import krb4-1.0.5

7 files changed, 497 insertions, 57 deletions

diff --git a/crypto/kerberosIV/appl/kip/Makefile.in b/crypto/kerberosIV/appl/kip/Makefile.in
index 801c3f9..16ed049 100644
--- a/crypto/kerberosIV/appl/kip/Makefile.in
+++ b/crypto/kerberosIV/appl/kip/Makefile.in
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.18 1999/03/10 19:01:11 joda Exp $
+# $Id: Makefile.in,v 1.18.4.1 2000/06/23 02:54:59 assar Exp $
 
 SHELL = /bin/sh
 
@@ -8,12 +8,13 @@ VPATH = @srcdir@
 CC = @CC@
 LINK = @LINK@
 AR = ar
-DEFS = @DEFS@
+DEFS = @DEFS@ -DLIBEXECDIR="\"$(libexecdir)\""
 CFLAGS = @CFLAGS@ $(WFLAGS)
 WFLAGS = @WFLAGS@
 LD_FLAGS = @LD_FLAGS@
 INSTALL = @INSTALL@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
 LIBS = @LIBS@
 MKINSTALLDIRS = @top_srcdir@/mkinstalldirs
 
@@ -27,7 +28,8 @@ EXECSUFFIX=@EXECSUFFIX@
 
 PROG_BIN	= kip$(EXECSUFFIX)
 PROG_LIBEXEC	= kipd$(EXECSUFFIX)
-PROGS = $(PROG_BIN) $(PROG_LIBEXEC)
+SCRIPT_LIBEXEC	= kip-join-network kipd-control
+PROGS = $(PROG_BIN) $(PROG_LIBEXEC) $(SCRIPT_LIBEXEC)
 
 SOURCES_KIP     = kip.c
 SOURCES_KIPD    = kipd.c
@@ -55,6 +57,9 @@ install: all
 	for x in $(PROG_LIBEXEC); do \
 	  $(INSTALL_PROGRAM) $$x $(DESTDIR)$(libexecdir)/`echo $$x | sed '$(transform)'`; \
 	done
+	for x in $(SCRIPT_LIBEXEC); do \
+	  $(INSTALL_SCRIPT) $$x $(DESTDIR)$(libexecdir)/`echo $$x | sed '$(transform)'`; \
+	done
 
 uninstall:
 	for x in $(PROG_BIN); do \
@@ -63,6 +68,9 @@ uninstall:
 	for x in $(PROG_LIBEXEC); do \
 	  rm -f $(DESTDIR)$(libexecdir)/`echo $$x | sed '$(transform)'`; \
 	done
+	for x in $(SCRIPT_LIBEXEC); do \
+	  rm -f $(DESTDIR)$(libexecdir)/`echo $$x | sed '$(transform)'`; \
+	done
 
 TAGS: $(SOURCES)
 	etags $(SOURCES)
@@ -91,4 +99,12 @@ kipd$(EXECSUFFIX): $(OBJECTS_KIPD)
 
 $(OBJECTS): ../../include/config.h
 
+kip-join-network: kip-join-network.in
+	sed -e "s!%bindir%!$(bindir)!" $(srcdir)/kip-join-network.in > $@
+	chmod +x $@
+
+kipd-control: kipd-control.in
+	sed -e "s!%bindir%!$(bindir)!" $(srcdir)/kipd-control.in > $@
+	chmod +x $@
+
 .PHONY: all Wall install uninstall check clean mostlyclean distclean realclean
diff --git a/crypto/kerberosIV/appl/kip/common.c b/crypto/kerberosIV/appl/kip/common.c
index c97fe9f..4feb9c8 100644
--- a/crypto/kerberosIV/appl/kip/common.c
+++ b/crypto/kerberosIV/appl/kip/common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,7 +33,10 @@
 
 #include "kip.h"
 
-RCSID("$Id: common.c,v 1.13 1999/12/02 16:58:31 joda Exp $");
+RCSID("$Id: common.c,v 1.13.2.4 2000/10/18 23:31:51 assar Exp $");
+
+sig_atomic_t disconnect = 0;
+int isserver = 0;
 
 /*
  * Copy packets from `tundev' to `netdev' or vice versa.
@@ -56,16 +59,23 @@ copy_packets (int tundev, int netdev, int mtu, des_cblock *iv,
 
      memcpy (&iv1, iv, sizeof(iv1));
      memcpy (&iv2, iv, sizeof(iv2));
-     for (;;) {
+     while(!disconnect) {
 	  fd_set fdset;
 	  int ret, len;
 
+	  if (tundev >= FD_SETSIZE || netdev >= FD_SETSIZE) {
+	      warnx ("fd too large");
+	      return 1;
+	  }
+
 	  FD_ZERO(&fdset);
 	  FD_SET(tundev, &fdset);
 	  FD_SET(netdev, &fdset);
 
 	  ret = select (max(tundev, netdev)+1, &fdset, NULL, NULL, NULL);
-	  if (ret < 0 && errno != EINTR) {
+	  if (ret < 0) {
+	      if (errno == EINTR)
+		  continue;
 	      warn ("select");
 	      return 1;
 	  }
@@ -107,6 +117,21 @@ copy_packets (int tundev, int netdev, int mtu, des_cblock *iv,
 	       des_cfb64_encrypt (buf, buf, 2, schedule,
 				  &iv2, &num2, DES_DECRYPT);
 	       len = (buf[0] << 8 ) | buf[1];
+	       if (len > mtu) {
+		   fatal (-1, "buffer too large", schedule, &iv2);
+		   return -1;
+	       }
+
+	       if (len == 0) {
+		   len = read (netdev, buf, mtu);
+		   if (len < 1)
+		       len = 1;
+		   buf[len-1] = '\0';
+
+		   fatal (-1, buf, schedule, &iv2);
+		   return -1;
+	       }
+
 	       ret = krb_net_read (netdev, buf + 2, len);
 	       if (ret == 0)
 		    return 0;
@@ -127,6 +152,7 @@ copy_packets (int tundev, int netdev, int mtu, des_cblock *iv,
 	       }
 	  }
      }
+     return 0;
 }
 
 /*
@@ -148,18 +174,19 @@ childhandler (int sig)
 
 /*
  * Find a free tunnel device and open it.
+ * Return the interface name in `name, len'.
  */
 
 int
-tunnel_open (void)
+tunnel_open (char *name, size_t len)
 {
      int fd;
      int i;
-     char name[64];
+     char devname[256];
 
      for (i = 0; i < 256; ++i) {
-	  snprintf (name, sizeof(name), "%s%s%d", _PATH_DEV, TUNDEV, i);
-	  fd = open (name, O_RDWR, 0);
+	  snprintf (devname, len, "%s%s%d", _PATH_DEV, TUNDEV, i);
+	  fd = open (devname, O_RDWR, 0);
 	  if (fd >= 0)
 	       break;
 	  if (errno == ENOENT || errno == ENODEV) {
@@ -169,5 +196,107 @@ tunnel_open (void)
      }
      if (fd < 0)
 	 warn("open %s" ,name);
+     else
+	 snprintf (name, len, "%s%d", TUNDEV, i);
      return fd;
 }
+
+/*
+ * run the command `cmd' with (...).  return 0 if succesful or error
+ * otherwise (and copy an error messages into `msg, len')
+ */
+
+int
+kip_exec (const char *cmd, char *msg, size_t len, ...)
+{
+    pid_t pid;
+    char **argv;
+    va_list ap;
+
+    va_start(ap, len);
+    argv = vstrcollect(&ap);
+    va_end(ap);
+
+    pid = fork();
+    switch (pid) {
+    case -1:
+	snprintf (msg, len, "fork: %s", strerror(errno));
+	return errno;
+    case 0: {
+	int fd = open (_PATH_DEVNULL, O_RDWR, 0600);
+	if (fd < 0) {
+	    snprintf (msg, len, "open " _PATH_DEVNULL ": %s", strerror(errno));
+	    return errno;
+	}
+
+	close (STDIN_FILENO);
+	close (STDOUT_FILENO);
+	close (STDERR_FILENO);
+	
+	dup2 (fd, STDIN_FILENO);
+	dup2 (fd, STDOUT_FILENO);
+	dup2 (fd, STDERR_FILENO);
+
+	execvp (cmd, argv);
+	snprintf (msg, len, "execvp %s: %s", cmd, strerror(errno));
+	return errno;
+    }
+    default: {
+	int status;
+
+	while (waitpid(pid, &status, 0) < 0)
+	    if (errno != EINTR) {
+		snprintf (msg, len, "waitpid: %s", strerror(errno));
+		return errno;
+	    }
+
+	if (WIFEXITED(status)) {
+	    if (WEXITSTATUS(status) == 0) {
+		return 0;
+	    } else {
+		snprintf (msg, len, "child returned with %d", 
+			  WEXITSTATUS(status));
+		return 1;
+	    }
+	} else if (WIFSIGNALED(status)) {
+#ifndef WCOREDUMP
+#define WCOREDUMP(X) 0
+#endif
+	    snprintf (msg, len, "terminated by signal num %d %s",
+		      WTERMSIG(status), 
+		      WCOREDUMP(status) ? " coredumped" : "");
+	    return 1;
+	} else if (WIFSTOPPED(status)) {
+	    snprintf (msg, len, "process stoped by signal %d",
+		      WSTOPSIG(status));
+	    return 1;
+	} else {
+	    snprintf (msg, len, "child died in mysterious circumstances");
+	    return 1;
+	}
+    }
+    }
+}
+
+/*
+ * fatal error `s' occured.
+ */
+
+void
+fatal (int fd, const char *s, des_key_schedule schedule, des_cblock *iv)
+{
+     int16_t err = 0;
+     int num = 0;
+
+     if (fd != -1) {
+	 des_cfb64_encrypt ((unsigned char*) &err, (unsigned char*) &err,
+			    sizeof(err), schedule, iv, &num, DES_ENCRYPT);
+
+	 write (fd, &err, sizeof(err));
+	 write (fd, s, strlen(s)+1);
+     }
+     if (isserver)
+	 syslog(LOG_ERR, "%s", s);
+     else
+	 warnx ("fatal error: %s", s);
+}
diff --git a/crypto/kerberosIV/appl/kip/kip-join-network.in b/crypto/kerberosIV/appl/kip/kip-join-network.in
new file mode 100644
index 0000000..c105fe6
--- /dev/null
+++ b/crypto/kerberosIV/appl/kip/kip-join-network.in
@@ -0,0 +1,53 @@
+#!/bin/sh
+# $Id$
+#
+# Join a network, see kipd-control from more comments.
+#
+
+PATH=/usr/sbin:/sbin:/usr/bin:/bin:%bindir%
+
+endpointhost=130.237.43.201
+thispointhost=130.237.43.17
+fakepoint=10.0.0.1
+dev=tun0
+
+case $# in
+    0)
+        modprobe tun
+	def=$(route -n | awk '$1 ~ /0.0.0.0/ && $3 ~ /0.0.0.0/ { print $2 }')
+
+	if test "X$def" = "X" ; then
+		echo "missing default route"
+		exit 1
+	fi
+
+	exec kip -c $0 -a $def $endpointhost
+	;;
+    *)
+	state=$1
+	dev=$2
+	host=$3
+	arg=$4
+	case $state in
+	up)
+		ifconfig $dev $thispointhost pointopoint $fakepoint
+		route delete default
+
+		route add -host $endpointhost gw $arg
+		route add default gw $fakepoint
+		;;
+	down)
+
+		echo $dev $arg > /tmp/kip-down
+
+		ifconfig $dev down
+
+		route delete default
+		route delete $endpointhost
+		route add default gw $arg
+		;;
+	*)
+		exit 17
+	;;
+	esac
+esac
diff --git a/crypto/kerberosIV/appl/kip/kip.c b/crypto/kerberosIV/appl/kip/kip.c
index 667a8d8..55b6032 100644
--- a/crypto/kerberosIV/appl/kip/kip.c
+++ b/crypto/kerberosIV/appl/kip/kip.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,14 +33,31 @@
 
 #include "kip.h"
 
-RCSID("$Id: kip.c,v 1.18 1999/12/02 16:58:31 joda Exp $");
+RCSID("$Id: kip.c,v 1.18.2.1 2000/06/23 02:55:01 assar Exp $");
 
-static void
-usage(void)
+static char *cmd_str		= NULL;
+static char *arg_str		= NULL;
+static char *port_str		= NULL;
+static int version_flag		= 0;
+static int help_flag		= 0;
+
+struct getargs args[] = {
+    { "port",		'p',	arg_string,	&port_str,	"Use this port",
+      "port" },
+    { "cmd",		'c',	arg_string,	&cmd_str,
+      "command to run when starting", "cmd"},
+    { "arg",		'a',	arg_string,	&arg_str,
+      "argument to above command", "arg"},
+    { "version",	0, 	arg_flag,		&version_flag },
+    { "help",		0, 	arg_flag,		&help_flag }
+};
+
+
+static RETSIGTYPE
+disconnecthandler (int sig)
 {
-     fprintf (stderr, "Usage: %s host\n",
-	      __progname);
-     exit (1);
+     disconnect = 1;
+     SIGRETURN(0);
 }
 
 /*
@@ -48,7 +65,8 @@ usage(void)
  */
 
 static int
-connect_host (char *host, des_cblock *key, des_key_schedule schedule)
+connect_host (char *host, int port,
+	      des_cblock *key, des_key_schedule schedule)
 {
      CREDENTIALS cred;
      KTEXT_ST text;
@@ -70,7 +88,7 @@ connect_host (char *host, des_cblock *key, des_key_schedule schedule)
 
      memset (&thataddr, 0, sizeof(thataddr));
      thataddr.sin_family = AF_INET;
-     thataddr.sin_port   = k_getportbyname ("kip", "tcp", htons(KIPPORT));
+     thataddr.sin_port   = port;
 
      for(p = hostent->h_addr_list; *p; ++p) {
 	 memcpy (&thataddr.sin_addr, *p, sizeof(thataddr.sin_addr));
@@ -139,19 +157,50 @@ connect_host (char *host, des_cblock *key, des_key_schedule schedule)
  */
 
 static int
-doit (char *host)
+doit (char *host, int port)
 {
+     char tun_if_name[64];
      des_key_schedule schedule;
      des_cblock iv;
-     int other, this;
+     int other, this, ret;
 
-     other = connect_host (host, &iv, schedule);
+     other = connect_host (host, port, &iv, schedule);
      if (other < 0)
 	  return 1;
-     this = tunnel_open ();
+     this = tunnel_open (tun_if_name, sizeof(tun_if_name));
      if (this < 0)
 	  return 1;
-     return copy_packets (this, other, TUNMTU, &iv, schedule);
+
+     if (cmd_str) {
+	 char buf[1024];
+	 ret = kip_exec (cmd_str, buf, sizeof(buf),
+			 "kip-control", "up", tun_if_name, host, arg_str,
+			 NULL);
+	 if (ret)
+	     errx (1, "%s (up) failed: %s", cmd_str, buf);
+     }
+
+     ret = copy_packets (this, other, TUNMTU, &iv, schedule);
+
+     if (cmd_str) {
+	 char buf[1024];
+	 ret = kip_exec (cmd_str, buf, sizeof(buf),
+			 "kip-control", "down", tun_if_name, host, arg_str,
+			 NULL);
+	 if (ret)
+	     errx (1, "%s (down) failed: %s", cmd_str, buf);
+     }
+     return 0;
+}
+
+static void
+usage(int ret)
+{
+    arg_printusage (args,
+		    sizeof(args) / sizeof(args[0]),
+		    NULL,
+		    "hostname");
+    exit (ret);
 }
 
 /*
@@ -162,9 +211,51 @@ doit (char *host)
 int
 main(int argc, char **argv)
 {
+    int port;
+    int optind = 0;
+    char *hostname;
+
     set_progname (argv[0]);
+    if (getarg (args, sizeof(args) / sizeof(args[0]), argc, argv,
+		&optind))
+	usage (1);
+
+    if (help_flag)
+	usage (0);
+
+    if (version_flag) {
+	print_version (NULL);
+	return 0;
+    }
+
+    argv += optind;
+    argc -= optind;
+
+    if (argc != 1)
+	usage (1);
+    
+    hostname = argv[0];
+
+    if(port_str) {
+	struct servent *s = roken_getservbyname (port_str, "tcp");
+
+	if (s)
+	    port = s->s_port;
+	else {
+	    char *ptr;
+
+	    port = strtol (port_str, &ptr, 10);
+	    if (port == 0 && ptr == port_str)
+		errx (1, "bad port `%s'", port_str);
+	    port = htons(port);
+	}
+    } else {
+	port = k_getportbyname ("kip", "tcp", htons(KIPPORT));
+    }
+
+    signal (SIGCHLD, childhandler);
+    signal (SIGHUP,  disconnecthandler);
+    signal (SIGTERM, disconnecthandler);
 
-    if (argc != 2)
-	usage ();
-    return doit (argv[1]);
+    return doit (hostname, port);
 }
diff --git a/crypto/kerberosIV/appl/kip/kip.h b/crypto/kerberosIV/appl/kip/kip.h
index dc748df..7bfc5f1 100644
--- a/crypto/kerberosIV/appl/kip/kip.h
+++ b/crypto/kerberosIV/appl/kip/kip.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: kip.h,v 1.18 1999/12/02 16:58:31 joda Exp $ */
+/* $Id: kip.h,v 1.18.2.1 2000/06/23 02:55:01 assar Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -44,7 +44,6 @@
 #include <errno.h>
 #include <pwd.h>
 #include <signal.h>
-#include <paths.h>
 #include <fcntl.h>
 #ifdef HAVE_SYSLOG_H
 #include <syslog.h>
@@ -72,14 +71,20 @@
 #include <netinet/tcp.h>
 #endif
 #include <netdb.h>
+#ifdef HAVE_SYS_SOCKIO_H
 #include <sys/sockio.h>
+#endif
 #include <net/if.h>
 #ifdef HAVE_NET_IF_VAR_H
 #include <net/if_var.h>
 #endif
+#ifdef HAVE_NET_IF_TUN_H
 #include <net/if_tun.h>
+#endif
 #include <err.h>
 
+#include <getarg.h>
+
 #ifdef SOCKS
 #include <socks.h>
 #endif
@@ -90,6 +95,10 @@
 
 #define TUNDEV "tun"
 
+#ifndef TUNMTU
+#define TUNMTU 1500		/* everything is ethernet :) */
+#endif
+
 #define KIPPORT 2112
 
 #define KIP_VERSION "KIPSRV.0"
@@ -100,5 +109,14 @@ copy_packets (int tundev, int netdev, int mtu, des_cblock *iv,
 
 RETSIGTYPE childhandler (int);
 
+extern sig_atomic_t disconnect;
+extern int isserver;
+
+int
+tunnel_open (char *, size_t);
+
+void
+fatal (int fd, const char *s, des_key_schedule schedule, des_cblock *iv);
+
 int
-tunnel_open (void);
+kip_exec (const char *cmd, char *msg, size_t len, ...);
diff --git a/crypto/kerberosIV/appl/kip/kipd-control.in b/crypto/kerberosIV/appl/kip/kipd-control.in
new file mode 100644
index 0000000..8fb0e9b
--- /dev/null
+++ b/crypto/kerberosIV/appl/kip/kipd-control.in
@@ -0,0 +1,54 @@
+#!/bin/sh
+#
+# $Id$
+#
+# Simple example how you can missuse kip to provide "mobile-ip".
+# This is since there is no way to tunnel ip over udp or any other
+# protocol. There is also problems to get thru firewalls and NATs
+# with mobile-ip since (today) they usully doesn't support IPIP or
+# GRE.
+#
+# All commands are for linux (redhat6.1) but it should be quite 
+# simple to fix it to support other OS.
+#
+
+PATH=/sbin:/usr/sbin:/usr/bin:/bin
+
+# arguments are: [up|down] dev remote-peer-addr user
+
+state=$1
+dev=$2
+remote=$3
+user=$4
+
+outdevice=eth0
+
+case "$state" in
+    up)
+        case "$user" in
+            lha.root@E.KTH.SE)
+                ifconfig $dev 10.0.0.1 pointopoint 130.237.43.17
+                route add -host 130.237.43.17 gw 10.0.0.1
+                arp -H ether -i $outdevice \
+                    -s 130.237.43.17 00:80:c8:82:83:61 pub
+            ;;
+        esac
+        ;;
+    down)
+        case "$user" in
+            lha.root@E.KTH.SE)
+                ifconfig $dev 0.0.0.0
+                ifconfig $dev down
+                arp -i $outdevice -d 130.237.43.17
+                arp -d 130.237.43.17
+                true
+            ;;
+        *)
+            ifconfig $dev down
+            ;;
+        esac
+        ;;
+    *)
+        exit 17
+        ;;
+esac
diff --git a/crypto/kerberosIV/appl/kip/kipd.c b/crypto/kerberosIV/appl/kip/kipd.c
index 429f815..74e8ac2 100644
--- a/crypto/kerberosIV/appl/kip/kipd.c
+++ b/crypto/kerberosIV/appl/kip/kipd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 1996, 1997, 1998, 1999 Kungliga Tekniska Högskolan
+ * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
  * 
@@ -33,22 +33,11 @@
 
 #include "kip.h"
 
-RCSID("$Id: kipd.c,v 1.16 1999/12/02 16:58:31 joda Exp $");
-
-static int
-fatal (int fd, char *s)
-{
-     u_char err = 1;
-
-     write (fd, &err, sizeof(err));
-     write (fd, s, strlen(s)+1);
-     syslog(LOG_ERR, s);
-     return err;
-}
+RCSID("$Id: kipd.c,v 1.16.2.3 2000/10/18 20:46:45 assar Exp $");
 
 static int
 recv_conn (int sock, des_cblock *key, des_key_schedule schedule,
-	   struct sockaddr_in *retaddr)
+	   struct sockaddr_in *retaddr, char *user, size_t len)
 {
      int status;
      KTEXT_ST ticket;
@@ -80,13 +69,21 @@ recv_conn (int sock, des_cblock *key, des_key_schedule schedule,
 	  return 1;
      }
      passwd = k_getpwnam ("root");
-     if (passwd == NULL)
-	  return fatal (sock, "Cannot find root");
-     if (kuserok(&auth, "root") != 0)
-	  return fatal (sock, "Permission denied");
+     if (passwd == NULL) {
+	  fatal (sock, "Cannot find root", schedule, &auth.session);
+	  return 1;
+     }
+     if (kuserok(&auth, "root") != 0) {
+	  fatal (sock, "Permission denied", schedule, &auth.session);
+	  return 1;
+     }
      if (write (sock, &ok, sizeof(ok)) != sizeof(ok))
 	  return 1;
 
+     snprintf (user, len, "%s%s%s@%s", auth.pname, 
+	       auth.pinst[0] != '\0' ? "." : "",
+	       auth.pinst, auth.prealm);
+
      memcpy(key, &auth.session, sizeof(des_cblock));
      *retaddr = thataddr;
      return 0;
@@ -95,17 +92,64 @@ recv_conn (int sock, des_cblock *key, des_key_schedule schedule,
 static int
 doit(int sock)
 {
+     char msg[1024];
+     char cmd[MAXPATHLEN];
+     char tun_if_name[64];
+     char user[MAX_K_NAME_SZ];
      struct sockaddr_in thataddr;
      des_key_schedule schedule;
      des_cblock key;
-     int this;
+     int this, ret, ret2;
 
-     if (recv_conn (sock, &key, schedule, &thataddr))
+     isserver = 1;
+
+     if (recv_conn (sock, &key, schedule, &thataddr, user, sizeof(user)))
 	  return 1;
-     this = tunnel_open ();
+     this = tunnel_open (tun_if_name, sizeof(tun_if_name));
      if (this < 0)
-	  fatal (sock, "Cannot open " _PATH_DEV TUNDEV);
-     return copy_packets (this, sock, TUNMTU, &key, schedule);
+	  fatal (sock, "Cannot open " _PATH_DEV TUNDEV, schedule, &key);
+
+     strlcpy(cmd, LIBEXECDIR "/kipd-control", sizeof(cmd));
+
+     ret = kip_exec (cmd, msg, sizeof(msg), "kipd-control",
+		     "up", tun_if_name, inet_ntoa(thataddr.sin_addr), user,
+		     NULL);
+     if (ret) {
+	 fatal (sock, msg, schedule, &key);
+	 return -1;
+     }
+
+     ret = copy_packets (this, sock, TUNMTU, &key, schedule);
+     
+     ret2 = kip_exec (cmd,  msg, sizeof(msg), "kipd-control",
+		      "down", tun_if_name, user, NULL);
+     if (ret2)
+	 syslog(LOG_ERR, "%s", msg);
+     return ret;
+}
+
+static char *port_str		= NULL;
+static int inetd_flag		= 1;
+static int version_flag		= 0;
+static int help_flag		= 0;
+
+struct getargs args[] = {
+    { "inetd",		'i',	arg_negative_flag,	&inetd_flag,
+      "Not started from inetd" },
+    { "port",		'p',	arg_string,	&port_str,	"Use this port",
+      "port" },
+    { "version",	0, 	arg_flag,		&version_flag },
+    { "help",		0, 	arg_flag,		&help_flag }
+};
+
+static void
+usage(int ret)
+{
+    arg_printusage (args,
+		    sizeof(args) / sizeof(args[0]),
+		    NULL,
+		    "");
+    exit (ret);
 }
 
 /*
@@ -115,9 +159,44 @@ doit(int sock)
 int
 main (int argc, char **argv)
 {
-    set_progname (argv[0]);
+    int port;
+    int optind = 0;
 
+    set_progname (argv[0]);
     roken_openlog(__progname, LOG_PID|LOG_CONS, LOG_DAEMON);
+
+    if (getarg (args, sizeof(args) / sizeof(args[0]), argc, argv,
+		&optind))
+	usage (1);
+
+    if (help_flag)
+	usage (0);
+
+    if (version_flag) {
+	print_version (NULL);
+	return 0;
+    }
+
+    if(port_str) {
+	struct servent *s = roken_getservbyname (port_str, "tcp");
+
+	if (s)
+	    port = s->s_port;
+	else {
+	    char *ptr;
+
+	    port = strtol (port_str, &ptr, 10);
+	    if (port == 0 && ptr == port_str)
+		errx (1, "bad port `%s'", port_str);
+	    port = htons(port);
+	}
+    } else {
+	port = k_getportbyname ("kip", "tcp", htons(KIPPORT));
+    }
+
+    if (!inetd_flag)
+	mini_inetd (port);
+
     signal (SIGCHLD, childhandler);
-    return doit(0);
+    return doit(STDIN_FILENO);
 }