2 * Copyright (c) 2001 - 2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
38 #include "locate_plugin.h"
41 string_to_proto(const char *string
)
43 if(strcasecmp(string
, "udp") == 0)
44 return KRB5_KRBHST_UDP
;
45 else if(strcasecmp(string
, "tcp") == 0)
46 return KRB5_KRBHST_TCP
;
47 else if(strcasecmp(string
, "http") == 0)
48 return KRB5_KRBHST_HTTP
;
53 is_invalid_tld_srv_target(const char *target
)
55 return (strncmp("your-dns-needs-immediate-attention.",
57 && strchr(&target
[35], '.') == NULL
);
61 * set `res' and `count' to the result of looking up SRV RR in DNS for
62 * `proto', `proto', `realm' using `dns_type'.
63 * if `port' != 0, force that port number
66 static krb5_error_code
67 srv_find_realm(krb5_context context
, krb5_krbhst_info
***res
, int *count
,
68 const char *realm
, const char *dns_type
,
69 const char *proto
, const char *service
, int port
)
72 struct rk_dns_reply
*r
;
73 struct rk_resource_record
*rr
;
81 proto_num
= string_to_proto(proto
);
83 krb5_set_error_message(context
, EINVAL
,
84 N_("unknown protocol `%s' to lookup", ""),
89 if(proto_num
== KRB5_KRBHST_HTTP
)
90 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
92 def_port
= ntohs(krb5_getportbyname (context
, service
, proto
, 88));
96 snprintf(domain
, sizeof(domain
), "_%s._%s.%s.", service
, proto
, realm
);
98 r
= rk_dns_lookup(domain
, dns_type
);
100 _krb5_debug(context
, 0,
101 "DNS lookup failed domain: %s", domain
);
102 return KRB5_KDC_UNREACH
;
105 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
106 if(rr
->type
== rk_ns_t_srv
)
109 *res
= malloc(num_srv
* sizeof(**res
));
112 return krb5_enomem(context
);
117 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
118 if(rr
->type
== rk_ns_t_srv
) {
119 krb5_krbhst_info
*hi
= NULL
;
123 /* Test for top-level domain controlled interruptions */
124 if (!is_invalid_tld_srv_target(rr
->u
.srv
->target
)) {
126 len
= strlen(rr
->u
.srv
->target
);
127 hi
= calloc(1, sizeof(*hi
) + len
);
131 while(--num_srv
>= 0)
132 free((*res
)[num_srv
]);
137 "Domain lookup failed: "
138 "Realm %s needs immediate attention "
139 "see https://icann.org/namecollision",
141 return KRB5_KDC_UNREACH
;
143 return krb5_enomem(context
);
145 (*res
)[num_srv
++] = hi
;
147 hi
->proto
= proto_num
;
149 hi
->def_port
= def_port
;
153 hi
->port
= rr
->u
.srv
->port
;
155 strlcpy(hi
->hostname
, rr
->u
.srv
->target
, len
+ 1);
165 struct krb5_krbhst_data
{
169 int port
; /* hardwired port number if != 0 */
173 #define KD_SRV_HTTP 8
174 #define KD_FALLBACK 16
175 #define KD_CONFIG_EXISTS 32
176 #define KD_LARGE_MSG 64
177 #define KD_PLUGIN 128
178 #define KD_HOSTNAMES 256
179 krb5_error_code (*get_next
)(krb5_context
, struct krb5_krbhst_data
*,
183 unsigned int fallback_count
;
185 struct krb5_krbhst_info
*hosts
, **index
, **end
;
189 krbhst_empty(const struct krb5_krbhst_data
*kd
)
191 return kd
->index
== &kd
->hosts
;
195 * Return the default protocol for the `kd' (either TCP or UDP)
199 krbhst_get_default_proto(struct krb5_krbhst_data
*kd
)
201 if (kd
->flags
& KD_LARGE_MSG
)
202 return KRB5_KRBHST_TCP
;
203 return KRB5_KRBHST_UDP
;
207 krbhst_get_default_port(struct krb5_krbhst_data
*kd
)
216 KRB5_LIB_FUNCTION
const char * KRB5_LIB_CALL
217 _krb5_krbhst_get_realm(krb5_krbhst_handle handle
)
219 return handle
->realm
;
223 * parse `spec' into a krb5_krbhst_info, defaulting the port to `def_port'
224 * and forcing it to `port' if port != 0
227 static struct krb5_krbhst_info
*
228 parse_hostspec(krb5_context context
, struct krb5_krbhst_data
*kd
,
229 const char *spec
, int def_port
, int port
)
231 const char *p
= spec
, *q
;
232 struct krb5_krbhst_info
*hi
;
234 hi
= calloc(1, sizeof(*hi
) + strlen(spec
));
238 hi
->proto
= krbhst_get_default_proto(kd
);
240 if(strncmp(p
, "http://", 7) == 0){
241 hi
->proto
= KRB5_KRBHST_HTTP
;
243 } else if(strncmp(p
, "http/", 5) == 0) {
244 hi
->proto
= KRB5_KRBHST_HTTP
;
246 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
247 }else if(strncmp(p
, "tcp/", 4) == 0){
248 hi
->proto
= KRB5_KRBHST_TCP
;
250 } else if(strncmp(p
, "udp/", 4) == 0) {
251 hi
->proto
= KRB5_KRBHST_UDP
;
255 if (p
[0] == '[' && (q
= strchr(p
, ']')) != NULL
) {
256 /* if address looks like [foo:bar] or [foo:bar]: its a ipv6
257 adress, strip of [] */
258 memcpy(hi
->hostname
, &p
[1], q
- p
- 1);
259 hi
->hostname
[q
- p
- 1] = '\0';
264 } else if(strsep_copy(&p
, ":", hi
->hostname
, strlen(spec
) + 1) < 0) {
265 /* copy everything before : */
269 /* get rid of trailing /, and convert to lower case */
270 hi
->hostname
[strcspn(hi
->hostname
, "/")] = '\0';
271 strlwr(hi
->hostname
);
273 hi
->port
= hi
->def_port
= def_port
;
274 if(p
!= NULL
&& p
[0]) {
276 hi
->port
= strtol(p
, &end
, 0);
287 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
288 _krb5_free_krbhst_info(krb5_krbhst_info
*hi
)
291 freeaddrinfo(hi
->ai
);
295 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
296 _krb5_krbhost_info_move(krb5_context context
,
297 krb5_krbhst_info
*from
,
298 krb5_krbhst_info
**to
)
300 size_t hostnamelen
= strlen(from
->hostname
);
301 /* trailing NUL is included in structure */
302 *to
= calloc(1, sizeof(**to
) + hostnamelen
);
304 return krb5_enomem(context
);
306 (*to
)->proto
= from
->proto
;
307 (*to
)->port
= from
->port
;
308 (*to
)->def_port
= from
->def_port
;
309 (*to
)->ai
= from
->ai
;
312 memcpy((*to
)->hostname
, from
->hostname
, hostnamelen
+ 1);
318 append_host_hostinfo(struct krb5_krbhst_data
*kd
, struct krb5_krbhst_info
*host
)
320 struct krb5_krbhst_info
*h
;
322 for(h
= kd
->hosts
; h
; h
= h
->next
)
323 if(h
->proto
== host
->proto
&&
324 h
->port
== host
->port
&&
325 strcmp(h
->hostname
, host
->hostname
) == 0) {
326 _krb5_free_krbhst_info(host
);
330 kd
->end
= &host
->next
;
333 static krb5_error_code
334 append_host_string(krb5_context context
, struct krb5_krbhst_data
*kd
,
335 const char *host
, int def_port
, int port
)
337 struct krb5_krbhst_info
*hi
;
339 hi
= parse_hostspec(context
, kd
, host
, def_port
, port
);
341 return krb5_enomem(context
);
343 append_host_hostinfo(kd
, hi
);
348 * return a readable representation of `host' in `hostname, hostlen'
351 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
352 krb5_krbhst_format_string(krb5_context context
, const krb5_krbhst_info
*host
,
353 char *hostname
, size_t hostlen
)
355 const char *proto
= "";
356 char portstr
[7] = "";
357 if(host
->proto
== KRB5_KRBHST_TCP
)
359 else if(host
->proto
== KRB5_KRBHST_HTTP
)
361 if(host
->port
!= host
->def_port
)
362 snprintf(portstr
, sizeof(portstr
), ":%d", host
->port
);
363 snprintf(hostname
, hostlen
, "%s%s%s", proto
, host
->hostname
, portstr
);
368 * create a getaddrinfo `hints' based on `proto'
372 make_hints(struct addrinfo
*hints
, int proto
)
374 memset(hints
, 0, sizeof(*hints
));
375 hints
->ai_family
= AF_UNSPEC
;
377 case KRB5_KRBHST_UDP
:
378 hints
->ai_socktype
= SOCK_DGRAM
;
380 case KRB5_KRBHST_HTTP
:
381 case KRB5_KRBHST_TCP
:
382 hints
->ai_socktype
= SOCK_STREAM
;
388 * Return an `struct addrinfo *' for a KDC host.
390 * Returns an the struct addrinfo in in that corresponds to the
391 * information in `host'. free:ing is handled by krb5_krbhst_free, so
392 * the returned ai must not be released.
397 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
398 krb5_krbhst_get_addrinfo(krb5_context context
, krb5_krbhst_info
*host
,
399 struct addrinfo
**ai
)
403 if (host
->ai
== NULL
) {
404 struct addrinfo hints
;
405 char portstr
[NI_MAXSERV
];
406 char *hostname
= host
->hostname
;
408 snprintf (portstr
, sizeof(portstr
), "%d", host
->port
);
409 make_hints(&hints
, host
->proto
);
412 * First try this as an IP address, this allows us to add a
413 * dot at the end to stop using the search domains.
416 hints
.ai_flags
|= AI_NUMERICHOST
| AI_NUMERICSERV
;
418 ret
= getaddrinfo(host
->hostname
, portstr
, &hints
, &host
->ai
);
423 * If the hostname contains a dot, assumes it's a FQDN and
424 * don't use search domains since that might be painfully slow
425 * when machine is disconnected from that network.
428 hints
.ai_flags
&= ~(AI_NUMERICHOST
);
430 if (strchr(hostname
, '.') && hostname
[strlen(hostname
) - 1] != '.') {
431 ret
= asprintf(&hostname
, "%s.", host
->hostname
);
432 if (ret
< 0 || hostname
== NULL
)
436 ret
= getaddrinfo(hostname
, portstr
, &hints
, &host
->ai
);
437 if (hostname
!= host
->hostname
)
440 ret
= krb5_eai_to_heim_errno(ret
, errno
);
450 get_next(struct krb5_krbhst_data
*kd
, krb5_krbhst_info
**host
)
452 struct krb5_krbhst_info
*hi
= *kd
->index
;
455 kd
->index
= &(*kd
->index
)->next
;
462 srv_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
463 const char *proto
, const char *service
)
466 krb5_krbhst_info
**res
;
469 if (krb5_realm_is_lkdc(kd
->realm
))
472 ret
= srv_find_realm(context
, &res
, &count
, kd
->realm
, "SRV", proto
, service
,
474 _krb5_debug(context
, 2, "searching DNS for realm %s %s.%s -> %d",
475 kd
->realm
, proto
, service
, ret
);
478 for(i
= 0; i
< count
; i
++)
479 append_host_hostinfo(kd
, res
[i
]);
484 * read the configuration for `conf_string', defaulting to kd->def_port and
485 * forcing it to `kd->port' if kd->port != 0
489 config_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
490 const char *conf_string
)
494 hostlist
= krb5_config_get_strings(context
, NULL
,
495 "realms", kd
->realm
, conf_string
, NULL
);
497 _krb5_debug(context
, 2, "configuration file for realm %s%s found",
498 kd
->realm
, hostlist
? "" : " not");
502 kd
->flags
|= KD_CONFIG_EXISTS
;
503 for(i
= 0; hostlist
&& hostlist
[i
] != NULL
; i
++)
504 append_host_string(context
, kd
, hostlist
[i
], kd
->def_port
, kd
->port
);
506 krb5_config_free_strings(hostlist
);
510 * as a fallback, look for `serv_string.kd->realm' (typically
511 * kerberos.REALM, kerberos-1.REALM, ...
512 * `port' is the default port for the service, and `proto' the
516 static krb5_error_code
517 fallback_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
518 const char *serv_string
, int port
, int proto
)
523 struct addrinfo hints
;
524 char portstr
[NI_MAXSERV
];
526 ret
= krb5_config_get_bool_default(context
, NULL
, KRB5_FALLBACK_DEFAULT
,
527 "libdefaults", "use_fallback", NULL
);
529 kd
->flags
|= KD_FALLBACK
;
533 _krb5_debug(context
, 2, "fallback lookup %d for realm %s (service %s)",
534 kd
->fallback_count
, kd
->realm
, serv_string
);
537 * Don't try forever in case the DNS server keep returning us
538 * entries (like wildcard entries or the .nu TLD)
540 * Also don't try LKDC realms since fallback wont work on them at all.
542 if(kd
->fallback_count
>= 5 || krb5_realm_is_lkdc(kd
->realm
)) {
543 kd
->flags
|= KD_FALLBACK
;
547 if(kd
->fallback_count
== 0)
548 ret
= asprintf(&host
, "%s.%s.", serv_string
, kd
->realm
);
550 ret
= asprintf(&host
, "%s-%d.%s.",
551 serv_string
, kd
->fallback_count
, kd
->realm
);
553 if (ret
< 0 || host
== NULL
)
554 return krb5_enomem(context
);
556 make_hints(&hints
, proto
);
557 snprintf(portstr
, sizeof(portstr
), "%d", port
);
558 ret
= getaddrinfo(host
, portstr
, &hints
, &ai
);
560 /* no more hosts, so we're done here */
562 kd
->flags
|= KD_FALLBACK
;
564 struct krb5_krbhst_info
*hi
;
567 /* Check for ICANN gTLD Name Collision address (127.0.53.53) */
568 if (ai
->ai_family
== AF_INET
) {
569 struct sockaddr_in
*sin
= (struct sockaddr_in
*)ai
->ai_addr
;
570 if (sin
->sin_addr
.s_addr
== htonl(0x7f003535)) {
572 "Fallback lookup failed: "
573 "Realm %s needs immediate attention "
574 "see https://icann.org/namecollision",
576 return KRB5_KDC_UNREACH
;
580 hostlen
= strlen(host
);
581 hi
= calloc(1, sizeof(*hi
) + hostlen
);
584 return krb5_enomem(context
);
588 hi
->port
= hi
->def_port
= port
;
590 memmove(hi
->hostname
, host
, hostlen
);
591 hi
->hostname
[hostlen
] = '\0';
593 append_host_hostinfo(kd
, hi
);
594 kd
->fallback_count
++;
600 * Fetch hosts from plugin
603 static krb5_error_code
604 add_plugin_host(struct krb5_krbhst_data
*kd
,
610 struct krb5_krbhst_info
*hi
;
611 struct addrinfo hints
, *ai
;
615 make_hints(&hints
, proto
);
616 ret
= getaddrinfo(host
, port
, &hints
, &ai
);
620 hostlen
= strlen(host
);
622 hi
= calloc(1, sizeof(*hi
) + hostlen
);
627 hi
->port
= hi
->def_port
= portnum
;
629 memmove(hi
->hostname
, host
, hostlen
);
630 hi
->hostname
[hostlen
] = '\0';
631 append_host_hostinfo(kd
, hi
);
636 static krb5_error_code
637 add_locate(void *ctx
, int type
, struct sockaddr
*addr
)
639 struct krb5_krbhst_data
*kd
= ctx
;
640 char host
[NI_MAXHOST
], port
[NI_MAXSERV
];
645 socklen
= socket_sockaddr_size(addr
);
646 portnum
= socket_get_port(addr
);
648 ret
= getnameinfo(addr
, socklen
, host
, sizeof(host
), port
, sizeof(port
),
649 NI_NUMERICHOST
|NI_NUMERICSERV
);
654 snprintf(port
, sizeof(port
), "%d", kd
->port
);
655 else if (atoi(port
) == 0)
656 snprintf(port
, sizeof(port
), "%d", krbhst_get_default_port(kd
));
658 proto
= krbhst_get_default_proto(kd
);
660 ret
= add_plugin_host(kd
, host
, port
, portnum
, proto
);
665 * This is really kind of broken and should be solved a different
666 * way, some sites block UDP, and we don't, in the general case,
667 * fall back to TCP, that should also be done. But since that
668 * should require us to invert the whole "find kdc" stack, let put
672 if (proto
== KRB5_KRBHST_UDP
) {
673 ret
= add_plugin_host(kd
, host
, port
, portnum
, KRB5_KRBHST_TCP
);
682 enum locate_service_type type
;
683 struct krb5_krbhst_data
*kd
;
687 static KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
688 plcallback(krb5_context context
,
689 const void *plug
, void *plugctx
, void *userctx
)
691 const krb5plugin_service_locate_ftable
*locate
= plug
;
692 struct plctx
*plctx
= userctx
;
694 if (locate
->minor_version
>= KRB5_PLUGIN_LOCATE_VERSION_2
)
695 return locate
->lookup(plugctx
, plctx
->flags
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
697 if (plctx
->flags
& KRB5_PLF_ALLOW_HOMEDIR
)
698 return locate
->old_lookup(plugctx
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
700 return KRB5_PLUGIN_NO_HANDLE
;
704 plugin_get_hosts(krb5_context context
,
705 struct krb5_krbhst_data
*kd
,
706 enum locate_service_type type
)
708 struct plctx ctx
= { type
, kd
, 0 };
710 if (_krb5_homedir_access(context
))
711 ctx
.flags
|= KRB5_PLF_ALLOW_HOMEDIR
;
713 _krb5_plugin_run_f(context
, "krb5", KRB5_PLUGIN_LOCATE
,
714 KRB5_PLUGIN_LOCATE_VERSION_0
,
715 0, &ctx
, plcallback
);
723 hostnames_get_hosts(krb5_context context
,
724 struct krb5_krbhst_data
*kd
,
727 kd
->flags
|= KD_HOSTNAMES
;
729 append_host_string(context
, kd
, kd
->hostname
, kd
->def_port
, kd
->port
);
737 static krb5_error_code
738 kdc_get_next(krb5_context context
,
739 struct krb5_krbhst_data
*kd
,
740 krb5_krbhst_info
**host
)
744 if ((kd
->flags
& KD_HOSTNAMES
) == 0) {
745 hostnames_get_hosts(context
, kd
, "kdc");
746 if(get_next(kd
, host
))
750 if ((kd
->flags
& KD_PLUGIN
) == 0) {
751 plugin_get_hosts(context
, kd
, locate_service_kdc
);
752 kd
->flags
|= KD_PLUGIN
;
753 if(get_next(kd
, host
))
757 if((kd
->flags
& KD_CONFIG
) == 0) {
758 config_get_hosts(context
, kd
, "kdc");
759 kd
->flags
|= KD_CONFIG
;
760 if(get_next(kd
, host
))
764 if (kd
->flags
& KD_CONFIG_EXISTS
) {
765 _krb5_debug(context
, 1,
766 "Configuration exists for realm %s, wont go to DNS",
768 return KRB5_KDC_UNREACH
;
771 if(context
->srv_lookup
) {
772 if((kd
->flags
& KD_SRV_UDP
) == 0 && (kd
->flags
& KD_LARGE_MSG
) == 0) {
773 srv_get_hosts(context
, kd
, "udp", "kerberos");
774 kd
->flags
|= KD_SRV_UDP
;
775 if(get_next(kd
, host
))
779 if((kd
->flags
& KD_SRV_TCP
) == 0) {
780 srv_get_hosts(context
, kd
, "tcp", "kerberos");
781 kd
->flags
|= KD_SRV_TCP
;
782 if(get_next(kd
, host
))
785 if((kd
->flags
& KD_SRV_HTTP
) == 0) {
786 srv_get_hosts(context
, kd
, "http", "kerberos");
787 kd
->flags
|= KD_SRV_HTTP
;
788 if(get_next(kd
, host
))
793 while((kd
->flags
& KD_FALLBACK
) == 0) {
794 ret
= fallback_get_hosts(context
, kd
, "kerberos",
796 krbhst_get_default_proto(kd
));
799 if(get_next(kd
, host
))
803 _krb5_debug(context
, 0, "No KDC entries found for %s", kd
->realm
);
805 return KRB5_KDC_UNREACH
; /* XXX */
808 static krb5_error_code
809 admin_get_next(krb5_context context
,
810 struct krb5_krbhst_data
*kd
,
811 krb5_krbhst_info
**host
)
815 if ((kd
->flags
& KD_PLUGIN
) == 0) {
816 plugin_get_hosts(context
, kd
, locate_service_kadmin
);
817 kd
->flags
|= KD_PLUGIN
;
818 if(get_next(kd
, host
))
822 if((kd
->flags
& KD_CONFIG
) == 0) {
823 config_get_hosts(context
, kd
, "admin_server");
824 kd
->flags
|= KD_CONFIG
;
825 if(get_next(kd
, host
))
829 if (kd
->flags
& KD_CONFIG_EXISTS
) {
830 _krb5_debug(context
, 1,
831 "Configuration exists for realm %s, wont go to DNS",
833 return KRB5_KDC_UNREACH
;
836 if(context
->srv_lookup
) {
837 if((kd
->flags
& KD_SRV_TCP
) == 0) {
838 srv_get_hosts(context
, kd
, "tcp", "kerberos-adm");
839 kd
->flags
|= KD_SRV_TCP
;
840 if(get_next(kd
, host
))
846 && (kd
->flags
& KD_FALLBACK
) == 0) {
847 ret
= fallback_get_hosts(context
, kd
, "kerberos",
849 krbhst_get_default_proto(kd
));
852 kd
->flags
|= KD_FALLBACK
;
853 if(get_next(kd
, host
))
857 _krb5_debug(context
, 0, "No admin entries found for realm %s", kd
->realm
);
859 return KRB5_KDC_UNREACH
; /* XXX */
862 static krb5_error_code
863 kpasswd_get_next(krb5_context context
,
864 struct krb5_krbhst_data
*kd
,
865 krb5_krbhst_info
**host
)
869 if ((kd
->flags
& KD_PLUGIN
) == 0) {
870 plugin_get_hosts(context
, kd
, locate_service_kpasswd
);
871 kd
->flags
|= KD_PLUGIN
;
872 if(get_next(kd
, host
))
876 if((kd
->flags
& KD_CONFIG
) == 0) {
877 config_get_hosts(context
, kd
, "kpasswd_server");
878 kd
->flags
|= KD_CONFIG
;
879 if(get_next(kd
, host
))
883 if (kd
->flags
& KD_CONFIG_EXISTS
) {
884 _krb5_debug(context
, 1,
885 "Configuration exists for realm %s, wont go to DNS",
887 return KRB5_KDC_UNREACH
;
890 if(context
->srv_lookup
) {
891 if((kd
->flags
& KD_SRV_UDP
) == 0) {
892 srv_get_hosts(context
, kd
, "udp", "kpasswd");
893 kd
->flags
|= KD_SRV_UDP
;
894 if(get_next(kd
, host
))
897 if((kd
->flags
& KD_SRV_TCP
) == 0) {
898 srv_get_hosts(context
, kd
, "tcp", "kpasswd");
899 kd
->flags
|= KD_SRV_TCP
;
900 if(get_next(kd
, host
))
905 /* no matches -> try admin */
907 if (krbhst_empty(kd
)) {
909 kd
->port
= kd
->def_port
;
910 kd
->get_next
= admin_get_next
;
911 ret
= (*kd
->get_next
)(context
, kd
, host
);
913 (*host
)->proto
= krbhst_get_default_proto(kd
);
917 _krb5_debug(context
, 0, "No kpasswd entries found for realm %s", kd
->realm
);
919 return KRB5_KDC_UNREACH
;
923 krbhost_dealloc(void *ptr
)
925 struct krb5_krbhst_data
*handle
= (struct krb5_krbhst_data
*)ptr
;
926 krb5_krbhst_info
*h
, *next
;
928 for (h
= handle
->hosts
; h
!= NULL
; h
= next
) {
930 _krb5_free_krbhst_info(h
);
932 if (handle
->hostname
)
933 free(handle
->hostname
);
938 static struct krb5_krbhst_data
*
939 common_init(krb5_context context
,
944 struct krb5_krbhst_data
*kd
;
946 if ((kd
= heim_alloc(sizeof(*kd
), "krbhst-context", krbhost_dealloc
)) == NULL
)
949 if((kd
->realm
= strdup(realm
)) == NULL
) {
954 _krb5_debug(context
, 2, "Trying to find service %s for realm %s flags %x",
955 service
, realm
, flags
);
957 /* For 'realms' without a . do not even think of going to DNS */
958 if (!strchr(realm
, '.'))
959 kd
->flags
|= KD_CONFIG_EXISTS
;
961 if (flags
& KRB5_KRBHST_FLAGS_LARGE_MSG
)
962 kd
->flags
|= KD_LARGE_MSG
;
963 kd
->end
= kd
->index
= &kd
->hosts
;
968 * initialize `handle' to look for hosts of type `type' in realm `realm'
971 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
972 krb5_krbhst_init(krb5_context context
,
975 krb5_krbhst_handle
*handle
)
977 return krb5_krbhst_init_flags(context
, realm
, type
, 0, handle
);
980 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
981 krb5_krbhst_init_flags(krb5_context context
,
985 krb5_krbhst_handle
*handle
)
987 struct krb5_krbhst_data
*kd
;
988 krb5_error_code (*next
)(krb5_context
, struct krb5_krbhst_data
*,
989 krb5_krbhst_info
**);
996 case KRB5_KRBHST_KDC
:
998 def_port
= ntohs(krb5_getportbyname (context
, "kerberos", "udp", 88));
1001 case KRB5_KRBHST_ADMIN
:
1002 next
= admin_get_next
;
1003 def_port
= ntohs(krb5_getportbyname (context
, "kerberos-adm",
1007 case KRB5_KRBHST_CHANGEPW
:
1008 next
= kpasswd_get_next
;
1009 def_port
= ntohs(krb5_getportbyname (context
, "kpasswd", "udp",
1011 service
= "change_password";
1014 krb5_set_error_message(context
, ENOTTY
,
1015 N_("unknown krbhst type (%u)", ""), type
);
1018 if((kd
= common_init(context
, service
, realm
, flags
)) == NULL
)
1020 kd
->get_next
= next
;
1021 kd
->def_port
= def_port
;
1027 * return the next host information from `handle' in `host'
1030 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1031 krb5_krbhst_next(krb5_context context
,
1032 krb5_krbhst_handle handle
,
1033 krb5_krbhst_info
**host
)
1035 if(get_next(handle
, host
))
1038 return (*handle
->get_next
)(context
, handle
, host
);
1042 * return the next host information from `handle' as a host name
1043 * in `hostname' (or length `hostlen)
1046 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1047 krb5_krbhst_next_as_string(krb5_context context
,
1048 krb5_krbhst_handle handle
,
1052 krb5_error_code ret
;
1053 krb5_krbhst_info
*host
;
1054 ret
= krb5_krbhst_next(context
, handle
, &host
);
1057 return krb5_krbhst_format_string(context
, host
, hostname
, hostlen
);
1064 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1065 krb5_krbhst_set_hostname(krb5_context context
,
1066 krb5_krbhst_handle handle
,
1067 const char *hostname
)
1069 if (handle
->hostname
)
1070 free(handle
->hostname
);
1071 handle
->hostname
= strdup(hostname
);
1072 if (handle
->hostname
== NULL
)
1077 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1078 krb5_krbhst_reset(krb5_context context
, krb5_krbhst_handle handle
)
1080 handle
->index
= &handle
->hosts
;
1083 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1084 krb5_krbhst_free(krb5_context context
, krb5_krbhst_handle handle
)
1086 heim_release(handle
);
1089 #ifndef HEIMDAL_SMALLER
1091 /* backwards compatibility ahead */
1093 static krb5_error_code
1094 gethostlist(krb5_context context
, const char *realm
,
1095 unsigned int type
, char ***hostlist
)
1097 krb5_error_code ret
;
1099 krb5_krbhst_handle handle
;
1100 char host
[MAXHOSTNAMELEN
];
1101 krb5_krbhst_info
*hostinfo
;
1103 ret
= krb5_krbhst_init(context
, realm
, type
, &handle
);
1107 while(krb5_krbhst_next(context
, handle
, &hostinfo
) == 0)
1110 krb5_set_error_message(context
, KRB5_KDC_UNREACH
,
1111 N_("No KDC found for realm %s", ""), realm
);
1112 return KRB5_KDC_UNREACH
;
1114 *hostlist
= calloc(nhost
+ 1, sizeof(**hostlist
));
1115 if(*hostlist
== NULL
) {
1116 krb5_krbhst_free(context
, handle
);
1117 return krb5_enomem(context
);
1120 krb5_krbhst_reset(context
, handle
);
1122 while(krb5_krbhst_next_as_string(context
, handle
,
1123 host
, sizeof(host
)) == 0) {
1124 if(((*hostlist
)[nhost
++] = strdup(host
)) == NULL
) {
1125 krb5_free_krbhst(context
, *hostlist
);
1126 krb5_krbhst_free(context
, handle
);
1127 return krb5_enomem(context
);
1130 (*hostlist
)[nhost
] = NULL
;
1131 krb5_krbhst_free(context
, handle
);
1136 * return an malloced list of kadmin-hosts for `realm' in `hostlist'
1139 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1140 krb5_get_krb_admin_hst (krb5_context context
,
1141 const krb5_realm
*realm
,
1144 return gethostlist(context
, *realm
, KRB5_KRBHST_ADMIN
, hostlist
);
1148 * return an malloced list of changepw-hosts for `realm' in `hostlist'
1151 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1152 krb5_get_krb_changepw_hst (krb5_context context
,
1153 const krb5_realm
*realm
,
1156 return gethostlist(context
, *realm
, KRB5_KRBHST_CHANGEPW
, hostlist
);
1160 * return an malloced list of 524-hosts for `realm' in `hostlist'
1163 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1164 krb5_get_krb524hst (krb5_context context
,
1165 const krb5_realm
*realm
,
1168 return gethostlist(context
, *realm
, KRB5_KRBHST_KRB524
, hostlist
);
1172 * return an malloced list of KDC's for `realm' in `hostlist'
1175 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1176 krb5_get_krbhst (krb5_context context
,
1177 const krb5_realm
*realm
,
1180 return gethostlist(context
, *realm
, KRB5_KRBHST_KDC
, hostlist
);
1184 * free all the memory allocated in `hostlist'
1187 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1188 krb5_free_krbhst (krb5_context context
,
1193 for (p
= hostlist
; *p
; ++p
)
1199 #endif /* HEIMDAL_SMALLER */