ipa-print-pac.c

Bug Summary

File:	daemons/ipa-kdb/ipa-print-pac.c
Warning:	line 324, column 27 The left operand of '!=' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ipa-print-pac.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mthread-model posix -mframe-pointer=all -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -resource-dir /usr/lib64/clang/10.0.0 -D HAVE_CONFIG_H -I . -I ../.. -I . -I ../../util -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -I /usr/include/nss3 -I /usr/include/nspr4 -I /usr/include/nspr4 -I /usr/include/nss3 -I /usr/include/nspr4 -I . -I ../../util -D PREFIX="/usr/local" -D BINDIR="/usr/local/bin" -D LIBDIR="/usr/local/lib" -D LIBEXECDIR="/usr/local/libexec" -D DATADIR="/usr/local/share" -D LDAPIDIR="/run" -I /usr/include/samba-4.0 -D _GNU_SOURCE=1 -D HAVE_IMMEDIATE_STRUCTURES=1 -D __STDC_WANT_LIB_EXT1__=1 -D _DEFAULT_SOURCE=1 -D _POSIX_C_SOURCE=200809L -internal-isystem /usr/local/include -internal-isystem /usr/lib64/clang/10.0.0/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -fdebug-compilation-dir /home/heimes/redhat/freeipa/daemons/ipa-kdb -ferror-limit 19 -fmessage-length 0 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -analyzer-output=html -faddrsig -o /home/heimes/redhat/freeipa/report/2020-06-05-101548-295465-1 -x c ipa-print-pac.c

1/*
* Copyright (C) 2020  FreeIPA Contributors see COPYING for license
*/
4#include <gen_ndr/ndr_krb5pac.h>
5#include <gssapi/gssapi_ext.h>
6#include <gssapi/gssapi_krb5.h>
7#include <ndr.h>
8#include <popt.h>
9#include <stdbool.h>
10#include <stdio.h>
11#include <string.h>
12#include <strings.h>

14#define IPAPWD_PASSWORD_MAX_LEN1024 1024

16typedef enum {
  OP_SERVICE_TICKET,
  OP_IMPERSONATE
19} pac_operation_t;

21pac_operation_t operation = OP_SERVICE_TICKET;
22char *keytab_path         = NULL((void*)0);
23char *ccache_path         = NULL((void*)0);
24bool_Bool init_tgt             = true1;
25const gss_OID *import_name_oid   = &GSS_C_NT_USER_NAME;

27TALLOC_CTX *frame = NULL((void*)0);

29gss_OID_desc mech_krb5 = {9, "\052\206\110\206\367\022\001\002\002"};

31/* NDR printing interface passes flags but the actual public print function
* does not accept flags. Generated ndr helpers actually have a small wrapper
* but since it is a static to the generated C code unit, we have to reimplement
* it here.
*/
36static void
37print_flags_PAC_DATA(struct ndr_print *ndr,
                   const char *name,
                   int unused,
                   const struct PAC_DATA *r)
41{
  ndr_print_PAC_DATA(ndr, name, r);
43}

45/*
* Print content of a PAC buffer, annotated by the libndr helpers
*/
48static void
49print_pac(gss_buffer_desc *pac, gss_buffer_desc *display)
50{
  struct ndr_print *ndr = NULL((void*)0);
  DATA_BLOB blob;
  struct ndr_pull *ndr_pull = NULL((void*)0);
  void *st                  = NULL((void*)0);
  int flags                 = NDR_SCALARS0x100 | NDR_BUFFERS0x200;
  enum ndr_err_code ndr_err;
  struct ndr_interface_call ndr_call = {
      .name        = "PAC_DATA",
      .struct_size = sizeof(struct PAC_DATA),
      .ndr_push    = (ndr_push_flags_fn_t)ndr_push_PAC_DATA,
      .ndr_pull    = (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA,
      .ndr_print   = (ndr_print_function_t)print_flags_PAC_DATA,
  };

  ndr        = talloc_zero(frame, struct ndr_print)(struct ndr_print *)_talloc_zero(frame, sizeof(struct ndr_print
), "struct ndr_print");
  ndr->print = ndr_print_string_helper;
  ndr->depth = 0;

  blob            = data_blob_const(pac->value, pac->length);
  ndr_pull        = ndr_pull_init_blob(&blob, ndr);
  ndr_pull->flags = LIBNDR_FLAG_REF_ALLOC(1U<<20);

  st      = talloc_zero_size(ndr, ndr_call.struct_size)_talloc_zero(ndr, ndr_call.struct_size, "ipa-print-pac.c" ":"
 "73");
  ndr_err = ndr_call.ndr_pull(ndr_pull, flags, st);
  if (ndr_err) {
      fprintf(stderrstderr,
              "Error parsing buffer '%.*s': %s\n",
              (int)display->length,
              (char *)display->value,
              ndr_map_error2string(ndr_err));
      return;
  }

  ndr_call.ndr_print(ndr, ndr_call.name, flags, st);
  printf("%s\n", (char *)ndr->private_data);
  talloc_free(ndr)_talloc_free(ndr, "ipa-print-pac.c" ":" "86");
87}

89static void
90display_error(int type, OM_uint32 code)
91{
  OM_uint32 min, ctx = 0;
  gss_buffer_desc status;

  do {
      (void)gss_display_status(&min, code, type, GSS_C_NO_OID((gss_OID) 0), &ctx, &status);
      fprintf(stderrstderr, "%.*s\n", (int)status.length, (char *)status.value);
      gss_release_buffer(&min, &status);
  } while (ctx != 0);
100}

102static void
103log_error(const char *fn, uint32_t maj, uint32_t min)
104{
  fprintf(stderrstderr, "%s: ", fn);
  display_error(GSS_C_GSS_CODE1, maj);
  display_error(GSS_C_MECH_CODE2, min);
108}

110static gss_name_t
111import_name(const char *name)
112{
  OM_uint32 maj, min;
  gss_name_t gss_name;
  gss_name             = GSS_C_NO_NAME((gss_name_t) 0);
  gss_buffer_desc buff = GSS_C_EMPTY_BUFFER{0, ((void*)0)};

  buff.value  = (void *)name;
  buff.length = strlen(name);

  maj = gss_import_name(&min, &buff, *import_name_oid, &gss_name);
  if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
      log_error("gss_import_name()", maj, min);
      return GSS_C_NO_NAME((gss_name_t) 0);
  }

  return gss_name;
128}

130static bool_Bool
131store_creds_into_cache(gss_cred_id_t creds, const char *cache)
132{
  OM_uint32 maj, min;
  gss_key_value_element_desc store_elm = {"ccache", cache};
  gss_key_value_set_desc store         = {1, &store_elm};

  maj = gss_store_cred_into(
      &min, creds, GSS_C_INITIATE1, GSS_C_NO_OID((gss_OID) 0), 1, 1, &store, NULL((void*)0), NULL((void*)0));
  if (maj != GSS_S_COMPLETE0) {
      log_error("gss_store_cred_into()", maj, min);
      return false0;
  }

  return true1;
145}

147static void
148dump_attribute(gss_name_t name, gss_buffer_t attribute)
149{
  OM_uint32 major, minor;
  gss_buffer_desc value;
  gss_buffer_desc display_value;
  int authenticated = 0;
  int complete      = 0;
  int more          = -1;
  int whole_pac     = 0;

  whole_pac = attribute->length == strlen("urn:mspac:");
  while (more != 0) {
      value.value         = NULL((void*)0);
      display_value.value = NULL((void*)0);

      major = gss_get_name_attribute(&minor,
                                     name,
                                     attribute,
                                     &authenticated,
                                     &complete,
                                     &value,
                                     &display_value,
                                     &more);
      if (GSS_ERROR(major)((major) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_get_name_attribute()", major, minor);
          return;
      }

      if (whole_pac) {
          print_pac(&value, attribute);
      }

      (void)gss_release_buffer(&minor, &value);
      (void)gss_release_buffer(&minor, &display_value);
  }
183}

185static void
186enumerate_attributes(gss_name_t name)
187{
  OM_uint32 major, minor;
  int is_mechname;
  gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET((gss_buffer_set_t) 0);
  size_t i;

  major = gss_inquire_name(&minor, name, &is_mechname, NULL((void*)0), &attrs);
  if (GSS_ERROR(major)((major) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
      log_error("gss_inquire_name()", major, minor);
      return;
  }
  if (GSS_ERROR(major)((major) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
      printf("gss_inquire_name: (%d, %d)\n", major, minor);
      return;
  }

  if (attrs != GSS_C_NO_BUFFER_SET((gss_buffer_set_t) 0)) {
      for (i = 0; i < attrs->count; i++)
          dump_attribute(name, &attrs->elements[i]);
  }

  (void)gss_release_buffer_set(&minor, &attrs);
209}

211static bool_Bool
212establish_contexts(gss_OID imech,
                 gss_cred_id_t icred,
                 gss_cred_id_t acred,
                 gss_name_t tname,
                 OM_uint32 flags,
                 gss_ctx_id_t *ictx,
                 gss_ctx_id_t *actx,
                 gss_name_t *src_name,
                 gss_OID *amech,
                 gss_cred_id_t *deleg_cred)
222{
  OM_uint32 minor, imaj, amaj;
  gss_buffer_desc itok, atok;

  *ictx = *actx = GSS_C_NO_CONTEXT((gss_ctx_id_t) 0);
  imaj = amaj = GSS_S_CONTINUE_NEEDED(1 << (0 + 0));
  itok.value = atok.value = NULL((void*)0);
  itok.length = atok.length = 0;
  for (;;) {
      (void)gss_release_buffer(&minor, &itok);
      imaj = gss_init_sec_context(&minor,
                                  icred,
                                  ictx,
                                  tname,
                                  imech,
                                  flags,
                                  GSS_C_INDEFINITE((OM_uint32) 0xfffffffful),
                                  GSS_C_NO_CHANNEL_BINDINGS((gss_channel_bindings_t) 0),
                                  &atok,
                                  NULL((void*)0),
                                  &itok,
                                  NULL((void*)0),
                                  NULL((void*)0));
      if (GSS_ERROR(imaj)((imaj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_init_sec_context()", imaj, minor);
          return false0;
      }
      if (amaj == GSS_S_COMPLETE0)
          break;

      (void)gss_release_buffer(&minor, &atok);
      amaj = gss_accept_sec_context(&minor,
                                    actx,
                                    acred,
                                    &itok,
                                    GSS_C_NO_CHANNEL_BINDINGS((gss_channel_bindings_t) 0),
                                    src_name,
                                    amech,
                                    &atok,
                                    NULL((void*)0),
                                    NULL((void*)0),
                                    deleg_cred);
      if (GSS_ERROR(amaj)((amaj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_accept_sec_context()", amaj, minor);
          return false0;
      }
      (void)gss_release_buffer(&minor, &itok);
      if (imaj == GSS_S_COMPLETE0) {
          break;
      }
  }

  if (imaj != GSS_S_COMPLETE0 || amaj != GSS_S_COMPLETE0) {
      printf("One side wants to continue after the other is done");
      return false0;
  }

  (void)gss_release_buffer(&minor, &itok);
  (void)gss_release_buffer(&minor, &atok);

  return true1;
283}

285static bool_Bool
286init_accept_sec_context(gss_cred_id_t claimant_cred_handle,
                      gss_cred_id_t verifier_cred_handle,
                      gss_cred_id_t *deleg_cred_handle)
289{
  OM_uint32 maj, min, flags;
  gss_name_t source_name = GSS_C_NO_NAME((gss_name_t) 0), target_name = GSS_C_NO_NAME((gss_name_t) 0);
  gss_ctx_id_t initiator_context, acceptor_context;
24
←
'initiator_context' declared without an initial value→
  gss_OID mech = &mech_krb5;
  bool_Bool success = false0;

  maj = gss_inquire_cred(
      &min, verifier_cred_handle, &target_name, NULL((void*)0), NULL((void*)0), NULL((void*)0));
  if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
25
←
Assuming the condition is true→
26
←
Taking true branch→
      log_error("gss_inquire_cred()", maj, min);
      goto done;
27
←
Control jumps to line 318→
  }

  flags   = GSS_C_REPLAY_FLAG4 | GSS_C_SEQUENCE_FLAG8;
  flags   = GSS_C_REPLAY_FLAG4 | GSS_C_SEQUENCE_FLAG8;
  success = establish_contexts(mech,
                               claimant_cred_handle,
                               verifier_cred_handle,
                               target_name,
                               flags,
                               &initiator_context,
                               &acceptor_context,
                               &source_name,
                               &mech,
                               deleg_cred_handle);
  if (success)
      enumerate_attributes(source_name);
317done:
  if (source_name27.1
'source_name' is equal to GSS_C_NO_NAME
 != GSS_C_NO_NAME((gss_name_t) 0))
28
←
Taking false branch→
      (void)gss_release_name(&min, &source_name);

  if (target_name != GSS_C_NO_NAME((gss_name_t) 0))
29
←
Assuming 'target_name' is equal to GSS_C_NO_NAME→
30
←
Taking false branch→
      (void)gss_release_name(&min, &target_name);

  if (initiator_context != NULL((void*)0))
31
←
The left operand of '!=' is a garbage value
      (void)gss_delete_sec_context(&min, &initiator_context, NULL((void*)0));

  if (acceptor_context != NULL((void*)0))
      (void)gss_delete_sec_context(&min, &acceptor_context, NULL((void*)0));

  return success;
331}

333static bool_Bool
334init_creds(gss_cred_id_t *service_creds, gss_cred_usage_t intent)
335{
  OM_uint32 maj, min;
  gss_key_value_element_desc keytab_elm = {"keytab", keytab_path};
  gss_key_value_set_desc store          = {1, &keytab_elm};

  maj = gss_acquire_cred_from(&min,
                              GSS_C_NO_NAME((gss_name_t) 0),
                              GSS_C_INDEFINITE((OM_uint32) 0xfffffffful),
                              GSS_C_NO_OID_SET((gss_OID_set) 0),
                              intent,
                              (keytab_path != NULL((void*)0)) ? &store : NULL((void*)0),
                              service_creds,
                              NULL((void*)0),
                              NULL((void*)0));
  if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
      log_error("gss_acquire_cred", maj, min);
      return false0;
  }

  return true1;
355}

357static bool_Bool
358impersonate(const char *name)
359{
  OM_uint32 maj, min;
  gss_name_t desired_principal  = GSS_C_NO_NAME((gss_name_t) 0);
  gss_cred_id_t client_creds    = GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0);
  gss_cred_id_t service_creds   = GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0);
  gss_cred_id_t delegated_creds = GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0);
  bool_Bool success                  = false0;

  if (!init_creds(&service_creds, GSS_C_BOTH0)) {
17
←
Taking false branch→
      goto done;
  }

  desired_principal = import_name(name);
  if (desired_principal == GSS_C_NO_NAME((gss_name_t) 0)) {
18
←
Assuming 'desired_principal' is not equal to GSS_C_NO_NAME→
19
←
Taking false branch→
      goto done;
  }

  maj = gss_acquire_cred_impersonate_name(&min,
                                          service_creds,
                                          desired_principal,
                                          GSS_C_INDEFINITE((OM_uint32) 0xfffffffful),
                                          GSS_C_NO_OID_SET((gss_OID_set) 0),
                                          GSS_C_INITIATE1,
                                          &client_creds,
                                          NULL((void*)0),
                                          NULL((void*)0));
  if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
20
←
Assuming the condition is false→
21
←
Taking false branch→
      log_error("gss_acquire_cred_impersonate_name()", maj, min);
      goto done;
  }

  if (ccache_path21.1
'ccache_path' is equal to NULL
 != NULL((void*)0)) {
22
←
Taking false branch→
      if (!store_creds_into_cache(client_creds, ccache_path)) {
          fprintf(stderrstderr, "Failed to store credentials in cache\n");
          goto done;
      }
  }

  fprintf(stderrstderr, "Acquired credentials for %s\n", name);
  init_accept_sec_context(client_creds, service_creds, &delegated_creds);
23
←
Calling 'init_accept_sec_context'→

  if (delegated_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0)) {
      gss_buffer_set_t bufset = GSS_C_NO_BUFFER_SET((gss_buffer_set_t) 0);
      /* Inquire impersonator status. */
      maj = gss_inquire_cred_by_oid(
          &min, client_creds, GSS_KRB5_GET_CRED_IMPERSONATOR, &bufset);
      if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_inquire_cred_by_oid()", maj, min);
          goto done;
      }
      if (bufset->count == 0) {
          log_error("gss_inquire_cred_by_oid(user) returned NO impersonator", 0, 0);
          goto done;
      }
      (void)gss_release_buffer_set(&min, &bufset);

      maj = gss_inquire_cred_by_oid(
          &min, service_creds, GSS_KRB5_GET_CRED_IMPERSONATOR, &bufset);
      if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_inquire_cred_by_oid()", maj, min);
          goto done;
      }
      if (bufset->count != 0) {
          log_error("gss_inquire_cred_by_oid(svc) returned an impersonator", 0, 0);
          goto done;
      }
      (void)gss_release_buffer_set(&min, &bufset);
      success = true1;
  }

429done:

  if (desired_principal != GSS_C_NO_NAME((gss_name_t) 0))
      gss_release_name(&min, &desired_principal);

  if (client_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      gss_release_cred(&min, &client_creds);

  if (service_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      gss_release_cred(&min, &service_creds);

  if (delegated_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      gss_release_cred(&min, &delegated_creds);

  return success;
444}

446static bool_Bool
447init_with_password(const char *name, const char *password)
448{
  OM_uint32 maj, min;
  gss_name_t desired_principal = GSS_C_NO_NAME((gss_name_t) 0);
  gss_cred_id_t client_creds   = GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0);
  gss_cred_id_t service_creds  = GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0);
  gss_buffer_desc pwd_buf;
  bool_Bool success = false0;

  if (!init_creds(&service_creds, GSS_C_ACCEPT2)) {
      goto done;
  }

  desired_principal = import_name(name);
  if (desired_principal == GSS_C_NO_NAME((gss_name_t) 0)) {
      goto done;
  }

  if (init_tgt && password != NULL((void*)0)) {
      pwd_buf.value  = (void *)password;
      pwd_buf.length = strlen(password);
      maj            = gss_acquire_cred_with_password(&min,
                                           desired_principal,
                                           &pwd_buf,
                                           GSS_C_INDEFINITE((OM_uint32) 0xfffffffful),
                                           GSS_C_NO_OID_SET((gss_OID_set) 0),
                                           GSS_C_INITIATE1,
                                           &client_creds,
                                           NULL((void*)0),
                                           NULL((void*)0));
      if (GSS_ERROR(maj)((maj) & ((((OM_uint32) 0377ul) << 24) | (((OM_uint32
) 0377ul) << 16)))) {
          log_error("gss_acquire_cred_with_password()", maj, min);
          goto done;
      }
  }

  if ((ccache_path != NULL((void*)0)) && (client_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))) {
      if (!store_creds_into_cache(client_creds, ccache_path)) {
          fprintf(stderrstderr, "Failed to store credentials in cache\n");
          goto done;
      }
  }

  if (client_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      fprintf(stderrstderr, "Acquired credentials for %s\n", name);

  success = init_accept_sec_context(client_creds, service_creds, NULL((void*)0));

495done:
  if (service_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      gss_release_cred(&min, &client_creds);

  if (client_creds != GSS_C_NO_CREDENTIAL((gss_cred_id_t) 0))
      gss_release_cred(&min, &client_creds);

  if (desired_principal != GSS_C_NO_NAME((gss_name_t) 0))
      gss_release_name(&min, &desired_principal);

  return success;
506}

508struct poptOption popt_options[] = {
  {
      .longName  = "enterprise",
      .shortName = 'E',
      .argInfo   = POPT_ARG_NONE0U | POPT_ARGFLAG_OPTIONAL0x10000000U,
      .val       = 'E',
      .descrip   = "Treat the user principal as an enterprise name",
  },
  {
      .longName  = "ccache",
      .shortName = 'c',
      .argInfo   = POPT_ARG_STRING1U | POPT_ARGFLAG_OPTIONAL0x10000000U,
      .val       = 'c',
      .descrip   = "Credentials cache file to save acquired tickets to. "
                 "Tickets aren't saved by default",
      .argDescrip = "CCACHE-PATH",
  },
  {
      .longName  = "keytab",
      .shortName = 'k',
      .argInfo   = POPT_ARG_STRING1U | POPT_ARGFLAG_OPTIONAL0x10000000U,
      .val       = 'k',
      .descrip   = "Keytab for a service key to acquire service ticket for. "
                 "Default keytab is used if omitted",
      .argDescrip = "KEYTAB-PATH",
  },
  {
      .longName  = "reuse",
      .shortName = 'r',
      .argInfo   = POPT_ARG_NONE0U | POPT_ARGFLAG_OPTIONAL0x10000000U,
      .val       = 'r',
      .descrip   = "Re-use user principal's TGT from a default ccache",
  },
  {
      .longName  = "help",
      .shortName = 'h',
      .argInfo   = POPT_ARG_NONE0U | POPT_ARGFLAG_OPTIONAL0x10000000U,
      .val       = 'h',
      .descrip   = "Show this help message",
  },

  POPT_TABLEEND{ ((void*)0), '\0', 0, ((void*)0), 0, ((void*)0), ((void*)0) }};

551static void
552print_help(poptContext pc, const char *name)
553{
  const char *help = ""
                     "Usage: %s [options] {impersonate|ticket} user@realm\n\n"
                     "Print MS-PAC structure from a service ticket.\n\n"
                     "Operation 'impersonate':\n"
                     "\tExpects a TGT for a service in the default ccache and attempts to "
                     "obtain a service\n"
                     "\tticket to itself by performing a protocol transition for the specified "
                     "user (S4U2Self).\n\n"
                     "Operation 'ticket':\n"
                     "\tExpects a user password to be provided, acquires ticket granting ticket "
                     "and attempts to \n"
                     "\tobtain a service ticket to the specified service.\n\n"
                     "Resulting service ticket can be stored in the credential cache file "
                     "specified by '-c file' option.\n\n"
                     "Defaults to the host principal service name and the host keytab.\n\n";
  fprintf(stderrstderr, help, name);
  poptPrintHelp(pc, stderrstderr, 0);
571}

573static char *
574ask_password(TALLOC_CTX *context, char *prompt1, char *prompt2, bool_Bool match)
575{
  krb5_prompt ap_prompts[2];
  krb5_data k5d_pw0;
  krb5_data k5d_pw1;
579#define MAX(a, b)(((a) > (b)) ? (a) : (b)) (((a) > (b)) ? (a) : (b))
580#define PWD_BUFFER_SIZE((((1024 + 2)) > (1024)) ? ((1024 + 2)) : (1024)) MAX((IPAPWD_PASSWORD_MAX_LEN + 2), 1024)((((1024 + 2)) > (1024)) ? ((1024 + 2)) : (1024))
  char pw0[PWD_BUFFER_SIZE((((1024 + 2)) > (1024)) ? ((1024 + 2)) : (1024))];
  char pw1[PWD_BUFFER_SIZE((((1024 + 2)) > (1024)) ? ((1024 + 2)) : (1024))];
  char *password;
  int num_prompts = match ? 2 : 1;

  k5d_pw0.length       = sizeof(pw0);
  k5d_pw0.data         = pw0;
  ap_prompts[0].prompt = prompt1;
  ap_prompts[0].hidden = 1;
  ap_prompts[0].reply  = &k5d_pw0;

  if (match) {
      k5d_pw1.length       = sizeof(pw1);
      k5d_pw1.data         = pw1;
      ap_prompts[1].prompt = prompt2;
      ap_prompts[1].hidden = 1;
      ap_prompts[1].reply  = &k5d_pw1;
  }

  /* krb5_prompter_posix does not use krb5_context internally */
  krb5_prompter_posix(NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0), num_prompts, ap_prompts);

  if (match && (strcmp(pw0, pw1))) {
      fprintf(stderrstderr, "Passwords do not match!\n");
      return NULL((void*)0);
  }

  if (k5d_pw0.length > IPAPWD_PASSWORD_MAX_LEN1024) {
      fprintf(stderrstderr, "%s\n", "Password is too long!\n");
      return NULL((void*)0);
  }

  password = talloc_strndup(context, pw0, k5d_pw0.length);
  if (!password)
      return NULL((void*)0);
  return password;
617}

619int main(int argc, char *argv[])
620{
  int ret = 0, c = 0;
  const char **argv_const = discard_const_p(const char *, argv)((const char * *)((void *)((uintptr_t)(argv))));
  const char **args       = NULL((void*)0);
  char *password          = NULL((void*)0);
  poptContext pc;

  frame = talloc_init("printpac");
  pc    = poptGetContext(
      "printpac", argc, argv_const, popt_options, POPT_CONTEXT_KEEP_FIRST(1U << 1));
  while ((c = poptGetNextOpt(pc)) >= 0) {
1
Assuming the condition is false→
2
←
Loop condition is false. Execution continues on line 650→
      switch (c) {
      case 'c':
          ccache_path = talloc_strdup(frame, poptGetOptArg(pc));
          break;
      case 'E':
          import_name_oid = &GSS_KRB5_NT_ENTERPRISE_NAME;
          break;
      case 'k':
          keytab_path = talloc_strdup(frame, poptGetOptArg(pc));
          break;
      case 'r':
          init_tgt = false0;
          break;
      case 'h':
          print_help(pc, argv[0]);
          ret = 0;
          goto done;
      }
  }
  if (c < -1) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
      fprintf(stderrstderr,
              "%s: %s\n",
              poptBadOption(pc, POPT_BADOPTION_NOALIAS(1U << 0)),
              poptStrerror(c));
      ret = 1;
      goto done;
  }
  args = poptGetArgs(pc);
  for (c = 0; args6.1
'args' is non-null
1
'args' is non-null
1
'args' is non-null
 && args[c]; c++)
5
←
Assuming 'args' is non-null→
6
←
Loop condition is true.  Entering loop body→
7
←
Loop condition is true.  Entering loop body→
8
←
Loop condition is true.  Entering loop body→
9
←
Loop condition is false. Execution continues on line 662→
      ;

  if (c9.1
'c' is >= 3
 < 3) {
10
←
Taking false branch→
      print_help(pc, args[0]);
      ret = 1;
      goto done;
  }

  c -= 2;
  if (strncasecmp("ticket", args[1], strlen("ticket")) == 0) {
11
←
Assuming the condition is false→
12
←
Taking false branch→
      operation = OP_SERVICE_TICKET;
      if (init_tgt) {
          switch (c) {
          case 1:
              password = ask_password(frame, "Password", NULL((void*)0), false0);
              break;
          case 2:
              password = talloc_strdup(frame, args[3]);
              break;
          default:
              fprintf(stderrstderr,
                      "Service ticket needs user principal and password\n\n");
              print_help(pc, args[0]);
              ret = 1;
              goto done;
              break;
          }
      } else {
          if (c != 1) {
              fprintf(stderrstderr, "Service ticket needs user principal and password\n\n");
              print_help(pc, args[0]);
              ret = 1;
              goto done;
          }
      }
  } else if (strncasecmp("impersonate", args[1], strlen("impersonate")) == 0) {
13
←
Taking true branch→
      operation = OP_IMPERSONATE;
      if (c13.1
'c' is equal to 1
 != 1) {
14
←
Taking false branch→
          fprintf(stderrstderr, "Impersonation ticket needs user principal\n\n");
          print_help(pc, args[0]);
          ret = 1;
          goto done;
      }
  } else {
      fprintf(stderrstderr, "Wrong request type: %s\n\n", args[1]);
      print_help(pc, args[0]);
      ret = 1;
      goto done;
  }

  switch (operation) {
15
←
Control jumps to 'case OP_IMPERSONATE:'  at line 711→
  case OP_IMPERSONATE:
      ret = impersonate(args[2]) != true1;
16
←
Calling 'impersonate'→
      break;
  case OP_SERVICE_TICKET:
      ret = init_with_password(args[2], password) != true1;
      break;
  }

719done:
  poptFreeContext(pc);
  talloc_free(frame)_talloc_free(frame, "ipa-print-pac.c" ":" "721");
  return ret;
723}