1/*
2 * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35#include <resolve.h>
36#include "config_plugin.h"
37
38/* To automagically find the correct realm of a host (without
39 * [domain_realm] in krb5.conf) add a text record for your domain with
40 * the name of your realm, like this:
41 *
42 * _kerberos	IN	TXT	"FOO.SE"
43 *
44 * The search is recursive, so you can add entries for specific
45 * hosts. To find the realm of host a.b.c, it first tries
46 * _kerberos.a.b.c, then _kerberos.b.c and so on.
47 *
48 * This method is described in draft-ietf-cat-krb-dns-locate-03.txt.
49 *
50 */
51
52static int
53copy_txt_to_realms (struct rk_resource_record *head,
54		    krb5_realm **realms)
55{
56    struct rk_resource_record *rr;
57    unsigned int n, i;
58
59    for(n = 0, rr = head; rr; rr = rr->next)
60	if (rr->type == rk_ns_t_txt)
61	    ++n;
62
63    if (n == 0)
64	return -1;
65
66    *realms = malloc ((n + 1) * sizeof(krb5_realm));
67    if (*realms == NULL)
68	return -1;
69
70    for (i = 0; i < n + 1; ++i)
71	(*realms)[i] = NULL;
72
73    for (i = 0, rr = head; rr; rr = rr->next) {
74	if (rr->type == rk_ns_t_txt) {
75	    char *tmp;
76
77	    tmp = strdup(rr->u.txt);
78	    if (tmp == NULL) {
79		for (i = 0; i < n; ++i)
80		    free ((*realms)[i]);
81		free (*realms);
82		return -1;
83	    }
84	    (*realms)[i] = tmp;
85	    ++i;
86	}
87    }
88    return 0;
89}
90
91static int
92dns_find_realm(krb5_context context,
93	       const char *domain,
94	       krb5_realm **realms)
95{
96    static const char *default_labels[] = { "_kerberos", NULL };
97    char dom[MAXHOSTNAMELEN];
98    struct rk_dns_reply *r;
99    const char **labels;
100    char **config_labels;
101    int i, ret;
102
103    config_labels = krb5_config_get_strings(context, NULL, "libdefaults",
104					    "dns_lookup_realm_labels", NULL);
105    if(config_labels != NULL)
106	labels = (const char **)config_labels;
107    else
108	labels = default_labels;
109    if(*domain == '.')
110	domain++;
111    for (i = 0; labels[i] != NULL; i++) {
112	ret = snprintf(dom, sizeof(dom), "%s.%s.", labels[i], domain);
113	if(ret < 0 || (size_t)ret >= sizeof(dom)) {
114	    if (config_labels)
115		krb5_config_free_strings(config_labels);
116	    return -1;
117	}
118    	r = rk_dns_lookup(dom, "TXT");
119    	if(r != NULL) {
120	    ret = copy_txt_to_realms (r->head, realms);
121	    rk_dns_free_data(r);
122	    if(ret == 0) {
123		if (config_labels)
124		    krb5_config_free_strings(config_labels);
125		return 0;
126	    }
127	}
128    }
129    if (config_labels)
130	krb5_config_free_strings(config_labels);
131    return -1;
132}
133
134/*
135 * Try to figure out what realms host in `domain' belong to from the
136 * configuration file.
137 */
138
139static int
140config_find_realm(krb5_context context,
141		  const char *domain,
142		  krb5_realm **realms)
143{
144    char **tmp = krb5_config_get_strings (context, NULL,
145					  "domain_realm",
146					  domain,
147					  NULL);
148
149    if (tmp == NULL)
150	return -1;
151    *realms = tmp;
152    return 0;
153}
154
155/*
156 * This function assumes that `host' is a FQDN (and doesn't handle the
157 * special case of host == NULL either).
158 * Try to find mapping in the config file or DNS and it that fails,
159 * fall back to guessing
160 */
161
162KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
163_krb5_get_host_realm_int (krb5_context context,
164			  const char *host,
165			  krb5_boolean use_dns,
166			  krb5_realm **realms)
167{
168    const char *p, *q;
169    krb5_boolean dns_locate_enable;
170
171    dns_locate_enable = krb5_config_get_bool_default(context, NULL,
172        KRB5_DNS_DOMAIN_REALM_DEFAULT,
173	"libdefaults", "dns_lookup_realm", NULL);
174    for (p = host; p != NULL; p = strchr (p + 1, '.')) {
175	if(config_find_realm(context, p, realms) == 0) {
176	    if(strcasecmp(*realms[0], "dns_locate") == 0) {
177		if(use_dns)
178		    for (q = host; q != NULL; q = strchr(q + 1, '.'))
179			if(dns_find_realm(context, q, realms) == 0)
180			    return 0;
181		continue;
182	    } else
183	    	return 0;
184	}
185	else if(use_dns && dns_locate_enable) {
186	    if(dns_find_realm(context, p, realms) == 0)
187		return 0;
188	}
189    }
190    p = strchr(host, '.');
191    if(p != NULL) {
192	p++;
193	*realms = malloc(2 * sizeof(krb5_realm));
194	if (*realms == NULL) {
195	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
196	    return ENOMEM;
197	}
198
199	(*realms)[0] = strdup(p);
200	if((*realms)[0] == NULL) {
201	    free(*realms);
202	    krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
203	    return ENOMEM;
204	}
205	strupr((*realms)[0]);
206	(*realms)[1] = NULL;
207	return 0;
208    }
209    krb5_set_error_message(context, KRB5_ERR_HOST_REALM_UNKNOWN,
210			   N_("unable to find realm of host %s", ""),
211			   host);
212    return KRB5_ERR_HOST_REALM_UNKNOWN;
213}
214
215/*
216 * Query plugins for domain realm mappings
217 */
218
219static void
220add_host_domain(krb5_context context, void *userctx, krb5_const_realm realm)
221{
222    heim_array_t array = userctx;
223    heim_string_t s = heim_string_create(realm);
224
225    if (s) {
226	heim_array_append_value(array, s);
227	heim_release(s);
228    }
229}
230
231struct host_domain_ctx {
232    const char *host;
233    heim_array_t array;
234};
235
236static krb5_error_code
237config_plugin(krb5_context context,
238	      const void *plug, void *plugctx, void *userctx)
239{
240    const krb5plugin_config_ftable *config = plug;
241    struct host_domain_ctx *ctx = userctx;
242    if (config->get_host_domain == NULL)
243	return KRB5_PLUGIN_NO_HANDLE;
244
245    return config->get_host_domain(context, ctx->host, plugctx, ctx->array, add_host_domain);
246}
247
248static krb5_error_code
249get_plugin(krb5_context context, const char *hostname, heim_array_t array)
250{
251    struct host_domain_ctx ctx;
252
253    ctx.host = hostname;
254    ctx.array = array;
255
256    return krb5_plugin_run_f(context, "krb5",
257			     KRB5_PLUGIN_CONFIGURATION,
258			     KRB5_PLUGIN_CONFIGURATION_VERSION_1,
259			     0, &ctx, config_plugin);
260}
261
262/*
263 *
264 */
265
266static void
267merge_irealm(heim_array_t array, krb5_realm *irealm)
268{
269    size_t len;
270
271    for (len = 0; irealm[len]; len++) {
272	heim_string_t r = heim_string_create(irealm[len]);
273	if (r) {
274	    if (!heim_array_contains_value(array, r))
275		heim_array_append_value(array, r);
276	    heim_release(r);
277	}
278    }
279}
280
281/*
282 * Return the realm(s) of `host' as a NULL-terminated list in
283 * `realms'. Free `realms' with krb5_free_host_realm().
284 */
285
286KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
287krb5_get_host_realm(krb5_context context,
288		    const char *host,
289		    krb5_realm **realms)
290{
291    char hostname[MAXHOSTNAMELEN];
292    krb5_error_code ret;
293    size_t len;
294    heim_array_t array;
295    int use_dns;
296    krb5_realm *irealm = NULL;
297
298    if (host == NULL) {
299	if (gethostname (hostname, sizeof(hostname))) {
300	    *realms = NULL;
301	    return errno;
302	}
303	hostname[sizeof(hostname) - 1] = '\0';
304    } else
305	strlcpy(hostname, host, sizeof(hostname));
306
307    /*
308     * Squash any trailing .
309     */
310
311    len = strlen(hostname);
312    if (len > 0 && hostname[len - 1] == '.')
313	hostname[len - 1] = '\0';
314
315    array = heim_array_create();
316    if (array == NULL)
317	return ENOMEM;
318
319
320    ret = config_find_realm(context, hostname, &irealm);
321    if (ret == 0 && irealm) {
322	merge_irealm(array, irealm);
323	krb5_free_host_realm(context, irealm);
324    }
325
326    /*
327     * Check plugins
328     */
329
330    get_plugin(context, hostname, array);
331
332    /*
333     * If our local hostname is without components, don't even try to dns.
334     */
335
336    use_dns = (strchr(hostname, '.') != NULL);
337
338    ret = _krb5_get_host_realm_int (context, hostname, use_dns, &irealm);
339    if (ret == 0 && irealm) {
340	merge_irealm(array, irealm);
341	krb5_free_host_realm(context, irealm);
342    }
343
344    if (heim_array_get_length(array) == 0 && host != NULL) {
345	/*
346	 * If there was no realm mapping for the host (and we wasn't
347	 * looking for ourself), guess at the local realm, maybe our
348	 * KDC knows better then we do and we get a referral back.
349	 */
350	ret = krb5_get_default_realms(context, realms);
351	if (ret) {
352	    krb5_set_error_message(context, KRB5_ERR_HOST_REALM_UNKNOWN,
353				   N_("Unable to find realm of host %s", ""),
354				   hostname);
355	    return KRB5_ERR_HOST_REALM_UNKNOWN;
356	}
357    }
358    ret = _krb5_array_to_realms(context, array, realms);
359    heim_release(array);
360    return ret;
361}
362