1/*
2 * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36/* this is an attempt at one of the most horrible `compression'
37   schemes that has ever been invented; it's so amazingly brain-dead
38   that words can not describe it, and all this just to save a few
39   silly bytes */
40
41struct tr_realm {
42    char *realm;
43    unsigned leading_space:1;
44    unsigned leading_slash:1;
45    unsigned trailing_dot:1;
46    struct tr_realm *next;
47};
48
49static void
50free_realms(struct tr_realm *r)
51{
52    struct tr_realm *p;
53    while(r){
54	p = r;
55	r = r->next;
56	free(p->realm);
57	free(p);
58    }
59}
60
61static int
62make_path(krb5_context context, struct tr_realm *r,
63	  const char *from, const char *to)
64{
65    struct tr_realm *tmp;
66    const char *p;
67
68    if(strlen(from) < strlen(to)){
69	const char *str;
70	str = from;
71	from = to;
72	to = str;
73    }
74
75    if(strcmp(from + strlen(from) - strlen(to), to) == 0){
76	p = from;
77	while(1){
78	    p = strchr(p, '.');
79	    if(p == NULL) {
80		krb5_clear_error_message (context);
81		return KRB5KDC_ERR_POLICY;
82	    }
83	    p++;
84	    if(strcmp(p, to) == 0)
85		break;
86	    tmp = calloc(1, sizeof(*tmp));
87	    if(tmp == NULL)
88		return krb5_enomem(context);
89	    tmp->next = r->next;
90	    r->next = tmp;
91	    tmp->realm = strdup(p);
92	    if(tmp->realm == NULL){
93		r->next = tmp->next;
94		free(tmp);
95		return krb5_enomem(context);
96	    }
97	}
98    }else if(strncmp(from, to, strlen(to)) == 0){
99	p = from + strlen(from);
100	while(1){
101	    while(p >= from && *p != '/') p--;
102	    if(p == from)
103		return KRB5KDC_ERR_POLICY;
104
105	    if(strncmp(to, from, p - from) == 0)
106		break;
107	    tmp = calloc(1, sizeof(*tmp));
108	    if(tmp == NULL)
109		return krb5_enomem(context);
110	    tmp->next = r->next;
111	    r->next = tmp;
112	    tmp->realm = malloc(p - from + 1);
113	    if(tmp->realm == NULL){
114		r->next = tmp->next;
115		free(tmp);
116		return krb5_enomem(context);
117	    }
118	    memcpy(tmp->realm, from, p - from);
119	    tmp->realm[p - from] = '\0';
120	    p--;
121	}
122    } else {
123	krb5_clear_error_message (context);
124	return KRB5KDC_ERR_POLICY;
125    }
126
127    return 0;
128}
129
130static int
131make_paths(krb5_context context,
132	   struct tr_realm *realms, const char *client_realm,
133	   const char *server_realm)
134{
135    struct tr_realm *r;
136    int ret;
137    const char *prev_realm = client_realm;
138    const char *next_realm = NULL;
139    for(r = realms; r; r = r->next){
140	/* it *might* be that you can have more than one empty
141	   component in a row, at least that's how I interpret the
142	   "," exception in 1510 */
143	if(r->realm[0] == '\0'){
144	    while(r->next && r->next->realm[0] == '\0')
145		r = r->next;
146	    if(r->next)
147		next_realm = r->next->realm;
148	    else
149		next_realm = server_realm;
150	    ret = make_path(context, r, prev_realm, next_realm);
151	    if(ret){
152		free_realms(realms);
153		return ret;
154	    }
155	}
156	prev_realm = r->realm;
157    }
158    return 0;
159}
160
161static int
162expand_realms(krb5_context context,
163	      struct tr_realm *realms, const char *client_realm)
164{
165    struct tr_realm *r;
166    const char *prev_realm = NULL;
167    for(r = realms; r; r = r->next){
168	if(r->trailing_dot){
169	    char *tmp;
170	    size_t len;
171
172	    if(prev_realm == NULL)
173		prev_realm = client_realm;
174
175	    len = strlen(r->realm) + strlen(prev_realm) + 1;
176
177	    tmp = realloc(r->realm, len);
178	    if(tmp == NULL){
179		free_realms(realms);
180		return krb5_enomem(context);
181	    }
182	    r->realm = tmp;
183	    strlcat(r->realm, prev_realm, len);
184	}else if(r->leading_slash && !r->leading_space && prev_realm){
185	    /* yet another exception: if you use x500-names, the
186               leading realm doesn't have to be "quoted" with a space */
187	    char *tmp;
188	    size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
189
190	    tmp = malloc(len);
191	    if(tmp == NULL){
192		free_realms(realms);
193		return krb5_enomem(context);
194	    }
195	    strlcpy(tmp, prev_realm, len);
196	    strlcat(tmp, r->realm, len);
197	    free(r->realm);
198	    r->realm = tmp;
199	}
200	prev_realm = r->realm;
201    }
202    return 0;
203}
204
205static struct tr_realm *
206make_realm(char *realm)
207{
208    struct tr_realm *r;
209    char *p, *q;
210    int quote = 0;
211    r = calloc(1, sizeof(*r));
212    if(r == NULL){
213	free(realm);
214	return NULL;
215    }
216    r->realm = realm;
217    for(p = q = r->realm; *p; p++){
218	if(p == r->realm && *p == ' '){
219	    r->leading_space = 1;
220	    continue;
221	}
222	if(q == r->realm && *p == '/')
223	    r->leading_slash = 1;
224	if(quote){
225	    *q++ = *p;
226	    quote = 0;
227	    continue;
228	}
229	if(*p == '\\'){
230	    quote = 1;
231	    continue;
232	}
233	if(p[0] == '.' && p[1] == '\0')
234	    r->trailing_dot = 1;
235	*q++ = *p;
236    }
237    *q = '\0';
238    return r;
239}
240
241static struct tr_realm*
242append_realm(struct tr_realm *head, struct tr_realm *r)
243{
244    struct tr_realm *p;
245    if(head == NULL){
246	r->next = NULL;
247	return r;
248    }
249    p = head;
250    while(p->next) p = p->next;
251    p->next = r;
252    return head;
253}
254
255static int
256decode_realms(krb5_context context,
257	      const char *tr, int length, struct tr_realm **realms)
258{
259    struct tr_realm *r = NULL;
260
261    char *tmp;
262    int quote = 0;
263    const char *start = tr;
264    int i;
265
266    for(i = 0; i < length; i++){
267	if(quote){
268	    quote = 0;
269	    continue;
270	}
271	if(tr[i] == '\\'){
272	    quote = 1;
273	    continue;
274	}
275	if(tr[i] == ','){
276	    tmp = malloc(tr + i - start + 1);
277	    if(tmp == NULL)
278		return krb5_enomem(context);
279	    memcpy(tmp, start, tr + i - start);
280	    tmp[tr + i - start] = '\0';
281	    r = make_realm(tmp);
282	    if(r == NULL){
283		free_realms(*realms);
284		return krb5_enomem(context);
285	    }
286	    *realms = append_realm(*realms, r);
287	    start = tr + i + 1;
288	}
289    }
290    tmp = malloc(tr + i - start + 1);
291    if(tmp == NULL){
292	free(*realms);
293	return krb5_enomem(context);
294    }
295    memcpy(tmp, start, tr + i - start);
296    tmp[tr + i - start] = '\0';
297    r = make_realm(tmp);
298    if(r == NULL){
299	free_realms(*realms);
300	return krb5_enomem(context);
301    }
302    *realms = append_realm(*realms, r);
303
304    return 0;
305}
306
307
308KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
309krb5_domain_x500_decode(krb5_context context,
310			krb5_data tr, char ***realms, unsigned int *num_realms,
311			const char *client_realm, const char *server_realm)
312{
313    struct tr_realm *r = NULL;
314    struct tr_realm *p, **q;
315    int ret;
316
317    if(tr.length == 0) {
318	*realms = NULL;
319	*num_realms = 0;
320	return 0;
321    }
322
323    /* split string in components */
324    ret = decode_realms(context, tr.data, tr.length, &r);
325    if(ret)
326	return ret;
327
328    /* apply prefix rule */
329    ret = expand_realms(context, r, client_realm);
330    if(ret)
331	return ret;
332
333    ret = make_paths(context, r, client_realm, server_realm);
334    if(ret)
335	return ret;
336
337    /* remove empty components and count realms */
338    *num_realms = 0;
339    for(q = &r; *q; ){
340	if((*q)->realm[0] == '\0'){
341	    p = *q;
342	    *q = (*q)->next;
343	    free(p->realm);
344	    free(p);
345	}else{
346	    q = &(*q)->next;
347	    (*num_realms)++;
348	}
349    }
350    if (*num_realms + 1 > UINT_MAX/sizeof(**realms))
351	return ERANGE;
352
353    {
354	char **R;
355	R = malloc((*num_realms + 1) * sizeof(*R));
356	if (R == NULL)
357	    return krb5_enomem(context);
358	*realms = R;
359	while(r){
360	    *R++ = r->realm;
361	    p = r->next;
362	    free(r);
363	    r = p;
364	}
365    }
366    return 0;
367}
368
369KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
370krb5_domain_x500_encode(char **realms, unsigned int num_realms,
371			krb5_data *encoding)
372{
373    char *s = NULL;
374    int len = 0;
375    unsigned int i;
376    krb5_data_zero(encoding);
377    if (num_realms == 0)
378	return 0;
379    for(i = 0; i < num_realms; i++){
380	len += strlen(realms[i]);
381	if(realms[i][0] == '/')
382	    len++;
383    }
384    len += num_realms - 1;
385    s = malloc(len + 1);
386    if (s == NULL)
387	return ENOMEM;
388    *s = '\0';
389    for(i = 0; i < num_realms; i++){
390	if(i)
391	    strlcat(s, ",", len + 1);
392	if(realms[i][0] == '/')
393	    strlcat(s, " ", len + 1);
394	strlcat(s, realms[i], len + 1);
395    }
396    encoding->data = s;
397    encoding->length = strlen(s);
398    return 0;
399}
400
401KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
402krb5_check_transited(krb5_context context,
403		     krb5_const_realm client_realm,
404		     krb5_const_realm server_realm,
405		     krb5_realm *realms,
406		     unsigned int num_realms,
407		     int *bad_realm)
408{
409    char **tr_realms;
410    char **p;
411    size_t i;
412
413    if(num_realms == 0)
414	return 0;
415
416    tr_realms = krb5_config_get_strings(context, NULL,
417					"capaths",
418					client_realm,
419					server_realm,
420					NULL);
421    for(i = 0; i < num_realms; i++) {
422	for(p = tr_realms; p && *p; p++) {
423	    if(strcmp(*p, realms[i]) == 0)
424		break;
425	}
426	if(p == NULL || *p == NULL) {
427	    krb5_config_free_strings(tr_realms);
428	    krb5_set_error_message (context, KRB5KRB_AP_ERR_ILL_CR_TKT,
429				    N_("no transit allowed "
430				       "through realm %s", ""),
431				    realms[i]);
432	    if(bad_realm)
433		*bad_realm = i;
434	    return KRB5KRB_AP_ERR_ILL_CR_TKT;
435	}
436    }
437    krb5_config_free_strings(tr_realms);
438    return 0;
439}
440
441KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
442krb5_check_transited_realms(krb5_context context,
443			    const char *const *realms,
444			    unsigned int num_realms,
445			    int *bad_realm)
446{
447    size_t i;
448    int ret = 0;
449    char **bad_realms = krb5_config_get_strings(context, NULL,
450						"libdefaults",
451						"transited_realms_reject",
452						NULL);
453    if(bad_realms == NULL)
454	return 0;
455
456    for(i = 0; i < num_realms; i++) {
457	char **p;
458	for(p = bad_realms; *p; p++)
459	    if(strcmp(*p, realms[i]) == 0) {
460		ret = KRB5KRB_AP_ERR_ILL_CR_TKT;
461		krb5_set_error_message (context, ret,
462					N_("no transit allowed "
463					   "through realm %s", ""),
464					*p);
465		if(bad_realm)
466		    *bad_realm = i;
467		break;
468	    }
469    }
470    krb5_config_free_strings(bad_realms);
471    return ret;
472}
473
474#if 0
475int
476main(int argc, char **argv)
477{
478    krb5_data x;
479    char **r;
480    int num, i;
481    x.data = argv[1];
482    x.length = strlen(x.data);
483    if(domain_expand(x, &r, &num, argv[2], argv[3]))
484	exit(1);
485    for(i = 0; i < num; i++)
486	printf("%s\n", r[i]);
487    return 0;
488}
489#endif
490
491