE_EITHER);
    ULINE("\t", gettext("-l lifetime"),                  OPTTYPE_EITHER);
    ULINE("\t", gettext("-s start time"),                OPTTYPE_KRB5);
    ULINE("\t", gettext("-r renewable lifetime"),        OPTTYPE_KRB5);
    ULINE("\t", gettext("-f forwardable"),               OPTTYPE_KRB5);
    ULINE("\t", gettext("-F not forwardable"),           OPTTYPE_KRB5);
    ULINE("\t", gettext("-p proxiable"),                 OPTTYPE_KRB5);
    ULINE("\t", gettext("-P not proxiable"),             OPTTYPE_KRB5);
    ULINE("\t", gettext("-A do not include addresses"),  OPTTYPE_KRB5);
    ULINE("\t", gettext("-a include addresses"),         OPTTYPE_KRB5);
    ULINE("\t", gettext("-v validate"),                  OPTTYPE_KRB5);
    ULINE("\t", gettext("-R renew"),                     OPTTYPE_BOTH);
    ULINE("\t", gettext("-k use keytab"),                OPTTYPE_BOTH);
    ULINE("\t", gettext("-t filename of keytab to use"), OPTTYPE_BOTH);
    ULINE("\t", gettext("-c Kerberos 5 cache name"),     OPTTYPE_KRB5);
    /* This options is not yet available: */
    /* ULINE("\t", "-C Kerberos 4 cache name",     OPTTYPE_KRB4); */
    ULINE("\t", gettext("-S service"),                   OPTTYPE_BOTH);
    ULINE("\t", gettext("-X <attribute>[=<value>]"),     OPTTYPE_KRB5);
    exit(2);
}

static krb5_context errctx;
static void extended_com_err_fn (const char *myprog, errcode_t code,
                 const char *fmt, va_list args)
{
    const char *emsg;
    emsg = krb5_get_error_message (errctx, code);
    fprintf (stderr, "%s: %s ", myprog, emsg);
    krb5_free_error_message (errctx, emsg);
    vfprintf (stderr, fmt, args);
    fprintf (stderr, "\n");
}

static int
add_preauth_opt(struct k_opts *opts, char *av)
{
    char *sep, *v;
    krb5_gic_opt_pa_data *p, *x;

    if (opts->num_pa_opts == 0) {
    opts->pa_opts = malloc(sizeof(krb5_gic_opt_pa_data));
    if (opts->pa_opts == NULL)
        return ENOMEM;
    } else {
    size_t newsize = (opts->num_pa_opts + 1) * sizeof(krb5_gic_opt_pa_data);
    x = realloc(opts->pa_opts, newsize);
    if (x == NULL)
        return ENOMEM;
    opts->pa_opts = x;
    }
    p = &opts->pa_opts[opts->num_pa_opts];
    sep = strchr(av, '=');
    if (sep) {
    *sep = '\0';
    v = ++sep;
    p->value = v;
    } else {
    p->value = "yes";
    }
    p->attr = av;
    opts->num_pa_opts++;
    return 0;
}

static char *
parse_options(argc, argv, opts, progname)
    int argc;
    char **argv;
    struct k_opts* opts;
    char *progname;
{
    krb5_error_code code;
    int errflg = 0;
    int use_k4 = 0;
    int use_k5 = 0;
    int i;

    while ((i = GETOPT(argc, argv, "r:fpFP54aAVl:s:c:kt:RS:vX:"))
       != -1) {
    switch (i) {
    case 'V':
        opts->verbose = 1;
        break;
    case 'l':
        /* Lifetime */
        code = krb5_string_to_deltat(optarg, &opts->lifetime);
        if (code != 0 || opts->lifetime == 0) {
        fprintf(stderr, gettext("Bad lifetime value %s\n"), optarg);
        errflg++;
        }
        break;
    case 'r':
        /* Renewable Time */
        code = krb5_string_to_deltat(optarg, &opts->rlife);
        if (code != 0 || opts->rlife == 0) {
        fprintf(stderr, gettext("Bad lifetime value %s\n"), optarg);
        errflg++;
        }
        break;
    case 'f':
        opts->forwardable = 1;
        break;
    case 'F':
        opts->not_forwardable = 1;
        break;
    case 'p':
        opts->proxiable = 1;
        break;
    case 'P':
        opts->not_proxiable = 1;
        break;
    case 'a':
        /* Note: This is supported only with GETOPT_LONG */
        opts->addresses = 1;
        break;
    case 'A':
        opts->no_addresses = 1;
        break;
        case 's':
        code = krb5_string_to_deltat(optarg, &opts->starttime);
        if (code != 0 || opts->starttime == 0) {
        krb5_timestamp abs_starttime;

        code = krb5_string_to_timestamp(optarg, &abs_starttime);
        if (code != 0 || abs_starttime == 0) {
            fprintf(stderr, gettext("Bad start time value %s\n"), optarg);
            errflg++;
        } else {
            opts->starttime = abs_starttime - time(0);
        }
        }
        break;
    case 'S':
        opts->service_name = optarg;
        break;
    case 'k':
        opts->action = INIT_KT;
        break;
    case 't':
        if (opts->keytab_name)
        {
        fprintf(stderr, gettext("Only one -t option allowed.\n"));
        errflg++;
        } else {
        opts->keytab_name = optarg;
        }
        break;
    case 'R':
        opts->action = RENEW;
        break;
    case 'v':
        opts->action = VALIDATE;
        break;
        case 'c':
        if (opts->k5_cache_name)
        {
        fprintf(stderr, gettext("Only one -c option allowed\n"));
        errflg++;
        } else {
        opts->k5_cache_name = optarg;
        }
        break;
    case 'X':
        code = add_preauth_opt(opts, optarg);
        if (code)
        {
        com_err(progname, code, "while adding preauth option");
        errflg++;
        }
        break;
#if 0
        /*
          A little more work is needed before we can enable this
          option.
        */
    case 'C':
        if (opts->k4_cache_name)
        {
        fprintf(stderr, "Only one -C option allowed\n");
        errflg++;
        } else {
        opts->k4_cache_name = optarg;
        }
        break;
#endif
    case '4':
        if (!got_k4)
        {
#ifdef KRB5_KRB4_COMPAT
        fprintf(stderr, "Kerberos 4 support could not be loaded\n");
#else
        fprintf(stderr, gettext("This was not built with Kerberos 4 support\n"));
#endif
        exit(3);
        }
        use_k4 = 1;
        break;
    case '5':
        if (!got_k5)
        {
        fprintf(stderr, gettext("Kerberos 5 support could not be loaded\n"));
        exit(3);
        }
        use_k5 = 1;
        break;
    default:
        errflg++;
        break;
    }
    }

    if (opts->forwardable && opts->not_forwardable)
    {
    fprintf(stderr, gettext("Only one of -f and -F allowed\n"));
    errflg++;
    }
    if (opts->proxiable && opts->not_proxiable)
    {
    fprintf(stderr, gettext("Only one of -p and -P allowed\n"));
    errflg++;
    }
    if (opts->addresses && opts->no_addresses)
    {
    fprintf(stderr, gettext("Only one of -a and -A allowed\n"));
    errflg++;
    }

    if (argc - optind > 1) {
    fprintf(stderr, gettext("Extra arguments (starting with \"%s\").\n"),
        argv[optind+1]);
    errflg++;
    }

    /* At this point, if errorless, we know we only have one option
       selection */
    if (!use_k5 && !use_k4) {
    use_k5 = default_k5;
    use_k4 = default_k4;
    }

    /* Now, we encode the OPTTYPE stuff here... */
    if (!use_k5 &&
    (opts->starttime || opts->rlife || opts->forwardable ||
     opts->proxiable || opts->addresses || opts->not_forwardable ||
     opts->not_proxiable || opts->no_addresses ||
     (opts->action == VALIDATE) || opts->k5_cache_name))
    {
    fprintf(stderr, gettext("Specified option that requires Kerberos 5\n"));
    errflg++;
    }
    if (!use_k4 &&
    opts->k4_cache_name)
    {
    fprintf(stderr, gettext("Specified option that require Kerberos 4\n"));
    errflg++;
    }
    if (
#ifdef HAVE_KRB524
    !use_k5
#else
    use_k4
#endif
    && (opts->service_name || opts->keytab_name ||
        (opts->action == INIT_KT) || (opts->action == RENEW))
    )
    {
    fprintf(stderr, gettext("Specified option that requires Kerberos 5\n"));
    errflg++;
    }

    if (errflg) {
    usage(progname);
    }

    got_k5 = got_k5 && use_k5;
    got_k4 = got_k4 && use_k4;

    opts->principal_name = (optind == argc-1) ? argv[optind] : 0;
    return opts->principal_name;
}

static int
k5_begin(opts, k5, k4)
    struct k_opts* opts;
struct k5_data* k5;
struct k4_data* k4;
{
    char* progname = progname_v5;
    krb5_error_code code = 0;

    if (!got_k5)
    return 0;

    code = krb5_init_context(&k5->ctx);
    if (code) {
    com_err(progname, code, gettext("while initializing Kerberos 5 library"));
    return 0;
    }
    errctx = k5->ctx;
    if (opts->k5_cache_name)
    {
    code = krb5_cc_resolve(k5->ctx, opts->k5_cache_name, &k5->cc);
    if (code != 0) {
        com_err(progname, code, gettext("resolving ccache %s"),
            opts->k5_cache_name);
        return 0;
    }
    }
    else
    {
    if ((code = krb5_cc_default(k5->ctx, &k5->cc))) {
        com_err(progname, code, gettext("while getting default ccache"));
        return 0;
    }
    }

    if (opts->principal_name)
    {
    /* Use specified name */
    if ((code = krb5_parse_name(k5->ctx, opts->principal_name,
                    &k5->me))) {
        com_err(progname, code, gettext("when parsing name %s"),
            opts->principal_name);
        return 0;
    }
    }
    else
    {
    /* No principal name specified */
    if (opts->action == INIT_KT) {
        /* Use the default host/service name */
      code = krb5_sname_to_principal(k5->ctx, NULL, NULL,
                     KRB5_NT_SRV_HST, &k5->me);
      if (code) {
        com_err(progname, code, gettext(
            "when creating default server principal name"));
        return 0;
      }
    } else {
      /* Get default principal from cache if one exists */
      code = krb5_cc_get_principal(k5->ctx, k5->cc,
                       &k5->me);
      if (code)
        {
          char *name = get_name_from_os();
          if (!name)
        {
          fprintf(stderr, gettext("Unable to identify user\n"));
          return 0;
        }
                /* use strcmp to ensure only "root" is matched */
                if (strcmp(name, ROOT_UNAME) == 0)
                {
                    if (code = krb5_sname_to_principal(k5->ctx, NULL, ROOT_UNAME,
                    KRB5_NT_SRV_HST, &k5->me)) {
                com_err(progname, code, gettext(
                "when creating default server principal name"));
                                return 0;
                        }
                } else
          if ((code = krb5_parse_name(k5->ctx, name,
                      &k5->me)))
        {
          com_err(progname, code, gettext("when parsing name %s"),
              name);
          return 0;
        }
        }
    }
    }

    code = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
    if (code) {
    com_err(progname, code, gettext("when unparsing name"));
    return 0;
    }
    opts->principal_name = k5->name;

#ifdef KRB5_KRB4_COMPAT
    if (got_k4)
    {
    /* Translate to a Kerberos 4 principal */
    code = krb5_524_conv_principal(k5->ctx, k5->me,
                       k4->aname, k4->inst, k4->realm);
    if (code) {
        k4->aname[0] = 0;
        k4->inst[0] = 0;
        k4->realm[0] = 0;
    }
    }
#endif
    return 1;
}

static void
k5_end(k5)
    struct k5_data* k5;
{
    if (k5->name)
    krb5_free_unparsed_name(k5->ctx, k5->name);
    if (k5->me)
    krb5_free_principal(k5->ctx, k5->me);
    if (k5->cc)
    krb5_cc_close(k5->ctx, k5->cc);
    if (k5->ctx)
    krb5_free_context(k5->ctx);
    errctx = NULL;
    memset(k5, 0, sizeof(*k5));
}

static int
k4_begin(opts, k4)
    struct k_opts* opts;
    struct k4_data* k4;
{
#ifdef KRB5_KRB4_COMPAT
    char* progname = progname_v4;
    int k_errno = 0;
#endif

    if (!got_k4)
    return 0;

#ifdef KRB5_KRB4_COMPAT
    if (k4->aname[0])
    goto skip;

    if (opts->principal_name)
    {
    /* Use specified name */
        k_errno = kname_parse(k4->aname, k4->inst, k4->realm,
                  opts->principal_name);
    if (k_errno)
    {
        fprintf(stderr, "%s: %s\n", progname,
            krb_get_err_text(k_errno));
        return 0;
    }
    } else {
    /* No principal name specified */
    if (opts->action == INIT_KT) {
        /* Use the default host/service name */
        /* XXX - need to add this functionality */
        fprintf(stderr, "%s: Kerberos 4 srvtab support is not "
            "implemented\n", progname);
        return 0;
    } else {
        /* Get default principal from cache if one exists */
        k_errno = krb_get_tf_fullname(tkt_string(), k4->aname,
                      k4->inst, k4->realm);
        if (k_errno)
        {
        char *name = get_name_from_os();
        if (!name)
        {
            fprintf(stderr, "Unable to identify user\n");
            return 0;
        }
        k_errno = kname_parse(k4->aname, k4->inst, k4->realm,
                      name);
        if (k_errno)
        {
            fprintf(stderr, "%s: %s\n", progname,
                krb_get_err_text(k_errno));
            return 0;
        }
        }
    }
    }

    if (!k4->realm[0])
    krb_get_lrealm(k4->realm, 1);

    if (k4->inst[0])
    sprintf(k4->name, "%s.%s@%s", k4->aname, k4->inst, k4->realm);
    else
    sprintf(k4->name, "%s@%s", k4->aname, k4->realm);
    opts->principal_name = k4->name;

 skip:
    if (k4->aname[0] && !k_isname(k4->aname))
    {
    fprintf(stderr, "%s: bad Kerberos 4 name format\n", progname);
    return 0;
    }

    if (k4->inst[0] && !k_isinst(k4->inst))
    {
    fprintf(stderr, "%s: bad Kerberos 4 instance format\n", progname);
    return 0;
    }

    if (k4->realm[0] && !k_isrealm(k4->realm))
    {
    fprintf(stderr, "%s: bad Kerberos 4 realm format\n", progname);
    return 0;
    }
#endif /* KRB5_KRB4_COMPAT */
    return 1;
}

static void
k4_end(k4)
    struct k4_data* k4;
{
    memset(k4, 0, sizeof(*k4));
}

#ifdef KRB5_KRB4_COMPAT
static char stash_password[1024];
static int got_password = 0;
#endif /* KRB5_KRB4_COMPAT */

static krb5_error_code
KRB5_CALLCONV
kinit_prompter(
    krb5_context ctx,
    void *data,
    const char *name,
    const char *banner,
    int num_prompts,
    krb5_prompt prompts[]
    )
{
    int i;
    krb5_prompt_type *types;
    krb5_error_code rc =
    krb5_prompter_posix(ctx, data, name, banner, num_prompts, prompts);
    if (!rc && (types = krb5_get_prompt_types(ctx)))
    for (i = 0; i < num_prompts; i++)
        if ((types[i] == KRB5_PROMPT_TYPE_PASSWORD) ||
        (types[i] == KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN))
        {
#ifdef KRB5_KRB4_COMPAT
        strncpy(stash_password, prompts[i].reply->data,
            sizeof(stash_password));
        got_password = 1;
#endif
        }
    return rc;
}

static int
k5_kinit(opts, k5)
    struct k_opts* opts;
    struct k5_data* k5;
{
    char* progname = progname_v5;
    int notix = 1;
    krb5_keytab keytab = 0;
    krb5_creds my_creds;
    krb5_error_code code = 0;
    krb5_get_init_creds_opt *options = NULL;
    int i;
    krb5_timestamp now;
    krb5_deltat lifetime = 0, rlife = 0, krb5_max_duration;

    if (!got_k5)
    return 0;

    code = krb5_get_init_creds_opt_alloc(k5->ctx, &options);
    if (code)
    goto cleanup;
    memset(&my_creds, 0, sizeof(my_creds));

    /*
     * Solaris Kerberos: added support for max_life and max_renewable_life
     * which should be removed in the next minor release.  See PSARC 2003/545
     * for more info.
     *
     * Also, check krb5.conf for proxiable/forwardable/renewable/no_address
     * parameter values.
     */
    /* If either tkt life or renew life weren't set earlier take common steps to
     * get the krb5.conf parameter values.
     */

    if ((code = krb5_timeofday(k5->ctx, &now))) {
        com_err(progname, code, gettext("while getting time of day"));
        exit(1);
    }
    krb5_max_duration = KRB5_KDB_EXPIRATION - now - 60*60;

    if (opts->lifetime == 0 || opts->rlife == 0) {

    krb_realm = krb5_princ_realm(k5->ctx, k5->me)->data;
    /* realm params take precedence */
    profile_get_options_string(k5->ctx->profile, realmdef, config_times);
    profile_get_options_string(k5->ctx->profile, appdef, config_times);

    /* if the input opts doesn't have lifetime set and the krb5.conf
     * parameter has been set, use that.
     */
    if (opts->lifetime == 0 && life_timeval != NULL) {
        code = krb5_string_to_deltat(life_timeval, &lifetime);
        if (code != 0 || lifetime == 0 || lifetime > krb5_max_duration) {
        fprintf(stderr, gettext("Bad max_life "
                "value in Kerberos config file %s\n"),
            life_timeval);
        exit(1);
        }
        opts->lifetime = lifetime;
    }
    if (opts->rlife == 0 && renew_timeval != NULL) {
        code = krb5_string_to_deltat(renew_timeval, &rlife);
        if (code != 0 || rlife == 0 || rlife > krb5_max_duration) {
        fprintf(stderr, gettext("Bad max_renewable_life "
                "value in Kerberos config file %s\n"),
            renew_timeval);
        exit(1);
        }
        opts->rlife = rlife;
    }
    }

    /*
     * If lifetime is not set on the cmdline or in the krb5.conf
     * file, default to max.
     */
    if (opts->lifetime == 0)
        opts->lifetime = krb5_max_duration;


    profile_get_options_boolean(k5->ctx->profile,
                realmdef, config_option);
    profile_get_options_boolean(k5->ctx->profile,
                appdef, config_option);


    /* cmdline opts take precedence over krb5.conf file values */
    if (!opts->not_proxiable && proxiable_flag) {
        krb5_get_init_creds_opt_set_proxiable(options, 1);
    }
    if (!opts->not_forwardable && forwardable_flag) {
        krb5_get_init_creds_opt_set_forwardable(options, 1);
    }
    if (renewable_flag) {
        /*
         * If this flag is set in krb5.conf, but rlife is 0, then
         * set it to the max (and let the KDC sort it out).
         */
        opts->rlife = opts->rlife ? opts->rlife : krb5_max_duration;
    }
    if (no_address_flag) {
        /* cmdline opts will overwrite this below if needbe */
        krb5_get_init_creds_opt_set_address_list(options, NULL);
    }


    /*
      From this point on, we can goto cleanup because my_creds is
      initialized.
    */

    if (opts->lifetime)
    krb5_get_init_creds_opt_set_tkt_life(options, opts->lifetime);
    if (opts->rlife)
    krb5_get_init_creds_opt_set_renew_life(options, opts->rlife);
    if (opts->forwardable)
    krb5_get_init_creds_opt_set_forwardable(options, 1);
    if (opts->not_forwardable)
    krb5_get_init_creds_opt_set_forwardable(options, 0);
    if (opts->proxiable)
    krb5_get_init_creds_opt_set_proxiable(options, 1);
    if (opts->not_proxiable)
    krb5_get_init_creds_opt_set_proxiable(options, 0);
    if (opts->addresses)
    {
    krb5_address **addresses = NULL;
    code = krb5_os_localaddr(k5->ctx, &addresses);
    if (code != 0) {
        com_err(progname, code, gettext("getting local addresses"));
        goto cleanup;
    }
    krb5_get_init_creds_opt_set_address_list(options, addresses);
    }
    if (opts->no_addresses)
    krb5_get_init_creds_opt_set_address_list(options, NULL);

    if ((opts->action == INIT_KT) && opts->keytab_name)
    {
    code = krb5_kt_resolve(k5->ctx, opts->keytab_name, &keytab);
    if (code != 0) {
        com_err(progname, code, gettext("resolving keytab %s"),
            opts->keytab_name);
        goto cleanup;
    }
    }

    for (i = 0; i < opts->num_pa_opts; i++) {
    code = krb5_get_init_creds_opt_set_pa(k5->ctx, options,
                          opts->pa_opts[i].attr,
                          opts->pa_opts[i].value);
    if (code != 0) {
        com_err(progname, code, "while setting '%s'='%s'",
            opts->pa_opts[i].attr, opts->pa_opts[i].value);
        goto cleanup;
    }
    }

    switch (opts->action) {
    case INIT_PW:
    code = krb5_get_init_creds_password(k5->ctx, &my_creds, k5->me,
                        0, kinit_prompter, 0,
                        opts->starttime,
                        opts->service_name,
                        options);
    break;
    case INIT_KT:
    code = krb5_get_init_creds_keytab(k5->ctx, &my_creds, k5->me,
                      keytab,
                      opts->starttime,
                      opts->service_name,
                      options);
    break;
    case VALIDATE:
    code = krb5_get_validated_creds(k5->ctx, &my_creds, k5->me, k5->cc,
                    opts->service_name);
    break;
    case RENEW:
    code = krb5_get_renewed_creds(k5->ctx, &my_creds, k5->me, k5->cc,
                      opts->service_name);
    break;
    }

    if (code) {
    char *doing = 0;
    switch (opts->action) {
    case INIT_PW:
    case INIT_KT:
        doing = gettext("getting initial credentials");
        break;
    case VALIDATE:
        doing = gettext("validating credentials");
        break;
    case RENEW:
        doing = gettext("renewing credentials");
        break;
    }

    /* If got code == KRB5_AP_ERR_V4_REPLY && got_k4, we should
       let the user know that maybe he/she wants -4. */
    if (code == KRB5KRB_AP_ERR_V4_REPLY && got_k4)
        com_err(progname, code, "while %s\n"
            "The KDC doesn't support v5.  "
            "You may want the -4 option in the future",
            doing);
    else if (code == KRB5KRB_AP_ERR_BAD_INTEGRITY)
        fprintf(stderr, gettext("%s: Password incorrect while %s\n"), progname,
            doing);
    else
        com_err(progname, code, gettext("while %s"), doing);
    goto cleanup;
    }

    if (!opts->lifetime) {
    /* We need to figure out what lifetime to use for Kerberos 4. */
    opts->lifetime = my_creds.times.endtime - my_creds.times.authtime;
    }

    code = krb5_cc_initialize(k5->ctx, k5->cc, k5->me);
    if (code) {
    com_err(progname, code, gettext("when initializing cache %s"),
        opts->k5_cache_name?opts->k5_cache_name:"");
    goto cleanup;
    }

    code = krb5_cc_store_cred(k5->ctx, k5->cc, &my_creds);
    if (code) {
    com_err(progname, code, gettext("while storing credentials"));
    goto cleanup;
    }

    if (opts->action == RENEW) {
        _kwarnd_del_warning(progname, opts->principal_name);
        _kwarnd_add_warning(progname, opts->principal_name, my_creds.times.endtime);
    } else if ((opts->action == INIT_KT) || (opts->action == INIT_PW)) {
        _kwarnd_add_warning(progname, opts->principal_name, my_creds.times.endtime);
    }

    notix = 0;

 cleanup:
    if (options)
    krb5_get_init_creds_opt_free(k5->ctx, options);
    if (my_creds.client == k5->me) {
    my_creds.client = 0;
    }
    if (opts->pa_opts) {
    free(opts->pa_opts);
    opts->pa_opts = NULL;
    opts->num_pa_opts = 0;
    }
    krb5_free_cred_contents(k5->ctx, &my_creds);
    if (keytab)
    krb5_kt_close(k5->ctx, keytab);
    return notix?0:1;
}

static int
k4_kinit(opts, k4, ctx)
    struct k_opts* opts;
    struct k4_data* k4;
    krb5_context ctx;
{
#ifdef KRB5_KRB4_COMPAT
    char* progname = progname_v4;
    int k_errno = 0;
#endif

    if (!got_k4)
    return 0;

    if (opts->starttime)
    return 0;

#ifdef KRB5_KRB4_COMPAT
    if (!k4->lifetime)
    k4->lifetime = opts->lifetime;
    if (!k4->lifetime)
    k4->lifetime = KRB4_BACKUP_DEFAULT_LIFE_SECS;

    k4->lifetime = krb_time_to_life(0, k4->lifetime);

    switch (opts->action)
    {
    case INIT_PW:
    if (!got_password) {
        unsigned int pwsize = sizeof(stash_password);
        krb5_error_code code;
        char prompt[1024];

        sprintf(prompt, gettext("Password for %s: "), opts->principal_name);
        stash_password[0] = 0;
        /*
          Note: krb5_read_password does not actually look at the
          context, so we're ok even if we don't have a context.  If
          we cannot dynamically load krb5, we can substitute any
          decent read password function instead of the krb5 one.
        */
        code = krb5_read_password(ctx, prompt, 0, stash_password, &pwsize);
        if (code || pwsize == 0)
        {
        fprintf(stderr, gettext("Error while reading password for '%s'\n"),
            opts->principal_name);
        memset(stash_password, 0, sizeof(stash_password));
        return 0;
        }
        got_password = 1;
    }
    k_errno = krb_get_pw_in_tkt(k4->aname, k4->inst, k4->realm, "krbtgt",
                    k4->realm, k4->lifetime, stash_password);

    if (k_errno) {
        fprintf(stderr, "%s: %s\n", progname,
            krb_get_err_text(k_errno));
        if (authed_k5)
            fprintf(stderr, gettext("Maybe your KDC does not support v4.  "
            "Try the -5 option next time.\n"));
        return 0;
    }
    return 1;
#ifndef HAVE_KRB524
    case INIT_KT:
    fprintf(stderr, gettext("%s: srvtabs are not supported\n"), progname);
    return 0;
    case RENEW:
    fprintf(stderr, gettext("%s: renewal of krb4 tickets is not supported\n"),
        progname);
    return 0;
#else
    /* These cases are handled by the 524 code - this prevents the compiler
       warnings of not using all the enumerated types.
    */
    case INIT_KT:
    case RENEW:
    case VALIDATE:
        return 0;
#endif
    }
#endif
    return 0;
}

static char*
getvprogname(v, progname)
    char *v, *progname;
{
    unsigned int len = strlen(progname) + 2 + strlen(v) + 2;
    char *ret = malloc(len);
    if (ret)
    sprintf(ret, "%s(v%s)", progname, v);
    else
    ret = progname;
    return ret;
}

#ifdef HAVE_KRB524
/* Convert krb5 tickets to krb4. */
static int try_convert524(k5)
    struct k5_data* k5;
{
    char * progname = progname_v524;
    krb5_error_code code = 0;
    int icode = 0;
    krb5_principal kpcserver = 0;
    krb5_creds *v5creds = 0;
    krb5_creds increds;
    CREDENTIALS v4creds;

    if (!got_k4 || !got_k5)
    return 0;

    memset((char *) &increds, 0, sizeof(increds));
    /*
      From this point on, we can goto cleanup because increds is
      initialized.
    */

    if ((code = krb5_build_principal(k5->ctx,
                     &kpcserver,
                     krb5_princ_realm(k5->ctx, k5->me)->length,
                     krb5_princ_realm(k5->ctx, k5->me)->data,
                     "krbtgt",
                     krb5_princ_realm(k5->ctx, k5->me)->data,
                     NULL))) {
    com_err(progname, code, gettext(
        "while creating service principal name"));
    goto cleanup;
    }

    increds.client = k5->me;
    increds.server = kpcserver;
    /* Prevent duplicate free calls.  */
    kpcserver = 0;

    increds.times.endtime = 0;
    increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
    if ((code = krb5_get_credentials(k5->ctx, 0,
                     k5->cc,
                     &increds,
                     &v5creds))) {
    com_err(progname, code,
        gettext("getting V5 credentials"));
    goto cleanup;
    }
    if ((icode = krb524_convert_creds_kdc(k5->ctx,
                      v5creds,
                      &v4creds))) {
    com_err(progname, icode,
        gettext("converting to V4 credentials"));
    goto cleanup;
    }
    /* this is stolen from the v4 kinit */
    /* initialize ticket cache */
    if ((icode = in_tkt(v4creds.pname, v4creds.pinst)
     != KSUCCESS)) {
    com_err(progname, icode, gettext(
        "trying to create the V4 ticket file"));
    goto cleanup;
    }
    /* stash ticket, session key, etc. for future use */
    if ((icode = krb_save_credentials(v4creds.service,
                      v4creds.instance,
                      v4creds.realm,
                      v4creds.session,
                      v4creds.lifetime,
                      v4creds.kvno,
                      &(v4creds.ticket_st),
                      v4creds.issue_date))) {
    com_err(progname, icode, gettext(
        "trying to save the V4 ticket"));
    goto cleanup;
    }

 cleanup:
    memset(&v4creds, 0, sizeof(v4creds));
    if (v5creds)
    krb5_free_creds(k5->ctx, v5creds);
    increds.client = 0;
    krb5_free_cred_contents(k5->ctx, &increds);
    if (kpcserver)
    krb5_free_principal(k5->ctx, kpcserver);
    return !(code || icode);
}
#endif /* HAVE_KRB524 */

int
main(argc, argv)
    int argc;
    char **argv;
{
    struct k_opts opts;
    struct k5_data k5;
    struct k4_data k4;
    char *progname;

    (void) setlocale(LC_ALL, "");

#if !defined(TEXT_DOMAIN)
#define TEXT_DOMAIN "SYS_TEST"
#endif

    (void) textdomain(TEXT_DOMAIN);

    progname = GET_PROGNAME(argv[0]);
    progname_v5 = getvprogname("5", progname);
#ifdef KRB5_KRB4_COMPAT
    progname_v4 = getvprogname("4", progname);
    progname_v524 = getvprogname("524", progname);
#endif

    /* Ensure we can be driven from a pipe */
    if(!isatty(fileno(stdin)))
    setvbuf(stdin, 0, _IONBF, 0);
    if(!isatty(fileno(stdout)))
    setvbuf(stdout, 0, _IONBF, 0);
    if(!isatty(fileno(stderr)))
    setvbuf(stderr, 0, _IONBF, 0);

    /*
      This is where we would put in code to dynamically load Kerberos
      libraries.  Currenlty, we just get them implicitly.
    */
    got_k5 = 1;
#ifdef KRB5_KRB4_COMPAT
    got_k4 = 1;
#endif

    memset(&opts, 0, sizeof(opts));
    opts.action = INIT_PW;

    memset(&k5, 0, sizeof(k5));
    memset(&k4, 0, sizeof(k4));

    set_com_err_hook (extended_com_err_fn);

    parse_options(argc, argv, &opts, progname);

    got_k5 = k5_begin(&opts, &k5, &k4);
    got_k4 = k4_begin(&opts, &k4);

    authed_k5 = k5_kinit(&opts, &k5);
#ifdef HAVE_KRB524
    if (authed_k5)
    authed_k4 = try_convert524(&k5);
#endif
    if (!authed_k4)
    authed_k4 = k4_kinit(&opts, &k4, k5.ctx);
#ifdef KRB5_KRB4_COMPAT
    memset(stash_password, 0, sizeof(stash_password));
#endif

    if (authed_k5 && opts.verbose)
    fprintf(stderr, gettext("Authenticated to Kerberos v5\n"));
    if (authed_k4 && opts.verbose)
    fprintf(stderr, gettext("Authenticated to Kerberos v4\n"));

    k5_end(&k5);
    k4_end(&k4);

    if ((got_k5 && !authed_k5) || (got_k4 && !authed_k4) ||
    (!got_k5 && !got_k4))
    exit(1);
    return 0;
}

static void
_kwarnd_add_warning(char *progname, char *me, time_t endtime)
{
    if (kwarn_add_warning(me, endtime) != 0)
        fprintf(stderr, gettext(
            "%s:  no ktkt_warnd warning possible\n"), progname);
    return;
}


static void
_kwarnd_del_warning(char *progname, char *me)
{
    if (kwarn_del_warning(me) != 0)
        fprintf(stderr, gettext(
            "%s:  unable to delete ktkt_warnd message for %s\n"),
            progname, me);
    return;
}