utils/gssd/gssd_proc.c

   1 /*
   2   gssd_proc.c
   3
   4   Copyright (c) 2000-2004 The Regents of the University of Michigan.
   5   All rights reserved.
   6
   7   Copyright (c) 2000 Dug Song <dugsong@UMICH.EDU>.
   8   Copyright (c) 2001 Andy Adamson <andros@UMICH.EDU>.
   9   Copyright (c) 2002 Marius Aamodt Eriksen <marius@UMICH.EDU>.
  10   Copyright (c) 2002 Bruce Fields <bfields@UMICH.EDU>
  11   Copyright (c) 2004 Kevin Coffman <kwc@umich.edu>
  12   All rights reserved, all wrongs reversed.
  13
  14   Redistribution and use in source and binary forms, with or without
  15   modification, are permitted provided that the following conditions
  16   are met:
  17
  18   1. Redistributions of source code must retain the above copyright
  19      notice, this list of conditions and the following disclaimer.
  20   2. Redistributions in binary form must reproduce the above copyright
  21      notice, this list of conditions and the following disclaimer in the
  22      documentation and/or other materials provided with the distribution.
  23   3. Neither the name of the University nor the names of its
  24      contributors may be used to endorse or promote products derived
  25      from this software without specific prior written permission.
  26
  27   THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  28   WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  29   MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  30   DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  31   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  32   CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  33   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  34   BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  35   LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  36   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  37   SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  38
  39 */
  40
  41 #ifndef _GNU_SOURCE
  42 #define _GNU_SOURCE
  43 #endif
  44 #include "config.h"
  45 #include <sys/param.h>
  46 #include <rpc/rpc.h>
  47 #include <sys/stat.h>
  48 #include <sys/socket.h>
  49 #include <arpa/inet.h>
  50
  51 #include <stdio.h>
  52 #include <stdlib.h>
  53 #include <pwd.h>
  54 #include <grp.h>
  55 #include <string.h>
  56 #include <dirent.h>
  57 #include <poll.h>
  58 #include <fcntl.h>
  59 #include <signal.h>
  60 #include <unistd.h>
  61 #include <errno.h>
  62 #include <gssapi/gssapi.h>
  63 #include <netdb.h>
  64
  65 #include "gssd.h"
  66 #include "err_util.h"
  67 #include "gss_util.h"
  68 #include "gss_oids.h"
  69 #include "krb5_util.h"
  70 #include "context.h"
  71
  72 /*
  73  * pollarray:
  74  *      array of struct pollfd suitable to pass to poll. initialized to
  75  *      zero - a zero struct is ignored by poll() because the events mask is 0.
  76  *
  77  * clnt_list:
  78  *      linked list of struct clnt_info which associates a clntXXX directory
  79  *      with an index into pollarray[], and other basic data about that client.
  80  *
  81  * Directory structure: created by the kernel nfs client
  82  *      /pipefsdir/clntXX             : one per rpc_clnt struct in the kernel
  83  *      /pipefsdir/clntXX/krb5        : read uid for which kernel wants
  84  *                                       a context, write the resulting context
  85  *      /pipefsdir/clntXX/info        : stores info such as server name
  86  *
  87  * Algorithm:
  88  *      Poll all /pipefsdir/clntXX/krb5 files.  When ready, data read
  89  *      is a uid; performs rpcsec_gss context initialization protocol to
  90  *      get a cred for that user.  Writes result to corresponding krb5 file
  91  *      in a form the kernel code will understand.
  92  *      In addition, we make sure we are notified whenever anything is
  93  *      created or destroyed in pipefsdir/ or in an of the clntXX directories,
  94  *      and rescan the whole pipefsdir when this happens.
  95  */
  96
  97 struct pollfd * pollarray;
  98
  99 int pollsize;  /* the size of pollaray (in pollfd's) */
 100
 101 /* XXX buffer problems: */
 102 static int
 103 read_service_info(char *info_file_name, char **servicename, char **servername,
 104                   int *prog, int *vers, char **protocol) {
 105 #define INFOBUFLEN 256
 106         char            buf[INFOBUFLEN];
 107         static char     dummy[128];
 108         int             nbytes;
 109         static char     service[128];
 110         static char     address[128];
 111         char            program[16];
 112         char            version[16];
 113         char            protoname[16];
 114         in_addr_t       inaddr;
 115         int             fd = -1;
 116         struct hostent  *ent = NULL;
 117         int             numfields;
 118
 119         *servicename = *servername = *protocol = NULL;
 120
 121         if ((fd = open(info_file_name, O_RDONLY)) == -1) {
 122                 printerr(0, "ERROR: can't open %s: %s\n", info_file_name,
 123                          strerror(errno));
 124                 goto fail;
 125         }
 126         if ((nbytes = read(fd, buf, INFOBUFLEN)) == -1)
 127                 goto fail;
 128         close(fd);
 129
 130         numfields = sscanf(buf,"RPC server: %s\n"
 131                    "service: %s %s version %s\n"
 132                    "address: %s\n"
 133                    "protocol: %s\n",
 134                    dummy,
 135                    service, program, version,
 136                    address,
 137                    protoname);
 138
 139         if (numfields == 5) {
 140                 strcpy(protoname, "tcp");
 141         } else if (numfields != 6) {
 142                 goto fail;
 143         }
 144
 145         /* check service, program, and version */
 146         if(memcmp(service, "nfs", 3)) return -1;
 147         *prog = atoi(program + 1); /* skip open paren */
 148         *vers = atoi(version);
 149         if((*prog != 100003) || ((*vers != 2) && (*vers != 3) && (*vers != 4)))
 150                 goto fail;
 151
 152         /* create service name */
 153         inaddr = inet_addr(address);
 154         if (!(ent = gethostbyaddr(&inaddr, sizeof(inaddr), AF_INET))) {
 155                 printerr(0, "ERROR: can't resolve server %s name\n", address);
 156                 goto fail;
 157         }
 158         if (!(*servername = calloc(strlen(ent->h_name) + 1, 1)))
 159                 goto fail;
 160         memcpy(*servername, ent->h_name, strlen(ent->h_name));
 161         snprintf(buf, INFOBUFLEN, "%s@%s", service, ent->h_name);
 162         if (!(*servicename = calloc(strlen(buf) + 1, 1)))
 163                 goto fail;
 164         memcpy(*servicename, buf, strlen(buf));
 165
 166         if (!(*protocol = strdup(protoname)))
 167                 goto fail;
 168         return 0;
 169 fail:
 170         printerr(0, "ERROR: failed to read service info\n");
 171         if (fd != -1) close(fd);
 172         if (*servername) free(*servername);
 173         if (*servicename) free(*servicename);
 174         if (*protocol) free(*protocol);
 175         return -1;
 176 }
 177
 178 static void
 179 destroy_client(struct clnt_info *clp)
 180 {
 181         if (clp->dir_fd != -1) close(clp->dir_fd);
 182         if (clp->krb5_fd != -1) close(clp->krb5_fd);
 183         if (clp->spkm3_fd != -1) close(clp->spkm3_fd);
 184         if (clp->dirname) free(clp->dirname);
 185         if (clp->servicename) free(clp->servicename);
 186         if (clp->servername) free(clp->servername);
 187         if (clp->protocol) free(clp->protocol);
 188         free(clp);
 189 }
 190
 191 static struct clnt_info *
 192 insert_new_clnt(void)
 193 {
 194         struct clnt_info        *clp = NULL;
 195
 196         if (!(clp = (struct clnt_info *)calloc(1,sizeof(struct clnt_info)))) {
 197                 printerr(0, "ERROR: can't malloc clnt_info: %s\n",
 198                          strerror(errno));
 199                 goto out;
 200         }
 201         clp->krb5_poll_index = -1;
 202         clp->spkm3_poll_index = -1;
 203         clp->krb5_fd = -1;
 204         clp->spkm3_fd = -1;
 205         clp->dir_fd = -1;
 206
 207         TAILQ_INSERT_HEAD(&clnt_list, clp, list);
 208 out:
 209         return clp;
 210 }
 211
 212 static int
 213 process_clnt_dir_files(struct clnt_info * clp)
 214 {
 215         char    kname[32];
 216         char    sname[32];
 217         char    info_file_name[32];
 218
 219         snprintf(kname, sizeof(kname), "%s/krb5", clp->dirname);
 220         clp->krb5_fd = open(kname, O_RDWR);
 221         snprintf(sname, sizeof(sname), "%s/spkm3", clp->dirname);
 222         clp->spkm3_fd = open(sname, O_RDWR);
 223         if((clp->krb5_fd == -1) && (clp->spkm3_fd == -1))
 224                 return -1;
 225         snprintf(info_file_name, sizeof(info_file_name), "%s/info",
 226                         clp->dirname);
 227         if (read_service_info(info_file_name, &clp->servicename,
 228                                 &clp->servername, &clp->prog, &clp->vers,
 229                                 &clp->protocol))
 230                 return -1;
 231         return 0;
 232 }
 233
 234 static int
 235 get_poll_index(int *ind)
 236 {
 237         int i;
 238
 239         *ind = -1;
 240         for (i=0; i<FD_ALLOC_BLOCK; i++) {
 241                 if (pollarray[i].events == 0) {
 242                         *ind = i;
 243                         break;
 244                 }
 245         }
 246         if (*ind == -1) {
 247                 printerr(0, "ERROR: No pollarray slots open\n");
 248                 return -1;
 249         }
 250         return 0;
 251 }
 252
 253 static void
 254 process_clnt_dir(char *dir)
 255 {
 256         struct clnt_info *      clp;
 257
 258         if (!(clp = insert_new_clnt()))
 259                 goto fail_destroy_client;
 260
 261         if (!(clp->dirname = calloc(strlen(dir) + 1, 1))) {
 262                 goto fail_destroy_client;
 263         }
 264         memcpy(clp->dirname, dir, strlen(dir));
 265         if ((clp->dir_fd = open(clp->dirname, O_RDONLY)) == -1) {
 266                 printerr(0, "ERROR: can't open %s: %s\n",
 267                          clp->dirname, strerror(errno));
 268                 goto fail_destroy_client;
 269         }
 270         fcntl(clp->dir_fd, F_SETSIG, DNOTIFY_SIGNAL);
 271         fcntl(clp->dir_fd, F_NOTIFY, DN_CREATE | DN_DELETE | DN_MULTISHOT);
 272
 273         if (process_clnt_dir_files(clp))
 274                 goto fail_keep_client;
 275
 276         if(clp->krb5_fd != -1) {
 277                 if (get_poll_index(&clp->krb5_poll_index)) {
 278                         printerr(0, "ERROR: Too many krb5 clients\n");
 279                         goto fail_destroy_client;
 280                 }
 281                 pollarray[clp->krb5_poll_index].fd = clp->krb5_fd;
 282                 pollarray[clp->krb5_poll_index].events |= POLLIN;
 283         }
 284
 285         if(clp->spkm3_fd != -1) {
 286                 if (get_poll_index(&clp->spkm3_poll_index)) {
 287                         printerr(0, "ERROR: Too many spkm3 clients\n");
 288                         goto fail_destroy_client;
 289                 }
 290                 pollarray[clp->spkm3_poll_index].fd = clp->spkm3_fd;
 291                 pollarray[clp->spkm3_poll_index].events |= POLLIN;
 292         }
 293
 294         return;
 295
 296 fail_destroy_client:
 297         if (clp) {
 298                 TAILQ_REMOVE(&clnt_list, clp, list);
 299                 destroy_client(clp);
 300         }
 301 fail_keep_client:
 302         /* We couldn't find some subdirectories, but we keep the client
 303          * around in case we get a notification on the directory when the
 304          * subdirectories are created. */
 305         return;
 306 }
 307
 308 void
 309 init_client_list(void)
 310 {
 311         TAILQ_INIT(&clnt_list);
 312         /* Eventually plan to grow/shrink poll array: */
 313         pollsize = FD_ALLOC_BLOCK;
 314         pollarray = calloc(pollsize, sizeof(struct pollfd));
 315 }
 316
 317 static void
 318 destroy_client_list(void)
 319 {
 320         struct clnt_info        *clp;
 321
 322         printerr(1, "processing client list\n");
 323
 324         while (clnt_list.tqh_first != NULL) {
 325                 clp = clnt_list.tqh_first;
 326                 TAILQ_REMOVE(&clnt_list, clp, list);
 327                 destroy_client(clp);
 328         }
 329 }
 330
 331 /* Used to read (and re-read) list of clients, set up poll array. */
 332 int
 333 update_client_list(void)
 334 {
 335         struct dirent **namelist;
 336         int i,j;
 337
 338         destroy_client_list();
 339
 340         if (chdir(pipefsdir) < 0) {
 341                 printerr(0, "ERROR: can't chdir to %s: %s\n",
 342                          pipefsdir, strerror(errno));
 343                 return -1;
 344         }
 345
 346         memset(pollarray, 0, pollsize * sizeof(struct pollfd));
 347
 348         j = scandir(pipefsdir, &namelist, NULL, alphasort);
 349         if (j < 0) {
 350                 printerr(0, "ERROR: can't scandir %s: %s\n",
 351                          pipefsdir, strerror(errno));
 352                 return -1;
 353         }
 354         for (i=0; i < j; i++) {
 355                 if (i < FD_ALLOC_BLOCK
 356                                 && !strncmp(namelist[i]->d_name, "clnt", 4))
 357                         process_clnt_dir(namelist[i]->d_name);
 358                 free(namelist[i]);
 359         }
 360
 361         free(namelist);
 362         return 0;
 363 }
 364
 365 static int
 366 do_downcall(int k5_fd, uid_t uid, struct authgss_private_data *pd,
 367             gss_buffer_desc *context_token)
 368 {
 369         char    buf[2048];
 370         char    *p = buf, *end = buf + 2048;
 371         unsigned int timeout = 0; /* XXX decide on a reasonable value */
 372
 373         printerr(1, "doing downcall\n");
 374
 375         if (WRITE_BYTES(&p, end, uid)) return -1;
 376         /* Not setting any timeout for now: */
 377         if (WRITE_BYTES(&p, end, timeout)) return -1;
 378         if (WRITE_BYTES(&p, end, pd->pd_seq_win)) return -1;
 379         if (write_buffer(&p, end, &pd->pd_ctx_hndl)) return -1;
 380         if (write_buffer(&p, end, context_token)) return -1;
 381
 382         if (write(k5_fd, buf, p - buf) < p - buf) return -1;
 383         return 0;
 384 }
 385
 386 static int
 387 do_error_downcall(int k5_fd, uid_t uid, int err)
 388 {
 389         char    buf[1024];
 390         char    *p = buf, *end = buf + 1024;
 391         unsigned int timeout = 0;
 392         int     zero = 0;
 393
 394         printerr(1, "doing error downcall\n");
 395
 396         if (WRITE_BYTES(&p, end, uid)) return -1;
 397         if (WRITE_BYTES(&p, end, timeout)) return -1;
 398         /* use seq_win = 0 to indicate an error: */
 399         if (WRITE_BYTES(&p, end, zero)) return -1;
 400         if (WRITE_BYTES(&p, end, err)) return -1;
 401
 402         if (write(k5_fd, buf, p - buf) < p - buf) return -1;
 403         return 0;
 404
 405 }
 406
 407 /*
 408  * Create an RPC connection and establish an authenticated
 409  * gss context with a server.
 410  */
 411 int create_auth_rpc_client(struct clnt_info *clp,
 412                            AUTH **auth_return,
 413                            uid_t uid,
 414                            int authtype)
 415 {
 416         CLIENT                  *rpc_clnt = NULL;
 417         struct rpc_gss_sec      sec;
 418         AUTH                    *auth = NULL;
 419         uid_t                   save_uid = -1;
 420         int                     retval = -1;
 421         OM_uint32               min_stat;
 422
 423         sec.qop = GSS_C_QOP_DEFAULT;
 424         sec.svc = RPCSEC_GSS_SVC_NONE;
 425         sec.cred = GSS_C_NO_CREDENTIAL;
 426         sec.req_flags = 0;
 427         if (authtype == AUTHTYPE_KRB5) {
 428                 sec.mech = (gss_OID)&krb5oid;
 429                 sec.req_flags = GSS_C_MUTUAL_FLAG;
 430         }
 431         else if (authtype == AUTHTYPE_SPKM3) {
 432                 sec.mech = (gss_OID)&spkm3oid;
 433                 sec.req_flags = GSS_C_ANON_FLAG;
 434         }
 435         else {
 436                 printerr(0, "ERROR: Invalid authentication type (%d) "
 437                         "in create_auth_rpc_client\n", authtype);
 438                 goto out_fail;
 439         }
 440
 441
 442         if (authtype == AUTHTYPE_KRB5) {
 443 #ifdef HAVE_SET_ALLOWABLE_ENCTYPES
 444                 /*
 445                  * Do this before creating rpc connection since we won't need
 446                  * rpc connection if it fails!
 447                  */
 448                 if (limit_krb5_enctypes(&sec, uid)) {
 449                         printerr(1, "WARNING: Failed while limiting krb5 "
 450                                     "encryption types for user with uid %d\n",
 451                                  uid);
 452                         goto out_fail;
 453                 }
 454 #endif
 455         }
 456
 457         /* Create the context as the user (not as root) */
 458         save_uid = geteuid();
 459         if (seteuid(uid) != 0) {
 460                 printerr(0, "WARNING: Failed to seteuid for "
 461                             "user with uid %d\n", uid);
 462                 goto out_fail;
 463         }
 464         printerr(2, "creating context using euid %d (save_uid %d)\n",
 465                         geteuid(), save_uid);
 466
 467         /* create an rpc connection to the nfs server */
 468
 469         printerr(2, "creating %s client for server %s\n", clp->protocol,
 470                         clp->servername);
 471         if ((rpc_clnt = clnt_create(clp->servername, clp->prog, clp->vers,
 472                                         clp->protocol)) == NULL) {
 473                 printerr(0, "WARNING: can't create rpc_clnt for server "
 474                             "%s for user with uid %d\n",
 475                         clp->servername, uid);
 476                 goto out_fail;
 477         }
 478
 479         printerr(2, "creating context with server %s\n", clp->servicename);
 480         auth = authgss_create_default(rpc_clnt, clp->servicename, &sec);
 481         if (!auth) {
 482                 /* Our caller should print appropriate message */
 483                 printerr(2, "WARNING: Failed to create krb5 context for "
 484                             "user with uid %d for server %s\n",
 485                          uid, clp->servername);
 486                 goto out_fail;
 487         }
 488
 489         /* Restore euid to original value */
 490         if (seteuid(save_uid) != 0) {
 491                 printerr(0, "WARNING: Failed to restore euid"
 492                             " to uid %d\n", save_uid);
 493                 goto out_fail;
 494         }
 495         save_uid = -1;
 496
 497         /* Success !!! */
 498         *auth_return = auth;
 499         retval = 0;
 500
 501   out_fail:
 502         if (sec.cred != GSS_C_NO_CREDENTIAL)
 503                 gss_release_cred(&min_stat, &sec.cred);
 504         if (rpc_clnt) clnt_destroy(rpc_clnt);
 505
 506         return retval;
 507 }
 508
 509
 510 /*
 511  * this code uses the userland rpcsec gss library to create a krb5
 512  * context on behalf of the kernel
 513  */
 514 void
 515 handle_krb5_upcall(struct clnt_info *clp)
 516 {
 517         uid_t                   uid;
 518         AUTH                    *auth;
 519         struct authgss_private_data pd;
 520         gss_buffer_desc         token;
 521         char                    **credlist = NULL;
 522         char                    **ccname;
 523
 524         printerr(1, "handling krb5 upcall\n");
 525
 526         token.length = 0;
 527         token.value = NULL;
 528
 529         if (read(clp->krb5_fd, &uid, sizeof(uid)) < sizeof(uid)) {
 530                 printerr(0, "WARNING: failed reading uid from krb5 "
 531                             "upcall pipe: %s\n", strerror(errno));
 532                 goto out;
 533         }
 534
 535         if (uid == 0) {
 536                 int success = 0;
 537
 538                 /*
 539                  * Get a list of credential cache names and try each
 540                  * of them until one works or we've tried them all
 541                  */
 542                 if (gssd_get_krb5_machine_cred_list(&credlist)) {
 543                         printerr(0, "WARNING: Failed to obtain machine "
 544                                     "credentials for connection to "
 545                                     "server %s\n", clp->servername);
 546                                 goto out_return_error;
 547                 }
 548                 for (ccname = credlist; ccname && *ccname; ccname++) {
 549                         gssd_setup_krb5_machine_gss_ccache(*ccname);
 550                         if ((create_auth_rpc_client(clp, &auth, uid,
 551                                                     AUTHTYPE_KRB5)) == 0) {
 552                                 /* Success! */
 553                                 success++;
 554                                 break;
 555                         }
 556                         printerr(2, "WARNING: Failed to create krb5 context "
 557                                     "for user with uid %d with credentials "
 558                                     "cache %s for server %s\n",
 559                                  uid, *ccname, clp->servername);
 560                 }
 561                 gssd_free_krb5_machine_cred_list(credlist);
 562                 if (!success) {
 563                         printerr(0, "WARNING: Failed to create krb5 context "
 564                                     "for user with uid %d with any "
 565                                     "credentials cache for server %s\n",
 566                                  uid, clp->servername);
 567                         goto out_return_error;
 568                 }
 569         }
 570         else {
 571                 /* Tell krb5 gss which credentials cache to use */
 572                 gssd_setup_krb5_user_gss_ccache(uid, clp->servername);
 573
 574                 if (create_auth_rpc_client(clp, &auth, uid, AUTHTYPE_KRB5)) {
 575                         printerr(0, "WARNING: Failed to create krb5 context "
 576                                     "for user with uid %d for server %s\n",
 577                                  uid, clp->servername);
 578                         goto out_return_error;
 579                 }
 580         }
 581
 582         if (!authgss_get_private_data(auth, &pd)) {
 583                 printerr(0, "WARNING: Failed to obtain authentication "
 584                             "data for user with uid %d for server %s\n",
 585                          uid, clp->servername);
 586                 goto out_return_error;
 587         }
 588
 589         if (serialize_context_for_kernel(pd.pd_ctx, &token)) {
 590                 printerr(0, "WARNING: Failed to serialize krb5 context for "
 591                             "user with uid %d for server %s\n",
 592                          uid, clp->servername);
 593                 goto out_return_error;
 594         }
 595
 596         do_downcall(clp->krb5_fd, uid, &pd, &token);
 597
 598         if (token.value)
 599                 free(token.value);
 600 out:
 601         return;
 602
 603 out_return_error:
 604         do_error_downcall(clp->krb5_fd, uid, -1);
 605         return;
 606 }
 607
 608 /*
 609  * this code uses the userland rpcsec gss library to create an spkm3
 610  * context on behalf of the kernel
 611  */
 612 void
 613 handle_spkm3_upcall(struct clnt_info *clp)
 614 {
 615         uid_t                   uid;
 616         AUTH                    *auth;
 617         struct authgss_private_data pd;
 618         gss_buffer_desc         token;
 619
 620         printerr(2, "handling spkm3 upcall\n");
 621
 622         token.length = 0;
 623         token.value = NULL;
 624
 625         if (read(clp->spkm3_fd, &uid, sizeof(uid)) < sizeof(uid)) {
 626                 printerr(0, "WARNING: failed reading uid from spkm3 "
 627                          "upcall pipe: %s\n", strerror(errno));
 628                 goto out;
 629         }
 630
 631         if (create_auth_rpc_client(clp, &auth, uid, AUTHTYPE_SPKM3)) {
 632                 printerr(0, "WARNING: Failed to create spkm3 context for "
 633                             "user with uid %d\n", uid);
 634                 goto out_return_error;
 635         }
 636
 637         if (!authgss_get_private_data(auth, &pd)) {
 638                 printerr(0, "WARNING: Failed to obtain authentication "
 639                             "data for user with uid %d for server %s\n",
 640                          uid, clp->servername);
 641                 goto out_return_error;
 642         }
 643
 644         if (serialize_context_for_kernel(pd.pd_ctx, &token)) {
 645                 printerr(0, "WARNING: Failed to serialize spkm3 context for "
 646                             "user with uid %d for server\n",
 647                          uid, clp->servername);
 648                 goto out_return_error;
 649         }
 650
 651         do_downcall(clp->spkm3_fd, uid, &pd, &token);
 652
 653         if (token.value)
 654                 free(token.value);
 655 out:
 656         return;
 657
 658 out_return_error:
 659         do_error_downcall(clp->spkm3_fd, uid, -1);
 660         return;
 661 }