2 * Copyright (c) 2001 - 2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Portions Copyright (c) 2010 Apple Inc. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 #include "krb5_locl.h"
38 #include "locate_plugin.h"
41 string_to_proto(const char *string
)
43 if(strcasecmp(string
, "udp") == 0)
44 return KRB5_KRBHST_UDP
;
45 else if(strcasecmp(string
, "tcp") == 0)
46 return KRB5_KRBHST_TCP
;
47 else if(strcasecmp(string
, "http") == 0)
48 return KRB5_KRBHST_HTTP
;
53 is_invalid_tld_srv_target(const char *target
)
55 return (strncmp("your-dns-needs-immediate-attention.",
57 && strchr(&target
[35], '.') == NULL
);
61 * set `res' and `count' to the result of looking up SRV RR in DNS for
62 * `proto', `proto', `realm' using `dns_type'.
63 * if `port' != 0, force that port number
66 static krb5_error_code
67 srv_find_realm(krb5_context context
, krb5_krbhst_info
***res
, int *count
,
68 const char *realm
, const char *dns_type
, const char *sitename
,
69 const char *proto
, const char *service
, int port
)
72 struct rk_dns_reply
*r
;
73 struct rk_resource_record
*rr
;
81 proto_num
= string_to_proto(proto
);
83 krb5_set_error_message(context
, EINVAL
,
84 N_("unknown protocol `%s' to lookup", ""),
89 if(proto_num
== KRB5_KRBHST_HTTP
)
90 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
92 def_port
= ntohs(krb5_getportbyname (context
, service
, proto
, 88));
97 snprintf(domain
, sizeof(domain
), "_%s._%s.%s._sites.%s.",
98 service
, proto
, sitename
, realm
);
100 snprintf(domain
, sizeof(domain
), "_%s._%s.%s.", service
, proto
, realm
);
102 r
= rk_dns_lookup(domain
, dns_type
);
104 _krb5_debug(context
, 0,
105 "DNS lookup failed domain: %s", domain
);
106 return KRB5_KDC_UNREACH
;
109 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
110 if(rr
->type
== rk_ns_t_srv
)
114 _krb5_debug(context
, 0,
115 "DNS SRV RR lookup domain nodata: %s", domain
);
117 return KRB5_KDC_UNREACH
;
120 *res
= malloc(num_srv
* sizeof(**res
));
123 return krb5_enomem(context
);
128 for(num_srv
= 0, rr
= r
->head
; rr
; rr
= rr
->next
)
129 if(rr
->type
== rk_ns_t_srv
) {
130 krb5_krbhst_info
*hi
= NULL
;
134 /* Test for top-level domain controlled interruptions */
135 if (!is_invalid_tld_srv_target(rr
->u
.srv
->target
)) {
137 len
= strlen(rr
->u
.srv
->target
);
138 hi
= calloc(1, sizeof(*hi
) + len
);
142 while(--num_srv
>= 0)
143 free((*res
)[num_srv
]);
148 "Domain lookup failed: "
149 "Realm %s needs immediate attention "
150 "see https://icann.org/namecollision",
152 return KRB5_KDC_UNREACH
;
154 return krb5_enomem(context
);
156 (*res
)[num_srv
++] = hi
;
158 hi
->proto
= proto_num
;
160 hi
->def_port
= def_port
;
164 hi
->port
= rr
->u
.srv
->port
;
166 strlcpy(hi
->hostname
, rr
->u
.srv
->target
, len
+ 1);
176 struct krb5_krbhst_data
{
177 const char *config_param
;
178 const char *srv_label
;
182 int port
; /* hardwired port number if != 0 */
183 #define KD_CONFIG 0x0001
184 #define KD_SRV_UDP 0x0002
185 #define KD_SRV_TCP 0x0004
186 #define KD_SITE_SRV_UDP 0x0008
187 #define KD_SITE_SRV_TCP 0x0010
188 #define KD_SRV_HTTP 0x0020
189 #define KD_SRV_KKDCP 0x0040
190 #define KD_FALLBACK 0x0080
191 #define KD_CONFIG_EXISTS 0x0100
192 #define KD_LARGE_MSG 0x0200
193 #define KD_PLUGIN 0x0400
194 #define KD_HOSTNAMES 0x0800
195 krb5_error_code (*get_next
)(krb5_context
, struct krb5_krbhst_data
*,
200 unsigned int fallback_count
;
202 struct krb5_krbhst_info
*hosts
, **index
, **end
;
206 krbhst_empty(const struct krb5_krbhst_data
*kd
)
208 return kd
->index
== &kd
->hosts
;
212 * Return the default protocol for the `kd' (either TCP or UDP)
216 krbhst_get_default_proto(struct krb5_krbhst_data
*kd
)
218 if (kd
->flags
& KD_LARGE_MSG
)
219 return KRB5_KRBHST_TCP
;
220 return KRB5_KRBHST_UDP
;
224 krbhst_get_default_port(struct krb5_krbhst_data
*kd
)
233 KRB5_LIB_FUNCTION
const char * KRB5_LIB_CALL
234 _krb5_krbhst_get_realm(krb5_krbhst_handle handle
)
236 return handle
->realm
;
240 * parse `spec' into a krb5_krbhst_info, defaulting the port to `def_port'
241 * and forcing it to `port' if port != 0
244 static struct krb5_krbhst_info
*
245 parse_hostspec(krb5_context context
, struct krb5_krbhst_data
*kd
,
246 const char *spec
, int def_port
, int port
)
248 const char *p
= spec
, *q
;
249 struct krb5_krbhst_info
*hi
;
251 hi
= calloc(1, sizeof(*hi
) + strlen(spec
));
255 hi
->proto
= krbhst_get_default_proto(kd
);
257 if(strncmp(p
, "http://", 7) == 0){
258 hi
->proto
= KRB5_KRBHST_HTTP
;
260 } else if(strncmp(p
, "http/", 5) == 0) {
261 hi
->proto
= KRB5_KRBHST_HTTP
;
263 def_port
= ntohs(krb5_getportbyname (context
, "http", "tcp", 80));
264 }else if(strncmp(p
, "tcp/", 4) == 0){
265 hi
->proto
= KRB5_KRBHST_TCP
;
267 } else if(strncmp(p
, "udp/", 4) == 0) {
268 hi
->proto
= KRB5_KRBHST_UDP
;
272 if (p
[0] == '[' && (q
= strchr(p
, ']')) != NULL
) {
273 /* if address looks like [foo:bar] or [foo:bar]: its a ipv6
274 adress, strip of [] */
275 memcpy(hi
->hostname
, &p
[1], q
- p
- 1);
276 hi
->hostname
[q
- p
- 1] = '\0';
281 } else if(strsep_copy(&p
, ":", hi
->hostname
, strlen(spec
) + 1) < 0) {
282 /* copy everything before : */
286 /* get rid of trailing /, and convert to lower case */
287 hi
->hostname
[strcspn(hi
->hostname
, "/")] = '\0';
288 strlwr(hi
->hostname
);
290 hi
->port
= hi
->def_port
= def_port
;
291 if(p
!= NULL
&& p
[0]) {
293 hi
->port
= strtol(p
, &end
, 0);
304 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
305 _krb5_free_krbhst_info(krb5_krbhst_info
*hi
)
308 freeaddrinfo(hi
->ai
);
312 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
313 _krb5_krbhost_info_move(krb5_context context
,
314 krb5_krbhst_info
*from
,
315 krb5_krbhst_info
**to
)
317 size_t hostnamelen
= strlen(from
->hostname
);
318 /* trailing NUL is included in structure */
319 *to
= calloc(1, sizeof(**to
) + hostnamelen
);
321 return krb5_enomem(context
);
323 (*to
)->proto
= from
->proto
;
324 (*to
)->port
= from
->port
;
325 (*to
)->def_port
= from
->def_port
;
326 (*to
)->ai
= from
->ai
;
329 memcpy((*to
)->hostname
, from
->hostname
, hostnamelen
+ 1);
335 append_host_hostinfo(struct krb5_krbhst_data
*kd
, struct krb5_krbhst_info
*host
)
337 struct krb5_krbhst_info
*h
;
339 for(h
= kd
->hosts
; h
; h
= h
->next
)
340 if(h
->proto
== host
->proto
&&
341 h
->port
== host
->port
&&
342 strcmp(h
->hostname
, host
->hostname
) == 0) {
343 _krb5_free_krbhst_info(host
);
347 kd
->end
= &host
->next
;
350 static krb5_error_code
351 append_host_string(krb5_context context
, struct krb5_krbhst_data
*kd
,
352 const char *host
, int def_port
, int port
)
354 struct krb5_krbhst_info
*hi
;
356 hi
= parse_hostspec(context
, kd
, host
, def_port
, port
);
358 return krb5_enomem(context
);
360 append_host_hostinfo(kd
, hi
);
365 * return a readable representation of `host' in `hostname, hostlen'
368 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
369 krb5_krbhst_format_string(krb5_context context
, const krb5_krbhst_info
*host
,
370 char *hostname
, size_t hostlen
)
372 const char *proto
= "";
373 if(host
->proto
== KRB5_KRBHST_TCP
)
375 else if(host
->proto
== KRB5_KRBHST_HTTP
)
377 if (host
->port
!= host
->def_port
)
378 snprintf(hostname
, hostlen
, "%s%s:%d", proto
, host
->hostname
, (int)host
->port
);
380 snprintf(hostname
, hostlen
, "%s%s", proto
, host
->hostname
);
385 * create a getaddrinfo `hints' based on `proto'
389 make_hints(struct addrinfo
*hints
, int proto
)
391 memset(hints
, 0, sizeof(*hints
));
392 hints
->ai_family
= AF_UNSPEC
;
394 case KRB5_KRBHST_UDP
:
395 hints
->ai_socktype
= SOCK_DGRAM
;
397 case KRB5_KRBHST_HTTP
:
398 case KRB5_KRBHST_TCP
:
399 hints
->ai_socktype
= SOCK_STREAM
;
405 * Return an `struct addrinfo *' for a KDC host.
407 * Returns an the struct addrinfo in in that corresponds to the
408 * information in `host'. free:ing is handled by krb5_krbhst_free, so
409 * the returned ai must not be released.
414 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
415 krb5_krbhst_get_addrinfo(krb5_context context
, krb5_krbhst_info
*host
,
416 struct addrinfo
**ai
)
420 if (host
->ai
== NULL
) {
421 struct addrinfo hints
;
422 char portstr
[NI_MAXSERV
];
424 snprintf (portstr
, sizeof(portstr
), "%d", host
->port
);
425 make_hints(&hints
, host
->proto
);
427 ret
= getaddrinfo(host
->hostname
, portstr
, &hints
, &host
->ai
);
429 ret
= krb5_eai_to_heim_errno(ret
, errno
);
439 get_next(struct krb5_krbhst_data
*kd
, krb5_krbhst_info
**host
)
441 struct krb5_krbhst_info
*hi
= *kd
->index
;
444 kd
->index
= &(*kd
->index
)->next
;
451 srv_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
452 const char *sitename
, const char *proto
, const char *service
)
455 krb5_krbhst_info
**res
;
458 if (krb5_realm_is_lkdc(kd
->realm
))
461 ret
= srv_find_realm(context
, &res
, &count
, kd
->realm
, "SRV",
462 sitename
, proto
, service
, kd
->port
);
463 _krb5_debug(context
, 2, "searching DNS for realm %s %s.%s -> %d",
464 kd
->realm
, proto
, service
, ret
);
467 for(i
= 0; i
< count
; i
++)
468 append_host_hostinfo(kd
, res
[i
]);
473 * read the configuration for `conf_string', defaulting to kd->def_port and
474 * forcing it to `kd->port' if kd->port != 0
478 config_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
479 const char *conf_string
)
483 hostlist
= krb5_config_get_strings(context
, NULL
,
484 "realms", kd
->realm
, conf_string
, NULL
);
486 _krb5_debug(context
, 2, "configuration file for realm %s%s found",
487 kd
->realm
, hostlist
? "" : " not");
491 kd
->flags
|= KD_CONFIG_EXISTS
;
492 for(i
= 0; hostlist
&& hostlist
[i
] != NULL
; i
++)
493 append_host_string(context
, kd
, hostlist
[i
], kd
->def_port
, kd
->port
);
495 krb5_config_free_strings(hostlist
);
499 * as a fallback, look for `serv_string.kd->realm' (typically
500 * kerberos.REALM, kerberos-1.REALM, ...
501 * `port' is the default port for the service, and `proto' the
505 static krb5_error_code
506 fallback_get_hosts(krb5_context context
, struct krb5_krbhst_data
*kd
,
507 const char *serv_string
, int port
, int proto
)
512 struct addrinfo hints
;
513 char portstr
[NI_MAXSERV
];
515 ret
= krb5_config_get_bool_default(context
, NULL
, KRB5_FALLBACK_DEFAULT
,
516 "libdefaults", "use_fallback", NULL
);
518 kd
->flags
|= KD_FALLBACK
;
522 _krb5_debug(context
, 2, "fallback lookup %d for realm %s (service %s)",
523 kd
->fallback_count
, kd
->realm
, serv_string
);
526 * Don't try forever in case the DNS server keep returning us
527 * entries (like wildcard entries or the .nu TLD)
529 * Also don't try LKDC realms since fallback wont work on them at all.
531 if(kd
->fallback_count
>= 5 || krb5_realm_is_lkdc(kd
->realm
)) {
532 kd
->flags
|= KD_FALLBACK
;
536 if(kd
->fallback_count
== 0)
537 ret
= asprintf(&host
, "%s.%s.", serv_string
, kd
->realm
);
539 ret
= asprintf(&host
, "%s-%d.%s.",
540 serv_string
, kd
->fallback_count
, kd
->realm
);
542 if (ret
< 0 || host
== NULL
)
543 return krb5_enomem(context
);
545 make_hints(&hints
, proto
);
546 snprintf(portstr
, sizeof(portstr
), "%d", port
);
547 ret
= getaddrinfo(host
, portstr
, &hints
, &ai
);
549 /* no more hosts, so we're done here */
551 kd
->flags
|= KD_FALLBACK
;
553 struct krb5_krbhst_info
*hi
;
556 /* Check for ICANN gTLD Name Collision address (127.0.53.53) */
557 if (ai
->ai_family
== AF_INET
) {
558 struct sockaddr_in
*sin
= (struct sockaddr_in
*)ai
->ai_addr
;
559 if (sin
->sin_addr
.s_addr
== htonl(0x7f003535)) {
561 "Fallback lookup failed: "
562 "Realm %s needs immediate attention "
563 "see https://icann.org/namecollision",
565 return KRB5_KDC_UNREACH
;
569 hostlen
= strlen(host
);
570 hi
= calloc(1, sizeof(*hi
) + hostlen
);
573 return krb5_enomem(context
);
577 hi
->port
= hi
->def_port
= port
;
579 memmove(hi
->hostname
, host
, hostlen
);
580 hi
->hostname
[hostlen
] = '\0';
582 append_host_hostinfo(kd
, hi
);
583 kd
->fallback_count
++;
589 * Fetch hosts from plugin
592 static krb5_error_code
593 add_plugin_host(struct krb5_krbhst_data
*kd
,
599 struct krb5_krbhst_info
*hi
;
600 struct addrinfo hints
, *ai
;
604 make_hints(&hints
, proto
);
605 ret
= getaddrinfo(host
, port
, &hints
, &ai
);
609 hostlen
= strlen(host
);
611 hi
= calloc(1, sizeof(*hi
) + hostlen
);
618 hi
->port
= hi
->def_port
= portnum
;
620 memmove(hi
->hostname
, host
, hostlen
);
621 hi
->hostname
[hostlen
] = '\0';
622 append_host_hostinfo(kd
, hi
);
627 static krb5_error_code
628 add_locate(void *ctx
, int type
, struct sockaddr
*addr
)
630 struct krb5_krbhst_data
*kd
= ctx
;
631 char host
[NI_MAXHOST
], port
[NI_MAXSERV
];
636 socklen
= socket_sockaddr_size(addr
);
637 portnum
= socket_get_port(addr
);
639 ret
= getnameinfo(addr
, socklen
, host
, sizeof(host
), port
, sizeof(port
),
640 NI_NUMERICHOST
|NI_NUMERICSERV
);
645 snprintf(port
, sizeof(port
), "%d", kd
->port
);
646 else if (atoi(port
) == 0)
647 snprintf(port
, sizeof(port
), "%d", krbhst_get_default_port(kd
));
649 proto
= krbhst_get_default_proto(kd
);
651 ret
= add_plugin_host(kd
, host
, port
, portnum
, proto
);
656 * This is really kind of broken and should be solved a different
657 * way, some sites block UDP, and we don't, in the general case,
658 * fall back to TCP, that should also be done. But since that
659 * should require us to invert the whole "find kdc" stack, let put
663 if (proto
== KRB5_KRBHST_UDP
) {
664 ret
= add_plugin_host(kd
, host
, port
, portnum
, KRB5_KRBHST_TCP
);
673 enum locate_service_type type
;
674 struct krb5_krbhst_data
*kd
;
678 static KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
679 plcallback(krb5_context context
,
680 const void *plug
, void *plugctx
, void *userctx
)
682 const krb5plugin_service_locate_ftable
*locate
= plug
;
683 struct plctx
*plctx
= userctx
;
685 if (locate
->minor_version
>= KRB5_PLUGIN_LOCATE_VERSION_2
)
686 return locate
->lookup(plugctx
, plctx
->flags
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
688 if (plctx
->flags
& KRB5_PLF_ALLOW_HOMEDIR
)
689 return locate
->old_lookup(plugctx
, plctx
->type
, plctx
->kd
->realm
, 0, 0, add_locate
, plctx
->kd
);
691 return KRB5_PLUGIN_NO_HANDLE
;
694 static const char *locate_plugin_deps
[] = { "krb5", NULL
};
696 static struct heim_plugin_data
697 locate_plugin_data
= {
700 KRB5_PLUGIN_LOCATE_VERSION_0
,
706 plugin_get_hosts(krb5_context context
,
707 struct krb5_krbhst_data
*kd
,
708 enum locate_service_type type
)
710 struct plctx ctx
= { type
, kd
, 0 };
712 if (_krb5_homedir_access(context
))
713 ctx
.flags
|= KRB5_PLF_ALLOW_HOMEDIR
;
715 _krb5_plugin_run_f(context
, &locate_plugin_data
,
716 0, &ctx
, plcallback
);
724 hostnames_get_hosts(krb5_context context
,
725 struct krb5_krbhst_data
*kd
,
728 kd
->flags
|= KD_HOSTNAMES
;
730 append_host_string(context
, kd
, kd
->hostname
, kd
->def_port
, kd
->port
);
738 static krb5_error_code
739 kdc_get_next(krb5_context context
,
740 struct krb5_krbhst_data
*kd
,
741 krb5_krbhst_info
**host
)
745 if ((kd
->flags
& KD_HOSTNAMES
) == 0) {
746 hostnames_get_hosts(context
, kd
, "kdc");
747 if(get_next(kd
, host
))
751 if ((kd
->flags
& KD_PLUGIN
) == 0) {
752 plugin_get_hosts(context
, kd
, locate_service_kdc
);
753 kd
->flags
|= KD_PLUGIN
;
754 if(get_next(kd
, host
))
758 if((kd
->flags
& KD_CONFIG
) == 0) {
759 config_get_hosts(context
, kd
, kd
->config_param
);
760 kd
->flags
|= KD_CONFIG
;
761 if(get_next(kd
, host
))
765 if (kd
->flags
& KD_CONFIG_EXISTS
) {
766 _krb5_debug(context
, 1,
767 "Configuration exists for realm %s, wont go to DNS",
769 return KRB5_KDC_UNREACH
;
772 if(context
->srv_lookup
) {
773 if(kd
->sitename
&& (kd
->flags
& KD_SITE_SRV_TCP
) == 0) {
774 srv_get_hosts(context
, kd
, kd
->sitename
, "tcp", "kerberos");
775 kd
->flags
|= KD_SITE_SRV_TCP
;
776 if(get_next(kd
, host
))
780 if((kd
->flags
& KD_SRV_UDP
) == 0 && (kd
->flags
& KD_LARGE_MSG
) == 0) {
781 srv_get_hosts(context
, kd
, NULL
, "udp", kd
->srv_label
);
782 kd
->flags
|= KD_SRV_UDP
;
783 if(get_next(kd
, host
))
787 if((kd
->flags
& KD_SRV_TCP
) == 0) {
788 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
789 kd
->flags
|= KD_SRV_TCP
;
790 if(get_next(kd
, host
))
793 if((kd
->flags
& KD_SRV_HTTP
) == 0) {
794 srv_get_hosts(context
, kd
, NULL
, "http", kd
->srv_label
);
795 kd
->flags
|= KD_SRV_HTTP
;
796 if(get_next(kd
, host
))
801 while((kd
->flags
& KD_FALLBACK
) == 0) {
802 ret
= fallback_get_hosts(context
, kd
, "kerberos",
804 krbhst_get_default_proto(kd
));
807 if(get_next(kd
, host
))
811 _krb5_debug(context
, 0, "No KDC entries found for %s", kd
->realm
);
813 return KRB5_KDC_UNREACH
; /* XXX */
816 static krb5_error_code
817 admin_get_next(krb5_context context
,
818 struct krb5_krbhst_data
*kd
,
819 krb5_krbhst_info
**host
)
823 if ((kd
->flags
& KD_PLUGIN
) == 0) {
824 plugin_get_hosts(context
, kd
, locate_service_kadmin
);
825 kd
->flags
|= KD_PLUGIN
;
826 if(get_next(kd
, host
))
830 if((kd
->flags
& KD_CONFIG
) == 0) {
831 config_get_hosts(context
, kd
, kd
->config_param
);
832 kd
->flags
|= KD_CONFIG
;
833 if(get_next(kd
, host
))
837 if (kd
->flags
& KD_CONFIG_EXISTS
) {
838 _krb5_debug(context
, 1,
839 "Configuration exists for realm %s, wont go to DNS",
841 return KRB5_KDC_UNREACH
;
844 if(context
->srv_lookup
) {
845 if((kd
->flags
& KD_SRV_TCP
) == 0) {
846 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
847 kd
->flags
|= KD_SRV_TCP
;
848 if(get_next(kd
, host
))
854 && (kd
->flags
& KD_FALLBACK
) == 0) {
855 ret
= fallback_get_hosts(context
, kd
, "kerberos",
857 krbhst_get_default_proto(kd
));
860 kd
->flags
|= KD_FALLBACK
;
861 if(get_next(kd
, host
))
865 _krb5_debug(context
, 0, "No admin entries found for realm %s", kd
->realm
);
867 return KRB5_KDC_UNREACH
; /* XXX */
870 static krb5_error_code
871 kpasswd_get_next(krb5_context context
,
872 struct krb5_krbhst_data
*kd
,
873 krb5_krbhst_info
**host
)
877 if ((kd
->flags
& KD_PLUGIN
) == 0) {
878 plugin_get_hosts(context
, kd
, locate_service_kpasswd
);
879 kd
->flags
|= KD_PLUGIN
;
880 if(get_next(kd
, host
))
884 if((kd
->flags
& KD_CONFIG
) == 0) {
885 config_get_hosts(context
, kd
, kd
->config_param
);
886 kd
->flags
|= KD_CONFIG
;
887 if(get_next(kd
, host
))
891 if (kd
->flags
& KD_CONFIG_EXISTS
) {
892 _krb5_debug(context
, 1,
893 "Configuration exists for realm %s, wont go to DNS",
895 return KRB5_KDC_UNREACH
;
898 if(context
->srv_lookup
) {
899 if((kd
->flags
& KD_SRV_UDP
) == 0) {
900 srv_get_hosts(context
, kd
, NULL
, "udp", kd
->srv_label
);
901 kd
->flags
|= KD_SRV_UDP
;
902 if(get_next(kd
, host
))
905 if((kd
->flags
& KD_SRV_TCP
) == 0) {
906 srv_get_hosts(context
, kd
, NULL
, "tcp", kd
->srv_label
);
907 kd
->flags
|= KD_SRV_TCP
;
908 if(get_next(kd
, host
))
913 /* no matches -> try admin */
915 if (krbhst_empty(kd
)) {
917 kd
->port
= kd
->def_port
;
918 kd
->get_next
= admin_get_next
;
919 ret
= (*kd
->get_next
)(context
, kd
, host
);
921 (*host
)->proto
= krbhst_get_default_proto(kd
);
925 _krb5_debug(context
, 0, "No kpasswd entries found for realm %s", kd
->realm
);
927 return KRB5_KDC_UNREACH
;
931 krbhost_dealloc(void *ptr
)
933 struct krb5_krbhst_data
*handle
= (struct krb5_krbhst_data
*)ptr
;
934 krb5_krbhst_info
*h
, *next
;
936 for (h
= handle
->hosts
; h
!= NULL
; h
= next
) {
938 _krb5_free_krbhst_info(h
);
940 if (handle
->hostname
)
941 free(handle
->hostname
);
942 if (handle
->sitename
)
943 free(handle
->sitename
);
948 static struct krb5_krbhst_data
*
949 common_init(krb5_context context
,
950 const char *config_param
,
951 const char *srv_label
,
956 struct krb5_krbhst_data
*kd
;
958 if ((kd
= heim_alloc(sizeof(*kd
), "krbhst-context", krbhost_dealloc
)) == NULL
)
961 if((kd
->realm
= strdup(realm
)) == NULL
) {
966 kd
->config_param
= config_param
;
967 kd
->srv_label
= srv_label
;
969 _krb5_debug(context
, 2, "Trying to find service %s for realm %s flags %x",
970 service
, realm
, flags
);
972 /* For 'realms' without a . do not even think of going to DNS */
973 if (!strchr(realm
, '.'))
974 kd
->flags
|= KD_CONFIG_EXISTS
;
976 if (flags
& KRB5_KRBHST_FLAGS_LARGE_MSG
)
977 kd
->flags
|= KD_LARGE_MSG
;
978 kd
->end
= kd
->index
= &kd
->hosts
;
983 * initialize `handle' to look for hosts of type `type' in realm `realm'
986 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
987 krb5_krbhst_init(krb5_context context
,
990 krb5_krbhst_handle
*handle
)
992 return krb5_krbhst_init_flags(context
, realm
, type
, 0, handle
);
995 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
996 krb5_krbhst_init_flags(krb5_context context
,
1000 krb5_krbhst_handle
*handle
)
1002 struct krb5_krbhst_data
*kd
;
1003 krb5_error_code (*next
)(krb5_context
, struct krb5_krbhst_data
*,
1004 krb5_krbhst_info
**);
1006 const char *config_param
;
1007 const char *srv_label
;
1008 const char *service
;
1013 case KRB5_KRBHST_KDC
:
1014 next
= kdc_get_next
;
1015 def_port
= ntohs(krb5_getportbyname(context
, "kerberos", "udp", 88));
1016 config_param
= "kdc";
1017 srv_label
= "kerberos";
1020 case KRB5_KRBHST_ADMIN
:
1021 next
= admin_get_next
;
1022 def_port
= ntohs(krb5_getportbyname(context
, "kerberos-adm",
1024 config_param
= "admin_server";
1025 srv_label
= "kerberos-adm";
1028 case KRB5_KRBHST_READONLY_ADMIN
:
1029 next
= admin_get_next
;
1030 def_port
= ntohs(krb5_getportbyname(context
, "kerberos-adm",
1032 config_param
= "readonly_admin_server";
1033 srv_label
= "kerberos-adm-readonly";
1036 case KRB5_KRBHST_CHANGEPW
:
1037 next
= kpasswd_get_next
;
1038 def_port
= ntohs(krb5_getportbyname(context
, "kpasswd", "udp",
1040 config_param
= "kpasswd_server";
1041 srv_label
= "kpasswd";
1042 service
= "change_password";
1044 case KRB5_KRBHST_TKTBRIDGEAP
:
1045 next
= kdc_get_next
;
1046 def_port
= ntohs(krb5_getportbyname(context
, "kerberos", "tcp", 88));
1047 config_param
= "tktbridgeap";
1048 srv_label
= "kerberos-tkt-bridge";
1052 krb5_set_error_message(context
, ENOTTY
,
1053 N_("unknown krbhst type (%u)", ""), type
);
1056 if((kd
= common_init(context
, config_param
, srv_label
, service
, realm
,
1059 kd
->get_next
= next
;
1060 kd
->def_port
= def_port
;
1066 * return the next host information from `handle' in `host'
1069 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1070 krb5_krbhst_next(krb5_context context
,
1071 krb5_krbhst_handle handle
,
1072 krb5_krbhst_info
**host
)
1074 if(get_next(handle
, host
))
1077 return (*handle
->get_next
)(context
, handle
, host
);
1081 * return the next host information from `handle' as a host name
1082 * in `hostname' (or length `hostlen)
1085 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1086 krb5_krbhst_next_as_string(krb5_context context
,
1087 krb5_krbhst_handle handle
,
1091 krb5_error_code ret
;
1092 krb5_krbhst_info
*host
;
1093 ret
= krb5_krbhst_next(context
, handle
, &host
);
1096 return krb5_krbhst_format_string(context
, host
, hostname
, hostlen
);
1103 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1104 krb5_krbhst_set_hostname(krb5_context context
,
1105 krb5_krbhst_handle handle
,
1106 const char *hostname
)
1108 if (handle
->hostname
)
1109 free(handle
->hostname
);
1110 handle
->hostname
= strdup(hostname
);
1111 if (handle
->hostname
== NULL
)
1116 krb5_error_code KRB5_LIB_FUNCTION
1117 krb5_krbhst_set_sitename(krb5_context context
,
1118 krb5_krbhst_handle handle
,
1119 const char *sitename
)
1121 if (handle
->sitename
)
1122 free(handle
->sitename
);
1123 handle
->sitename
= strdup(sitename
);
1124 if (handle
->sitename
== NULL
)
1125 return krb5_enomem(context
);
1129 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1130 krb5_krbhst_reset(krb5_context context
, krb5_krbhst_handle handle
)
1132 handle
->index
= &handle
->hosts
;
1135 KRB5_LIB_FUNCTION
void KRB5_LIB_CALL
1136 krb5_krbhst_free(krb5_context context
, krb5_krbhst_handle handle
)
1138 heim_release(handle
);
1141 #ifndef HEIMDAL_SMALLER
1143 /* backwards compatibility ahead */
1145 static krb5_error_code
1146 gethostlist(krb5_context context
, const char *realm
,
1147 unsigned int type
, char ***hostlist
)
1149 krb5_error_code ret
;
1151 krb5_krbhst_handle handle
;
1152 char host
[MAXHOSTNAMELEN
];
1153 krb5_krbhst_info
*hostinfo
;
1155 ret
= krb5_krbhst_init(context
, realm
, type
, &handle
);
1159 while (krb5_krbhst_next(context
, handle
, &hostinfo
) == 0)
1162 krb5_set_error_message(context
, KRB5_KDC_UNREACH
,
1163 N_("No KDC found for realm %s", ""), realm
);
1164 krb5_krbhst_free(context
, handle
);
1165 return KRB5_KDC_UNREACH
;
1167 *hostlist
= calloc(nhost
+ 1, sizeof(**hostlist
));
1168 if (*hostlist
== NULL
) {
1169 krb5_krbhst_free(context
, handle
);
1170 return krb5_enomem(context
);
1173 krb5_krbhst_reset(context
, handle
);
1175 while (krb5_krbhst_next_as_string(context
, handle
,
1176 host
, sizeof(host
)) == 0) {
1177 if (((*hostlist
)[nhost
++] = strdup(host
)) == NULL
) {
1178 krb5_free_krbhst(context
, *hostlist
);
1179 krb5_krbhst_free(context
, handle
);
1180 return krb5_enomem(context
);
1183 (*hostlist
)[nhost
] = NULL
;
1184 krb5_krbhst_free(context
, handle
);
1189 * Return a malloced list of kadmin-hosts for `realm' in `hostlist'
1192 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1193 krb5_get_krb_admin_hst(krb5_context context
,
1194 const krb5_realm
*realm
,
1197 return gethostlist(context
, *realm
, KRB5_KRBHST_ADMIN
, hostlist
);
1201 * Return a malloced list of writable kadmin-hosts for `realm' in `hostlist'
1204 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1205 krb5_get_krb_readonly_admin_hst(krb5_context context
,
1206 const krb5_realm
*realm
,
1209 return gethostlist(context
, *realm
, KRB5_KRBHST_READONLY_ADMIN
, hostlist
);
1213 * return an malloced list of changepw-hosts for `realm' in `hostlist'
1216 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1217 krb5_get_krb_changepw_hst (krb5_context context
,
1218 const krb5_realm
*realm
,
1221 return gethostlist(context
, *realm
, KRB5_KRBHST_CHANGEPW
, hostlist
);
1225 * return an malloced list of 524-hosts for `realm' in `hostlist'
1228 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1229 krb5_get_krb524hst (krb5_context context
,
1230 const krb5_realm
*realm
,
1233 return gethostlist(context
, *realm
, KRB5_KRBHST_KRB524
, hostlist
);
1237 * return an malloced list of KDC's for `realm' in `hostlist'
1240 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1241 krb5_get_krbhst (krb5_context context
,
1242 const krb5_realm
*realm
,
1245 return gethostlist(context
, *realm
, KRB5_KRBHST_KDC
, hostlist
);
1249 * free all the memory allocated in `hostlist'
1252 KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
1253 krb5_free_krbhst (krb5_context context
,
1258 for (p
= hostlist
; *p
; ++p
)
1264 #endif /* HEIMDAL_SMALLER */