ipa-getkeytab.c

Bug Summary

File:	client/ipa-getkeytab.c
Warning:	line 982, column 11 2nd function call argument is an uninitialized value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa-getkeytab.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I .. -I . -I ../util -I ../asn1 -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LOCALEDIR="/usr/local/share/locale" -D IPACONFFILE="/usr/local/etc/ipa/default.conf" -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/client -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa-getkeytab.c
1/* Authors: Simo Sorce <ssorce@redhat.com>
*
* Copyright (C) 2007  Red Hat
* see file 'COPYING' for use and warranty information
*
* This program is free software you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

20#define _GNU_SOURCE

22#include <sys/types.h>
23#include <sys/stat.h>
24#include <fcntl.h>
25#include <sys/time.h>
26#include <unistd.h>
27#include <stdio.h>
28#include <stdarg.h>
29#include <stdlib.h>
30#include <stdint.h>
31#include <stdbool.h>
32#include <string.h>
33#include <errno(*__errno_location ()).h>
34#include <time.h>
35#include <krb5.h>
36#include <ldap.h>
37#include <sasl/sasl.h>
38#include <popt.h>
39#include <ini_configobj.h>

41#include "config.h"

43#include "ipa_krb5.h"
44#include "ipa_asn1.h"
45#include "ipa-client-common.h"
46#include "ipa_ldap.h"


49static int check_sasl_mech(const char *mech)
50{
  int i;
  int ret = 1;
  const char *supported_sasl_mechs[] = {
      LDAP_SASL_EXTERNAL"EXTERNAL",
      LDAP_SASL_GSSAPI"GSSAPI",
      NULL((void*)0)
  };

  for (i=0; NULL((void*)0) != supported_sasl_mechs[i]; i++) {
      if (strcmp(mech, supported_sasl_mechs[i]) == 0) {
          return 0;
      }
  }
  return ret;
65}

67static int ldap_sasl_interact(LDAP *ld, unsigned flags, void *priv_data, void *sit)
68{
sasl_interact_t *in = NULL((void*)0);
int ret = LDAP_OTHER0x50;
krb5_principal princ = (krb5_principal)priv_data;
krb5_context krbctx;
char *outname = NULL((void*)0);
krb5_error_code krberr;

if (!ld) return LDAP_PARAM_ERROR(-9);

for (in = sit; in && in->id != SASL_CB_LIST_END0; in++) {
switch(in->id) {
case SASL_CB_USER0x4001:
	krberr = krb5_init_context(&krbctx);

	if (krberr) {
		fprintf(stderrstderr, _("Kerberos context initialization failed: %1$s (%2$d)\n")gettext("Kerberos context initialization failed: %1$s (%2$d)\n"
),
                              error_message(krberr), krberr);
		in->result = NULL((void*)0);
		in->len = 0;
		ret = LDAP_LOCAL_ERROR(-2);
		break;
	}

	krberr = krb5_unparse_name(krbctx, princ, &outname);

	if (krberr) {
              fprintf(stderrstderr, _("Unable to parse principal: %1$s (%2$d)\n")gettext("Unable to parse principal: %1$s (%2$d)\n"),
                              error_message(krberr), krberr);
		in->result = NULL((void*)0);
		in->len = 0;
		ret = LDAP_LOCAL_ERROR(-2);
		break;
	}

	in->result = outname;
	in->len = strlen(outname);
	ret = LDAP_SUCCESS0x00;

	krb5_free_context(krbctx);

	break;
case SASL_CB_GETREALM(0x4008):
	in->result = princ->realm.data;
	in->len = princ->realm.length;
	ret = LDAP_SUCCESS0x00;
	break;
default:
	in->result = NULL((void*)0);
	in->len = 0;
	ret = LDAP_OTHER0x50;
}
}
return ret;
122}

124int filter_keys(krb5_context krbctx, struct keys_container *keys,
              ber_int_t *enctypes)
126{
  struct krb_key_salt *ksdata;
  int i, j, n;

  n = keys->nkeys;
  ksdata = keys->ksdata;
  for (i = 0; i < n; i++) {
      if (ksdata[i].enctype == enctypes[i]) continue;
      if (enctypes[i] == 0) {
          /* remove unsupported one */
          krb5_free_keyblock_contents(krbctx, &ksdata[i].key);
          krb5_free_data_contents(krbctx, &ksdata[i].salt);
          for (j = i; j < n-1; j++) {
              ksdata[j] = ksdata[j + 1];
              enctypes[j] = enctypes[j + 1];
          }
          n--;
          /* new key has been moved to this position, make sure
           * we do not skip it, by neutralizing next i increment */
          i--;
      }
  }

  if (n == 0) {
      fprintf(stderrstderr, _("No keys accepted by KDC\n")gettext("No keys accepted by KDC\n"));
      return 0;
  }

  keys->nkeys = n;
  return n;
156}

158static int ipa_server_to_uri(const char *servername, const char *mech,
                           char **ldap_uri)
160{
  char *url = NULL((void*)0);
  int url_len = 0;
  int port = 389;

  url_len = asprintf(&url, "%s%s:%d", SCHEMA_LDAP"ldap://", servername, port);

  if (url_len == -1) {
      fprintf(stderrstderr, _("Out of memory \n")gettext("Out of memory \n"));
      return LDAP_NO_MEMORY(-10);
  }
  *ldap_uri = url;
  return 0;
173}

175static int ipa_ldap_bind(const char *ldap_uri, krb5_principal bind_princ,
                       const char *bind_dn, const char *bind_pw,
                       const char *mech, const char *ca_cert_file,
                       LDAP **_ld)
179{
  struct berval bv;
  LDAP *ld;
  int ret;

  /* TODO: support referrals ? */
  ret = ipa_ldap_init(&ld, ldap_uri);
  if (ret != LDAP_SUCCESS0x00) {
      return ret;
  }

  if (ld == NULL((void*)0)) {
      fprintf(stderrstderr, _("Unable to initialize ldap library!\n")gettext("Unable to initialize ldap library!\n"));
      return LDAP_OPERATIONS_ERROR0x01;
  }

  ret = ipa_tls_ssl_init(ld, ldap_uri, ca_cert_file);
  if (ret != LDAP_OPT_SUCCESS0) {
      goto done;
  }

  if (bind_dn) {
      bv.bv_val = discard_const(bind_pw)((void *)((uintptr_t)(bind_pw)));
      bv.bv_len = strlen(bind_pw);

      ret = ldap_sasl_bind_s(ld, bind_dn, LDAP_SASL_SIMPLE((char*)0),
                             &bv, NULL((void*)0), NULL((void*)0), NULL((void*)0));
      if (ret != LDAP_SUCCESS0x00) {
          ipa_ldap_error(ld, ret, _("Simple bind failed\n")gettext("Simple bind failed\n"));
          goto done;
      }
  } else {
      if (strcmp(mech, LDAP_SASL_EXTERNAL"EXTERNAL") == 0) {
          ret = ldap_sasl_bind_s(ld, NULL((void*)0), LDAP_SASL_EXTERNAL"EXTERNAL",
                                 NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0));
      } else {
          ret = ldap_sasl_interactive_bind_s(ld, NULL((void*)0), LDAP_SASL_GSSAPI"GSSAPI",
                                             NULL((void*)0), NULL((void*)0), LDAP_SASL_QUIET2U,
                                             ldap_sasl_interact, bind_princ);
      }

      if (ret != LDAP_SUCCESS0x00) {
          ipa_ldap_error(ld, ret, _("SASL Bind failed\n")gettext("SASL Bind failed\n"));
          goto done;
      }
  }

  ret = LDAP_SUCCESS0x00;

228done:
  if (ret != LDAP_SUCCESS0x00) {
      if (ld) ldap_unbind_ext(ld, NULL((void*)0), NULL((void*)0));
  } else {
      *_ld = ld;
  }
  return ret;
235}

237static int ipa_ldap_extended_op(LDAP *ld, const char *reqoid,
                              struct berval *control,
                              LDAPControl ***srvctrl)
240{
  struct berval *retdata = NULL((void*)0);
  LDAPMessage *res = NULL((void*)0);
  char *retoid = NULL((void*)0);
  struct timeval tv;
  char *err = NULL((void*)0);
  int msgid;
  int ret, rc;

  ret = ldap_extended_operation(ld, reqoid, control,
                                NULL((void*)0), NULL((void*)0), &msgid);
  if (ret != LDAP_SUCCESS0x00) {
      fprintf(stderrstderr, _("Operation failed: %s\n")gettext("Operation failed: %s\n"), ldap_err2string(ret));
      return ret;
  }

  /* wait max 100 secs for the answer */
  tv.tv_sec = 100;
  tv.tv_usec = 0;
  ret = ldap_result(ld, msgid, 1, &tv, &res);
  if (ret == -1) {
      fprintf(stderrstderr, _("Failed to get result: %s\n")gettext("Failed to get result: %s\n"), ldap_err2string(ret));
      goto done;
  }
  else if (res == NULL((void*)0)) {
      fprintf(stderrstderr, _("Timeout exceeded.")gettext("Timeout exceeded."));
      goto done;
  }

  ret = ldap_parse_extended_result(ld, res, &retoid, &retdata, 0);
  if (ret != LDAP_SUCCESS0x00) {
      fprintf(stderrstderr, _("Failed to parse extended result: %s\n")gettext("Failed to parse extended result: %s\n"),
                      ldap_err2string(ret));
      goto done;
  }

  ret = ldap_parse_result(ld, res, &rc, NULL((void*)0), &err, NULL((void*)0), srvctrl, 0);
  if (ret != LDAP_SUCCESS0x00 || rc != LDAP_SUCCESS0x00) {
      fprintf(stderrstderr, _("Failed to parse result: %s\n")gettext("Failed to parse result: %s\n"),
                      err ? err : ldap_err2string(ret));
      if (ret == LDAP_SUCCESS0x00) ret = rc;
      goto done;
  }

284done:
  if (err) ldap_memfree(err);
  if (res) ldap_msgfree(res);
  return ret;
288}

290static int find_control_data(LDAPControl **list, const char *repoid,
                           struct berval *data)
292{
  LDAPControl *control = NULL((void*)0);
  int i;

  if (!list) {
      fprintf(stderrstderr, _("Missing reply control list!\n")gettext("Missing reply control list!\n"));
      return LDAP_OPERATIONS_ERROR0x01;
  }

  for (i = 0; list[i]; i++) {
      if (strcmp(list[i]->ldctl_oid, repoid) == 0) {
          control = list[i];
      }
  }
  if (!control) {
      fprintf(stderrstderr, _("Missing reply control!\n")gettext("Missing reply control!\n"));
      return LDAP_OPERATIONS_ERROR0x01;
  }

  *data = control->ldctl_value;
  return LDAP_SUCCESS0x00;
313}

315static BerElement *get_control_data(LDAPControl **list, const char *repoid)
316{
  struct berval data;
  int ret;

  ret = find_control_data(list, repoid, &data);
  if (ret != LDAP_SUCCESS0x00) return NULL((void*)0);

  return ber_init(&data);
324}

326static int ldap_set_keytab(krb5_context krbctx,
	   const char *ldap_uri,
	   const char *principal_name,
	   krb5_principal princ,
	   const char *binddn,
	   const char *bindpw,
	   const char *mech,
	   const char *ca_cert_file,
	   struct keys_container *keys)
335{
LDAP *ld = NULL((void*)0);
BerElement *sctrl = NULL((void*)0);
struct berval *control = NULL((void*)0);
LDAPControl **srvctrl = NULL((void*)0);
int ret;
int kvno, i;
ber_tag_t rtag;
ber_int_t *encs = NULL((void*)0);
int successful_keys = 0;

/* cant' return more than nkeys, sometimes less */
encs = calloc(keys->nkeys + 1, sizeof(ber_int_t));
if (!encs) {
fprintf(stderrstderr, _("Out of Memory!\n")gettext("Out of Memory!\n"));
return 0;
}

/* build password change control */
control = create_key_control(keys, principal_name);
if (!control) {
fprintf(stderrstderr, _("Failed to create control!\n")gettext("Failed to create control!\n"));
goto error_out;
}

  ret = ipa_ldap_bind(ldap_uri, princ, binddn, bindpw, mech, ca_cert_file, &ld);
  if (ret != LDAP_SUCCESS0x00) {
      fprintf(stderrstderr, _("Failed to bind to server!\n")gettext("Failed to bind to server!\n"));
      goto error_out;
  }

  /* perform password change */
  ret = ipa_ldap_extended_op(ld, KEYTAB_SET_OID"2.16.840.1.113730.3.8.10.1", control, &srvctrl);
  if (ret != LDAP_SUCCESS0x00) {
      fprintf(stderrstderr, _("Failed to get keytab!\n")gettext("Failed to get keytab!\n"));
      goto error_out;
  }

ber_bvfree(control);
control = NULL((void*)0);

sctrl = get_control_data(srvctrl, KEYTAB_RET_OID"2.16.840.1.113730.3.8.10.2");
if (!sctrl) {
fprintf(stderrstderr, _("ber_init() failed, Invalid control ?!\n")gettext("ber_init() failed, Invalid control ?!\n"));
goto error_out;
}

/* Format of response
*
* KeytabGetRequest ::= SEQUENCE {
* 	new_kvno	Int32
* 	SEQUENCE OF	KeyTypes
* }
*
* * List of accepted enctypes *
* KeyTypes ::= SEQUENCE {
* 	enctype		Int32
* }
*/

rtag = ber_scanf(sctrl, "{i{", &kvno);
if (rtag == LBER_ERROR((ber_tag_t) -1)) {
fprintf(stderrstderr, _("ber_scanf() failed, unable to find kvno ?!\n")gettext("ber_scanf() failed, unable to find kvno ?!\n"));
goto error_out;
}

for (i = 0; i < keys->nkeys; i++) {
ret = ber_scanf(sctrl, "{i}", &encs[i]);
if (ret == LBER_ERROR((ber_tag_t) -1)) {
	char enc[79]; /* fit std terminal or truncate */
	krb5_error_code krberr;
	krberr = krb5_enctype_to_string(
		keys->ksdata[i].enctype, enc, 79);
	if (krberr) {
		fprintf(stderrstderr, _("Failed to retrieve "gettext("Failed to retrieve " "encryption type type #%d\n")
			"encryption type type #%d\n")gettext("Failed to retrieve " "encryption type type #%d\n"),
			keys->ksdata[i].enctype);
	} else {
		fprintf(stderrstderr, _("Failed to retrieve "gettext("Failed to retrieve " "encryption type %1$s (#%2$d)\n"
)
			"encryption type %1$s (#%2$d)\n")gettext("Failed to retrieve " "encryption type %1$s (#%2$d)\n"
),
			enc, keys->ksdata[i].enctype);
	}
              } else {
	successful_keys++;
}
}

if (successful_keys == 0) {
fprintf(stderrstderr, _("Failed to retrieve any keys")gettext("Failed to retrieve any keys"));
goto error_out;
}

ret = filter_keys(krbctx, keys, encs);
if (ret == 0) goto error_out;

ber_free(sctrl, 1);
ldap_controls_free(srvctrl);
ldap_unbind_ext(ld, NULL((void*)0), NULL((void*)0));
free(encs);
return kvno;

436error_out:
if (sctrl) ber_free(sctrl, 1);
if (srvctrl) ldap_controls_free(srvctrl);
if (ld) ldap_unbind_ext(ld, NULL((void*)0), NULL((void*)0));
if (control) ber_bvfree(control);
free(encs);
return -1;
443}

445/* use asn1c generated code to fill up control */
446static struct berval *create_getkeytab_control(const char *svc_princ, bool_Bool gen,
                                             const char *password,
                                             struct krb_key_salt *encsalts,
                                             int num_encsalts)
450{
  struct berval *result = NULL((void*)0);
  void *buffer = NULL((void*)0);
  size_t buflen;
  long ets[num_encsalts];
  bool_Bool ret;
  int i;

  if (gen) {
      for (i = 0; i < num_encsalts; i++) {
          ets[i] = encsalts[i].enctype;
      }
  }
  ret = ipaasn1_enc_getkt(gen, svc_princ,
                          password, ets, num_encsalts,
                          &buffer, &buflen);
  if (!ret) goto done;

  result = malloc(sizeof(struct berval));
  if (!result) goto done;

  result->bv_val = buffer;
  result->bv_len = buflen;

474done:
  if (result == NULL((void*)0)) {
      if (buffer) {
          free(buffer);
      }
  }
  return result;
481}

483#define GK_REPLY_TAG(((ber_tag_t) 0x80U) | ((ber_tag_t) 0x20U) | 2) (LBER_CLASS_CONTEXT((ber_tag_t) 0x80U) | LBER_CONSTRUCTED((ber_tag_t) 0x20U) | 2)
484#define GKREP_KEY_TAG(((ber_tag_t) 0x80U) | ((ber_tag_t) 0x20U) | 0) (LBER_CLASS_CONTEXT((ber_tag_t) 0x80U) | LBER_CONSTRUCTED((ber_tag_t) 0x20U) | 0)
485#define GKREP_SALT_TAG(((ber_tag_t) 0x80U) | ((ber_tag_t) 0x20U) | 1) (LBER_CLASS_CONTEXT((ber_tag_t) 0x80U) | LBER_CONSTRUCTED((ber_tag_t) 0x20U) | 1)

487static int ldap_get_keytab(krb5_context krbctx, bool_Bool generate, char *password,
                         const char *enctypes, const char *ldap_uri,
                         const char *svc_princ, krb5_principal bind_princ,
                         const char *bind_dn, const char *bind_pw,
                         const char *mech,
                         const char *ca_cert_file,
                         struct keys_container *keys, int *kvno,
                         char **err_msg)
495{
  struct krb_key_salt *es = NULL((void*)0);
  int num_es = 0;
  struct berval *control = NULL((void*)0);
  LDAP *ld = NULL((void*)0);
  LDAPControl **srvctrl = NULL((void*)0);
  struct berval data;
  bool_Bool res;
  int ret;

  *err_msg = NULL((void*)0);

  if (enctypes) {
      ret = ipa_string_to_enctypes(enctypes, &es, &num_es, err_msg);
      if (ret || num_es == 0) {
          free(es);
          return LDAP_OPERATIONS_ERROR0x01;
      }
  }

  control = create_getkeytab_control(svc_princ, generate,
                                     password, es, num_es);
  if (!control) {
      *err_msg = _("Failed to create control!\n")gettext("Failed to create control!\n");
      ret = LDAP_OPERATIONS_ERROR0x01;
      goto done;
  }

  ret = ipa_ldap_bind(ldap_uri, bind_princ, bind_dn, bind_pw, mech,
                      ca_cert_file, &ld);
  if (ret != LDAP_SUCCESS0x00) {
      *err_msg = _("Failed to bind to server!\n")gettext("Failed to bind to server!\n");
      goto done;
  }

  /* perform extedned opt to get keytab */
  ret = ipa_ldap_extended_op(ld, KEYTAB_GET_OID"2.16.840.1.113730.3.8.10.5", control, &srvctrl);
  if (ret != LDAP_SUCCESS0x00) {
      goto done;
  }

  ret = find_control_data(srvctrl, KEYTAB_GET_OID"2.16.840.1.113730.3.8.10.5", &data);
  if (ret != LDAP_SUCCESS0x00) goto done;

  res = ipaasn1_dec_getktreply(data.bv_val, data.bv_len, kvno, keys);
  if (!res) {
      *err_msg = _("Failed to decode control reply!\n")gettext("Failed to decode control reply!\n");
      ret = LDAP_OPERATIONS_ERROR0x01;
      goto done;
  }

  ret = LDAP_SUCCESS0x00;

548done:
  if (ld) ldap_unbind_ext(ld, NULL((void*)0), NULL((void*)0));
  if (control) ber_bvfree(control);
  free(es);
  if (ret) {
      free_keys_contents(krbctx, keys);
  }
  return ret;
556}

558/* Prompt for either a password.
* This can be either asking for a new or existing password.
*
* To set a new password provide values for both prompt1 and prompt2 and
* set match=true to enforce that the two entered passwords match.
*
* To prompt for an existing password provide prompt1 and set match=false.
*
* Implementation details:
* krb5_prompter_posix() does not differentiate between too long entry or
* an entry exactly the size of a buffer. Thus, allocate a bigger buffer
* and do the check for a too long password afterwards.
*/
571static char *ask_password(krb5_context krbctx, char *prompt1, char *prompt2,
                        bool_Bool match)
573{
  krb5_prompt ap_prompts[2];
  krb5_data k5d_pw0;
  krb5_data k5d_pw1;
577#define MAX(a,b)(((a)>(b))?(a):(b)) (((a)>(b))?(a):(b))
578#define PWD_BUFFER_SIZE((((1000 + 2))>(1024))?((1000 + 2)):(1024)) MAX((IPAPWD_PASSWORD_MAX_LEN + 2), 1024)((((1000 + 2))>(1024))?((1000 + 2)):(1024))
  char pw0[PWD_BUFFER_SIZE((((1000 + 2))>(1024))?((1000 + 2)):(1024))];
  char pw1[PWD_BUFFER_SIZE((((1000 + 2))>(1024))?((1000 + 2)):(1024))];
  char *password;
  int num_prompts = match ? 2:1;

  k5d_pw0.length = sizeof(pw0);
  k5d_pw0.data = pw0;
  ap_prompts[0].prompt = prompt1;
  ap_prompts[0].hidden = 1;
  ap_prompts[0].reply = &k5d_pw0;

  if (match) {
      k5d_pw1.length = sizeof(pw1);
      k5d_pw1.data = pw1;
      ap_prompts[1].prompt = prompt2;
      ap_prompts[1].hidden = 1;
      ap_prompts[1].reply = &k5d_pw1;
  }

  krb5_prompter_posix(krbctx, NULL((void*)0),
              NULL((void*)0), NULL((void*)0),
              num_prompts, ap_prompts);

  if (match && (strcmp(pw0, pw1))) {
      fprintf(stderrstderr, _("Passwords do not match!\n")gettext("Passwords do not match!\n"));
      return NULL((void*)0);
  }

  if (k5d_pw0.length > IPAPWD_PASSWORD_MAX_LEN1000) {
      fprintf(stderrstderr, "%s\n", ipapwd_password_max_len_errmsg);
      return NULL((void*)0);
  }

  password = malloc(k5d_pw0.length + 1);
  if (!password) return NULL((void*)0);
  memcpy(password, pw0, k5d_pw0.length);
  password[k5d_pw0.length] = '\0';

  return password;
618}

620struct ipa_config {
  const char *server_name;
622};

624static int config_from_file(struct ini_cfgobj *cfgctx)
625{
  struct ini_cfgfile *fctx = NULL((void*)0);
  char **errors = NULL((void*)0);
  int ret;

  ret = ini_config_file_open(IPACONFFILE"/usr/local/etc/ipa/default.conf", 0, &fctx);
  if (ret) {
      fprintf(stderrstderr, _("Failed to open config file %s\n")gettext("Failed to open config file %s\n"), IPACONFFILE"/usr/local/etc/ipa/default.conf");
      return ret;
  }

  ret = ini_config_parse(fctx,
                         INI_STOP_ON_ANY,
                         INI_MS_MERGE0x0000 | INI_MV1S_ALLOW0x0003 | INI_MV2S_ALLOW0x0030,
                         INI_PARSE_NOWRAP0x0001,
                         cfgctx);
  if (ret) {
      fprintf(stderrstderr, _("Failed to parse config file %s\n")gettext("Failed to parse config file %s\n"), IPACONFFILE"/usr/local/etc/ipa/default.conf");
      if (ini_config_error_count(cfgctx)) {
          ini_config_get_errors(cfgctx, &errors);
          if (errors) {
              ini_config_print_errors(stderrstderr, errors);
              ini_config_free_errors(errors);
          }
      }
      ini_config_file_destroy(fctx);
      return ret;
  }

  ini_config_file_destroy(fctx);
  return 0;
656}

658int read_ipa_config(struct ipa_config **ipacfg)
659{
  struct ini_cfgobj *cfgctx = NULL((void*)0);
  struct value_obj *obj = NULL((void*)0);
  int ret;

  *ipacfg = calloc(1, sizeof(struct ipa_config));
  if (!*ipacfg) {
      return ENOMEM12;
  }

  ret = ini_config_create(&cfgctx);
  if (ret) {
      return ENOENT2;
  }

  ret = config_from_file(cfgctx);
  if (ret) {
      ini_config_destroy(cfgctx);
      return EINVAL22;
  }

  ret = ini_get_config_valueobj("global", "server", cfgctx,
                                INI_GET_LAST_VALUE, &obj);
  if (ret != 0 || obj == NULL((void*)0)) {
      /* if called on an IPA server we need to look for 'host' instead */
      ret = ini_get_config_valueobj("global", "host", cfgctx,
                                    INI_GET_LAST_VALUE, &obj);
  }

  if (ret == 0 && obj != NULL((void*)0)) {
      (*ipacfg)->server_name = ini_get_string_config_value(obj, &ret);
  }

  return 0;
693}

695static int resolve_ktname(const char *keytab, char **ktname, char **err_msg)
696{
char keytab_resolved[PATH_MAX4096 + 1];
struct stat st;
struct stat lst;
int ret;

*err_msg = NULL((void*)0);

  /* Resolve keytab symlink to support dangling symlinks, see
   * https://pagure.io/freeipa/issue/4607. To prevent symlink attacks,
   * the symlink is only resolved owned by the current user or by
   * root. For simplicity, only one level if indirection is resolved.
   */
  if ((stat(keytab, &st) == -1) &&
29
←
Assuming the condition is true→
33
←
Taking true branch→
          (errno(*__errno_location ()) == ENOENT2) &&
30
←
Assuming the condition is true→
          (lstat(keytab, &lst) == 0) &&
31
←
Assuming the condition is true→
          (S_ISLNK(lst.st_mode)((((lst.st_mode)) & 0170000) == (0120000)))) {
32
←
Assuming the condition is true→
      /* keytab is a dangling symlink. */
      if (((lst.st_uid == 0) && (lst.st_gid == 0)) ||
34
←
Assuming field 'st_uid' is not equal to 0→
              ((lst.st_uid == geteuid()) && (lst.st_gid == getegid()))) {
35
←
Assuming the condition is false→
          /* Either root or current user owns symlink, resolve symlink and
           * return the resolved symlink. */
          ret = readlink(keytab, keytab_resolved, PATH_MAX4096 + 1);
          if ((ret == -1) || (ret > PATH_MAX4096)) {
              *err_msg = _("Failed to resolve symlink to keytab.\n")gettext("Failed to resolve symlink to keytab.\n");
              return ENOENT2;
          }
          keytab_resolved[ret] = '\0';
          ret = asprintf(ktname, "WRFILE:%s", keytab_resolved);
          if (ret == -1) {
              *err_msg = strerror(errno(*__errno_location ()));
              return ENOMEM12;
          }
          return 0;
      } else {
          *err_msg = _("keytab is a dangling symlink and owned by another "gettext("keytab is a dangling symlink and owned by another " "user.\n"
)
                       "user.\n")gettext("keytab is a dangling symlink and owned by another " "user.\n"
);
          return EINVAL22;
36
←
Returning without writing to '*ktname'→
      }
  } else {
      ret = asprintf(ktname, "WRFILE:%s", keytab);
      if (ret == -1) {
          *err_msg = strerror(errno(*__errno_location ()));
          return ENOMEM12;
      }
      return 0;
  }
743}

745int main(int argc, const char *argv[])
746{
static const char *server = NULL((void*)0);
static const char *principal = NULL((void*)0);
static const char *keytab = NULL((void*)0);
static const char *enctypes_string = NULL((void*)0);
static const char *binddn = NULL((void*)0);
static const char *bindpw = NULL((void*)0);
char *ldap_uri = NULL((void*)0);
static const char *sasl_mech = NULL((void*)0);
static const char *ca_cert_file = NULL((void*)0);
int quiet = 0;
int askpass = 0;
int askbindpw = 0;
int permitted_enctypes = 0;
int retrieve = 0;
      struct poptOption options[] = {
          { "quiet", 'q', POPT_ARG_NONE0U, &quiet, 0,
            _("Print as little as possible")gettext("Print as little as possible"), _("Output only on errors")gettext("Output only on errors")},
          { "server", 's', POPT_ARG_STRING1U, &server, 0,
            _("Contact this specific KDC Server")gettext("Contact this specific KDC Server"),
            _("Server Name")gettext("Server Name") },
          { "principal", 'p', POPT_ARG_STRING1U, &principal, 0,
            _("The principal to get a keytab for (ex: ftp/ftp.example.com@EXAMPLE.COM)")gettext("The principal to get a keytab for (ex: ftp/ftp.example.com@EXAMPLE.COM)"
),
            _("Kerberos Service Principal Name")gettext("Kerberos Service Principal Name") },
          { "keytab", 'k', POPT_ARG_STRING1U, &keytab, 0,
            _("The keytab file to append the new key to (will be "gettext("The keytab file to append the new key to (will be " "created if it does not exist)."
)
              "created if it does not exist).")gettext("The keytab file to append the new key to (will be " "created if it does not exist)."
),
            _("Keytab File Name")gettext("Keytab File Name") },
   { "enctypes", 'e', POPT_ARG_STRING1U, &enctypes_string, 0,
            _("Encryption types to request")gettext("Encryption types to request"),
            _("Comma separated encryption types list")gettext("Comma separated encryption types list") },
   { "permitted-enctypes", 0, POPT_ARG_NONE0U, &permitted_enctypes, 0,
            _("Show the list of permitted encryption types and exit")gettext("Show the list of permitted encryption types and exit"
),
            _("Permitted Encryption Types")gettext("Permitted Encryption Types") },
   { "password", 'P', POPT_ARG_NONE0U, &askpass, 0,
            _("Asks for a non-random password to use for the principal")gettext("Asks for a non-random password to use for the principal"
), NULL((void*)0) },
   { "binddn", 'D', POPT_ARG_STRING1U, &binddn, 0,
            _("LDAP DN")gettext("LDAP DN"), _("DN to bind as if not using kerberos")gettext("DN to bind as if not using kerberos") },
   { "bindpw", 'w', POPT_ARG_STRING1U, &bindpw, 0,
            _("LDAP password")gettext("LDAP password"), _("password to use if not using kerberos")gettext("password to use if not using kerberos") },
   { NULL((void*)0), 'W', POPT_ARG_NONE0U, &askbindpw, 0,
            _("Prompt for LDAP password")gettext("Prompt for LDAP password"), NULL((void*)0) },
   { "cacert", 0, POPT_ARG_STRING1U, &ca_cert_file, 0,
            _("Path to the IPA CA certificate")gettext("Path to the IPA CA certificate"), _("IPA CA certificate")gettext("IPA CA certificate")},
   { "ldapuri", 'H', POPT_ARG_STRING1U, &ldap_uri, 0,
            _("LDAP uri to connect to. Mutually exclusive with --server")gettext("LDAP uri to connect to. Mutually exclusive with --server"
),
            _("url")gettext("url")},
   { "mech", 'Y', POPT_ARG_STRING1U, &sasl_mech, 0,
            _("LDAP SASL bind mechanism if no bindd/bindpw")gettext("LDAP SASL bind mechanism if no bindd/bindpw"),
            _("GSSAPI|EXTERNAL")gettext("GSSAPI|EXTERNAL") },
   { "retrieve", 'r', POPT_ARG_NONE0U, &retrieve, 0,
            _("Retrieve current keys without changing them")gettext("Retrieve current keys without changing them"), NULL((void*)0) },
          POPT_AUTOHELP{ ((void*)0), '\0', 4U, poptHelpOptions, 0, "Help options:", (
(void*)0) },
          POPT_TABLEEND{ ((void*)0), '\0', 0, ((void*)0), 0, ((void*)0), ((void*)0) }
};
poptContext pc;
char *ktname;
1
'ktname' declared without an initial value→
char *password = NULL((void*)0);
krb5_context krbctx;
krb5_ccache ccache;
krb5_principal uprinc = NULL((void*)0);
krb5_principal sprinc;
krb5_error_code krberr;
struct keys_container keys = { 0 };
krb5_keytab kt;
int kvno;
int i, ret;
char *err_msg;

  ret = init_gettext();
  if (ret) {
2
←
Assuming 'ret' is 0→
3
←
Taking false branch→
      fprintf(stderrstderr, "Failed to load translations\n");
  }

krberr = krb5_init_context(&krbctx);
if (krberr) {
4
←
Assuming 'krberr' is 0→
5
←
Taking false branch→
fprintf(stderrstderr, _("Kerberos context initialization failed\n")gettext("Kerberos context initialization failed\n"));
exit(1);
}

pc = poptGetContext("ipa-getkeytab", argc, (const char **)argv, options, 0);
ret = poptGetNextOpt(pc);
if (ret == -1 && permitted_enctypes &&
6
←
Assuming the condition is true→
7
←
Assuming 'permitted_enctypes' is 0→
   !(server || principal || keytab || quiet)) {
krb5_enctype *ktypes;
char enc[79]; /* fit std terminal or truncate */

krberr = krb5_get_permitted_enctypes(krbctx, &ktypes);
if (krberr) {
	fprintf(stderrstderr, _("No system preferred enctypes ?!\n")gettext("No system preferred enctypes ?!\n"));
	exit(1);
}
fprintf(stdoutstdout, _("Supported encryption types:\n")gettext("Supported encryption types:\n"));
for (i = 0; ktypes[i]; i++) {
	krberr = krb5_enctype_to_string(ktypes[i], enc, 79);
	if (krberr) {
		fprintf(stderrstderr, _("Warning: "gettext("Warning: " "failed to convert type (#%d)\n")
                                      "failed to convert type (#%d)\n")gettext("Warning: " "failed to convert type (#%d)\n"), i);
		continue;
	}
	fprintf(stdoutstdout, "%s\n", enc);
}
ipa_krb5_free_ktypes(krbctx, ktypes);
exit (0);
}

if (ret != -1 || !principal || !keytab || permitted_enctypes9.1
'permitted_enctypes' is 0
) {
8
←
Assuming 'principal' is non-null→
9
←
Assuming 'keytab' is non-null→
10
←
Taking false branch→
if (!quiet) {
	poptPrintUsage(pc, stderrstderr, 0);
}
exit(2);
}

  if (askbindpw && bindpw != NULL((void*)0)) {
11
←
Assuming 'askbindpw' is 0→
fprintf(stderrstderr, _("Bind password already provided (-w).\n")gettext("Bind password already provided (-w).\n"));
if (!quiet) {
	poptPrintUsage(pc, stderrstderr, 0);
}
exit(2);
  }

  if (askbindpw11.1
'askbindpw' is 0
) {
12
←
Taking false branch→
bindpw = ask_password(krbctx, _("Enter LDAP password")gettext("Enter LDAP password"), NULL((void*)0), false0);
if (!bindpw) {
	exit(2);
}
  }

if (NULL((void*)0)!=binddn && NULL((void*)0)==bindpw) {
13
←
Assuming 'binddn' is equal to NULL→
fprintf(stderrstderr,
                      _("Bind password required when using a bind DN (-w or -W).\n")gettext("Bind password required when using a bind DN (-w or -W).\n"
));
if (!quiet)
	poptPrintUsage(pc, stderrstderr, 0);
exit(10);
}

  if (NULL((void*)0) != binddn13.1
'binddn' is equal to NULL
 && NULL((void*)0) != sasl_mech) {
      fprintf(stderrstderr, _("Cannot specify both SASL mechanism "gettext("Cannot specify both SASL mechanism " "and bind DN simultaneously.\n"
)
                        "and bind DN simultaneously.\n")gettext("Cannot specify both SASL mechanism " "and bind DN simultaneously.\n"
));
      if (!quiet)
          poptPrintUsage(pc, stderrstderr, 0);
      exit(2);
  }

  if (sasl_mech && check_sasl_mech(sasl_mech)) {
14
←
Assuming 'sasl_mech' is null→
      fprintf(stderrstderr, _("Invalid SASL bind mechanism\n")gettext("Invalid SASL bind mechanism\n"));
      if (!quiet)
          poptPrintUsage(pc, stderrstderr, 0);
      exit(2);
  }

  if (!binddn14.1
'binddn' is null
 && !sasl_mech14.2
'sasl_mech' is null
) {
15
←
Taking true branch→
      sasl_mech = LDAP_SASL_GSSAPI"GSSAPI";
  }

  if (server && ldap_uri) {
16
←
Assuming 'server' is null→
      fprintf(stderrstderr, _("Cannot specify server and LDAP uri "gettext("Cannot specify server and LDAP uri " "simultaneously.\n"
)
                        "simultaneously.\n")gettext("Cannot specify server and LDAP uri " "simultaneously.\n"
));
      if (!quiet)
          poptPrintUsage(pc, stderrstderr, 0);
      exit(2);
  }

  if (!server16.1
'server' is null
 && !ldap_uri) {
17
←
Assuming 'ldap_uri' is non-null→
18
←
Taking false branch→
      struct ipa_config *ipacfg = NULL((void*)0);

      ret = read_ipa_config(&ipacfg);
      if (ret == 0) {
          server = ipacfg->server_name;
          ipacfg->server_name = NULL((void*)0);
      }
      free(ipacfg);
      if (!server) {
          fprintf(stderrstderr, _("Server name not provided and unavailable\n")gettext("Server name not provided and unavailable\n"));
          exit(2);
      }
  }
  if (server18.1
'server' is null
) {
19
←
Taking false branch→
      ret = ipa_server_to_uri(server, sasl_mech, &ldap_uri);
      if (ret) {
          exit(ret);
      }
  }

  if (!ca_cert_file) {
20
←
Assuming 'ca_cert_file' is non-null→
21
←
Taking false branch→
      ca_cert_file = DEFAULT_CA_CERT_FILE"/etc/ipa/ca.crt";
  }

  if (askpass && retrieve) {
22
←
Assuming 'askpass' is 0→
      fprintf(stderrstderr, _("Incompatible options provided (-r and -P)\n")gettext("Incompatible options provided (-r and -P)\n"));
      exit(2);
  }

      if (askpass22.1
'askpass' is 0
) {
23
←
Taking false branch→
password = ask_password(krbctx, _("New Principal Password")gettext("New Principal Password"),
             	                _("Verify Principal Password")gettext("Verify Principal Password"), true1);
if (!password) {
	exit(2);
}
} else if (enctypes_string && strchr(enctypes_string, ':')) {
24
←
Assuming 'enctypes_string' is null→
if (!quiet) {
	fprintf(stderrstderr, _("Warning: salt types are not honored"gettext("Warning: salt types are not honored" " with randomized passwords (see opt. -P)\n"
)
                              " with randomized passwords (see opt. -P)\n")gettext("Warning: salt types are not honored" " with randomized passwords (see opt. -P)\n"
));
}
}

krberr = krb5_parse_name(krbctx, principal, &sprinc);
if (krberr) {
25
←
Assuming 'krberr' is 0→
26
←
Taking false branch→
fprintf(stderrstderr, _("Invalid Service Principal Name\n")gettext("Invalid Service Principal Name\n"));
exit(4);
}

if (NULL((void*)0) == bindpw && strcmp(sasl_mech, LDAP_SASL_GSSAPI"GSSAPI") == 0) {
27
←
Assuming 'bindpw' is not equal to NULL→
krberr = krb5_cc_default(krbctx, &ccache);
if (krberr) {
	fprintf(stderrstderr,
                              _("Kerberos Credential Cache not found. "gettext("Kerberos Credential Cache not found. " "Do you have a Kerberos Ticket?\n"
)
		  "Do you have a Kerberos Ticket?\n")gettext("Kerberos Credential Cache not found. " "Do you have a Kerberos Ticket?\n"
));
	exit(5);
}

krberr = krb5_cc_get_principal(krbctx, ccache, &uprinc);
if (krberr) {
	fprintf(stderrstderr,
                              _("Kerberos User Principal not found. "gettext("Kerberos User Principal not found. " "Do you have a valid Credential Cache?\n"
)
		  "Do you have a valid Credential Cache?\n")gettext("Kerberos User Principal not found. " "Do you have a valid Credential Cache?\n"
));
	exit(6);
}
}

ret = resolve_ktname(keytab, &ktname, &err_msg);
28
←
Calling 'resolve_ktname'→
37
←
Returning from 'resolve_ktname'→
if (krberr37.1
'krberr' is 0
) {
38
←
Taking false branch→
fprintf(stderrstderr, "%s", err_msg);
exit(ret);
}

krberr = krb5_kt_resolve(krbctx, ktname, &kt);
39
←
2nd function call argument is an uninitialized value
if (krberr) {
fprintf(stderrstderr, _("Failed to open Keytab\n")gettext("Failed to open Keytab\n"));
exit(7);
}

  kvno = -1;
  ret = ldap_get_keytab(krbctx, (retrieve == 0), password, enctypes_string,
                        ldap_uri, principal, uprinc, binddn, bindpw,
                        sasl_mech, ca_cert_file,
                        &keys, &kvno, &err_msg);
  if (ret) {
      if (!quiet && err_msg != NULL((void*)0)) {
          fprintf(stderrstderr, "%s", err_msg);
      }
  }

  if (retrieve == 0 && kvno == -1) {
      if (!quiet) {
          fprintf(stderrstderr,
                  _("Retrying with pre-4.0 keytab retrieval method...\n")gettext("Retrying with pre-4.0 keytab retrieval method...\n"));
      }

      /* create key material */
      ret = create_keys(krbctx, sprinc, password, enctypes_string, &keys, &err_msg);
      if (!ret) {
          if (err_msg != NULL((void*)0)) {
              fprintf(stderrstderr, "%s", err_msg);
          }

          fprintf(stderrstderr, _("Failed to create key material\n")gettext("Failed to create key material\n"));
          free_keys_contents(krbctx, &keys);
          exit(8);
      }

      kvno = ldap_set_keytab(krbctx, ldap_uri, principal, uprinc, binddn,
                             bindpw, sasl_mech, ca_cert_file, &keys);
  }

  if (kvno == -1) {
      fprintf(stderrstderr, _("Failed to get keytab\n")gettext("Failed to get keytab\n"));
      exit(9);
  }

for (i = 0; i < keys.nkeys; i++) {
krb5_keytab_entry kt_entry;
memset((char *)&kt_entry, 0, sizeof(kt_entry));
kt_entry.principal = sprinc;
kt_entry.key = keys.ksdata[i].key;
kt_entry.vno = kvno;

krberr = krb5_kt_add_entry(krbctx, kt, &kt_entry);
if (krberr) {
	fprintf(stderrstderr,
                              _("Failed to add key to the keytab\n")gettext("Failed to add key to the keytab\n"));
	exit (11);
}
}

free_keys_contents(krbctx, &keys);

krberr = krb5_kt_close(krbctx, kt);
if (krberr) {
fprintf(stderrstderr, _("Failed to close the keytab\n")gettext("Failed to close the keytab\n"));
exit (12);
}

if (!quiet) {
fprintf(stderrstderr,
	_("Keytab successfully retrieved and stored in: %s\n")gettext("Keytab successfully retrieved and stored in: %s\n"),
	keytab);
}
exit(0);
1055}