s4:heimdal: import lorikeet-heimdal-201003262338 (commit f4e0dc17709829235f057e0e100d...
[Samba/gebeck_regimport.git] / source4 / heimdal / lib / krb5 / principal.c
blob8e6341fd62e87540fa0dfba8aba01447149da812
1 /*
2 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
34 /**
35 * @page krb5_principal_intro The principal handing functions.
37 * A Kerberos principal is a email address looking string that
38 * contains to parts separeted by a @. The later part is the kerbero
39 * realm the principal belongs to and the former is a list of 0 or
40 * more components. For example
41 * @verbatim
42 lha@SU.SE
43 host/hummel.it.su.se@SU.SE
44 host/admin@H5L.ORG
45 @endverbatim
47 * See the library functions here: @ref krb5_principal
50 #include "krb5_locl.h"
51 #ifdef HAVE_RES_SEARCH
52 #define USE_RESOLVER
53 #endif
54 #ifdef HAVE_ARPA_NAMESER_H
55 #include <arpa/nameser.h>
56 #endif
57 #include <fnmatch.h>
58 #include "resolve.h"
60 #define princ_num_comp(P) ((P)->name.name_string.len)
61 #define princ_type(P) ((P)->name.name_type)
62 #define princ_comp(P) ((P)->name.name_string.val)
63 #define princ_ncomp(P, N) ((P)->name.name_string.val[(N)])
64 #define princ_realm(P) ((P)->realm)
66 /**
67 * Frees a Kerberos principal allocated by the library with
68 * krb5_parse_name(), krb5_make_principal() or any other related
69 * principal functions.
71 * @param context A Kerberos context.
72 * @param p a principal to free.
74 * @return An krb5 error code, see krb5_get_error_message().
76 * @ingroup krb5_principal
79 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
80 krb5_free_principal(krb5_context context,
81 krb5_principal p)
83 if(p){
84 free_Principal(p);
85 free(p);
89 /**
90 * Set the type of the principal
92 * @param context A Kerberos context.
93 * @param principal principal to set the type for
94 * @param type the new type
96 * @return An krb5 error code, see krb5_get_error_message().
98 * @ingroup krb5_principal
101 KRB5_LIB_FUNCTION void KRB5_LIB_CALL
102 krb5_principal_set_type(krb5_context context,
103 krb5_principal principal,
104 int type)
106 princ_type(principal) = type;
110 * Get the type of the principal
112 * @param context A Kerberos context.
113 * @param principal principal to get the type for
115 * @return the type of principal
117 * @ingroup krb5_principal
120 KRB5_LIB_FUNCTION int KRB5_LIB_CALL
121 krb5_principal_get_type(krb5_context context,
122 krb5_const_principal principal)
124 return princ_type(principal);
128 * Get the realm of the principal
130 * @param context A Kerberos context.
131 * @param principal principal to get the realm for
133 * @return realm of the principal, don't free or use after krb5_principal is freed
135 * @ingroup krb5_principal
138 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
139 krb5_principal_get_realm(krb5_context context,
140 krb5_const_principal principal)
142 return princ_realm(principal);
145 KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
146 krb5_principal_get_comp_string(krb5_context context,
147 krb5_const_principal principal,
148 unsigned int component)
150 if(component >= princ_num_comp(principal))
151 return NULL;
152 return princ_ncomp(principal, component);
156 * Get number of component is principal.
158 * @param context Kerberos 5 context
159 * @param principal principal to query
161 * @return number of components in string
163 * @ingroup krb5_principal
166 KRB5_LIB_FUNCTION unsigned int KRB5_LIB_CALL
167 krb5_principal_get_num_comp(krb5_context context,
168 krb5_const_principal principal)
170 return princ_num_comp(principal);
174 * Parse a name into a krb5_principal structure, flags controls the behavior.
176 * @param context Kerberos 5 context
177 * @param name name to parse into a Kerberos principal
178 * @param flags flags to control the behavior
179 * @param principal returned principal, free with krb5_free_principal().
181 * @return An krb5 error code, see krb5_get_error_message().
183 * @ingroup krb5_principal
186 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
187 krb5_parse_name_flags(krb5_context context,
188 const char *name,
189 int flags,
190 krb5_principal *principal)
192 krb5_error_code ret;
193 heim_general_string *comp;
194 heim_general_string realm = NULL;
195 int ncomp;
197 const char *p;
198 char *q;
199 char *s;
200 char *start;
202 int n;
203 char c;
204 int got_realm = 0;
205 int first_at = 1;
206 int enterprise = (flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE);
208 *principal = NULL;
210 #define RFLAGS (KRB5_PRINCIPAL_PARSE_NO_REALM|KRB5_PRINCIPAL_PARSE_REQUIRE_REALM)
212 if ((flags & RFLAGS) == RFLAGS) {
213 krb5_set_error_message(context, KRB5_ERR_NO_SERVICE,
214 N_("Can't require both realm and "
215 "no realm at the same time", ""));
216 return KRB5_ERR_NO_SERVICE;
218 #undef RFLAGS
220 /* count number of component,
221 * enterprise names only have one component
223 ncomp = 1;
224 if (!enterprise) {
225 for(p = name; *p; p++){
226 if(*p=='\\'){
227 if(!p[1]) {
228 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
229 N_("trailing \\ in principal name", ""));
230 return KRB5_PARSE_MALFORMED;
232 p++;
233 } else if(*p == '/')
234 ncomp++;
235 else if(*p == '@')
236 break;
239 comp = calloc(ncomp, sizeof(*comp));
240 if (comp == NULL) {
241 krb5_set_error_message(context, ENOMEM,
242 N_("malloc: out of memory", ""));
243 return ENOMEM;
246 n = 0;
247 p = start = q = s = strdup(name);
248 if (start == NULL) {
249 free (comp);
250 krb5_set_error_message(context, ENOMEM,
251 N_("malloc: out of memory", ""));
252 return ENOMEM;
254 while(*p){
255 c = *p++;
256 if(c == '\\'){
257 c = *p++;
258 if(c == 'n')
259 c = '\n';
260 else if(c == 't')
261 c = '\t';
262 else if(c == 'b')
263 c = '\b';
264 else if(c == '0')
265 c = '\0';
266 else if(c == '\0') {
267 ret = KRB5_PARSE_MALFORMED;
268 krb5_set_error_message(context, ret,
269 N_("trailing \\ in principal name", ""));
270 goto exit;
272 }else if(enterprise && first_at) {
273 if (c == '@')
274 first_at = 0;
275 }else if((c == '/' && !enterprise) || c == '@'){
276 if(got_realm){
277 ret = KRB5_PARSE_MALFORMED;
278 krb5_set_error_message(context, ret,
279 N_("part after realm in principal name", ""));
280 goto exit;
281 }else{
282 comp[n] = malloc(q - start + 1);
283 if (comp[n] == NULL) {
284 ret = ENOMEM;
285 krb5_set_error_message(context, ret,
286 N_("malloc: out of memory", ""));
287 goto exit;
289 memcpy(comp[n], start, q - start);
290 comp[n][q - start] = 0;
291 n++;
293 if(c == '@')
294 got_realm = 1;
295 start = q;
296 continue;
298 if(got_realm && (c == '/' || c == '\0')) {
299 ret = KRB5_PARSE_MALFORMED;
300 krb5_set_error_message(context, ret,
301 N_("part after realm in principal name", ""));
302 goto exit;
304 *q++ = c;
306 if(got_realm){
307 if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
308 ret = KRB5_PARSE_MALFORMED;
309 krb5_set_error_message(context, ret,
310 N_("realm found in 'short' principal "
311 "expected to be without one", ""));
312 goto exit;
314 realm = malloc(q - start + 1);
315 if (realm == NULL) {
316 ret = ENOMEM;
317 krb5_set_error_message(context, ret,
318 N_("malloc: out of memory", ""));
319 goto exit;
321 memcpy(realm, start, q - start);
322 realm[q - start] = 0;
323 }else{
324 if (flags & KRB5_PRINCIPAL_PARSE_REQUIRE_REALM) {
325 ret = KRB5_PARSE_MALFORMED;
326 krb5_set_error_message(context, ret,
327 N_("realm NOT found in principal "
328 "expected to be with one", ""));
329 goto exit;
330 } else if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
331 realm = NULL;
332 } else {
333 ret = krb5_get_default_realm (context, &realm);
334 if (ret)
335 goto exit;
338 comp[n] = malloc(q - start + 1);
339 if (comp[n] == NULL) {
340 ret = ENOMEM;
341 krb5_set_error_message(context, ret,
342 N_("malloc: out of memory", ""));
343 goto exit;
345 memcpy(comp[n], start, q - start);
346 comp[n][q - start] = 0;
347 n++;
349 *principal = malloc(sizeof(**principal));
350 if (*principal == NULL) {
351 ret = ENOMEM;
352 krb5_set_error_message(context, ret,
353 N_("malloc: out of memory", ""));
354 goto exit;
356 if (enterprise)
357 (*principal)->name.name_type = KRB5_NT_ENTERPRISE_PRINCIPAL;
358 else
359 (*principal)->name.name_type = KRB5_NT_PRINCIPAL;
360 (*principal)->name.name_string.val = comp;
361 princ_num_comp(*principal) = n;
362 (*principal)->realm = realm;
363 free(s);
364 return 0;
365 exit:
366 while(n>0){
367 free(comp[--n]);
369 free(comp);
370 free(realm);
371 free(s);
372 return ret;
376 * Parse a name into a krb5_principal structure
378 * @param context Kerberos 5 context
379 * @param name name to parse into a Kerberos principal
380 * @param principal returned principal, free with krb5_free_principal().
382 * @return An krb5 error code, see krb5_get_error_message().
384 * @ingroup krb5_principal
387 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
388 krb5_parse_name(krb5_context context,
389 const char *name,
390 krb5_principal *principal)
392 return krb5_parse_name_flags(context, name, 0, principal);
395 static const char quotable_chars[] = " \n\t\b\\/@";
396 static const char replace_chars[] = " ntb\\/@";
397 static const char nq_chars[] = " \\/@";
399 #define add_char(BASE, INDEX, LEN, C) do { if((INDEX) < (LEN)) (BASE)[(INDEX)++] = (C); }while(0);
401 static size_t
402 quote_string(const char *s, char *out, size_t idx, size_t len, int display)
404 const char *p, *q;
405 for(p = s; *p && idx < len; p++){
406 q = strchr(quotable_chars, *p);
407 if (q && display) {
408 add_char(out, idx, len, replace_chars[q - quotable_chars]);
409 } else if (q) {
410 add_char(out, idx, len, '\\');
411 add_char(out, idx, len, replace_chars[q - quotable_chars]);
412 }else
413 add_char(out, idx, len, *p);
415 if(idx < len)
416 out[idx] = '\0';
417 return idx;
421 static krb5_error_code
422 unparse_name_fixed(krb5_context context,
423 krb5_const_principal principal,
424 char *name,
425 size_t len,
426 int flags)
428 size_t idx = 0;
429 int i;
430 int short_form = (flags & KRB5_PRINCIPAL_UNPARSE_SHORT) != 0;
431 int no_realm = (flags & KRB5_PRINCIPAL_UNPARSE_NO_REALM) != 0;
432 int display = (flags & KRB5_PRINCIPAL_UNPARSE_DISPLAY) != 0;
434 if (!no_realm && princ_realm(principal) == NULL) {
435 krb5_set_error_message(context, ERANGE,
436 N_("Realm missing from principal, "
437 "can't unparse", ""));
438 return ERANGE;
441 for(i = 0; i < princ_num_comp(principal); i++){
442 if(i)
443 add_char(name, idx, len, '/');
444 idx = quote_string(princ_ncomp(principal, i), name, idx, len, display);
445 if(idx == len) {
446 krb5_set_error_message(context, ERANGE,
447 N_("Out of space printing principal", ""));
448 return ERANGE;
451 /* add realm if different from default realm */
452 if(short_form && !no_realm) {
453 krb5_realm r;
454 krb5_error_code ret;
455 ret = krb5_get_default_realm(context, &r);
456 if(ret)
457 return ret;
458 if(strcmp(princ_realm(principal), r) != 0)
459 short_form = 0;
460 free(r);
462 if(!short_form && !no_realm) {
463 add_char(name, idx, len, '@');
464 idx = quote_string(princ_realm(principal), name, idx, len, display);
465 if(idx == len) {
466 krb5_set_error_message(context, ERANGE,
467 N_("Out of space printing "
468 "realm of principal", ""));
469 return ERANGE;
472 return 0;
476 * Unparse the principal name to a fixed buffer
478 * @param context A Kerberos context.
479 * @param principal principal to unparse
480 * @param name buffer to write name to
481 * @param len length of buffer
483 * @return An krb5 error code, see krb5_get_error_message().
485 * @ingroup krb5_principal
488 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
489 krb5_unparse_name_fixed(krb5_context context,
490 krb5_const_principal principal,
491 char *name,
492 size_t len)
494 return unparse_name_fixed(context, principal, name, len, 0);
498 * Unparse the principal name to a fixed buffer. The realm is skipped
499 * if its a default realm.
501 * @param context A Kerberos context.
502 * @param principal principal to unparse
503 * @param name buffer to write name to
504 * @param len length of buffer
506 * @return An krb5 error code, see krb5_get_error_message().
508 * @ingroup krb5_principal
511 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
512 krb5_unparse_name_fixed_short(krb5_context context,
513 krb5_const_principal principal,
514 char *name,
515 size_t len)
517 return unparse_name_fixed(context, principal, name, len,
518 KRB5_PRINCIPAL_UNPARSE_SHORT);
522 * Unparse the principal name with unparse flags to a fixed buffer.
524 * @param context A Kerberos context.
525 * @param principal principal to unparse
526 * @param flags unparse flags
527 * @param name buffer to write name to
528 * @param len length of buffer
530 * @return An krb5 error code, see krb5_get_error_message().
532 * @ingroup krb5_principal
535 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
536 krb5_unparse_name_fixed_flags(krb5_context context,
537 krb5_const_principal principal,
538 int flags,
539 char *name,
540 size_t len)
542 return unparse_name_fixed(context, principal, name, len, flags);
545 static krb5_error_code
546 unparse_name(krb5_context context,
547 krb5_const_principal principal,
548 char **name,
549 int flags)
551 size_t len = 0, plen;
552 int i;
553 krb5_error_code ret;
554 /* count length */
555 if (princ_realm(principal)) {
556 plen = strlen(princ_realm(principal));
558 if(strcspn(princ_realm(principal), quotable_chars) == plen)
559 len += plen;
560 else
561 len += 2*plen;
562 len++; /* '@' */
564 for(i = 0; i < princ_num_comp(principal); i++){
565 plen = strlen(princ_ncomp(principal, i));
566 if(strcspn(princ_ncomp(principal, i), quotable_chars) == plen)
567 len += plen;
568 else
569 len += 2*plen;
570 len++;
572 len++; /* '\0' */
573 *name = malloc(len);
574 if(*name == NULL) {
575 krb5_set_error_message(context, ENOMEM,
576 N_("malloc: out of memory", ""));
577 return ENOMEM;
579 ret = unparse_name_fixed(context, principal, *name, len, flags);
580 if(ret) {
581 free(*name);
582 *name = NULL;
584 return ret;
588 * Unparse the Kerberos name into a string
590 * @param context Kerberos 5 context
591 * @param principal principal to query
592 * @param name resulting string, free with krb5_xfree()
594 * @return An krb5 error code, see krb5_get_error_message().
596 * @ingroup krb5_principal
599 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
600 krb5_unparse_name(krb5_context context,
601 krb5_const_principal principal,
602 char **name)
604 return unparse_name(context, principal, name, 0);
608 * Unparse the Kerberos name into a string
610 * @param context Kerberos 5 context
611 * @param principal principal to query
612 * @param flags flag to determine the behavior
613 * @param name resulting string, free with krb5_xfree()
615 * @return An krb5 error code, see krb5_get_error_message().
617 * @ingroup krb5_principal
620 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
621 krb5_unparse_name_flags(krb5_context context,
622 krb5_const_principal principal,
623 int flags,
624 char **name)
626 return unparse_name(context, principal, name, flags);
630 * Unparse the principal name to a allocated buffer. The realm is
631 * skipped if its a default realm.
633 * @param context A Kerberos context.
634 * @param principal principal to unparse
635 * @param name returned buffer, free with krb5_xfree()
637 * @return An krb5 error code, see krb5_get_error_message().
639 * @ingroup krb5_principal
642 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
643 krb5_unparse_name_short(krb5_context context,
644 krb5_const_principal principal,
645 char **name)
647 return unparse_name(context, principal, name, KRB5_PRINCIPAL_UNPARSE_SHORT);
651 * Set a new realm for a principal, and as a side-effect free the
652 * previous realm.
654 * @param context A Kerberos context.
655 * @param principal principal set the realm for
656 * @param realm the new realm to set
658 * @return An krb5 error code, see krb5_get_error_message().
660 * @ingroup krb5_principal
663 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
664 krb5_principal_set_realm(krb5_context context,
665 krb5_principal principal,
666 krb5_const_realm realm)
668 if (princ_realm(principal))
669 free(princ_realm(principal));
671 princ_realm(principal) = strdup(realm);
672 if (princ_realm(principal) == NULL) {
673 krb5_set_error_message(context, ENOMEM,
674 N_("malloc: out of memory", ""));
675 return ENOMEM;
677 return 0;
680 #ifndef HEIMDAL_SMALLER
682 * Build a principal using vararg style building
684 * @param context A Kerberos context.
685 * @param principal returned principal
686 * @param rlen length of realm
687 * @param realm realm name
688 * @param ... a list of components ended with NULL.
690 * @return An krb5 error code, see krb5_get_error_message().
692 * @ingroup krb5_principal
695 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
696 krb5_build_principal(krb5_context context,
697 krb5_principal *principal,
698 int rlen,
699 krb5_const_realm realm,
700 ...)
702 krb5_error_code ret;
703 va_list ap;
704 va_start(ap, realm);
705 ret = krb5_build_principal_va(context, principal, rlen, realm, ap);
706 va_end(ap);
707 return ret;
709 #endif
712 * Build a principal using vararg style building
714 * @param context A Kerberos context.
715 * @param principal returned principal
716 * @param realm realm name
717 * @param ... a list of components ended with NULL.
719 * @return An krb5 error code, see krb5_get_error_message().
721 * @ingroup krb5_principal
724 krb5_error_code KRB5_LIB_FUNCTION
725 krb5_make_principal(krb5_context context,
726 krb5_principal *principal,
727 krb5_const_realm realm,
728 ...)
730 krb5_error_code ret;
731 krb5_realm r = NULL;
732 va_list ap;
733 if(realm == NULL) {
734 ret = krb5_get_default_realm(context, &r);
735 if(ret)
736 return ret;
737 realm = r;
739 va_start(ap, realm);
740 ret = krb5_build_principal_va(context, principal, strlen(realm), realm, ap);
741 va_end(ap);
742 if(r)
743 free(r);
744 return ret;
747 static krb5_error_code
748 append_component(krb5_context context, krb5_principal p,
749 const char *comp,
750 size_t comp_len)
752 heim_general_string *tmp;
753 size_t len = princ_num_comp(p);
755 tmp = realloc(princ_comp(p), (len + 1) * sizeof(*tmp));
756 if(tmp == NULL) {
757 krb5_set_error_message(context, ENOMEM,
758 N_("malloc: out of memory", ""));
759 return ENOMEM;
761 princ_comp(p) = tmp;
762 princ_ncomp(p, len) = malloc(comp_len + 1);
763 if (princ_ncomp(p, len) == NULL) {
764 krb5_set_error_message(context, ENOMEM,
765 N_("malloc: out of memory", ""));
766 return ENOMEM;
768 memcpy (princ_ncomp(p, len), comp, comp_len);
769 princ_ncomp(p, len)[comp_len] = '\0';
770 princ_num_comp(p)++;
771 return 0;
774 static void
775 va_ext_princ(krb5_context context, krb5_principal p, va_list ap)
777 while(1){
778 const char *s;
779 int len;
780 len = va_arg(ap, int);
781 if(len == 0)
782 break;
783 s = va_arg(ap, const char*);
784 append_component(context, p, s, len);
788 static void
789 va_princ(krb5_context context, krb5_principal p, va_list ap)
791 while(1){
792 const char *s;
793 s = va_arg(ap, const char*);
794 if(s == NULL)
795 break;
796 append_component(context, p, s, strlen(s));
800 static krb5_error_code
801 build_principal(krb5_context context,
802 krb5_principal *principal,
803 int rlen,
804 krb5_const_realm realm,
805 void (*func)(krb5_context, krb5_principal, va_list),
806 va_list ap)
808 krb5_principal p;
810 p = calloc(1, sizeof(*p));
811 if (p == NULL) {
812 krb5_set_error_message(context, ENOMEM,
813 N_("malloc: out of memory", ""));
814 return ENOMEM;
816 princ_type(p) = KRB5_NT_PRINCIPAL;
818 princ_realm(p) = strdup(realm);
819 if(p->realm == NULL){
820 free(p);
821 krb5_set_error_message(context, ENOMEM,
822 N_("malloc: out of memory", ""));
823 return ENOMEM;
826 (*func)(context, p, ap);
827 *principal = p;
828 return 0;
831 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
832 krb5_build_principal_va(krb5_context context,
833 krb5_principal *principal,
834 int rlen,
835 krb5_const_realm realm,
836 va_list ap)
838 return build_principal(context, principal, rlen, realm, va_princ, ap);
841 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
842 krb5_build_principal_va_ext(krb5_context context,
843 krb5_principal *principal,
844 int rlen,
845 krb5_const_realm realm,
846 va_list ap)
848 return build_principal(context, principal, rlen, realm, va_ext_princ, ap);
852 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
853 krb5_build_principal_ext(krb5_context context,
854 krb5_principal *principal,
855 int rlen,
856 krb5_const_realm realm,
857 ...)
859 krb5_error_code ret;
860 va_list ap;
861 va_start(ap, realm);
862 ret = krb5_build_principal_va_ext(context, principal, rlen, realm, ap);
863 va_end(ap);
864 return ret;
868 * Copy a principal
870 * @param context A Kerberos context.
871 * @param inprinc principal to copy
872 * @param outprinc copied principal, free with krb5_free_principal()
874 * @return An krb5 error code, see krb5_get_error_message().
876 * @ingroup krb5_principal
880 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
881 krb5_copy_principal(krb5_context context,
882 krb5_const_principal inprinc,
883 krb5_principal *outprinc)
885 krb5_principal p = malloc(sizeof(*p));
886 if (p == NULL) {
887 krb5_set_error_message(context, ENOMEM,
888 N_("malloc: out of memory", ""));
889 return ENOMEM;
891 if(copy_Principal(inprinc, p)) {
892 free(p);
893 krb5_set_error_message(context, ENOMEM,
894 N_("malloc: out of memory", ""));
895 return ENOMEM;
897 *outprinc = p;
898 return 0;
902 * Return TRUE iff princ1 == princ2 (without considering the realm)
904 * @param context Kerberos 5 context
905 * @param princ1 first principal to compare
906 * @param princ2 second principal to compare
908 * @return non zero if equal, 0 if not
910 * @ingroup krb5_principal
911 * @see krb5_principal_compare()
912 * @see krb5_realm_compare()
915 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
916 krb5_principal_compare_any_realm(krb5_context context,
917 krb5_const_principal princ1,
918 krb5_const_principal princ2)
920 int i;
921 if(princ_num_comp(princ1) != princ_num_comp(princ2))
922 return FALSE;
923 for(i = 0; i < princ_num_comp(princ1); i++){
924 if(strcmp(princ_ncomp(princ1, i), princ_ncomp(princ2, i)) != 0)
925 return FALSE;
927 return TRUE;
930 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
931 _krb5_principal_compare_PrincipalName(krb5_context context,
932 krb5_const_principal princ1,
933 PrincipalName *princ2)
935 int i;
936 if (princ_num_comp(princ1) != princ2->name_string.len)
937 return FALSE;
938 for(i = 0; i < princ_num_comp(princ1); i++){
939 if(strcmp(princ_ncomp(princ1, i), princ2->name_string.val[i]) != 0)
940 return FALSE;
942 return TRUE;
947 * Compares the two principals, including realm of the principals and returns
948 * TRUE if they are the same and FALSE if not.
950 * @param context Kerberos 5 context
951 * @param princ1 first principal to compare
952 * @param princ2 second principal to compare
954 * @ingroup krb5_principal
955 * @see krb5_principal_compare_any_realm()
956 * @see krb5_realm_compare()
960 * return TRUE iff princ1 == princ2
963 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
964 krb5_principal_compare(krb5_context context,
965 krb5_const_principal princ1,
966 krb5_const_principal princ2)
968 if(!krb5_realm_compare(context, princ1, princ2))
969 return FALSE;
970 return krb5_principal_compare_any_realm(context, princ1, princ2);
974 * return TRUE iff realm(princ1) == realm(princ2)
976 * @param context Kerberos 5 context
977 * @param princ1 first principal to compare
978 * @param princ2 second principal to compare
980 * @ingroup krb5_principal
981 * @see krb5_principal_compare_any_realm()
982 * @see krb5_principal_compare()
985 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
986 krb5_realm_compare(krb5_context context,
987 krb5_const_principal princ1,
988 krb5_const_principal princ2)
990 return strcmp(princ_realm(princ1), princ_realm(princ2)) == 0;
994 * return TRUE iff princ matches pattern
996 * @ingroup krb5_principal
999 KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL
1000 krb5_principal_match(krb5_context context,
1001 krb5_const_principal princ,
1002 krb5_const_principal pattern)
1004 int i;
1005 if(princ_num_comp(princ) != princ_num_comp(pattern))
1006 return FALSE;
1007 if(fnmatch(princ_realm(pattern), princ_realm(princ), 0) != 0)
1008 return FALSE;
1009 for(i = 0; i < princ_num_comp(princ); i++){
1010 if(fnmatch(princ_ncomp(pattern, i), princ_ncomp(princ, i), 0) != 0)
1011 return FALSE;
1013 return TRUE;
1016 #if defined(KRB4) || !defined(HEIMDAL_SMALLER)
1018 static struct v4_name_convert {
1019 const char *from;
1020 const char *to;
1021 } default_v4_name_convert[] = {
1022 { "ftp", "ftp" },
1023 { "hprop", "hprop" },
1024 { "pop", "pop" },
1025 { "imap", "imap" },
1026 { "rcmd", "host" },
1027 { "smtp", "smtp" },
1028 { NULL, NULL }
1031 #endif
1033 #ifdef KRB4
1036 * return the converted instance name of `name' in `realm'.
1037 * look in the configuration file and then in the default set above.
1038 * return NULL if no conversion is appropriate.
1041 static const char*
1042 get_name_conversion(krb5_context context, const char *realm, const char *name)
1044 struct v4_name_convert *q;
1045 const char *p;
1047 p = krb5_config_get_string(context, NULL, "realms", realm,
1048 "v4_name_convert", "host", name, NULL);
1049 if(p == NULL)
1050 p = krb5_config_get_string(context, NULL, "libdefaults",
1051 "v4_name_convert", "host", name, NULL);
1052 if(p)
1053 return p;
1055 /* XXX should be possible to override default list */
1056 p = krb5_config_get_string(context, NULL,
1057 "realms",
1058 realm,
1059 "v4_name_convert",
1060 "plain",
1061 name,
1062 NULL);
1063 if(p)
1064 return NULL;
1065 p = krb5_config_get_string(context, NULL,
1066 "libdefaults",
1067 "v4_name_convert",
1068 "plain",
1069 name,
1070 NULL);
1071 if(p)
1072 return NULL;
1073 for(q = default_v4_name_convert; q->from; q++)
1074 if(strcmp(q->from, name) == 0)
1075 return q->to;
1076 return NULL;
1080 * convert the v4 principal `name.instance@realm' to a v5 principal in `princ'.
1081 * if `resolve', use DNS.
1082 * if `func', use that function for validating the conversion
1085 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1086 krb5_425_conv_principal_ext2(krb5_context context,
1087 const char *name,
1088 const char *instance,
1089 const char *realm,
1090 krb5_boolean (*func)(krb5_context,
1091 void *, krb5_principal),
1092 void *funcctx,
1093 krb5_boolean resolve,
1094 krb5_principal *princ)
1096 const char *p;
1097 krb5_error_code ret;
1098 krb5_principal pr;
1099 char host[MAXHOSTNAMELEN];
1100 char local_hostname[MAXHOSTNAMELEN];
1102 /* do the following: if the name is found in the
1103 `v4_name_convert:host' part, is assumed to be a `host' type
1104 principal, and the instance is looked up in the
1105 `v4_instance_convert' part. if not found there the name is
1106 (optionally) looked up as a hostname, and if that doesn't yield
1107 anything, the `default_domain' is appended to the instance
1110 if(instance == NULL)
1111 goto no_host;
1112 if(instance[0] == 0){
1113 instance = NULL;
1114 goto no_host;
1116 p = get_name_conversion(context, realm, name);
1117 if(p == NULL)
1118 goto no_host;
1119 name = p;
1120 p = krb5_config_get_string(context, NULL, "realms", realm,
1121 "v4_instance_convert", instance, NULL);
1122 if(p){
1123 instance = p;
1124 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
1125 if (ret)
1126 return ret;
1127 if(func == NULL || (*func)(context, funcctx, pr)){
1128 *princ = pr;
1129 return 0;
1131 krb5_free_principal(context, pr);
1132 *princ = NULL;
1133 krb5_clear_error_message (context);
1134 return HEIM_ERR_V4_PRINC_NO_CONV;
1136 if(resolve){
1137 krb5_boolean passed = FALSE;
1138 char *inst = NULL;
1139 #ifdef USE_RESOLVER
1140 struct rk_dns_reply *r;
1142 r = rk_dns_lookup(instance, "aaaa");
1143 if (r) {
1144 if (r->head && r->head->type == rk_ns_t_aaaa) {
1145 inst = strdup(r->head->domain);
1146 passed = TRUE;
1148 rk_dns_free_data(r);
1149 } else {
1150 r = rk_dns_lookup(instance, "a");
1151 if (r) {
1152 if(r->head && r->head->type == rk_ns_t_a) {
1153 inst = strdup(r->head->domain);
1154 passed = TRUE;
1156 rk_dns_free_data(r);
1159 #else
1160 struct addrinfo hints, *ai;
1162 memset (&hints, 0, sizeof(hints));
1163 hints.ai_flags = AI_CANONNAME;
1164 ret = getaddrinfo(instance, NULL, &hints, &ai);
1165 if (ret == 0) {
1166 const struct addrinfo *a;
1167 for (a = ai; a != NULL; a = a->ai_next) {
1168 if (a->ai_canonname != NULL) {
1169 inst = strdup (a->ai_canonname);
1170 passed = TRUE;
1171 break;
1174 freeaddrinfo (ai);
1176 #endif
1177 if (passed) {
1178 if (inst == NULL) {
1179 krb5_set_error_message(context, ENOMEM,
1180 N_("malloc: out of memory", ""));
1181 return ENOMEM;
1183 strlwr(inst);
1184 ret = krb5_make_principal(context, &pr, realm, name, inst,
1185 NULL);
1186 free (inst);
1187 if(ret == 0) {
1188 if(func == NULL || (*func)(context, funcctx, pr)){
1189 *princ = pr;
1190 return 0;
1192 krb5_free_principal(context, pr);
1196 if(func != NULL) {
1197 snprintf(host, sizeof(host), "%s.%s", instance, realm);
1198 strlwr(host);
1199 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1200 if (ret)
1201 return ret;
1202 if((*func)(context, funcctx, pr)){
1203 *princ = pr;
1204 return 0;
1206 krb5_free_principal(context, pr);
1210 * if the instance is the first component of the local hostname,
1211 * the converted host should be the long hostname.
1214 if (func == NULL &&
1215 gethostname (local_hostname, sizeof(local_hostname)) == 0 &&
1216 strncmp(instance, local_hostname, strlen(instance)) == 0 &&
1217 local_hostname[strlen(instance)] == '.') {
1218 strlcpy(host, local_hostname, sizeof(host));
1219 goto local_host;
1223 char **domains, **d;
1224 domains = krb5_config_get_strings(context, NULL, "realms", realm,
1225 "v4_domains", NULL);
1226 for(d = domains; d && *d; d++){
1227 snprintf(host, sizeof(host), "%s.%s", instance, *d);
1228 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1229 if (ret) {
1230 krb5_config_free_strings(domains);
1231 return ret;
1233 if(func == NULL || (*func)(context, funcctx, pr)){
1234 *princ = pr;
1235 krb5_config_free_strings(domains);
1236 return 0;
1238 krb5_free_principal(context, pr);
1240 krb5_config_free_strings(domains);
1244 p = krb5_config_get_string(context, NULL, "realms", realm,
1245 "default_domain", NULL);
1246 if(p == NULL){
1247 /* this should be an error, just faking a name is not good */
1248 krb5_clear_error_message (context);
1249 return HEIM_ERR_V4_PRINC_NO_CONV;
1252 if (*p == '.')
1253 ++p;
1254 snprintf(host, sizeof(host), "%s.%s", instance, p);
1255 local_host:
1256 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1257 if (ret)
1258 return ret;
1259 if(func == NULL || (*func)(context, funcctx, pr)){
1260 *princ = pr;
1261 return 0;
1263 krb5_free_principal(context, pr);
1264 krb5_clear_error_message (context);
1265 return HEIM_ERR_V4_PRINC_NO_CONV;
1266 no_host:
1267 p = krb5_config_get_string(context, NULL,
1268 "realms",
1269 realm,
1270 "v4_name_convert",
1271 "plain",
1272 name,
1273 NULL);
1274 if(p == NULL)
1275 p = krb5_config_get_string(context, NULL,
1276 "libdefaults",
1277 "v4_name_convert",
1278 "plain",
1279 name,
1280 NULL);
1281 if(p)
1282 name = p;
1284 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
1285 if (ret)
1286 return ret;
1287 if(func == NULL || (*func)(context, funcctx, pr)){
1288 *princ = pr;
1289 return 0;
1291 krb5_free_principal(context, pr);
1292 krb5_clear_error_message (context);
1293 return HEIM_ERR_V4_PRINC_NO_CONV;
1296 #endif /* KRB4 */
1298 #ifndef HEIMDAL_SMALLER
1300 static int
1301 check_list(const krb5_config_binding *l, const char *name, const char **out)
1303 while(l){
1304 if (l->type != krb5_config_string)
1305 continue;
1306 if(strcmp(name, l->u.string) == 0) {
1307 *out = l->name;
1308 return 1;
1310 l = l->next;
1312 return 0;
1315 static int
1316 name_convert(krb5_context context, const char *name, const char *realm,
1317 const char **out)
1319 const krb5_config_binding *l;
1320 l = krb5_config_get_list (context,
1321 NULL,
1322 "realms",
1323 realm,
1324 "v4_name_convert",
1325 "host",
1326 NULL);
1327 if(l && check_list(l, name, out))
1328 return KRB5_NT_SRV_HST;
1329 l = krb5_config_get_list (context,
1330 NULL,
1331 "libdefaults",
1332 "v4_name_convert",
1333 "host",
1334 NULL);
1335 if(l && check_list(l, name, out))
1336 return KRB5_NT_SRV_HST;
1337 l = krb5_config_get_list (context,
1338 NULL,
1339 "realms",
1340 realm,
1341 "v4_name_convert",
1342 "plain",
1343 NULL);
1344 if(l && check_list(l, name, out))
1345 return KRB5_NT_UNKNOWN;
1346 l = krb5_config_get_list (context,
1347 NULL,
1348 "libdefaults",
1349 "v4_name_convert",
1350 "host",
1351 NULL);
1352 if(l && check_list(l, name, out))
1353 return KRB5_NT_UNKNOWN;
1355 /* didn't find it in config file, try built-in list */
1356 #ifdef KRB4
1358 struct v4_name_convert *q;
1359 for(q = default_v4_name_convert; q->from; q++) {
1360 if(strcmp(name, q->to) == 0) {
1361 *out = q->from;
1362 return KRB5_NT_SRV_HST;
1366 #endif
1367 return -1;
1371 * convert the v5 principal in `principal' into a v4 corresponding one
1372 * in `name, instance, realm'
1373 * this is limited interface since there's no length given for these
1374 * three parameters. They have to be 40 bytes each (ANAME_SZ).
1377 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1378 krb5_524_conv_principal(krb5_context context,
1379 const krb5_principal principal,
1380 char *name,
1381 char *instance,
1382 char *realm)
1384 const char *n, *i, *r;
1385 char tmpinst[40];
1386 int type = princ_type(principal);
1387 const int aname_sz = 40;
1389 r = principal->realm;
1391 switch(principal->name.name_string.len){
1392 case 1:
1393 n = principal->name.name_string.val[0];
1394 i = "";
1395 break;
1396 case 2:
1397 n = principal->name.name_string.val[0];
1398 i = principal->name.name_string.val[1];
1399 break;
1400 default:
1401 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1402 N_("cannot convert a %d "
1403 "component principal", ""),
1404 principal->name.name_string.len);
1405 return KRB5_PARSE_MALFORMED;
1409 const char *tmp;
1410 int t = name_convert(context, n, r, &tmp);
1411 if(t >= 0) {
1412 type = t;
1413 n = tmp;
1417 if(type == KRB5_NT_SRV_HST){
1418 char *p;
1420 strlcpy (tmpinst, i, sizeof(tmpinst));
1421 p = strchr(tmpinst, '.');
1422 if(p)
1423 *p = 0;
1424 i = tmpinst;
1427 if (strlcpy (name, n, aname_sz) >= aname_sz) {
1428 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1429 N_("too long name component to convert", ""));
1430 return KRB5_PARSE_MALFORMED;
1432 if (strlcpy (instance, i, aname_sz) >= aname_sz) {
1433 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1434 N_("too long instance component to convert", ""));
1435 return KRB5_PARSE_MALFORMED;
1437 if (strlcpy (realm, r, aname_sz) >= aname_sz) {
1438 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1439 N_("too long realm component to convert", ""));
1440 return KRB5_PARSE_MALFORMED;
1442 return 0;
1445 #endif /* !HEIMDAL_SMALLER */
1448 * Create a principal for the service running on hostname. If
1449 * KRB5_NT_SRV_HST is used, the hostname is canonization using DNS (or
1450 * some other service), this is potentially insecure.
1452 * @param context A Kerberos context.
1453 * @param hostname hostname to use
1454 * @param sname Service name to use
1455 * @param type name type of pricipal, use KRB5_NT_SRV_HST or KRB5_NT_UNKNOWN.
1456 * @param ret_princ return principal, free with krb5_free_principal().
1458 * @return An krb5 error code, see krb5_get_error_message().
1460 * @ingroup krb5_principal
1463 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1464 krb5_sname_to_principal (krb5_context context,
1465 const char *hostname,
1466 const char *sname,
1467 int32_t type,
1468 krb5_principal *ret_princ)
1470 krb5_error_code ret;
1471 char localhost[MAXHOSTNAMELEN];
1472 char **realms, *host = NULL;
1474 if(type != KRB5_NT_SRV_HST && type != KRB5_NT_UNKNOWN) {
1475 krb5_set_error_message(context, KRB5_SNAME_UNSUPP_NAMETYPE,
1476 N_("unsupported name type %d", ""),
1477 (int)type);
1478 return KRB5_SNAME_UNSUPP_NAMETYPE;
1480 if(hostname == NULL) {
1481 ret = gethostname(localhost, sizeof(localhost) - 1);
1482 if (ret != 0) {
1483 ret = errno;
1484 krb5_set_error_message(context, ret,
1485 N_("Failed to get local hostname", ""));
1486 return ret;
1488 localhost[sizeof(localhost) - 1] = '\0';
1489 hostname = localhost;
1491 if(sname == NULL)
1492 sname = "host";
1493 if(type == KRB5_NT_SRV_HST) {
1494 ret = krb5_expand_hostname_realms (context, hostname,
1495 &host, &realms);
1496 if (ret)
1497 return ret;
1498 strlwr(host);
1499 hostname = host;
1500 } else {
1501 ret = krb5_get_host_realm(context, hostname, &realms);
1502 if(ret)
1503 return ret;
1506 ret = krb5_make_principal(context, ret_princ, realms[0], sname,
1507 hostname, NULL);
1508 if(host)
1509 free(host);
1510 krb5_free_host_realm(context, realms);
1511 return ret;
1514 static const struct {
1515 const char *type;
1516 int32_t value;
1517 } nametypes[] = {
1518 { "UNKNOWN", KRB5_NT_UNKNOWN },
1519 { "PRINCIPAL", KRB5_NT_PRINCIPAL },
1520 { "SRV_INST", KRB5_NT_SRV_INST },
1521 { "SRV_HST", KRB5_NT_SRV_HST },
1522 { "SRV_XHST", KRB5_NT_SRV_XHST },
1523 { "UID", KRB5_NT_UID },
1524 { "X500_PRINCIPAL", KRB5_NT_X500_PRINCIPAL },
1525 { "SMTP_NAME", KRB5_NT_SMTP_NAME },
1526 { "ENTERPRISE_PRINCIPAL", KRB5_NT_ENTERPRISE_PRINCIPAL },
1527 { "ENT_PRINCIPAL_AND_ID", KRB5_NT_ENT_PRINCIPAL_AND_ID },
1528 { "MS_PRINCIPAL", KRB5_NT_MS_PRINCIPAL },
1529 { "MS_PRINCIPAL_AND_ID", KRB5_NT_MS_PRINCIPAL_AND_ID },
1530 { NULL }
1534 * Parse nametype string and return a nametype integer
1536 * @ingroup krb5_principal
1539 krb5_error_code
1540 krb5_parse_nametype(krb5_context context, const char *str, int32_t *nametype)
1542 size_t i;
1544 for(i = 0; nametypes[i].type; i++) {
1545 if (strcasecmp(nametypes[i].type, str) == 0) {
1546 *nametype = nametypes[i].value;
1547 return 0;
1550 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1551 N_("Failed to find name type %s", ""), str);
1552 return KRB5_PARSE_MALFORMED;
1556 * Check if the cname part of the principal is a krbtgt principal
1558 * @ingroup krb5_principal
1561 krb5_boolean
1562 krb5_principal_is_krbtgt(krb5_context context, krb5_const_principal p)
1564 return p->name.name_string.len == 2 &&
1565 strcmp(p->name.name_string.val[0], KRB5_TGS_NAME) == 0;