Break wallet-rekey out into a separate client program

Build a separate wallet-rekey client that rekeys every keytab given
on the command-line.  Fix some coding style issues and add internal
prototypes.  Build the shared source for both clients into an
uninstalled library to save compilation time.

1 files changed, 46 insertions, 0 deletions

diff --git a/client/internal.h b/client/internal.h
index d82196c..c8e5802 100644
--- a/client/internal.h
+++ b/client/internal.h
@@ -15,13 +15,43 @@
 
 #include <sys/types.h>
 
+/*
+ * Allow defaults to be set for a particular site with configure options if
+ * people don't want to use krb5.conf for some reason.
+ */
+#ifndef WALLET_SERVER
+# define WALLET_SERVER NULL
+#endif
+#ifndef WALLET_PORT
+# define WALLET_PORT 0
+#endif
+
 /* Forward declarations to avoid unnecessary includes. */
 struct remctl;
 struct iovec;
 
+/*
+ * Basic wallet behavior options set either on the command line or via
+ * krb5.conf.  If set via krb5.conf, we allocate memory for the strings, but
+ * we never free them.
+ */
+struct options {
+    char *type;
+    char *server;
+    char *principal;
+    char *user;
+    int port;
+};
+
 BEGIN_DECLS
 
 /*
+ * Set default options from the system krb5.conf or from compile-time
+ * defaults.
+ */
+void default_options(krb5_context ctx, struct options *options);
+
+/*
  * Given a Kerberos context and a principal name, obtain Kerberos credentials
  * for that principal and store them in a temporary ticket cache for use by
  * later operations.  kdestroy() then cleans up that cache.
@@ -75,12 +105,28 @@ int get_keytab(struct remctl *, krb5_context, const char *type,
                const char *name, const char *file, const char *srvtab);
 
 /*
+ * Given a remctl object, the Kerberos context, the type for the wallet
+ * interface, and a file name of a keytab, iterate through every existing
+ * principal in the keytab in the local realm, get fresh keys for those
+ * principals, and save the old and new keys to that file.  Returns true on
+ * success and false on partial failure to retrieve all the keys.
+ */
+bool rekey_keytab(struct remctl *, krb5_context, const char *type,
+                  const char *file);
+
+/*
  * Given a filename, some data, and a length, write that data to the given
  * file with error checking, overwriting any existing contents.
  */
 void overwrite_file(const char *name, const void *data, size_t length);
 
 /*
+ * Given a filename, some data, and a length, append that data to an existing
+ * file.  Dies on any failure.
+ */
+void append_file(const char *name, const void *data, size_t length);
+
+/*
  * Given a filename, some data, and a length, write that data to the given
  * file safely and atomically by creating file.new, writing the data, linking
  * file to file.bak, and then renaming file.new to file.