lib/realm.c

   1 /* realm.c --- Realm related functions.
   2  * Copyright (C) 2002, 2003, 2004  Simon Josefsson
   3  *
   4  * This file is part of Shishi.
   5  *
   6  * Shishi is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * Shishi is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with Shishi; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  */
  21
  22 #include "internal.h"
  23
  24 /**
  25  * shishi_realm_default_guess:
  26  *
  27  * Guesses a realm based on getdomainname() (which really is NIS/YP
  28  * domain, but if it is set it might be a good guess), or if it fails,
  29  * based on gethostname(), or if it fails, the string
  30  * "could-not-guess-default-realm". Note that the hostname is not
  31  * trimmed off of the data returned by gethostname() to get the domain
  32  * name and use that as the realm.
  33  *
  34  * Return value: Returns guessed realm for host as a string that has
  35  * to be deallocated with free() by the caller.
  36  **/
  37 char *
  38 shishi_realm_default_guess (void)
  39 {
  40   char *realm;
  41
  42   realm = xgetdomainname ();
  43   if (realm && strlen (realm) > 0 && strcmp (realm, "(none)") != 0)
  44     return realm;
  45
  46   if (realm)
  47     free (realm);
  48
  49   realm = xgethostname ();
  50   if (realm && strlen (realm) > 0 && strcmp (realm, "(none)") != 0)
  51     return realm;
  52
  53   if (realm)
  54     free (realm);
  55
  56   realm = strdup ("could-not-guess-default-realm");
  57
  58   return realm;
  59 }
  60
  61 /**
  62  * shishi_realm_default:
  63  * @handle: Shishi library handle create by shishi_init().
  64  *
  65  * Get name of default realm.
  66  *
  67  * Return value: Returns the default realm used in the library.  (Not
  68  * a copy of it, so don't modify or deallocate it.)
  69  **/
  70 const char *
  71 shishi_realm_default (Shishi * handle)
  72 {
  73   if (!handle->default_realm)
  74     {
  75       char *p;
  76       p = shishi_realm_default_guess ();
  77       shishi_realm_default_set (handle, p);
  78       free (p);
  79     }
  80
  81   return handle->default_realm;
  82 }
  83
  84 /**
  85  * shishi_realm_default_set:
  86  * @handle: Shishi library handle create by shishi_init().
  87  * @realm: string with new default realm name, or NULL to reset to default.
  88  *
  89  * Set the default realm used in the library.  The string is copied
  90  * into the library, so you can dispose of the variable immediately
  91  * after calling this function.
  92  **/
  93 void
  94 shishi_realm_default_set (Shishi * handle, const char *realm)
  95 {
  96   if (handle->default_realm)
  97     free (handle->default_realm);
  98   if (realm)
  99     handle->default_realm = xstrdup (realm);
 100   else
 101     handle->default_realm = NULL;
 102 }
 103
 104 /**
 105  * shishi_realm_for_server_file:
 106  * @handle: Shishi library handle create by shishi_init().
 107  * @server: hostname to find realm for.
 108  *
 109  * Find realm for a host using configuration file.
 110  *
 111  * Return value: Returns realm for host, or NULL if not found.
 112  **/
 113 char *
 114 shishi_realm_for_server_file (Shishi * handle, char *server)
 115 {
 116   return NULL;
 117 }
 118
 119 /**
 120  * shishi_realm_for_server_dns:
 121  * @handle: Shishi library handle create by shishi_init().
 122  * @server: hostname to find realm for.
 123  *
 124  * Find realm for a host using DNS lookups, according to
 125  * draft-ietf-krb-wg-krb-dns-locate-03.txt.  Since DNS lookups may be
 126  * spoofed, relying on the realm information may result in a
 127  * redirection attack.  In a single-realm scenario, this only achieves
 128  * a denial of service, but with cross-realm trust it may redirect you
 129  * to a compromised realm.  For this reason, Shishi prints a warning,
 130  * suggesting that the user should add the proper 'server-realm'
 131  * configuration tokens instead.
 132  *
 133  * To illustrate the DNS information used, here is an extract from a
 134  * zone file for the domain ASDF.COM:
 135  *
 136  * _kerberos.asdf.com.             IN      TXT     "ASDF.COM"
 137  * _kerberos.mrkserver.asdf.com.   IN      TXT     "MARKETING.ASDF.COM"
 138  * _kerberos.salesserver.asdf.com. IN      TXT     "SALES.ASDF.COM"
 139  *
 140  * Let us suppose that in this case, a client wishes to use a service
 141  * on the host foo.asdf.com.  It would first query:
 142  *
 143  * _kerberos.foo.asdf.com. IN TXT
 144  *
 145  * Finding no match, it would then query:
 146  *
 147  * _kerberos.asdf.com. IN TXT
 148  *
 149  * Return value: Returns realm for host, or NULL if not found.
 150  **/
 151 char *
 152 shishi_realm_for_server_dns (Shishi * handle, char *server)
 153 {
 154   Shishi_dns rrs;
 155   char *tmp = NULL;
 156   char *p = server;
 157
 158   do
 159     {
 160       asprintf (&tmp, "_kerberos.%s", p);
 161       rrs = shishi_resolv (tmp, SHISHI_DNS_TXT);
 162       free (tmp);
 163       p = strchr (p, '.');
 164       if (p)
 165         p++;
 166     }
 167   while (!rrs && p && *p);
 168
 169   if (!rrs)
 170     return NULL;
 171
 172   if (rrs->class != C_IN || rrs->type != T_TXT)
 173     {
 174       shishi_warn (handle, "Got non-TXT response to TXT query from DNS?");
 175       return NULL;
 176     }
 177
 178   shishi_warn (handle, "DNS maps '%s' to '%s'.", server, (char *) rrs->rr);
 179   shishi_warn (handle,
 180                "Consider using a 'server-realm' configuration token.");
 181
 182   return rrs->rr;
 183 }
 184
 185 /**
 186  * shishi_realm_for_server:
 187  * @handle: Shishi library handle create by shishi_init().
 188  * @server: hostname to find realm for.
 189  *
 190  * Find realm for a host, using various methods.  Currently this
 191  * includes static configuration files (see
 192  * shishi_realm_for_server_file()) and DNS (see
 193  * shishi_realm_for_server_dns()).
 194  *
 195  * Return value: Returns realm for host, or NULL if not found.
 196  **/
 197 char *
 198 shishi_realm_for_server (Shishi * handle, char *server)
 199 {
 200   char *p;
 201
 202   p = shishi_realm_for_server_file (handle, server);
 203   if (!p)
 204     p = shishi_realm_for_server_dns (handle, server);
 205
 206   return p;
 207 }