[SCM] GNU shishi branch, master, updated. shishi-0-0-41-9-g3948ccf

[Simon Josefsson]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU shishi".

http://git.savannah.gnu.org/cgit/shishi.git/commit/?id=3948ccfbf0bdc05e864d1877a277a12488619c44

The branch, master has been updated
       via  3948ccfbf0bdc05e864d1877a277a12488619c44 (commit)
       via  2386db1f2307d793c4aaae645ea626dacd8a40dc (commit)
       via  39351f652dfd08db256c5133dbe12b19dc1de175 (commit)
      from  5d4a6a3c964f6d0692bfc5f1c25d986602e2ca7f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3948ccfbf0bdc05e864d1877a277a12488619c44
Author: Simon Josefsson <address@hidden>
Date:   Mon Mar 8 15:45:13 2010 +0100

    Add shishi_keys_from_file and keytab2shishi -R parameter.

commit 2386db1f2307d793c4aaae645ea626dacd8a40dc
Author: Simon Josefsson <address@hidden>
Date:   Mon Mar 8 15:19:14 2010 +0100

    libshishi: Add APIs to save keys on keytab format.

commit 39351f652dfd08db256c5133dbe12b19dc1de175
Author: Simon Josefsson <address@hidden>
Date:   Wed Mar 3 10:32:38 2010 +0100

    Work around strict aliasing warning.

-----------------------------------------------------------------------

Summary of changes:
 NEWS                  |   19 ++++-
 lib/key.c             |   38 ++++++++
 lib/keys.c            |   50 ++++++++++
 lib/keytab.c          |  253 ++++++++++++++++++++++++++++++++++++++++++++++++-
 lib/libshishi.map     |   12 ++-
 lib/netio.c           |    9 +-
 lib/shishi.h          |   36 +++++---
 src/keytab2shishi.c   |  102 ++++++++++++++------
 src/keytab2shishi.ggo |    4 +-
 tests/keytab.c        |   32 ++++++-
 10 files changed, 496 insertions(+), 59 deletions(-)

diff --git a/NEWS b/NEWS
index 9c4a96c..4331234 100644
--- a/NEWS
+++ b/NEWS
@@ -4,8 +4,25 @@ See the end for copying conditions.
 
 * Version 0.0.42 (unreleased)
 
+** libshishi: Add APIs to save keys on keytab format.
+The functions are shishi_keys_to_keytab_file and
+shishi_keys_to_keytab_mem.
+
+** libshishi: Add APIs to retrieve/set the timestamp for a key.
+Typically only used by keytab format.  The functions are
+shishi_key_timestamp and shishi_key_timestamp_set.
+
+** libshishi: Add API to read several keys from a file.
+The function is shishi_keys_from_file.
+
+** keytab2shishi: Add --reverse (-R) parameter to write Keytab files.
+This allows you to use create Keytab files from your Shishi hostkeys.
+
 ** API and ABI modifications:
-No changes since last version.
+shishi_key_timestamp: ADD.
+shishi_key_timestamp_set: ADD.
+shishi_keys_to_keytab_file: ADD.
+shishi_keys_to_keytab_mem: ADD.
 
 * Version 0.0.41 (released 2010-01-19)
 
diff --git a/lib/key.c b/lib/key.c
index 13051c0..7380556 100644
--- a/lib/key.c
+++ b/lib/key.c
@@ -30,6 +30,9 @@ struct Shishi_key
   int type;
   char value[MAX_KEY_LEN];
   uint32_t kvno; /* UINT32_MAX means undefined kvno */
+  time_t timestamp; /* Only used by keytab code. */
+  /* If you add anything here, check the functions shishi_key,
+     shishi_key_done and shishi_key_copy. */
 };
 
 /**
@@ -192,6 +195,40 @@ shishi_key_version_set (Shishi_key * key, uint32_t kvno)
 }
 
 /**
+ * shishi_key_timestamp:
+ * @key: structure that holds key information
+ *
+ * Get the time the key was established.  Typically only present when
+ * the key was imported from a keytab format.
+ *
+ * Return value: Returns the time the key was established, or
+ *   (time_t)-1 if not available.
+ *
+ * Since: 0.0.42
+ **/
+time_t
+shishi_key_timestamp (const Shishi_key * key)
+{
+  return key->timestamp;
+}
+
+/**
+ * shishi_key_timestamp_set:
+ * @key: structure that holds key information
+ * @timestamp: new timestamp.
+ *
+ * Set the time the key was established.  Typically only relevant when
+ * exporting the key to keytab format.
+ *
+ * Since: 0.0.42
+ **/
+void
+shishi_key_timestamp_set (Shishi_key * key, time_t timestamp)
+{
+  key->timestamp = timestamp;
+}
+
+/**
  * shishi_key_name:
  * @key: structure that holds key information
  *
@@ -268,6 +305,7 @@ shishi_key_copy (Shishi_key * dstkey, Shishi_key * srckey)
   shishi_key_type_set (dstkey, shishi_key_type (srckey));
   shishi_key_value_set (dstkey, shishi_key_value (srckey));
   shishi_key_version_set (dstkey, shishi_key_version (srckey));
+  shishi_key_timestamp_set (dstkey, shishi_key_timestamp (srckey));
 }
 
 /**
diff --git a/lib/keys.c b/lib/keys.c
index 564aaba..80da544 100644
--- a/lib/keys.c
+++ b/lib/keys.c
@@ -235,6 +235,56 @@ shishi_keys_to_file (Shishi * handle,
 }
 
 /**
+ * shishi_keys_from_file:
+ * @keys: key set handle as allocated by shishi_keys().
+ * @filename: filename to read keys from.
+ *
+ * Read zero or more keys from file @filename and append them to the
+ * keyset @keys.  See shishi_key_print() for the format of the input.
+ *
+ * Return value: Returns %SHISHI_OK iff successful.
+ *
+ * Since: 0.0.42
+ **/
+int
+shishi_keys_from_file (Shishi_keys * keys, const char *filename)
+{
+  FILE *fh;
+  int res;
+
+  fh = fopen (filename, "r");
+  if (fh == NULL)
+    return SHISHI_FOPEN_ERROR;
+
+  res = SHISHI_OK;
+  while (!feof (fh))
+    {
+      Shishi_key *key = NULL;
+
+      res = shishi_key_parse (keys->handle, fh, &key);
+      if (res != SHISHI_OK || key == NULL)
+       break;
+
+      if (VERBOSENOISE (keys->handle))
+       {
+         printf ("Read key:\n");
+         shishi_key_print (keys->handle, stdout, key);
+       }
+
+      res = shishi_keys_add (keys, key);
+
+      shishi_key_done (key);
+      key = NULL;
+    }
+
+  res = fclose (fh);
+  if (res != 0)
+    return SHISHI_IO_ERROR;
+
+  return SHISHI_OK;
+}
+
+/**
  * shishi_keys_for_serverrealm_in_file
  * @handle: Shishi library handle create by shishi_init().
  * @filename: file to read keys from.
diff --git a/lib/keytab.c b/lib/keytab.c
index 5fd3a3f..37016cc 100644
--- a/lib/keytab.c
+++ b/lib/keytab.c
@@ -1,5 +1,5 @@
 /* keys.c --- Functions for reading /etc/krb5.keytab style key files.
- * Copyright (C) 2002, 2003, 2004, 2006, 2007, 2008  Simon Josefsson
+ * Copyright (C) 2002, 2003, 2004, 2006, 2007, 2008, 2010  Simon Josefsson
  *
  * This file is part of Shishi.
  *
@@ -164,12 +164,18 @@ shishi_keys_add_keytab_mem (Shishi * handle,
 
       /* Timestamp */
       {
-       uint32_t timestamp = data[pos] << 24 | data[pos+1] << 16
-         | data[pos+2] << 8 | data[pos+3];
+       uint32_t timestamp =
+         ((data[pos] << 24) & 0xFF000000)
+         | ((data[pos+1] << 16) & 0xFF0000)
+         | ((data[pos+2] << 8) & 0xFF00)
+         | ((data[pos+3] & 0xFF));
+       time_t t = timestamp;
        pos += 4;
 
        if (VERBOSENOISE (handle))
          printf ("keytab timestamp %u (0x%08ux)\n", timestamp, timestamp);
+
+       shishi_key_timestamp_set (key, t);
       }
 
       /* keyvno8 */
@@ -357,3 +363,244 @@ shishi_keys_from_keytab_file (Shishi * handle,
 
   return SHISHI_OK;
 }
+
+static int
+key_to_keytab_entry (Shishi * handle,
+                    const Shishi_key *key,
+                    char **out, size_t *len)
+{
+  uint16_t num_components = 0;
+  const char *realm = shishi_key_realm (key);
+  size_t realmlen = strlen (realm);
+  const char *principal = shishi_key_principal (key);
+  uint32_t name_type = SHISHI_NT_PRINCIPAL;
+  time_t timestamp = shishi_key_timestamp (key);
+  uint32_t version = shishi_key_version (key);
+  uint16_t key_type = shishi_key_type (key);
+  size_t key_length = shishi_key_length (key);
+  const char *key_value = shishi_key_value (key);
+  char *tmpname;
+  const char **namebuf;
+  char *tokptr = NULL;
+  char *p;
+  size_t i;
+
+  if (realmlen > UINT16_MAX)
+    return SHISHI_KEYTAB_ERROR;
+
+  if (key_length > UINT16_MAX)
+    return SHISHI_KEYTAB_ERROR;
+
+  /* Reserve room for size, num_components, realm.length, realm,
+     name_type, timestamp, vno8, keyblock.type, keyblock.data.length,
+     keyblock.data, and version. */
+  *len = 4 + 2 + 2 + realmlen + 4 + 4 + 1 + 2 + 2 + key_length + 4;
+
+  tmpname = xstrdup (principal);
+  namebuf = xmalloc (sizeof (*namebuf));
+  for (num_components = 0; (namebuf[num_components] =
+                           strtok_r (num_components == 0 ? tmpname
+                                     : NULL, "/", &tokptr));
+       num_components++)
+    {
+      size_t length = strlen (namebuf[num_components]);
+
+      if (length > UINT16_MAX)
+       return SHISHI_KEYTAB_ERROR;
+      *len += 2 + length;
+
+      namebuf = xrealloc (namebuf, (num_components + 2) * sizeof (*namebuf));
+    }
+
+  *out = xmalloc (*len);
+  p = *out;
+
+  /* Write size. */
+  p[0] = ((*len - 4) >> 24) & 0xFF;
+  p[1] = ((*len - 4) >> 16) & 0xFF;
+  p[2] = ((*len - 4) >> 8) & 0xFF;
+  p[3] = (*len - 4) & 0xFF;
+  p += 4;
+
+  /* Write num_components. */
+  p[0] = (num_components >> 8) & 0xFF;
+  p[1] = num_components & 0xFF;
+  p += 2;
+
+  /* Write realm.length and realm.data. */
+  p[0] = (realmlen >> 8) & 0xFF;
+  p[1] = realmlen & 0xFF;
+  p += 2;
+  memcpy (p, realm, realmlen);
+  p += realmlen;
+
+  for (i = 0; i < num_components; i++)
+    {
+      uint16_t length = strlen (namebuf[i]);
+      p[0] = (length >> 8) & 0xFF;
+      p[1] = length & 0xFF;
+      p += 2;
+      memcpy (p, namebuf[i], length);
+      p += length;
+    }
+
+  /* Name type */
+  p[0] = (name_type >> 24) & 0xFF;
+  p[1] = (name_type >> 16) & 0xFF;
+  p[2] = (name_type >> 8) & 0xFF;
+  p[3] = name_type & 0xFF;
+  p += 4;
+
+  /* Timestamp */
+  p[0] = (timestamp >> 24) & 0xFF;
+  p[1] = (timestamp >> 16) & 0xFF;
+  p[2] = (timestamp >> 8) & 0xFF;
+  p[3] = timestamp & 0xFF;
+  p += 4;
+
+  /* Version */
+  if (version < 256)
+    p[0] = version & 0xFF;
+  else
+    p[0] = 0; /* use vno */
+  p += 1;
+
+  /* Key */
+  p[0] = (key_type >> 8) & 0xFF;
+  p[1] = key_type & 0xFF;
+  p += 2;
+
+  p[0] = (key_length >> 8) & 0xFF;
+  p[1] = key_length & 0xFF;
+  p += 2;
+  memcpy (p, key_value, key_length);
+  p += key_length;
+
+  /* Version */
+  p[0] = (version >> 24) & 0xFF;
+  p[1] = (version >> 16) & 0xFF;
+  p[2] = (version >> 8) & 0xFF;
+  p[3] = version & 0xFF;
+
+  free (tmpname);
+  free (namebuf);
+
+  return SHISHI_OK;
+}
+
+/**
+ * shishi_keys_to_keytab_mem:
+ * @handle: shishi handle as allocated by shishi_init().
+ * @keys: key set to convert to keytab format.
+ * @out: constant memory buffer with keytab of @len size.
+ * @len: size of memory buffer with keytab data.
+ *
+ * Write keys to a MIT keytab data structure.
+ *
+ * The format of keytab's is proprietary, and this function writes the
+ * 0x0502 format.  See the section The MIT Kerberos Keytab Binary File
+ * Format in the Shishi manual for a description of the
+ * reverse-engineered format.
+ *
+ * Returns: On success %SHISHI_OK is returned, otherwise an error
+ *   code.
+ *
+ * Since: 0.0.42
+ **/
+int
+shishi_keys_to_keytab_mem (Shishi * handle,
+                          Shishi_keys *keys,
+                          char **out, size_t *len)
+{
+  int rc;
+  const Shishi_key *key;
+  int keyno = 0;
+
+  *out = xmalloc (2);
+  *len = 2;
+
+  /* Write file format version. */
+  (*out)[0] = '\x05';
+  (*out)[1] = '\x02';
+
+  while ((key = shishi_keys_nth (keys, keyno++)) != NULL)
+    {
+      char *tmp = NULL;
+      size_t tmplen = 0;
+
+      rc = key_to_keytab_entry (handle, key, &tmp, &tmplen);
+      if (rc != SHISHI_OK)
+       {
+         free (*out);
+         return rc;
+       }
+
+      *out = xrealloc (*out, *len + tmplen);
+      memcpy (*out + *len, tmp, tmplen);
+      *len += tmplen;
+    }
+
+  if (VERBOSENOISE (handle))
+    {
+      printf ("keys_to_keytab len %d (0x%x)\n", *len, *len);
+      _shishi_hexprint (*out, *len);
+    }
+
+  return rc;
+}
+
+static int
+write_binary_file (const char *filename, const char *data, size_t length)
+{
+  FILE *fh;
+  size_t written;
+
+  fh = fopen (filename, "wb");
+  if (!fh)
+    return SHISHI_FOPEN_ERROR;
+
+  written = fwrite (data, 1, length, fh);
+  if (written != length)
+    return SHISHI_IO_ERROR;
+
+  return SHISHI_OK;
+}
+
+/**
+ * shishi_keys_to_keytab_file:
+ * @handle: shishi handle as allocated by shishi_init().
+ * @keys: keyset to write.
+ * @filename: name of file to write.
+ *
+ * Write keys to a MIT keytab data structure.
+ *
+ * The format of keytab's is proprietary, and this function writes the
+ * 0x0502 format.  See the section The MIT Kerberos Keytab Binary File
+ * Format in the Shishi manual for a description of the
+ * reverse-engineered format.
+ *
+ * Returns: %SHISHI_FOPEN_ERROR if there is a problem opening
+ *   @filename for writing, %SHISHI_IO_ERROR if there is problem
+ *   writing the file, and %SHISHI_OK on success.
+ *
+ * Since: 0.0.42
+ **/
+int
+shishi_keys_to_keytab_file (Shishi * handle,
+                           Shishi_keys *keys,
+                           const char *filename)
+{
+  int rc;
+  char *data;
+  size_t len;
+
+  rc = shishi_keys_to_keytab_mem (handle, keys, &data, &len);
+  if (rc != SHISHI_OK)
+    return rc;
+
+  rc = write_binary_file (filename, data, len);
+  if (rc != SHISHI_OK)
+    return rc;
+
+  return SHISHI_OK;
+}
diff --git a/lib/libshishi.map b/lib/libshishi.map
index 70679f3..609b8bc 100644
--- a/lib/libshishi.map
+++ b/lib/libshishi.map
@@ -1,5 +1,5 @@
 # libshishi.maps -- versioning script to control what symbols to export
-# Copyright (C) 2005, 2006, 2007, 2008, 2009 Simon Josefsson.
+# Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Simon Josefsson.
 #
 # This file is part of Shishi.
 #
@@ -745,3 +745,13 @@ SHISHI_0.0 {
   local:
     *;
 };
+
+SHISHI_0.0.42
+{
+  global:
+    shishi_key_timestamp;
+    shishi_key_timestamp_set;
+    shishi_keys_from_file;
+    shishi_keys_to_keytab_file;
+    shishi_keys_to_keytab_mem;
+} SHISHI_0.0;
diff --git a/lib/netio.c b/lib/netio.c
index 31e81f2..86f4b00 100644
--- a/lib/netio.c
+++ b/lib/netio.c
@@ -1,5 +1,5 @@
 /* netio.c --- Network I/O functions.
- * Copyright (C) 2002, 2003, 2004, 2006, 2007, 2008  Simon Josefsson
+ * Copyright (C) 2002, 2003, 2004, 2006, 2007, 2008, 2010  Simon Josefsson
  *
  * This file is part of Shishi.
  *
@@ -37,8 +37,7 @@ shishi_sendrecv_udp (Shishi * handle,
                     const char *indata, int inlen,
                     char **outdata, size_t * outlen, size_t timeout)
 {
-  struct sockaddr lsa;
-  struct sockaddr_in *lsa_inp = (struct sockaddr_in *) &lsa;
+  struct sockaddr_in lsa;
   char tmpbuf[BUFSIZ];         /* XXX can we do without it?
                                   MSG_PEEK|MSG_TRUNC doesn't work for udp.. */
   int sockfd;
@@ -51,8 +50,8 @@ shishi_sendrecv_udp (Shishi * handle,
   ssize_t slen;
 
   memset (&lsa, 0, sizeof (lsa));
-  lsa_inp->sin_family = AF_INET;
-  lsa_inp->sin_addr.s_addr = htonl (INADDR_ANY);
+  lsa.sin_family = AF_INET;
+  lsa.sin_addr.s_addr = htonl (INADDR_ANY);
 
   sockfd = socket (AF_INET, SOCK_DGRAM, 0);
   if (sockfd < 0)
diff --git a/lib/shishi.h b/lib/shishi.h
index 5b76277..ec510fa 100644
--- a/lib/shishi.h
+++ b/lib/shishi.h
@@ -1872,6 +1872,8 @@ extern const char *shishi_key_name (Shishi_key * key);
 extern size_t shishi_key_length (const Shishi_key * key);
 extern uint32_t shishi_key_version (const Shishi_key * key);
 extern void shishi_key_version_set (Shishi_key * key, uint32_t kvno);
+extern time_t shishi_key_timestamp (const Shishi_key * key);
+extern void shishi_key_timestamp_set (Shishi_key * key, time_t timestamp);
 extern int shishi_key (Shishi * handle, Shishi_key ** key);
 extern void shishi_key_done (Shishi_key * key);
 extern void shishi_key_copy (Shishi_key * dstkey, Shishi_key * srckey);
@@ -1913,20 +1915,8 @@ extern const Shishi_key *shishi_keys_nth (Shishi_keys * 
keys, int keyno);
 extern void shishi_keys_remove (Shishi_keys * keys, int keyno);
 extern int shishi_keys_add (Shishi_keys * keys, Shishi_key * key);
 
-extern int shishi_keys_add_keytab_mem (Shishi * handle,
-                                      const char *data, size_t len,
-                                      Shishi_keys *keys);
-extern int shishi_keys_add_keytab_file (Shishi * handle,
-                                       const char *filename,
-                                       Shishi_keys *keys);
-extern int shishi_keys_from_keytab_mem (Shishi * handle,
-                                       const char *data, size_t len,
-                                       Shishi_keys **outkeys);
-extern int shishi_keys_from_keytab_file (Shishi * handle,
-                                        const char *filename,
-                                        Shishi_keys **outkeys);
-
 extern int shishi_keys_print (Shishi_keys * keys, FILE *fh);
+extern int shishi_keys_from_file (Shishi_keys * keys, const char *filename);
 extern int shishi_keys_to_file (Shishi * handle,
                                const char *filename,
                                Shishi_keys * keys);
@@ -1946,6 +1936,26 @@ extern Shishi_key 
*shishi_keys_for_localservicerealm_in_file (Shishi * handle,
                                                              const char
                                                              *realm);
 
+/* keytab.c */
+extern int shishi_keys_add_keytab_mem (Shishi * handle,
+                                      const char *data, size_t len,
+                                      Shishi_keys *keys);
+extern int shishi_keys_add_keytab_file (Shishi * handle,
+                                       const char *filename,
+                                       Shishi_keys *keys);
+extern int shishi_keys_from_keytab_mem (Shishi * handle,
+                                       const char *data, size_t len,
+                                       Shishi_keys **outkeys);
+extern int shishi_keys_from_keytab_file (Shishi * handle,
+                                        const char *filename,
+                                        Shishi_keys **outkeys);
+extern int shishi_keys_to_keytab_mem (Shishi * handle,
+                                     Shishi_keys *keys,
+                                     char **out, size_t *len);
+extern int shishi_keys_to_keytab_file (Shishi * handle,
+                                      Shishi_keys *keys,
+                                      const char *filename);
+
 /* hostkeys.c */
 extern const char *shishi_hostkeys_default_file (Shishi * handle);
 extern void shishi_hostkeys_default_file_set (Shishi * handle,
diff --git a/src/keytab2shishi.c b/src/keytab2shishi.c
index c1bde47..1223d44 100644
--- a/src/keytab2shishi.c
+++ b/src/keytab2shishi.c
@@ -105,38 +105,76 @@ main (int argc, char *argv[])
   if (args.verbose_given > 4)
     shishi_cfg (sh, "verbose-crypto-noise");
 
-  if (!infile)
-    infile = "/etc/krb5.keytab";
-
-  if (!outfile)
-    outfile = HOSTKEYSFILE;
-
-  {
-    Shishi_keys *keys;
-
-    rc = shishi_keys_from_keytab_file (sh, infile, &keys);
-    if (rc != SHISHI_OK)
-      error (EXIT_FAILURE, errno, "%s: %s", infile, shishi_strerror (rc));
-
-    if (args.verbose_given)
-      shishi_keys_print (keys, stdout);
-
-    rc = shishi_keys_to_file (sh, outfile, keys);
-    if (rc != SHISHI_OK)
-      error (EXIT_FAILURE, errno, "%s:%s", outfile, shishi_strerror (rc));
-
-    if (!args.quiet_flag)
-      {
-       size_t nkeys = shishi_keys_size (keys);
-       if (nkeys == 0)
-         printf (_("No keys written.\n"));
-       else
-         printf (ngettext ("%d key written.\n",
-                           "%d keys written.\n", nkeys), nkeys);
-      }
-
-    shishi_keys_done (&keys);
-  }
+  if (args.reverse_flag)
+    {
+      Shishi_keys *keys;
+
+      if (!infile)
+       infile = HOSTKEYSFILE;
+
+      if (!outfile)
+       outfile = "/etc/krb5.keytab";
+
+      rc = shishi_keys (sh, &keys);
+      if (rc != SHISHI_OK)
+       error (EXIT_FAILURE, errno, "%s", shishi_strerror (rc));
+
+      rc = shishi_keys_from_file (keys, infile);
+      if (rc != SHISHI_OK)
+       error (EXIT_FAILURE, errno, "%s: %s", infile, shishi_strerror (rc));
+
+      if (args.verbose_given)
+       shishi_keys_print (keys, stdout);
+
+      rc = shishi_keys_to_keytab_file (sh, keys, outfile);
+      if (rc != SHISHI_OK)
+       error (EXIT_FAILURE, errno, "%s:%s", outfile, shishi_strerror (rc));
+
+      if (!args.quiet_flag)
+       {
+         size_t nkeys = shishi_keys_size (keys);
+         if (nkeys == 0)
+           printf (_("No keys written.\n"));
+         else
+           printf (ngettext ("%d key written.\n",
+                             "%d keys written.\n", nkeys), nkeys);
+       }
+
+      shishi_keys_done (&keys);
+    }
+  else
+    {
+      Shishi_keys *keys;
+
+      if (!infile)
+       infile = "/etc/krb5.keytab";
+
+      if (!outfile)
+       outfile = HOSTKEYSFILE;
+
+      rc = shishi_keys_from_keytab_file (sh, infile, &keys);
+      if (rc != SHISHI_OK)
+       error (EXIT_FAILURE, errno, "%s: %s", infile, shishi_strerror (rc));
+
+      if (args.verbose_given)
+       shishi_keys_print (keys, stdout);
+
+      rc = shishi_keys_to_file (sh, outfile, keys);
+      if (rc != SHISHI_OK)
+       error (EXIT_FAILURE, errno, "%s:%s", outfile, shishi_strerror (rc));
+
+      if (!args.quiet_flag)
+       {
+         size_t nkeys = shishi_keys_size (keys);
+         if (nkeys == 0)
+           printf (_("No keys written.\n"));
+         else
+           printf (ngettext ("%d key written.\n",
+                             "%d keys written.\n", nkeys), nkeys);
+       }
+
+      shishi_keys_done (&keys);
+    }
 
   shishi_done (sh);
 
diff --git a/src/keytab2shishi.ggo b/src/keytab2shishi.ggo
index 7e68a96..dc0327a 100644
--- a/src/keytab2shishi.ggo
+++ b/src/keytab2shishi.ggo
@@ -1,5 +1,5 @@
 ## Process this file with gengetopt to produce keytab2shishi_cmd.*
-# Copyright (C) 2006, 2007 Simon Josefsson.
+# Copyright (C) 2006, 2007, 2010 Simon Josefsson.
 #
 # This file is part of Shishi.
 #
@@ -24,5 +24,7 @@ purpose "Read keytab data from INFILE (usually 
/etc/krb5.keytab) and
 write Shishi hostkeys to OUTFILE.  If INFILE and OUTFILE are not
 specified, use the defaults."
 
+option "reverse" R "Reverse action, read Shishi hostkeys from INFILE and write 
keytab data to OUTFILE." flag off
+
 option "verbose" v "Produce verbose output.\nUse multiple times to increase 
amount of information." no multiple
 option "quiet" q "Don't produce any diagnostic output.\n" flag off
diff --git a/tests/keytab.c b/tests/keytab.c
index 9087b72..ed7c80e 100644
--- a/tests/keytab.c
+++ b/tests/keytab.c
@@ -1,5 +1,5 @@
 /* keytab.c --- Self test MIT keytab file readers.
- * Copyright (C) 2002, 2003, 2006, 2007, 2008  Simon Josefsson
+ * Copyright (C) 2002, 2003, 2006, 2007, 2008, 2010  Simon Josefsson
  *
  * This file is part of Shishi.
  *
@@ -21,23 +21,49 @@
  */
 
 #include "utils.c"
+#include "read-file.h"
 
 void
 test (Shishi * handle)
 {
   Shishi_keys *keys;
+  const Shishi_key *key;
   const char *keytab = getenv ("KEYTAB1");
+  char *data, *data2;
+  size_t len, len2;
   int rc;
+  int keyno = 0;
 
   if (!keytab)
     keytab = "keytab1.bin";
 
-  rc = shishi_keys_from_keytab_file (handle, keytab, &keys);
+  data = read_binary_file (keytab, &len);
+  if (data == NULL)
+    fail ("cannot read keytab file %s", keytab);
+
+  rc = shishi_keys_from_keytab_mem (handle, data, len, &keys);
   if (rc != SHISHI_OK)
-    fail ("shishi_keys_from_keytab_file() failed (%d)\n", rc);
+    fail ("shishi_keys_from_keytab_mem() failed (%d)\n", rc);
 
   if (shishi_keys_size (keys) != 6)
     fail ("shishi_keys_size() failed (%d)\n", shishi_keys_size (keys));
 
+  if (debug)
+    {
+      while ((key = shishi_keys_nth (keys, keyno++)) != NULL)
+       {
+         rc = shishi_key_print (handle, stdout, key);
+         if (rc != SHISHI_OK)
+           fail ("shishi_key_print() failed (%d)\n", rc);
+       }
+    }
+
+  rc = shishi_keys_to_keytab_mem (handle, keys, &data2, &len2);
+  if (rc != SHISHI_OK)
+    fail ("shishi_keys_to_keytab_mem() failed (%d)\n", rc);
+
+  if (len != len2 || memcmp (data, data2, len) != 0)
+    fail ("memory comparison failed\n");
+
   shishi_keys_done (&keys);
 }


hooks/post-receive
-- 
GNU shishi