[utils.git] / krb5-agent.c

/*
 *  krb5-agent - Renews Kerberos tickets periodically.
 *  Copyright (C) 2004 Fredrik Tolf (fredrik@dolda2000.com)
 *  
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *  
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *  
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <krb5.h>
#include <time.h>
#include <string.h>
#include <signal.h>
#include <sys/wait.h>

volatile int died = 0;
pid_t child;
int execmode = 0, failsafe = 0;
int verbose = 0, quiet = 0;
time_t renewat;

krb5_context context = NULL;
krb5_ccache ccache = NULL;

void cleanup_krb5(void)
{
    if(ccache != NULL)
	krb5_cc_close(context, ccache);
    ccache = NULL;
    if(context != NULL)
	krb5_free_context(context);
    context = NULL;
}

void sighandler(int sig)
{
    switch(sig) {
    case SIGCHLD:
	died = 1;
	break;
    case SIGHUP:
    case SIGINT:
    case SIGTERM:
	if(execmode)
	    kill(child, sig);
	break;
    }
}

void renew(void)
{
    int ret;
    krb5_principal me;
    krb5_creds creds;
    
    if(context == NULL)
	return;
    if(ccache == NULL) {
	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	    if(!quiet)
		fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	    return;
	}
    }
    
    me = NULL;
    memset(&creds, 0, sizeof(creds));
    if((ret = krb5_cc_get_principal(context, ccache, &me)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not get principal from cache: %s\n", error_message(ret));
	goto out;
    }
    if((ret = krb5_get_renewed_creds(context, &creds, me, ccache, NULL)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not get renewed credentials: %s\n", error_message(ret));
	goto out;
    }
    if((ret = krb5_cc_initialize(context, ccache, me)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not reinitialize cache: %s\n", error_message(ret));
	krb5_free_cred_contents(context, &creds);
	goto out;
    }
    if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not store renewed credentials: %s\n", error_message(ret));
	krb5_free_cred_contents(context, &creds);
	goto out;
    }
    krb5_free_cred_contents(context, &creds);
    if(verbose >= 1)
	printf("successfully renewed credentials\n");
    
 out:
    if(me != NULL)
	krb5_free_principal(context, me);
}

time_t goodrenewtime(void)
{
    int ret;
    krb5_principal me;
    krb5_cc_cursor cur;
    krb5_creds creds;
    time_t now, good;
    
    if(context == NULL)
	return(-1);
    if(ccache == NULL) {
	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	    if(!quiet)
		fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	    return(-1);
	}
    }
    
    me = NULL;
    cur = NULL;
    good = -1;
    if((ret = krb5_cc_get_principal(context, ccache, &me)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not get principal from cache: %s\n", error_message(ret));
	goto out;
    }
    if((ret = krb5_cc_start_seq_get(context, ccache, &cur)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not open credentials cache: %s\n", error_message(ret));
	goto out;
    }
    now = time(NULL);
    while(!krb5_cc_next_cred(context, ccache, &cur, &creds)) {
	if(!strcmp(krb5_princ_component(context, creds.server, 0)->data, KRB5_TGS_NAME) &&
	   !strcmp(krb5_princ_component(context, creds.server, 1)->data, me->realm.data)) {
	    if(!creds.times.starttime)
		creds.times.starttime = creds.times.authtime;
	    good = (creds.times.starttime + (((creds.times.endtime - creds.times.starttime) * 9) / 10));
	    break;
	}
	krb5_free_cred_contents(context, &creds);
    }
    
 out:
    if(cur != NULL)
	krb5_cc_end_seq_get(context, ccache, &cur);
    if(me != NULL)
	krb5_free_principal(context, me);
    return(good);
}

int main(int argc, char **argv)
{
    char *p;
    int c;
    time_t interval, now;
    pid_t wpid;
    int ret, status;
    
    interval = -1;
    while((c = getopt(argc, argv, "+hi:vqf")) != -1) {
	switch(c) {
	case 'v':
	    verbose++;
	    break;
	case 'q':
	    quiet = 1;
	    break;
	case 'f':
	    failsafe = 1;
	    break;
	case 'i':
	    p = optarg + strlen(optarg) - 1;
	    if((*p >= 'a') && (*p <= 'z')) {
		if(*p == 'm')
		    interval = 60;
		else if(*p == 'h')
		    interval = 3600;
		else if(*p == 'd')
		    interval = 86400;
		else
		    interval = 1;
		*p = 0;
	    } else {
		interval = 1;
	    }
	    interval *= atoi(optarg);
	    break;
	case 'h':
	case '?':
	case ':':
	default:
	    fprintf(stderr, "usage: krb5-agent [-hvqf] [-i interval] [program args...]\n");
	    exit((c == 'h')?0:1);
	}
    }
    
    atexit(cleanup_krb5);
    if((ret = krb5_init_context(&context)) != 0) {
	if(!quiet)
	    fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	if(!failsafe)
	    exit(1);
    }
    if(context != NULL) {
	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	    if(!quiet)
		fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	    if(!failsafe)
		exit(1);
	}
    }
    
    if(optind < argc) {
	execmode = 1;
	signal(SIGCHLD, sighandler);
	if((child = fork()) < 0) {
	    perror("fork");
	    exit(1);
	}
	if(child == 0) {
	    char buf[80];
	    snprintf(buf, 80, "KRB5_AGENT_PID=%i", getppid());
	    putenv(buf);
	    execvp(argv[optind], argv + optind);
	    perror(argv[optind]);
	    exit(255);
	}
	signal(SIGHUP, sighandler);
	signal(SIGINT, sighandler);
	signal(SIGTERM, sighandler);
    }
    now = time(NULL);
    if(interval >= 0)
	renewat = now + interval;
    while(1) {
	if(died) {
	    wpid = waitpid(-1, &status, WNOHANG);
	    if(wpid < 0) {
		perror("waitpid");
	    } else if(execmode && (wpid == child)) {
		/* Try to preserve exit status as best as we can... */
		if(WIFEXITED(status)) {
		    exit(WEXITSTATUS(status));
		} else {
		    cleanup_krb5();
		    signal(WTERMSIG(status), SIG_DFL);
		    kill(getpid(), WTERMSIG(status));
		    exit(255);
		}
	    }
	    died = 0;
	}
	if(interval < 0) {
	    if((renewat = goodrenewtime()) < 0) {
		renewat = -1;
	    } else if(verbose >= 2) {
		printf("will renew tickets at %s", ctime(&renewat));
	    }
	}
	if(renewat < 0)
	    sleep(60);
	else
	    sleep(renewat - now);
	now = time(NULL);
	if((renewat >= 0) && (now >= renewat)) {
	    renew();
	    now = time(NULL);
	    if(interval >= 0)
		renewat = now + interval;
	}
    }
}

/*
 * Local Variables:
 * compile-command: "gcc -Wall -g -o krb5-agent krb5-agent.c -lkrb5"
 * End:
 */
Commit	Line	Data
6087eccb DC	1	/*
	2	* krb5-agent - Renews Kerberos tickets periodically.
	3	* Copyright (C) 2004 Fredrik Tolf (fredrik@dolda2000.com)
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License as published by
	7	* the Free Software Foundation; either version 2 of the License, or
	8	* (at your option) any later version.
	9	*
	10	* This program is distributed in the hope that it will be useful,
	11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	* GNU General Public License for more details.
	14	*
	15	* You should have received a copy of the GNU General Public License
	16	* along with this program; if not, write to the Free Software
	17	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	18	*/
d5996a1f DC	19	#include <stdlib.h>
	20	#include <stdio.h>
	21	#include <unistd.h>
	22	#include <krb5.h>
e73ae134 DC	23	#include <time.h>
	24	#include <string.h>
	25	#include <signal.h>
	26	#include <sys/wait.h>
	27
e73ae134 DC	28	volatile int died = 0;
	29	pid_t child;
	30	int execmode = 0, failsafe = 0;
	31	int verbose = 0, quiet = 0;
116e305b DC	32	time_t renewat;
116e305b DC	33
e73ae134 DC	34	krb5_context context = NULL;
	35	krb5_ccache ccache = NULL;
	36
	37	void cleanup_krb5(void)
	38	{
	39	if(ccache != NULL)
	40	krb5_cc_close(context, ccache);
116e305b	41	ccache = NULL;
e73ae134 DC	42	if(context != NULL)
e73ae134 DC	43	krb5_free_context(context);
116e305b	44	context = NULL;
e73ae134 DC	45	}
	46
	47	void sighandler(int sig)
	48	{
	49	switch(sig) {
	50	case SIGCHLD:
	51	died = 1;
	52	break;
116e305b DC	53	case SIGHUP:
	54	case SIGINT:
	55	case SIGTERM:
	56	if(execmode)
	57	kill(child, sig);
	58	break;
e73ae134 DC	59	}
	60	}
	61
	62	void renew(void)
	63	{
	64	int ret;
116e305b DC	65	krb5_principal me;
116e305b DC	66	krb5_creds creds;
e73ae134	67
116e305b	68	if(context == NULL)
e73ae134	69	return;
116e305b DC	70	if(ccache == NULL) {
	71	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	72	if(!quiet)
	73	fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	74	return;
	75	}
	76	}
	77
	78	me = NULL;
	79	memset(&creds, 0, sizeof(creds));
	80	if((ret = krb5_cc_get_principal(context, ccache, &me)) != 0) {
	81	if(!quiet)
	82	fprintf(stderr, "could not get principal from cache: %s\n", error_message(ret));
	83	goto out;
	84	}
	85	if((ret = krb5_get_renewed_creds(context, &creds, me, ccache, NULL)) != 0) {
	86	if(!quiet)
	87	fprintf(stderr, "could not get renewed credentials: %s\n", error_message(ret));
	88	goto out;
	89	}
	90	if((ret = krb5_cc_initialize(context, ccache, me)) != 0) {
	91	if(!quiet)
	92	fprintf(stderr, "could not reinitialize cache: %s\n", error_message(ret));
	93	krb5_free_cred_contents(context, &creds);
	94	goto out;
	95	}
	96	if((ret = krb5_cc_store_cred(context, ccache, &creds)) != 0) {
	97	if(!quiet)
	98	fprintf(stderr, "could not store renewed credentials: %s\n", error_message(ret));
	99	krb5_free_cred_contents(context, &creds);
	100	goto out;
	101	}
	102	krb5_free_cred_contents(context, &creds);
	103	if(verbose >= 1)
	104	printf("successfully renewed credentials\n");
	105
	106	out:
	107	if(me != NULL)
	108	krb5_free_principal(context, me);
	109	}
	110
	111	time_t goodrenewtime(void)
	112	{
	113	int ret;
	114	krb5_principal me;
	115	krb5_cc_cursor cur;
	116	krb5_creds creds;
	117	time_t now, good;
	118
	119	if(context == NULL)
	120	return(-1);
	121	if(ccache == NULL) {
	122	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	123	if(!quiet)
	124	fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	125	return(-1);
	126	}
	127	}
	128
	129	me = NULL;
	130	cur = NULL;
	131	good = -1;
	132	if((ret = krb5_cc_get_principal(context, ccache, &me)) != 0) {
	133	if(!quiet)
134	fprintf(stderr, "could not get principal from cache: %s\n", error_message(ret));
135	goto out;
136	}
137	if((ret = krb5_cc_start_seq_get(context, ccache, &cur)) != 0) {
138	if(!quiet)
139	fprintf(stderr, "could not open credentials cache: %s\n", error_message(ret));
140	goto out;
141	}
142	now = time(NULL);
143	while(!krb5_cc_next_cred(context, ccache, &cur, &creds)) {
144	if(!strcmp(krb5_princ_component(context, creds.server, 0)->data, KRB5_TGS_NAME) &&
145	!strcmp(krb5_princ_component(context, creds.server, 1)->data, me->realm.data)) {
146	if(!creds.times.starttime)
147	creds.times.starttime = creds.times.authtime;
148	good = (creds.times.starttime + (((creds.times.endtime - creds.times.starttime) * 9) / 10));
149	break;
150	}
151	krb5_free_cred_contents(context, &creds);
152	}
153
154	out:
155	if(cur != NULL)
156	krb5_cc_end_seq_get(context, ccache, &cur);
157	if(me != NULL)
158	krb5_free_principal(context, me);
159	return(good);
e73ae134	160	}
d5996a1f DC	161
	162	int main(int argc, char **argv)
	163	{
e73ae134 DC	164	char *p;
e73ae134 DC	165	int c;
116e305b	166	time_t interval, now;
e73ae134 DC	167	pid_t wpid;
	168	int ret, status;
	169
116e305b	170	interval = -1;
e73ae134 DC	171	while((c = getopt(argc, argv, "+hi:vqf")) != -1) {
	172	switch(c) {
	173	case 'v':
	174	verbose++;
	175	break;
	176	case 'q':
	177	quiet = 1;
	178	break;
	179	case 'f':
	180	failsafe = 1;
	181	break;
	182	case 'i':
	183	p = optarg + strlen(optarg) - 1;
116e305b	184	if((p >= 'a') && (p <= 'z')) {
e73ae134 DC	185	if(*p == 'm')
	186	interval = 60;
	187	else if(*p == 'h')
	188	interval = 3600;
	189	else if(*p == 'd')
	190	interval = 86400;
	191	else
	192	interval = 1;
	193	*p = 0;
	194	} else {
	195	interval = 1;
	196	}
	197	interval *= atoi(optarg);
	198	break;
	199	case 'h':
	200	case '?':
	201	case ':':
	202	default:
	203	fprintf(stderr, "usage: krb5-agent [-hvqf] [-i interval] [program args...]\n");
	204	exit((c == 'h')?0:1);
	205	}
	206	}
	207
	208	atexit(cleanup_krb5);
	209	if((ret = krb5_init_context(&context)) != 0) {
	210	if(!quiet)
	211	fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	212	if(!failsafe)
	213	exit(1);
	214	}
	215	if(context != NULL) {
	216	if((ret = krb5_cc_default(context, &ccache)) != 0) {
	217	if(!quiet)
	218	fprintf(stderr, "could not initialize Kerberos context: %s\n", error_message(ret));
	219	if(!failsafe)
	220	exit(1);
	221	}
	222	}
	223
	224	if(optind < argc) {
	225	execmode = 1;
	226	signal(SIGCHLD, sighandler);
	227	if((child = fork()) < 0) {
	228	perror("fork");
	229	exit(1);
	230	}
	231	if(child == 0) {
	232	char buf[80];
1df7c6ce	233	snprintf(buf, 80, "KRB5_AGENT_PID=%i", getppid());
e73ae134 DC	234	putenv(buf);
	235	execvp(argv[optind], argv + optind);
	236	perror(argv[optind]);
	237	exit(255);
	238	}
116e305b DC	239	signal(SIGHUP, sighandler);
	240	signal(SIGINT, sighandler);
	241	signal(SIGTERM, sighandler);
e73ae134	242	}
116e305b DC	243	now = time(NULL);
	244	if(interval >= 0)
	245	renewat = now + interval;
e73ae134 DC	246	while(1) {
	247	if(died) {
	248	wpid = waitpid(-1, &status, WNOHANG);
	249	if(wpid < 0) {
	250	perror("waitpid");
	251	} else if(execmode && (wpid == child)) {
	252	/* Try to preserve exit status as best as we can... */
	253	if(WIFEXITED(status)) {
	254	exit(WEXITSTATUS(status));
	255	} else {
116e305b	256	cleanup_krb5();
e73ae134 DC	257	signal(WTERMSIG(status), SIG_DFL);
	258	kill(getpid(), WTERMSIG(status));
	259	exit(255);
	260	}
	261	}
	262	died = 0;
	263	}
116e305b DC	264	if(interval < 0) {
	265	if((renewat = goodrenewtime()) < 0) {
	266	renewat = -1;
	267	} else if(verbose >= 2) {
	268	printf("will renew tickets at %s", ctime(&renewat));
	269	}
	270	}
	271	if(renewat < 0)
	272	sleep(60);
	273	else
	274	sleep(renewat - now);
e73ae134	275	now = time(NULL);
116e305b	276	if((renewat >= 0) && (now >= renewat)) {
e73ae134	277	renew();
116e305b DC	278	now = time(NULL);
	279	if(interval >= 0)
	280	renewat = now + interval;
	281	}
e73ae134	282	}
d5996a1f	283	}
e73ae134 DC	284
	285	/*
	286	* Local Variables:
	287	* compile-command: "gcc -Wall -g -o krb5-agent krb5-agent.c -lkrb5"
	288	* End:
	289	*/