[06/11] fedfsc: Convert fedfs-get-limited-nsdb-params to use new libadmin API

diff --git a/doc/man/fedfs-get-limited-nsdb-params.8 b/doc/man/fedfs-get-limited-nsdb-params.8
index dc17a2d..c81fc3f 100644
--- a/doc/man/fedfs-get-limited-nsdb-params.8
+++ b/doc/man/fedfs-get-limited-nsdb-params.8
@@ -5,7 +5,7 @@ 
 .\"
 
 .\"
-.\" Copyright 2011 Oracle.  All rights reserved.
+.\" Copyright 2011, 2013 Oracle.  All rights reserved.
 .\"
 .\" This file is part of fedfs-utils.
 .\"
@@ -37,6 +37,8 @@  fedfs-get-limited-nsdb-params \- send a FEDFS_GET_LIMITED_NSDB_PARAMS ADMIN prot
 .IR nsdbname ]
 .RB [ \-r
 .IR nsdbport ]
+.RB [ \-s
+.IR security ]
 .SH INTRODUCTION
 RFC 5716 introduces the Federated File System (FedFS, for short).
 FedFS is an extensible standardized mechanism
@@ -118,90 +120,21 @@  Specifies the IP port of the NSDB to insert into the new FedFS junction.
 If this option is not specified,
 the value of the FEDFS_NSDB_PORT environment variable is consulted.
 The default value if the variable is not set is 389.
-.SH EXIT CODES
-The remote administration service returns a value that reflects the
-success of the requested operation.
-.TP
-.B FEDFS_OK
-The operation succeeded.
-.TP
-.B FEDFS_ERR_ACCESS
-The caller does not have permission to perform the requested operation
-on the remote server.
-.TP
-.B FEDFS_ERR_BADCHAR
-The NSDB hostname contains a character which is not
-supported by the remote server.
-.TP
-.B FEDFS_ERR_BADXDR
-The remote server encountered an XDR decoding error while
-processing the request.
-.TP
-.B FEDFS_ERR_INVAL
-One of the arguments was not valid.
-.TP
-.B FEDFS_ERR_IO
-A hard error occurred on the remote server.
-.TP
-.B FEDFS_ERR_PERM
-The operation was not allowed because the caller is
-either not a privileged user or not the owner of an object that
-would be modified by the operation.
-.TP
-.B FEDFS_ERR_SVRFAULT
-An unanticipated non-protocol error occurred on the remote server.
-.TP
-.B FEDFS_ERR_NSDB_ROUTE
-The remote server was unable to find a route to the NSDB.
-.TP
-.B FEDFS_ERR_NSDB_DOWN
-The remote server determined that the NSDB was down.
-.TP
-.B FEDFS_ERR_NSDB_CONN
-The remote server was unable to establish a connection with the NSDB.
-.TP
-.B FEDFS_ERR_NSDB_AUTH
-The remote server was unable to authenticate
-and establish a secure connection with the NSDB.
-.TP
-.B FEDFS_ERR_NSDB_LDAP
-An LDAP error occurred on the connection between the remote server and NSDB.
-.TP
-.B FEDFS_ERR_NSDB_LDAP_VAL
-Indicates the same error as FEDFS_ERR_NSDB_LDAP,
-and allows an LDAP protocol error value to be returned to the client.
-.TP
-.B FEDFS_ERR_NSDB_RESPONSE
-The remote server received a malformed response from the NSDB.
-This includes situations when an NSDB entry (e.g. FSN or FSL)
-is missing a required attribute.
-.TP
-.B FEDFS_ERR_NSDB_FAULT
-An unanticipated error related to the NSDB occurred.
-.TP
-.B FEDFS_ERR_NSDB_PARAMS
-The remote server does not have any connection
-parameters on record for the specified NSDB.
-.TP
-.B FEDFS_ERR_NSDB_LDAP_REFERRAL
-The remote server received an LDAP referral that it was unable to follow.
-.TP
-.B FEDFS_ERR_NSDB_LDAP_REFERRAL_VAL
-Indicates the same error as FEDFS_ERR_NSDB_LDAP_REFERRAL,
-and allows an LDAP protocol error value to be returned back to the client.
-.TP
-.B FEDFS_ERR_NSDB_LDAP_REFERRAL_NOTFOLLOWED
-The remote server received an LDAP referral that it chose not to follow,
-either because the remote server does not support following LDAP referrals
-or LDAP referral following is disabled.
-.TP
-.B FEDFS_ERR_NSDB_PARAMS_LDAP_REFERRAL
-The remote server received an LDAP referral that it chose not to follow
-because the remote server had no NSDB parameters for the NSDB
-targeted by the LDAP referral.
-.TP
-.B FEDFS_ERR_NOTSUPP
-The remote server does not support the specified procedure.
+.IP "\fB\-s, \-\-security=\fIflavor\fP"
+Specifies the security flavor to use
+when contacting the remote FedFS ADMIN service.
+Valid flavors are
+.BR sys ,
+.BR unix ,
+.BR krb5 ,
+.BR krb5i ", and"
+.BR krb5p .
+If this option is not specified, the
+.B unix
+flavor is used.
+See the
+.B SECURITY
+section of this man page for details.
 .SH EXAMPLES
 Suppose you are the FedFS administrator of the
 .I example.net
@@ -223,12 +156,32 @@  The remote server knows about
 .I nsdb.example.net
 and does not use TLS when querying it to resolve junctions.
 .SH SECURITY
-RPCSEC GSSAPI authentication has not yet been implemented for this command.
+By default, or if the
+.B sys
+and
+.B unix
+flavors are specified with the
+.BI \-\-security= flavor
+option, the
+.BR fedfs-create-junction (8)
+command uses AUTH_SYS security for the Remote Procedure Call.
+AUTH_SYS has known weaknesses and should be avoided on untrusted networks.
+.P
+The RPC client uses the Kerberos v5 GSS mechanism
+if a Kerberos security flavor is specified.
+When specifying a Kerberos security flavor,
+the user must first obtain a valid Kerberos ticket using
+.BR kinit (1)
+before running
+.BR fedfs-create-junction (8).
+.P
+The AUTH_NONE security flavor is no longer supported by this implementation.
 .SH "SEE ALSO"
 .BR fedfs (7),
 .BR rpc.fedfsd (8),
 .BR fedfs-get-nsdb-params (8),
 .BR nsdbparams (8),
+.BR kinit (1),
 .BR rpc (3t)
 .sp
 RFC 5716 for FedFS requirements and overview
diff --git a/src/fedfsc/fedfs-get-limited-nsdb-params.c b/src/fedfsc/fedfs-get-limited-nsdb-params.c
index 59c3035..ec66d86 100644
--- a/src/fedfsc/fedfs-get-limited-nsdb-params.c
+++ b/src/fedfsc/fedfs-get-limited-nsdb-params.c
@@ -4,7 +4,7 @@ 
  */
 
 /*
- * Copyright 2010 Oracle.  All rights reserved.
+ * Copyright 2010, 2013 Oracle.  All rights reserved.
  *
  * This file is part of fedfs-utils.
  *
@@ -28,31 +28,25 @@ 
 
 #include <string.h>
 #include <stdbool.h>
+#include <stdlib.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <errno.h>
 #include <getopt.h>
 #include <locale.h>
 
-#include <rpc/clnt.h>
-#include <ldap.h>
-
 #include "fedfs.h"
 #include "fedfs_admin.h"
+#include "admin.h"
 #include "nsdb.h"
 #include "junction.h"
 #include "xlog.h"
 #include "gpl-boiler.h"
 
 /**
- * Default RPC request timeout
- */
-static struct timeval fedfs_get_limited_nsdb_params_timeout = { 25, 0 };
-
-/**
  * Short form command line options
  */
-static const char fedfs_get_limited_nsdb_params_opts[] = "?dh:l:n:r:";
+static const char fedfs_get_limited_nsdb_params_opts[] = "?dh:l:n:r:s:";
 
 /**
  * Long form command line options
@@ -64,6 +58,7 @@  static const struct option fedfs_get_limited_nsdb_params_longopts[] = {
 	{ "nsdbname", 1, NULL, 'l', },
 	{ "nettype", 1, NULL, 'n', },
 	{ "nsdbport", 1, NULL, 'r', },
+	{ "security", 1, NULL, 's', },
 	{ NULL, 0, NULL, 0, },
 };
 
@@ -71,8 +66,9 @@  static const struct option fedfs_get_limited_nsdb_params_longopts[] = {
  * Display program synopsis
  *
  * @param progname NUL-terminated C string containing name of program
+ * @return program exit status
  */
-static void
+static int
 fedfs_get_limited_nsdb_params_usage(const char *progname)
 {
 	fprintf(stderr, "\n%s version " VERSION "\n", progname);
@@ -85,32 +81,22 @@  fedfs_get_limited_nsdb_params_usage(const char *progname)
 	fprintf(stderr, "\t-h, --hostname       ADMIN server hostname (default: 'localhost')\n");
 	fprintf(stderr, "\t-l, --nsdbname       NSDB hostname\n");
 	fprintf(stderr, "\t-r, --nsdbport       NSDB port\n");
+	fprintf(stderr, "\t-s, --security       RPC security level\n");
 
 	fprintf(stderr, "%s", fedfs_gpl_boilerplate);
 
-	exit((int)FEDFS_ERR_INVAL);
+	return EXIT_FAILURE;
 }
 
 /**
  * Display NSDB information
  *
- * @param result NSDB information to display
+ * @param sectype NSDB connection security type to display
  */
 static void
-fedfs_get_limited_nsdb_params_print_result(FedFsGetNsdbParamsRes result)
+fedfs_get_limited_nsdb_params_print_result(FedFsConnectionSec sectype)
 {
-	FedFsNsdbParams *params = &result.FedFsGetNsdbParamsRes_u.params;
-
-	if (result.status == FEDFS_ERR_NSDB_PARAMS) {
-		printf("No connection parameters found\n");
-		return;
-	}
-
-	nsdb_print_fedfsstatus(result.status);
-	if (result.status != FEDFS_OK)
-		return;
-
-	switch (params->secType) {
+	switch (sectype) {
 	case FEDFS_SEC_NONE:
 		printf("ConnectionSec: FEDFS_SEC_NONE\n");
 		break;
@@ -119,59 +105,95 @@  fedfs_get_limited_nsdb_params_print_result(FedFsGetNsdbParamsRes result)
 		break;
 	default:
 		printf("Unrecognized FedFsConnectionSec value: %u\n",
-				params->secType);
+				sectype);
 	}
 }
 
 /**
  * Retrieve limited NSDB information from a remote fileserver
  *
- * @param hostname NUL-terminated UTF-8 string containing ADMIN server's hostname
- * @param nettype NUL-terminated C string containing nettype to use for connection
- * @param nsdbname NUL-terminated UTF-8 string containing name of NSDB node to retrieve
- * @param nsdbport port number of NSDB node to retrieve
- * @return a FedFsStatus code
+ * @param host an initialized and opened admin_t
+ * @param nsdb an NSDB hostname and port
+ * @return program exit status
  */
-static FedFsStatus
-fedfs_get_limited_nsdb_params_call(const char *hostname, const char *nettype,
-		char *nsdbname, const unsigned short nsdbport)
+static int
+fedfs_get_limited_nsdb_params_try(admin_t host, struct admin_nsdb *nsdb)
 {
-	FedFsGetNsdbParamsRes result;
-	enum clnt_stat status;
-	FedFsNsdbName arg;
-	CLIENT *client;
-
-	memset(&arg, 0, sizeof(arg));
+	FedFsConnectionSec sectype;
+	int status, err;
 
-	arg.hostname.utf8string_len = strlen(nsdbname);
-	arg.hostname.utf8string_val = nsdbname;
-	arg.port = nsdbport;
-
-	client = clnt_create(hostname, FEDFS_PROG, FEDFS_V1, nettype);
-	if (client == NULL) {
-		clnt_pcreateerror("Failed to create FEDFS client");
-		result.status = FEDFS_ERR_SVRFAULT;
+	status = EXIT_FAILURE;
+	err = admin_get_limited_nsdb_params(host, nsdb, &sectype);
+	switch (err) {
+	case 0:
+		break;
+	case EACCES:
+		xlog(L_ERROR, "%s: access denied", admin_hostname(host));
+		xlog(D_GENERAL, "%s",
+			admin_perror(host, admin_hostname(host)));
+		goto out;
+	case EIO:
+		xlog(L_ERROR, "%s",
+			admin_perror(host, admin_hostname(host)));
+		goto out;
+	default:
+		xlog(L_ERROR, "ADMIN client: %s", strerror(err));
 		goto out;
 	}
 
-	memset((char *)&result, 0, sizeof(result));
-	status = clnt_call(client, FEDFS_GET_LIMITED_NSDB_PARAMS,
-				(xdrproc_t)xdr_FedFsNsdbName, (caddr_t)&arg,
-				(xdrproc_t)xdr_FedFsGetLimitedNsdbParamsRes, (caddr_t)&result,
-				fedfs_get_limited_nsdb_params_timeout);
-	if (status != RPC_SUCCESS) {
-		clnt_perror(client, "FEDFS_GET_LIMITED_NSDB_PARAMS call failed");
-		result.status = FEDFS_ERR_SVRFAULT;
-	} else {
-		fedfs_get_limited_nsdb_params_print_result(result);
-		clnt_freeres(client,
-			(xdrproc_t)xdr_FedFsGetLimitedNsdbParamsRes,
-			(caddr_t)&result);
+	switch (admin_status(host)) {
+	case FEDFS_OK:
+		fedfs_get_limited_nsdb_params_print_result(sectype);
+		status = EXIT_SUCCESS;
+		break;
+	case FEDFS_ERR_NSDB_PARAMS:
+		printf("No connection parameters found\n");
+		break;
+	default:
+		nsdb_print_fedfsstatus(admin_status(host));
 	}
-	(void)clnt_destroy(client);
 
 out:
-	return result.status;
+	return status;
+}
+
+/**
+ * Retrieve limited NSDB information from a remote fileserver
+ *
+ * @param hostname NUL-terminated UTF-8 string containing ADMIN server's hostname
+ * @param nettype NUL-terminated C string containing nettype to use for connection
+ * @param security NUL-terminated C string containing RPC security mode
+ * @param nsdb an NSDB hostname and port
+ * @return program exit status
+ */
+static int
+fedfs_get_limited_nsdb_params_host(const char *hostname, const char *nettype,
+		const char *security, struct admin_nsdb *nsdb)
+{
+	admin_t host;
+	int status;
+
+	status = EXIT_FAILURE;
+	switch (admin_create(hostname, nettype, security, &host)) {
+	case 0:
+		status = fedfs_get_limited_nsdb_params_try(host, nsdb);
+		admin_release(host);
+		break;
+	case EINVAL:
+		xlog(L_ERROR, "Invalid command line parameter");
+		break;
+	case EACCES:
+		xlog(L_ERROR, "Failed to authenticate server");
+		break;
+	case EKEYEXPIRED:
+		xlog(L_ERROR, "User credentials not found");
+		break;
+	default:
+		xlog(L_ERROR, "%s",
+			admin_open_perror(admin_hostname(host)));
+	}
+
+	return status;
 }
 
 /**
@@ -184,10 +206,8 @@  out:
 int
 main(int argc, char **argv)
 {
-	char *progname, *hostname, *nettype, *nsdbname;
-	unsigned short nsdbport;
-	unsigned int seconds;
-	FedFsStatus status;
+	char *progname, *hostname, *security, *nettype;
+	struct admin_nsdb nsdb;
 	int arg;
 
 	(void)setlocale(LC_ALL, "");
@@ -204,10 +224,11 @@  main(int argc, char **argv)
 	xlog_syslog(0);
 	xlog_open(progname);
 
-	nsdb_env(&nsdbname, &nsdbport, NULL, NULL);
+	nsdb_env((char **)&nsdb.an_hostname, &nsdb.an_port, NULL, NULL);
 
 	hostname = "localhost";
 	nettype = "netpath";
+	security = "unix";
 	while ((arg = getopt_long(argc, argv, fedfs_get_limited_nsdb_params_opts, fedfs_get_limited_nsdb_params_longopts, NULL)) != -1) {
 		switch (arg) {
 		case 'd':
@@ -220,44 +241,38 @@  main(int argc, char **argv)
 			if (!nsdb_is_hostname_utf8(optarg)) {
 				fprintf(stderr, "NSDB name %s is "
 					"not a UTF-8 hostname\n", optarg);
-				fedfs_get_limited_nsdb_params_usage(progname);
+				return fedfs_get_limited_nsdb_params_usage(progname);
 			}
-			nsdbname = optarg;
+			nsdb.an_hostname = optarg;
 			break;
 		case 'n':
 			nettype = optarg;
 			break;
 		case 'r':
-			if (!nsdb_parse_port_string(optarg, &nsdbport)) {
+			if (!nsdb_parse_port_string(optarg, &nsdb.an_port)) {
 				fprintf(stderr, "Bad port number: %s\n",
 					optarg);
-				fedfs_get_limited_nsdb_params_usage(progname);
+				return fedfs_get_limited_nsdb_params_usage(progname);
 			}
 			break;
+		case 's':
+			security = optarg;
+			break;
 		default:
 			fprintf(stderr, "Invalid command line argument: %c\n", (char)arg);
 		case '?':
-			fedfs_get_limited_nsdb_params_usage(progname);
+			return fedfs_get_limited_nsdb_params_usage(progname);
 		}
 	}
 	if (optind != argc) {
 		fprintf(stderr, "Unrecognized command line argument\n");
-		fedfs_get_limited_nsdb_params_usage(progname);
+		return fedfs_get_limited_nsdb_params_usage(progname);
 	}
-	if (nsdbname == NULL) {
+	if (nsdb.an_hostname == NULL) {
 		fprintf(stderr, "Missing required command line argument\n");
-		fedfs_get_limited_nsdb_params_usage(progname);
+		return fedfs_get_limited_nsdb_params_usage(progname);
 	}
 
-	for (seconds = FEDFS_DELAY_MIN_SECS;; seconds = fedfs_delay(seconds)) {
-		status = fedfs_get_limited_nsdb_params_call(hostname, nettype,
-							nsdbname, nsdbport);
-		if (status != FEDFS_ERR_DELAY)
-			break;
-
-		xlog(D_GENERAL, "Delaying %u seconds...", seconds);
-		if (sleep(seconds) != 0)
-			break;
-	}
-	return (int)status;
+	return fedfs_get_limited_nsdb_params_host(hostname, nettype,
+							security, &nsdb);
 }