2 * Copyright (c) 2001 - 2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
37 RCSID("$Id: krbhst.c,v 1.52 2005/06/17 04:23:26 lha Exp $");
40 string_to_proto(const char *string)
42 if(strcasecmp(string, "udp") == 0)
43 return KRB5_KRBHST_UDP;
44 else if(strcasecmp(string, "tcp") == 0)
45 return KRB5_KRBHST_TCP;
46 else if(strcasecmp(string, "http") == 0)
47 return KRB5_KRBHST_HTTP;
52 * set `res' and `count' to the result of looking up SRV RR in DNS for
53 * `proto', `proto', `realm' using `dns_type'.
54 * if `port' != 0, force that port number
57 static krb5_error_code
58 srv_find_realm(krb5_context context, krb5_krbhst_info ***res, int *count,
59 const char *realm, const char *dns_type,
60 const char *proto, const char *service, int port)
64 struct resource_record *rr;
72 proto_num = string_to_proto(proto);
74 krb5_set_error_string(context, "unknown protocol `%s'", proto);
78 if(proto_num == KRB5_KRBHST_HTTP)
79 def_port = ntohs(krb5_getportbyname (context, "http", "tcp", 80));
81 def_port = ntohs(krb5_getportbyname (context, service, proto, 88));
85 snprintf(domain, sizeof(domain), "_%s._%s.%s.", service, proto, realm);
87 r = dns_lookup(domain, dns_type);
89 return KRB5_KDC_UNREACH;
91 for(num_srv = 0, rr = r->head; rr; rr = rr->next)
95 *res = malloc(num_srv * sizeof(**res));
98 krb5_set_error_string(context, "malloc: out of memory");
104 for(num_srv = 0, rr = r->head; rr; rr = rr->next)
105 if(rr->type == T_SRV) {
106 krb5_krbhst_info *hi;
107 size_t len = strlen(rr->u.srv->target);
109 hi = calloc(1, sizeof(*hi) + len);
112 while(--num_srv >= 0)
113 free((*res)[num_srv]);
118 (*res)[num_srv++] = hi;
120 hi->proto = proto_num;
122 hi->def_port = def_port;
126 hi->port = rr->u.srv->port;
128 strlcpy(hi->hostname, rr->u.srv->target, len + 1);
138 struct krb5_krbhst_data {
142 int port; /* hardwired port number if != 0 */
146 #define KD_SRV_HTTP 8
147 #define KD_FALLBACK 16
148 #define KD_CONFIG_EXISTS 32
149 #define KD_LARGE_MSG 64
150 krb5_error_code (*get_next)(krb5_context, struct krb5_krbhst_data *,
153 unsigned int fallback_count;
155 struct krb5_krbhst_info *hosts, **index, **end;
159 krbhst_empty(const struct krb5_krbhst_data *kd)
161 return kd->index == &kd->hosts;
165 * Return the default protocol for the `kd' (either TCP or UDP)
169 krbhst_get_default_proto(struct krb5_krbhst_data *kd)
171 if (kd->flags & KD_LARGE_MSG)
172 return KRB5_KRBHST_TCP;
173 return KRB5_KRBHST_UDP;
178 * parse `spec' into a krb5_krbhst_info, defaulting the port to `def_port'
179 * and forcing it to `port' if port != 0
182 static struct krb5_krbhst_info*
183 parse_hostspec(krb5_context context, struct krb5_krbhst_data *kd,
184 const char *spec, int def_port, int port)
186 const char *p = spec;
187 struct krb5_krbhst_info *hi;
189 hi = calloc(1, sizeof(*hi) + strlen(spec));
193 hi->proto = krbhst_get_default_proto(kd);
195 if(strncmp(p, "http://", 7) == 0){
196 hi->proto = KRB5_KRBHST_HTTP;
198 } else if(strncmp(p, "http/", 5) == 0) {
199 hi->proto = KRB5_KRBHST_HTTP;
201 def_port = ntohs(krb5_getportbyname (context, "http", "tcp", 80));
202 }else if(strncmp(p, "tcp/", 4) == 0){
203 hi->proto = KRB5_KRBHST_TCP;
205 } else if(strncmp(p, "udp/", 4) == 0) {
209 if(strsep_copy(&p, ":", hi->hostname, strlen(spec) + 1) < 0) {
213 /* get rid of trailing /, and convert to lower case */
214 hi->hostname[strcspn(hi->hostname, "/")] = '\0';
215 strlwr(hi->hostname);
217 hi->port = hi->def_port = def_port;
220 hi->port = strtol(p, &end, 0);
232 free_krbhst_info(krb5_krbhst_info *hi)
235 freeaddrinfo(hi->ai);
240 append_host_hostinfo(struct krb5_krbhst_data *kd, struct krb5_krbhst_info *host)
242 struct krb5_krbhst_info *h;
244 for(h = kd->hosts; h; h = h->next)
245 if(h->proto == host->proto &&
246 h->port == host->port &&
247 strcmp(h->hostname, host->hostname) == 0) {
248 free_krbhst_info(host);
252 kd->end = &host->next;
255 static krb5_error_code
256 append_host_string(krb5_context context, struct krb5_krbhst_data *kd,
257 const char *host, int def_port, int port)
259 struct krb5_krbhst_info *hi;
261 hi = parse_hostspec(context, kd, host, def_port, port);
265 append_host_hostinfo(kd, hi);
270 * return a readable representation of `host' in `hostname, hostlen'
273 krb5_error_code KRB5_LIB_FUNCTION
274 krb5_krbhst_format_string(krb5_context context, const krb5_krbhst_info *host,
275 char *hostname, size_t hostlen)
277 const char *proto = "";
278 char portstr[7] = "";
279 if(host->proto == KRB5_KRBHST_TCP)
281 else if(host->proto == KRB5_KRBHST_HTTP)
283 if(host->port != host->def_port)
284 snprintf(portstr, sizeof(portstr), ":%d", host->port);
285 snprintf(hostname, hostlen, "%s%s%s", proto, host->hostname, portstr);
290 * create a getaddrinfo `hints' based on `proto'
294 make_hints(struct addrinfo *hints, int proto)
296 memset(hints, 0, sizeof(*hints));
297 hints->ai_family = AF_UNSPEC;
299 case KRB5_KRBHST_UDP :
300 hints->ai_socktype = SOCK_DGRAM;
302 case KRB5_KRBHST_HTTP :
303 case KRB5_KRBHST_TCP :
304 hints->ai_socktype = SOCK_STREAM;
310 * return an `struct addrinfo *' in `ai' corresponding to the information
311 * in `host'. free:ing is handled by krb5_krbhst_free.
314 krb5_error_code KRB5_LIB_FUNCTION
315 krb5_krbhst_get_addrinfo(krb5_context context, krb5_krbhst_info *host,
316 struct addrinfo **ai)
318 struct addrinfo hints;
319 char portstr[NI_MAXSERV];
322 if (host->ai == NULL) {
323 make_hints(&hints, host->proto);
324 snprintf (portstr, sizeof(portstr), "%d", host->port);
325 ret = getaddrinfo(host->hostname, portstr, &hints, &host->ai);
327 return krb5_eai_to_heim_errno(ret, errno);
334 get_next(struct krb5_krbhst_data *kd, krb5_krbhst_info **host)
336 struct krb5_krbhst_info *hi = *kd->index;
339 kd->index = &(*kd->index)->next;
346 srv_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
347 const char *proto, const char *service)
349 krb5_krbhst_info **res;
352 if (srv_find_realm(context, &res, &count, kd->realm, "SRV", proto, service,
355 for(i = 0; i < count; i++)
356 append_host_hostinfo(kd, res[i]);
361 * read the configuration for `conf_string', defaulting to kd->def_port and
362 * forcing it to `kd->port' if kd->port != 0
366 config_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
367 const char *conf_string)
372 hostlist = krb5_config_get_strings(context, NULL,
373 "realms", kd->realm, conf_string, NULL);
377 kd->flags |= KD_CONFIG_EXISTS;
378 for(i = 0; hostlist && hostlist[i] != NULL; i++)
379 append_host_string(context, kd, hostlist[i], kd->def_port, kd->port);
381 krb5_config_free_strings(hostlist);
385 * as a fallback, look for `serv_string.kd->realm' (typically
386 * kerberos.REALM, kerberos-1.REALM, ...
387 * `port' is the default port for the service, and `proto' the
391 static krb5_error_code
392 fallback_get_hosts(krb5_context context, struct krb5_krbhst_data *kd,
393 const char *serv_string, int port, int proto)
398 struct addrinfo hints;
399 char portstr[NI_MAXSERV];
401 if(kd->fallback_count == 0)
402 asprintf(&host, "%s.%s.", serv_string, kd->realm);
404 asprintf(&host, "%s-%d.%s.",
405 serv_string, kd->fallback_count, kd->realm);
410 make_hints(&hints, proto);
411 snprintf(portstr, sizeof(portstr), "%d", port);
412 ret = getaddrinfo(host, portstr, &hints, &ai);
414 /* no more hosts, so we're done here */
416 kd->flags |= KD_FALLBACK;
418 struct krb5_krbhst_info *hi;
419 size_t hostlen = strlen(host);
421 hi = calloc(1, sizeof(*hi) + hostlen);
428 hi->port = hi->def_port = port;
430 memmove(hi->hostname, host, hostlen - 1);
431 hi->hostname[hostlen - 1] = '\0';
433 append_host_hostinfo(kd, hi);
434 kd->fallback_count++;
439 static krb5_error_code
440 kdc_get_next(krb5_context context,
441 struct krb5_krbhst_data *kd,
442 krb5_krbhst_info **host)
446 if((kd->flags & KD_CONFIG) == 0) {
447 config_get_hosts(context, kd, "kdc");
448 kd->flags |= KD_CONFIG;
449 if(get_next(kd, host))
453 if (kd->flags & KD_CONFIG_EXISTS)
454 return KRB5_KDC_UNREACH; /* XXX */
456 if(context->srv_lookup) {
457 if((kd->flags & KD_SRV_UDP) == 0 && (kd->flags & KD_LARGE_MSG) == 0) {
458 srv_get_hosts(context, kd, "udp", "kerberos");
459 kd->flags |= KD_SRV_UDP;
460 if(get_next(kd, host))
464 if((kd->flags & KD_SRV_TCP) == 0) {
465 srv_get_hosts(context, kd, "tcp", "kerberos");
466 kd->flags |= KD_SRV_TCP;
467 if(get_next(kd, host))
470 if((kd->flags & KD_SRV_HTTP) == 0) {
471 srv_get_hosts(context, kd, "http", "kerberos");
472 kd->flags |= KD_SRV_HTTP;
473 if(get_next(kd, host))
478 while((kd->flags & KD_FALLBACK) == 0) {
479 ret = fallback_get_hosts(context, kd, "kerberos",
481 krbhst_get_default_proto(kd));
484 if(get_next(kd, host))
488 return KRB5_KDC_UNREACH; /* XXX */
491 static krb5_error_code
492 admin_get_next(krb5_context context,
493 struct krb5_krbhst_data *kd,
494 krb5_krbhst_info **host)
498 if((kd->flags & KD_CONFIG) == 0) {
499 config_get_hosts(context, kd, "admin_server");
500 kd->flags |= KD_CONFIG;
501 if(get_next(kd, host))
505 if (kd->flags & KD_CONFIG_EXISTS)
506 return KRB5_KDC_UNREACH; /* XXX */
508 if(context->srv_lookup) {
509 if((kd->flags & KD_SRV_TCP) == 0) {
510 srv_get_hosts(context, kd, "tcp", "kerberos-adm");
511 kd->flags |= KD_SRV_TCP;
512 if(get_next(kd, host))
518 && (kd->flags & KD_FALLBACK) == 0) {
519 ret = fallback_get_hosts(context, kd, "kerberos",
521 krbhst_get_default_proto(kd));
524 kd->flags |= KD_FALLBACK;
525 if(get_next(kd, host))
529 return KRB5_KDC_UNREACH; /* XXX */
532 static krb5_error_code
533 kpasswd_get_next(krb5_context context,
534 struct krb5_krbhst_data *kd,
535 krb5_krbhst_info **host)
539 if((kd->flags & KD_CONFIG) == 0) {
540 config_get_hosts(context, kd, "kpasswd_server");
541 kd->flags |= KD_CONFIG;
542 if(get_next(kd, host))
546 if (kd->flags & KD_CONFIG_EXISTS)
547 return KRB5_KDC_UNREACH; /* XXX */
549 if(context->srv_lookup) {
550 if((kd->flags & KD_SRV_UDP) == 0) {
551 srv_get_hosts(context, kd, "udp", "kpasswd");
552 kd->flags |= KD_SRV_UDP;
553 if(get_next(kd, host))
556 if((kd->flags & KD_SRV_TCP) == 0) {
557 srv_get_hosts(context, kd, "tcp", "kpasswd");
558 kd->flags |= KD_SRV_TCP;
559 if(get_next(kd, host))
564 /* no matches -> try admin */
566 if (krbhst_empty(kd)) {
568 kd->port = kd->def_port;
569 kd->get_next = admin_get_next;
570 ret = (*kd->get_next)(context, kd, host);
572 (*host)->proto = krbhst_get_default_proto(kd);
576 return KRB5_KDC_UNREACH; /* XXX */
579 static krb5_error_code
580 krb524_get_next(krb5_context context,
581 struct krb5_krbhst_data *kd,
582 krb5_krbhst_info **host)
584 if((kd->flags & KD_CONFIG) == 0) {
585 config_get_hosts(context, kd, "krb524_server");
586 if(get_next(kd, host))
588 kd->flags |= KD_CONFIG;
591 if (kd->flags & KD_CONFIG_EXISTS)
592 return KRB5_KDC_UNREACH; /* XXX */
594 if(context->srv_lookup) {
595 if((kd->flags & KD_SRV_UDP) == 0) {
596 srv_get_hosts(context, kd, "udp", "krb524");
597 kd->flags |= KD_SRV_UDP;
598 if(get_next(kd, host))
602 if((kd->flags & KD_SRV_TCP) == 0) {
603 srv_get_hosts(context, kd, "tcp", "krb524");
604 kd->flags |= KD_SRV_TCP;
605 if(get_next(kd, host))
610 /* no matches -> try kdc */
612 if (krbhst_empty(kd)) {
614 kd->port = kd->def_port;
615 kd->get_next = kdc_get_next;
616 return (*kd->get_next)(context, kd, host);
619 return KRB5_KDC_UNREACH; /* XXX */
622 static struct krb5_krbhst_data*
623 common_init(krb5_context context,
627 struct krb5_krbhst_data *kd;
629 if((kd = calloc(1, sizeof(*kd))) == NULL)
632 if((kd->realm = strdup(realm)) == NULL) {
637 if (flags & KRB5_KRBHST_FLAGS_LARGE_MSG)
638 kd->flags |= KD_LARGE_MSG;
639 kd->end = kd->index = &kd->hosts;
644 * initialize `handle' to look for hosts of type `type' in realm `realm'
647 krb5_error_code KRB5_LIB_FUNCTION
648 krb5_krbhst_init(krb5_context context,
651 krb5_krbhst_handle *handle)
653 return krb5_krbhst_init_flags(context, realm, type, 0, handle);
656 krb5_error_code KRB5_LIB_FUNCTION
657 krb5_krbhst_init_flags(krb5_context context,
661 krb5_krbhst_handle *handle)
663 struct krb5_krbhst_data *kd;
664 krb5_error_code (*next)(krb5_context, struct krb5_krbhst_data *,
665 krb5_krbhst_info **);
669 case KRB5_KRBHST_KDC:
671 def_port = ntohs(krb5_getportbyname (context, "kerberos", "udp", 88));
673 case KRB5_KRBHST_ADMIN:
674 next = admin_get_next;
675 def_port = ntohs(krb5_getportbyname (context, "kerberos-adm",
678 case KRB5_KRBHST_CHANGEPW:
679 next = kpasswd_get_next;
680 def_port = ntohs(krb5_getportbyname (context, "kpasswd", "udp",
683 case KRB5_KRBHST_KRB524:
684 next = krb524_get_next;
685 def_port = ntohs(krb5_getportbyname (context, "krb524", "udp", 4444));
688 krb5_set_error_string(context, "unknown krbhst type (%u)", type);
691 if((kd = common_init(context, realm, flags)) == NULL)
694 kd->def_port = def_port;
700 * return the next host information from `handle' in `host'
703 krb5_error_code KRB5_LIB_FUNCTION
704 krb5_krbhst_next(krb5_context context,
705 krb5_krbhst_handle handle,
706 krb5_krbhst_info **host)
708 if(get_next(handle, host))
711 return (*handle->get_next)(context, handle, host);
715 * return the next host information from `handle' as a host name
716 * in `hostname' (or length `hostlen)
719 krb5_error_code KRB5_LIB_FUNCTION
720 krb5_krbhst_next_as_string(krb5_context context,
721 krb5_krbhst_handle handle,
726 krb5_krbhst_info *host;
727 ret = krb5_krbhst_next(context, handle, &host);
730 return krb5_krbhst_format_string(context, host, hostname, hostlen);
734 void KRB5_LIB_FUNCTION
735 krb5_krbhst_reset(krb5_context context, krb5_krbhst_handle handle)
737 handle->index = &handle->hosts;
740 void KRB5_LIB_FUNCTION
741 krb5_krbhst_free(krb5_context context, krb5_krbhst_handle handle)
743 krb5_krbhst_info *h, *next;
748 for (h = handle->hosts; h != NULL; h = next) {
757 /* backwards compatibility ahead */
759 static krb5_error_code
760 gethostlist(krb5_context context, const char *realm,
761 unsigned int type, char ***hostlist)
765 krb5_krbhst_handle handle;
766 char host[MAXHOSTNAMELEN];
767 krb5_krbhst_info *hostinfo;
769 ret = krb5_krbhst_init(context, realm, type, &handle);
773 while(krb5_krbhst_next(context, handle, &hostinfo) == 0)
776 return KRB5_KDC_UNREACH;
777 *hostlist = calloc(nhost + 1, sizeof(**hostlist));
778 if(*hostlist == NULL) {
779 krb5_krbhst_free(context, handle);
783 krb5_krbhst_reset(context, handle);
785 while(krb5_krbhst_next_as_string(context, handle,
786 host, sizeof(host)) == 0) {
787 if(((*hostlist)[nhost++] = strdup(host)) == NULL) {
788 krb5_free_krbhst(context, *hostlist);
789 krb5_krbhst_free(context, handle);
793 (*hostlist)[nhost++] = NULL;
794 krb5_krbhst_free(context, handle);
799 * return an malloced list of kadmin-hosts for `realm' in `hostlist'
802 krb5_error_code KRB5_LIB_FUNCTION
803 krb5_get_krb_admin_hst (krb5_context context,
804 const krb5_realm *realm,
807 return gethostlist(context, *realm, KRB5_KRBHST_ADMIN, hostlist);
811 * return an malloced list of changepw-hosts for `realm' in `hostlist'
814 krb5_error_code KRB5_LIB_FUNCTION
815 krb5_get_krb_changepw_hst (krb5_context context,
816 const krb5_realm *realm,
819 return gethostlist(context, *realm, KRB5_KRBHST_CHANGEPW, hostlist);
823 * return an malloced list of 524-hosts for `realm' in `hostlist'
826 krb5_error_code KRB5_LIB_FUNCTION
827 krb5_get_krb524hst (krb5_context context,
828 const krb5_realm *realm,
831 return gethostlist(context, *realm, KRB5_KRBHST_KRB524, hostlist);
836 * return an malloced list of KDC's for `realm' in `hostlist'
839 krb5_error_code KRB5_LIB_FUNCTION
840 krb5_get_krbhst (krb5_context context,
841 const krb5_realm *realm,
844 return gethostlist(context, *realm, KRB5_KRBHST_KDC, hostlist);
848 * free all the memory allocated in `hostlist'
851 krb5_error_code KRB5_LIB_FUNCTION
852 krb5_free_krbhst (krb5_context context,
857 for (p = hostlist; *p; ++p)