2 * Copyright (c) 2001 - 2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
38 #include "locate_plugin.h"
41 string_to_proto(const char *string
)
43 if(strcasecmp(string
, "udp") == 0)
44 return KRB5_KRBHST_UDP
;
45 else if(strcasecmp(string
, "tcp") == 0)
46 return KRB5_KRBHST_TCP
;
47 else if(strcasecmp(string
, "http") == 0)
48 return KRB5_KRBHST_HTTP
;
53 is_invalid_tld_srv_target(const char *target
)
55 return (strncmp("your-dns-needs-immediate-attention.",
57 && strchr(&target
[35], '.') == NULL
);
61 * set `res' and `count' to the result of looking up SRV RR in DNS for
62 * `proto', `proto', `realm' using `dns_type'.
63 * if `port' != 0, force that port number
66 static krb5_error_code
67 srv_find_realm(krb5_context context
, krb5_krbhst_info
***res
, int *count
,
68 const char *realm
, const char *dns_type
, const char *sitename
,
69 const char *proto
, const char *service
, int port
)
72 struct rk_dns_reply
*r
;
73 struct rk_resource_record
*rr
;
81 proto_num
= string_to_proto(proto
);
83 krb5_set_error_message(context
, EINVAL
,
84 N_("unknown protocol `%s' to lookup", ""),
89 if(proto_num
== KRB5_KRBHST_HTTP
)
90 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
92 def_port
= ntohs(krb5_getportbyname (context
, service
, proto
, 88));
97 snprintf(domain
, sizeof(domain
), "_%s._%s.%s._sites.%s.",
98 service
, proto
, sitename
, realm
);
100 snprintf(domain
, sizeof(domain
), "_%s._%s.%s.", service
, proto
, realm
);
102 r
= rk_dns_lookup(domain
, dns_type
);
104 _krb5_debug(context
, 0,
105 "DNS lookup failed domain: %s", domain
);
106 return KRB5_KDC_UNREACH
;
109 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
110 if(rr
->type
== rk_ns_t_srv
)
114 _krb5_debug(context
, 0,
115 "DNS SRV RR lookup domain nodata: %s", domain
);
117 return KRB5_KDC_UNREACH
;
120 *res
= malloc(num_srv
* sizeof(**res
));
123 return krb5_enomem(context
);
128 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
129 if(rr
->type
== rk_ns_t_srv
) {
130 krb5_krbhst_info
*hi
= NULL
;
134 /* Test for top-level domain controlled interruptions */
135 if (!is_invalid_tld_srv_target(rr
->u
.srv
->target
)) {
137 len
= strlen(rr
->u
.srv
->target
);
138 hi
= calloc(1, sizeof(*hi
) + len
);
142 while(--num_srv
>= 0)
143 free((*res
)[num_srv
]);
148 "Domain lookup failed: "
149 "Realm %s needs immediate attention "
150 "see https://icann.org/namecollision",
152 return KRB5_KDC_UNREACH
;
154 return krb5_enomem(context
);
156 (*res
)[num_srv
++] = hi
;
158 hi
->proto
= proto_num
;
160 hi
->def_port
= def_port
;
164 hi
->port
= rr
->u
.srv
->port
;
166 strlcpy(hi
->hostname
, rr
->u
.srv
->target
, len
+ 1);
176 struct krb5_krbhst_data
{
177 const char *config_param
;
178 const char *srv_label
;
182 int port
; /* hardwired port number if != 0 */
183 #define KD_CONFIG 0x0001
184 #define KD_SRV_UDP 0x0002
185 #define KD_SRV_TCP 0x0004
186 #define KD_SITE_SRV_UDP 0x0008
187 #define KD_SITE_SRV_TCP 0x0010
188 #define KD_SRV_HTTP 0x0020
189 #define KD_SRV_KKDCP 0x0040
190 #define KD_FALLBACK 0x0080
191 #define KD_CONFIG_EXISTS 0x0100
192 #define KD_LARGE_MSG 0x0200
193 #define KD_PLUGIN 0x0400
194 #define KD_HOSTNAMES 0x0800
195 krb5_error_code (*get_next
)(krb5_context
, struct krb5_krbhst_data
*,
200 unsigned int fallback_count
;
202 struct krb5_krbhst_info
*hosts
, **index
, **end
;
206 krbhst_empty(const struct krb5_krbhst_data
*kd
)
208 return kd
->index
== &kd
->hosts
;
212 * Return the default protocol for the `kd' (either TCP or UDP)
216 krbhst_get_default_proto(struct krb5_krbhst_data
*kd
)
218 if (kd
->flags
& KD_LARGE_MSG
)
219 return KRB5_KRBHST_TCP
;
220 return KRB5_KRBHST_UDP
;
224 krbhst_get_default_port(struct krb5_krbhst_data
*kd
)
233 KRB5_LIB_FUNCTION
const char * KRB5_LIB_CALL
234 _krb5_krbhst_get_realm(krb5_krbhst_handle handle
)
236 return handle
->realm
;
240 * parse `spec' into a krb5_krbhst_info, defaulting the port to `def_port'
241 * and forcing it to `port' if port != 0
244 static struct krb5_krbhst_info
*
245 parse_hostspec(krb5_context context
, struct krb5_krbhst_data
*kd
,
246 const char *spec
, int def_port
, int port
)
248 const char *p
= spec
, *q
;
249 struct krb5_krbhst_info
*hi
;
251 hi
= calloc(1, sizeof(*hi
) + strlen(spec
));
255 hi
->proto
= krbhst_get_default_proto(kd
);
257 if(strncmp(p
, "http://", 7) == 0){
258 hi
->proto
= KRB5_KRBHST_HTTP
;
260 } else if(strncmp(p
, "http/", 5) == 0) {
261 hi
->proto
= KRB5_KRBHST_HTTP
;
263 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
264 }else if(strncmp(p
, "tcp/", 4) == 0){
265 hi
->proto
= KRB5_KRBHST_TCP
;
267 } else if(strncmp(p
, "udp/", 4) == 0) {
268 hi
->proto
= KRB5_KRBHST_UDP
;
272 if (p
[0] == '[' && (q
= strchr(p
, ']')) != NULL
) {
273 /* if address looks like [foo:bar] or [foo:bar]: its a ipv6
274 adress, strip of [] */
275 memcpy(hi
->hostname
, &p
[1], q
- p
- 1);
276 hi
->hostname
[q
- p
- 1] = '\0';
281 } else if(strsep_copy(&p
, ":", hi
->hostname
, strlen(spec
) + 1) < 0) {
282 /* copy everything before : */
286 /* get rid of trailing /, and convert to lower case */
287 hi
->hostname
[strcspn(hi
->hostname
, "/")] = '\0';
288 strlwr(hi
->hostname
);
290 hi
->port
= hi
->def_port
= def_port
;
291 if(p
!= NULL
&& p
[0]) {
293 hi
->port
= strtol(p
, &end
, 0);
304 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
305 _krb5_free_krbhst_info(krb5_krbhst_info
*hi
)
308 freeaddrinfo(hi
->ai
);
312 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
313 _krb5_krbhost_info_move(krb5_context context
,
314 krb5_krbhst_info
*from
,
315 krb5_krbhst_info
**to
)
317 size_t hostnamelen
= strlen(from
->hostname
);
318 /* trailing NUL is included in structure */
319 *to
= calloc(1, sizeof(**to
) + hostnamelen
);
321 return krb5_enomem(context
);
323 (*to
)->proto
= from
->proto
;
324 (*to
)->port
= from
->port
;
325 (*to
)->def_port
= from
->def_port
;
326 (*to
)->ai
= from
->ai
;
329 memcpy((*to
)->hostname
, from
->hostname
, hostnamelen
+ 1);
335 append_host_hostinfo(struct krb5_krbhst_data
*kd
, struct krb5_krbhst_info
*host
)
337 struct krb5_krbhst_info
*h
;
339 for(h
= kd
->hosts
; h
; h
= h
->next
)
340 if(h
->proto
== host
->proto
&&
341 h
->port
== host
->port
&&
342 strcmp(h
->hostname
, host
->hostname
) == 0) {
343 _krb5_free_krbhst_info(host
);
347 kd
->end
= &host
->next
;
350 static krb5_error_code
351 append_host_string(krb5_context context
, struct krb5_krbhst_data
*kd
,
352 const char *host
, int def_port
, int port
)
354 struct krb5_krbhst_info
*hi
;
356 hi
= parse_hostspec(context
, kd
, host
, def_port
, port
);
358 return krb5_enomem(context
);
360 append_host_hostinfo(kd
, hi
);
365 * return a readable representation of `host' in `hostname, hostlen'
368 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
369 krb5_krbhst_format_string(krb5_context context
, const krb5_krbhst_info
*host
,
370 char *hostname
, size_t hostlen
)
372 const char *proto
= "";
373 if(host
->proto
== KRB5_KRBHST_TCP
)
375 else if(host
->proto
== KRB5_KRBHST_HTTP
)
377 if (host
->port
!= host
->def_port
)
378 snprintf(hostname
, hostlen
, "%s%s:%d", proto
, host
->hostname
, (int)host
->port
);
380 snprintf(hostname
, hostlen
, "%s%s", proto
, host
->hostname
);
385 * create a getaddrinfo `hints' based on `proto'
389 make_hints(struct addrinfo
*hints
, int proto
)
391 memset(hints
, 0, sizeof(*hints
));
392 hints
->ai_family
= AF_UNSPEC
;
394 case KRB5_KRBHST_UDP
:
395 hints
->ai_socktype
= SOCK_DGRAM
;
397 case KRB5_KRBHST_HTTP
:
398 case KRB5_KRBHST_TCP
:
399 hints
->ai_socktype
= SOCK_STREAM
;
405 * Return an `struct addrinfo *' for a KDC host.
407 * Returns an the struct addrinfo in in that corresponds to the
408 * information in `host'. free:ing is handled by krb5_krbhst_free, so
409 * the returned ai must not be released.
414 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
415 krb5_krbhst_get_addrinfo(krb5_context context
, krb5_krbhst_info
*host
,
416 struct addrinfo
**ai
)
420 if (host
->ai
== NULL
) {
421 struct addrinfo hints
;
422 char portstr
[NI_MAXSERV
];
424 snprintf (portstr
, sizeof(portstr
), "%d", host
->port
);
425 make_hints(&hints
, host
->proto
);
427 ret
= getaddrinfo(host
->hostname
, portstr
, &hints
, &host
->ai
);
429 ret
= krb5_eai_to_heim_errno(ret
, errno
);
439 get_next(struct krb5_krbhst_data
*kd
, krb5_krbhst_info
**host
)
441 struct krb5_krbhst_info
*hi
= kd
? *kd
->index
: NULL
;
444 kd
->index
= &(*kd
->index
)->next
;
451 srv_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
452 const char *sitename
, const char *proto
, const char *service
)
455 krb5_krbhst_info
**res
;
458 if (krb5_realm_is_lkdc(kd
->realm
))
461 ret
= srv_find_realm(context
, &res
, &count
, kd
->realm
, "SRV",
462 sitename
, proto
, service
, kd
->port
);
463 _krb5_debug(context
, 2, "searching DNS for realm %s %s.%s -> %d",
464 kd
->realm
, proto
, service
, ret
);
467 for(i
= 0; i
< count
; i
++)
468 append_host_hostinfo(kd
, res
[i
]);
473 * read the configuration for `conf_string', defaulting to kd->def_port and
474 * forcing it to `kd->port' if kd->port != 0
478 config_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
479 const char *conf_string
)
483 hostlist
= krb5_config_get_strings(context
, NULL
,
484 "realms", kd
->realm
, conf_string
, NULL
);
486 _krb5_debug(context
, 2, "configuration file for realm %s%s found",
487 kd
->realm
, hostlist
? "" : " not");
491 kd
->flags
|= KD_CONFIG_EXISTS
;
492 for(i
= 0; hostlist
&& hostlist
[i
] != NULL
; i
++)
493 append_host_string(context
, kd
, hostlist
[i
], kd
->def_port
, kd
->port
);
495 krb5_config_free_strings(hostlist
);
499 * as a fallback, look for `serv_string.kd->realm' (typically
500 * kerberos.REALM, kerberos-1.REALM, ...
501 * `port' is the default port for the service, and `proto' the
505 static krb5_error_code
506 fallback_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
507 const char *serv_string
, int port
, int proto
)
512 struct addrinfo hints
;
513 char portstr
[NI_MAXSERV
];
515 ret
= krb5_config_get_bool_default(context
, NULL
, KRB5_FALLBACK_DEFAULT
,
516 "libdefaults", "use_fallback", NULL
);
518 kd
->flags
|= KD_FALLBACK
;
522 _krb5_debug(context
, 2, "fallback lookup %d for realm %s (service %s)",
523 kd
->fallback_count
, kd
->realm
, serv_string
);
526 * Don't try forever in case the DNS server keep returning us
527 * entries (like wildcard entries or the .nu TLD)
529 * Also don't try LKDC realms since fallback wont work on them at all.
531 if(kd
->fallback_count
>= 5 || krb5_realm_is_lkdc(kd
->realm
)) {
532 kd
->flags
|= KD_FALLBACK
;
536 if(kd
->fallback_count
== 0)
537 ret
= asprintf(&host
, "%s.%s.", serv_string
, kd
->realm
);
539 ret
= asprintf(&host
, "%s-%d.%s.",
540 serv_string
, kd
->fallback_count
, kd
->realm
);
542 if (ret
< 0 || host
== NULL
)
543 return krb5_enomem(context
);
545 make_hints(&hints
, proto
);
546 snprintf(portstr
, sizeof(portstr
), "%d", port
);
547 ret
= getaddrinfo(host
, portstr
, &hints
, &ai
);
549 /* no more hosts, so we're done here */
551 kd
->flags
|= KD_FALLBACK
;
553 struct krb5_krbhst_info
*hi
;
556 /* Check for ICANN gTLD Name Collision address (127.0.53.53) */
557 if (ai
->ai_family
== AF_INET
) {
558 struct sockaddr_in
*sin
= (struct sockaddr_in
*)ai
->ai_addr
;
559 if (sin
->sin_addr
.s_addr
== htonl(0x7f003535)) {
561 "Fallback lookup failed: "
562 "Realm %s needs immediate attention "
563 "see https://icann.org/namecollision",
566 return KRB5_KDC_UNREACH
;
570 hostlen
= strlen(host
);
571 hi
= calloc(1, sizeof(*hi
) + hostlen
);
575 return krb5_enomem(context
);
579 hi
->port
= hi
->def_port
= port
;
581 memmove(hi
->hostname
, host
, hostlen
);
582 hi
->hostname
[hostlen
] = '\0';
584 append_host_hostinfo(kd
, hi
);
585 kd
->fallback_count
++;
591 * Fetch hosts from plugin
594 static krb5_error_code
595 add_plugin_host(struct krb5_krbhst_data
*kd
,
601 struct krb5_krbhst_info
*hi
;
602 struct addrinfo hints
, *ai
;
606 make_hints(&hints
, proto
);
607 ret
= getaddrinfo(host
, port
, &hints
, &ai
);
611 hostlen
= strlen(host
);
613 hi
= calloc(1, sizeof(*hi
) + hostlen
);
620 hi
->port
= hi
->def_port
= portnum
;
622 memmove(hi
->hostname
, host
, hostlen
);
623 hi
->hostname
[hostlen
] = '\0';
624 append_host_hostinfo(kd
, hi
);
629 static krb5_error_code
630 add_locate(void *ctx
, int type
, struct sockaddr
*addr
)
632 struct krb5_krbhst_data
*kd
= ctx
;
633 char host
[NI_MAXHOST
], port
[NI_MAXSERV
];
638 socklen
= socket_sockaddr_size(addr
);
639 portnum
= socket_get_port(addr
);
641 ret
= getnameinfo(addr
, socklen
, host
, sizeof(host
), port
, sizeof(port
),
642 NI_NUMERICHOST
|NI_NUMERICSERV
);
647 snprintf(port
, sizeof(port
), "%d", kd
->port
);
648 else if (atoi(port
) == 0)
649 snprintf(port
, sizeof(port
), "%d", krbhst_get_default_port(kd
));
651 proto
= krbhst_get_default_proto(kd
);
653 ret
= add_plugin_host(kd
, host
, port
, portnum
, proto
);
658 * This is really kind of broken and should be solved a different
659 * way, some sites block UDP, and we don't, in the general case,
660 * fall back to TCP, that should also be done. But since that
661 * should require us to invert the whole "find kdc" stack, let put
665 if (proto
== KRB5_KRBHST_UDP
) {
666 ret
= add_plugin_host(kd
, host
, port
, portnum
, KRB5_KRBHST_TCP
);
675 enum locate_service_type type
;
676 struct krb5_krbhst_data
*kd
;
680 static KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
681 plcallback(krb5_context context
,
682 const void *plug
, void *plugctx
, void *userctx
)
684 const krb5plugin_service_locate_ftable
*locate
= plug
;
685 struct plctx
*plctx
= userctx
;
687 if (locate
->minor_version
>= KRB5_PLUGIN_LOCATE_VERSION_2
)
688 return locate
->lookup(plugctx
, plctx
->flags
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
690 if (plctx
->flags
& KRB5_PLF_ALLOW_HOMEDIR
)
691 return locate
->old_lookup(plugctx
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
693 return KRB5_PLUGIN_NO_HANDLE
;
696 static const char *locate_plugin_deps
[] = { "krb5", NULL
};
698 static struct heim_plugin_data
699 locate_plugin_data
= {
702 KRB5_PLUGIN_LOCATE_VERSION_0
,
708 plugin_get_hosts(krb5_context context
,
709 struct krb5_krbhst_data
*kd
,
710 enum locate_service_type type
)
712 struct plctx ctx
= { type
, kd
, 0 };
714 if (_krb5_homedir_access(context
))
715 ctx
.flags
|= KRB5_PLF_ALLOW_HOMEDIR
;
717 _krb5_plugin_run_f(context
, &locate_plugin_data
,
718 0, &ctx
, plcallback
);
726 hostnames_get_hosts(krb5_context context
,
727 struct krb5_krbhst_data
*kd
,
730 kd
->flags
|= KD_HOSTNAMES
;
732 append_host_string(context
, kd
, kd
->hostname
, kd
->def_port
, kd
->port
);
740 static krb5_error_code
741 kdc_get_next(krb5_context context
,
742 struct krb5_krbhst_data
*kd
,
743 krb5_krbhst_info
**host
)
747 if ((kd
->flags
& KD_HOSTNAMES
) == 0) {
748 hostnames_get_hosts(context
, kd
, "kdc");
749 if(get_next(kd
, host
))
753 if ((kd
->flags
& KD_PLUGIN
) == 0) {
754 plugin_get_hosts(context
, kd
, locate_service_kdc
);
755 kd
->flags
|= KD_PLUGIN
;
756 if(get_next(kd
, host
))
760 if((kd
->flags
& KD_CONFIG
) == 0) {
761 config_get_hosts(context
, kd
, kd
->config_param
);
762 kd
->flags
|= KD_CONFIG
;
763 if(get_next(kd
, host
))
767 if (kd
->flags
& KD_CONFIG_EXISTS
) {
768 _krb5_debug(context
, 1,
769 "Configuration exists for realm %s, wont go to DNS",
771 return KRB5_KDC_UNREACH
;
774 if(context
->srv_lookup
) {
775 if(kd
->sitename
&& (kd
->flags
& KD_SITE_SRV_TCP
) == 0) {
776 srv_get_hosts(context
, kd
, kd
->sitename
, "tcp", "kerberos");
777 kd
->flags
|= KD_SITE_SRV_TCP
;
778 if(get_next(kd
, host
))
782 if((kd
->flags
& KD_SRV_UDP
) == 0 && (kd
->flags
& KD_LARGE_MSG
) == 0) {
783 srv_get_hosts(context
, kd
, NULL
, "udp", kd
->srv_label
);
784 kd
->flags
|= KD_SRV_UDP
;
785 if(get_next(kd
, host
))
789 if((kd
->flags
& KD_SRV_TCP
) == 0) {
790 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
791 kd
->flags
|= KD_SRV_TCP
;
792 if(get_next(kd
, host
))
795 if((kd
->flags
& KD_SRV_HTTP
) == 0) {
796 srv_get_hosts(context
, kd
, NULL
, "http", kd
->srv_label
);
797 kd
->flags
|= KD_SRV_HTTP
;
798 if(get_next(kd
, host
))
803 while((kd
->flags
& KD_FALLBACK
) == 0) {
804 ret
= fallback_get_hosts(context
, kd
, "kerberos",
806 krbhst_get_default_proto(kd
));
809 if(get_next(kd
, host
))
813 _krb5_debug(context
, 0, "No KDC entries found for %s", kd
->realm
);
815 return KRB5_KDC_UNREACH
; /* XXX */
818 static krb5_error_code
819 admin_get_next(krb5_context context
,
820 struct krb5_krbhst_data
*kd
,
821 krb5_krbhst_info
**host
)
825 if ((kd
->flags
& KD_PLUGIN
) == 0) {
826 plugin_get_hosts(context
, kd
, locate_service_kadmin
);
827 kd
->flags
|= KD_PLUGIN
;
828 if(get_next(kd
, host
))
832 if((kd
->flags
& KD_CONFIG
) == 0) {
833 config_get_hosts(context
, kd
, kd
->config_param
);
834 kd
->flags
|= KD_CONFIG
;
835 if(get_next(kd
, host
))
839 if (kd
->flags
& KD_CONFIG_EXISTS
) {
840 _krb5_debug(context
, 1,
841 "Configuration exists for realm %s, wont go to DNS",
843 return KRB5_KDC_UNREACH
;
846 if(context
->srv_lookup
) {
847 if((kd
->flags
& KD_SRV_TCP
) == 0) {
848 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
849 kd
->flags
|= KD_SRV_TCP
;
850 if(get_next(kd
, host
))
856 && (kd
->flags
& KD_FALLBACK
) == 0) {
857 ret
= fallback_get_hosts(context
, kd
, "kerberos",
859 krbhst_get_default_proto(kd
));
862 kd
->flags
|= KD_FALLBACK
;
863 if(get_next(kd
, host
))
867 _krb5_debug(context
, 0, "No admin entries found for realm %s", kd
->realm
);
869 return KRB5_KDC_UNREACH
; /* XXX */
872 static krb5_error_code
873 kpasswd_get_next(krb5_context context
,
874 struct krb5_krbhst_data
*kd
,
875 krb5_krbhst_info
**host
)
879 if ((kd
->flags
& KD_PLUGIN
) == 0) {
880 plugin_get_hosts(context
, kd
, locate_service_kpasswd
);
881 kd
->flags
|= KD_PLUGIN
;
882 if(get_next(kd
, host
))
886 if((kd
->flags
& KD_CONFIG
) == 0) {
887 config_get_hosts(context
, kd
, kd
->config_param
);
888 kd
->flags
|= KD_CONFIG
;
889 if(get_next(kd
, host
))
893 if (kd
->flags
& KD_CONFIG_EXISTS
) {
894 _krb5_debug(context
, 1,
895 "Configuration exists for realm %s, wont go to DNS",
897 return KRB5_KDC_UNREACH
;
900 if(context
->srv_lookup
) {
901 if((kd
->flags
& KD_SRV_UDP
) == 0) {
902 srv_get_hosts(context
, kd
, NULL
, "udp", kd
->srv_label
);
903 kd
->flags
|= KD_SRV_UDP
;
904 if(get_next(kd
, host
))
907 if((kd
->flags
& KD_SRV_TCP
) == 0) {
908 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
909 kd
->flags
|= KD_SRV_TCP
;
910 if(get_next(kd
, host
))
915 /* no matches -> try admin */
917 if (krbhst_empty(kd
)) {
919 kd
->port
= kd
->def_port
;
920 kd
->get_next
= admin_get_next
;
921 ret
= (*kd
->get_next
)(context
, kd
, host
);
923 (*host
)->proto
= krbhst_get_default_proto(kd
);
927 _krb5_debug(context
, 0, "No kpasswd entries found for realm %s", kd
->realm
);
929 return KRB5_KDC_UNREACH
;
933 krbhost_dealloc(void *ptr
)
935 struct krb5_krbhst_data
*handle
= (struct krb5_krbhst_data
*)ptr
;
936 krb5_krbhst_info
*h
, *next
;
938 for (h
= handle
->hosts
; h
!= NULL
; h
= next
) {
940 _krb5_free_krbhst_info(h
);
942 if (handle
->hostname
)
943 free(handle
->hostname
);
944 if (handle
->sitename
)
945 free(handle
->sitename
);
950 static struct krb5_krbhst_data
*
951 common_init(krb5_context context
,
952 const char *config_param
,
953 const char *srv_label
,
958 struct krb5_krbhst_data
*kd
;
960 if ((kd
= heim_alloc(sizeof(*kd
), "krbhst-context", krbhost_dealloc
)) == NULL
)
963 if((kd
->realm
= strdup(realm
)) == NULL
) {
968 kd
->config_param
= config_param
;
969 kd
->srv_label
= srv_label
;
971 _krb5_debug(context
, 2, "Trying to find service %s for realm %s flags %x",
972 service
, realm
, flags
);
974 /* For 'realms' without a . do not even think of going to DNS */
975 if (!strchr(realm
, '.'))
976 kd
->flags
|= KD_CONFIG_EXISTS
;
978 if (flags
& KRB5_KRBHST_FLAGS_LARGE_MSG
)
979 kd
->flags
|= KD_LARGE_MSG
;
980 kd
->end
= kd
->index
= &kd
->hosts
;
985 * initialize `handle' to look for hosts of type `type' in realm `realm'
988 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
989 krb5_krbhst_init(krb5_context context
,
992 krb5_krbhst_handle
*handle
)
994 return krb5_krbhst_init_flags(context
, realm
, type
, 0, handle
);
997 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
998 krb5_krbhst_init_flags(krb5_context context
,
1002 krb5_krbhst_handle
*handle
)
1004 struct krb5_krbhst_data
*kd
;
1005 krb5_error_code (*next
)(krb5_context
, struct krb5_krbhst_data
*,
1006 krb5_krbhst_info
**);
1008 const char *config_param
;
1009 const char *srv_label
;
1010 const char *service
;
1015 case KRB5_KRBHST_KDC
:
1016 next
= kdc_get_next
;
1017 def_port
= ntohs(krb5_getportbyname(context
, "kerberos", "udp", 88));
1018 config_param
= "kdc";
1019 srv_label
= "kerberos";
1022 case KRB5_KRBHST_ADMIN
:
1023 next
= admin_get_next
;
1024 def_port
= ntohs(krb5_getportbyname(context
, "kerberos-adm",
1026 config_param
= "admin_server";
1027 srv_label
= "kerberos-adm";
1030 case KRB5_KRBHST_READONLY_ADMIN
:
1031 next
= admin_get_next
;
1032 def_port
= ntohs(krb5_getportbyname(context
, "kerberos-adm",
1034 config_param
= "readonly_admin_server";
1035 srv_label
= "kerberos-adm-readonly";
1038 case KRB5_KRBHST_CHANGEPW
:
1039 next
= kpasswd_get_next
;
1040 def_port
= ntohs(krb5_getportbyname(context
, "kpasswd", "udp",
1042 config_param
= "kpasswd_server";
1043 srv_label
= "kpasswd";
1044 service
= "change_password";
1046 case KRB5_KRBHST_TKTBRIDGEAP
:
1047 next
= kdc_get_next
;
1048 def_port
= ntohs(krb5_getportbyname(context
, "kerberos", "tcp", 88));
1049 config_param
= "tktbridgeap";
1050 srv_label
= "kerberos-tkt-bridge";
1054 krb5_set_error_message(context
, ENOTTY
,
1055 N_("unknown krbhst type (%u)", ""), type
);
1058 if((kd
= common_init(context
, config_param
, srv_label
, service
, realm
,
1061 kd
->get_next
= next
;
1062 kd
->def_port
= def_port
;
1068 * return the next host information from `handle' in `host'
1071 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1072 krb5_krbhst_next(krb5_context context
,
1073 krb5_krbhst_handle handle
,
1074 krb5_krbhst_info
**host
)
1076 if(get_next(handle
, host
))
1079 return (*handle
->get_next
)(context
, handle
, host
);
1083 * return the next host information from `handle' as a host name
1084 * in `hostname' (or length `hostlen)
1087 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1088 krb5_krbhst_next_as_string(krb5_context context
,
1089 krb5_krbhst_handle handle
,
1093 krb5_error_code ret
;
1094 krb5_krbhst_info
*host
;
1095 ret
= krb5_krbhst_next(context
, handle
, &host
);
1098 return krb5_krbhst_format_string(context
, host
, hostname
, hostlen
);
1105 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1106 krb5_krbhst_set_hostname(krb5_context context
,
1107 krb5_krbhst_handle handle
,
1108 const char *hostname
)
1110 if (handle
->hostname
)
1111 free(handle
->hostname
);
1112 handle
->hostname
= strdup(hostname
);
1113 if (handle
->hostname
== NULL
)
1118 krb5_error_code KRB5_LIB_FUNCTION
1119 krb5_krbhst_set_sitename(krb5_context context
,
1120 krb5_krbhst_handle handle
,
1121 const char *sitename
)
1123 if (handle
->sitename
)
1124 free(handle
->sitename
);
1125 handle
->sitename
= strdup(sitename
);
1126 if (handle
->sitename
== NULL
)
1127 return krb5_enomem(context
);
1131 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1132 krb5_krbhst_reset(krb5_context context
, krb5_krbhst_handle handle
)
1134 handle
->index
= &handle
->hosts
;
1137 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1138 krb5_krbhst_free(krb5_context context
, krb5_krbhst_handle handle
)
1140 heim_release(handle
);
1143 #ifndef HEIMDAL_SMALLER
1145 /* backwards compatibility ahead */
1147 static krb5_error_code
1148 gethostlist(krb5_context context
, const char *realm
,
1149 unsigned int type
, char ***hostlist
)
1151 krb5_error_code ret
;
1153 krb5_krbhst_handle handle
;
1154 char host
[MAXHOSTNAMELEN
];
1155 krb5_krbhst_info
*hostinfo
;
1157 ret
= krb5_krbhst_init(context
, realm
, type
, &handle
);
1161 while (krb5_krbhst_next(context
, handle
, &hostinfo
) == 0)
1164 krb5_set_error_message(context
, KRB5_KDC_UNREACH
,
1165 N_("No KDC found for realm %s", ""), realm
);
1166 krb5_krbhst_free(context
, handle
);
1167 return KRB5_KDC_UNREACH
;
1169 *hostlist
= calloc(nhost
+ 1, sizeof(**hostlist
));
1170 if (*hostlist
== NULL
) {
1171 krb5_krbhst_free(context
, handle
);
1172 return krb5_enomem(context
);
1175 krb5_krbhst_reset(context
, handle
);
1177 while (krb5_krbhst_next_as_string(context
, handle
,
1178 host
, sizeof(host
)) == 0) {
1179 if (((*hostlist
)[nhost
++] = strdup(host
)) == NULL
) {
1180 krb5_free_krbhst(context
, *hostlist
);
1181 krb5_krbhst_free(context
, handle
);
1182 return krb5_enomem(context
);
1185 (*hostlist
)[nhost
] = NULL
;
1186 krb5_krbhst_free(context
, handle
);
1191 * Return a malloced list of kadmin-hosts for `realm' in `hostlist'
1194 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1195 krb5_get_krb_admin_hst(krb5_context context
,
1196 const krb5_realm
*realm
,
1199 return gethostlist(context
, *realm
, KRB5_KRBHST_ADMIN
, hostlist
);
1203 * Return a malloced list of writable kadmin-hosts for `realm' in `hostlist'
1206 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1207 krb5_get_krb_readonly_admin_hst(krb5_context context
,
1208 const krb5_realm
*realm
,
1211 return gethostlist(context
, *realm
, KRB5_KRBHST_READONLY_ADMIN
, hostlist
);
1215 * return an malloced list of changepw-hosts for `realm' in `hostlist'
1218 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1219 krb5_get_krb_changepw_hst (krb5_context context
,
1220 const krb5_realm
*realm
,
1223 return gethostlist(context
, *realm
, KRB5_KRBHST_CHANGEPW
, hostlist
);
1227 * return an malloced list of 524-hosts for `realm' in `hostlist'
1230 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1231 krb5_get_krb524hst (krb5_context context
,
1232 const krb5_realm
*realm
,
1235 return gethostlist(context
, *realm
, KRB5_KRBHST_KRB524
, hostlist
);
1239 * return an malloced list of KDC's for `realm' in `hostlist'
1242 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1243 krb5_get_krbhst (krb5_context context
,
1244 const krb5_realm
*realm
,
1247 return gethostlist(context
, *realm
, KRB5_KRBHST_KDC
, hostlist
);
1251 * free all the memory allocated in `hostlist'
1254 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1255 krb5_free_krbhst (krb5_context context
,
1260 for (p
= hostlist
; *p
; ++p
)
1266 #endif /* HEIMDAL_SMALLER */