2 * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
35 #ifdef HAVE_RES_SEARCH
38 #ifdef HAVE_ARPA_NAMESER_H
39 #include <arpa/nameser.h>
44 RCSID("$Id: principal.c,v 1.82.2.1 2003/08/15 14:30:07 lha Exp $");
46 #define princ_num_comp(P) ((P)->name.name_string.len)
47 #define princ_type(P) ((P)->name.name_type)
48 #define princ_comp(P) ((P)->name.name_string.val)
49 #define princ_ncomp(P, N) ((P)->name.name_string.val[(N)])
50 #define princ_realm(P) ((P)->realm)
53 krb5_free_principal(krb5_context context,
63 krb5_principal_get_type(krb5_context context,
64 krb5_principal principal)
66 return princ_type(principal);
70 krb5_principal_get_realm(krb5_context context,
71 krb5_principal principal)
73 return princ_realm(principal);
77 krb5_principal_get_comp_string(krb5_context context,
78 krb5_principal principal,
79 unsigned int component)
81 if(component >= princ_num_comp(principal))
83 return princ_ncomp(principal, component);
87 krb5_parse_name(krb5_context context,
89 krb5_principal *principal)
105 /* count number of component */
107 for(p = name; *p; p++){
110 krb5_set_error_string (context,
111 "trailing \\ in principal name");
112 return KRB5_PARSE_MALFORMED;
118 comp = calloc(ncomp, sizeof(*comp));
120 krb5_set_error_string (context, "malloc: out of memory");
125 p = start = q = s = strdup(name);
128 krb5_set_error_string (context, "malloc: out of memory");
144 krb5_set_error_string (context,
145 "trailing \\ in principal name");
146 ret = KRB5_PARSE_MALFORMED;
149 }else if(c == '/' || c == '@'){
151 krb5_set_error_string (context,
152 "part after realm in principal name");
153 ret = KRB5_PARSE_MALFORMED;
156 comp[n] = malloc(q - start + 1);
157 if (comp[n] == NULL) {
158 krb5_set_error_string (context, "malloc: out of memory");
162 memcpy(comp[n], start, q - start);
163 comp[n][q - start] = 0;
171 if(got_realm && (c == ':' || c == '/' || c == '\0')) {
172 krb5_set_error_string (context,
173 "part after realm in principal name");
174 ret = KRB5_PARSE_MALFORMED;
180 realm = malloc(q - start + 1);
182 krb5_set_error_string (context, "malloc: out of memory");
186 memcpy(realm, start, q - start);
187 realm[q - start] = 0;
189 ret = krb5_get_default_realm (context, &realm);
193 comp[n] = malloc(q - start + 1);
194 if (comp[n] == NULL) {
195 krb5_set_error_string (context, "malloc: out of memory");
199 memcpy(comp[n], start, q - start);
200 comp[n][q - start] = 0;
203 *principal = malloc(sizeof(**principal));
204 if (*principal == NULL) {
205 krb5_set_error_string (context, "malloc: out of memory");
209 (*principal)->name.name_type = KRB5_NT_PRINCIPAL;
210 (*principal)->name.name_string.val = comp;
211 princ_num_comp(*principal) = n;
212 (*principal)->realm = realm;
224 static const char quotable_chars[] = " \n\t\b\\/@";
225 static const char replace_chars[] = " ntb\\/@";
227 #define add_char(BASE, INDEX, LEN, C) do { if((INDEX) < (LEN)) (BASE)[(INDEX)++] = (C); }while(0);
230 quote_string(const char *s, char *out, size_t index, size_t len)
233 for(p = s; *p && index < len; p++){
234 if((q = strchr(quotable_chars, *p))){
235 add_char(out, index, len, '\\');
236 add_char(out, index, len, replace_chars[q - quotable_chars]);
238 add_char(out, index, len, *p);
246 static krb5_error_code
247 unparse_name_fixed(krb5_context context,
248 krb5_const_principal principal,
251 krb5_boolean short_form)
255 for(i = 0; i < princ_num_comp(principal); i++){
257 add_char(name, index, len, '/');
258 index = quote_string(princ_ncomp(principal, i), name, index, len);
262 /* add realm if different from default realm */
266 ret = krb5_get_default_realm(context, &r);
269 if(strcmp(princ_realm(principal), r) != 0)
274 add_char(name, index, len, '@');
275 index = quote_string(princ_realm(principal), name, index, len);
283 krb5_unparse_name_fixed(krb5_context context,
284 krb5_const_principal principal,
288 return unparse_name_fixed(context, principal, name, len, FALSE);
292 krb5_unparse_name_fixed_short(krb5_context context,
293 krb5_const_principal principal,
297 return unparse_name_fixed(context, principal, name, len, TRUE);
300 static krb5_error_code
301 unparse_name(krb5_context context,
302 krb5_const_principal principal,
304 krb5_boolean short_flag)
306 size_t len = 0, plen;
310 plen = strlen(princ_realm(principal));
311 if(strcspn(princ_realm(principal), quotable_chars) == plen)
316 for(i = 0; i < princ_num_comp(principal); i++){
317 plen = strlen(princ_ncomp(principal, i));
318 if(strcspn(princ_ncomp(principal, i), quotable_chars) == plen)
327 krb5_set_error_string (context, "malloc: out of memory");
330 ret = unparse_name_fixed(context, principal, *name, len, short_flag);
339 krb5_unparse_name(krb5_context context,
340 krb5_const_principal principal,
343 return unparse_name(context, principal, name, FALSE);
347 krb5_unparse_name_short(krb5_context context,
348 krb5_const_principal principal,
351 return unparse_name(context, principal, name, TRUE);
354 #if 0 /* not implemented */
357 krb5_unparse_name_ext(krb5_context context,
358 krb5_const_principal principal,
362 krb5_abortx(context, "unimplemented krb5_unparse_name_ext called");
368 krb5_princ_realm(krb5_context context,
369 krb5_principal principal)
371 return &princ_realm(principal);
376 krb5_princ_set_realm(krb5_context context,
377 krb5_principal principal,
380 princ_realm(principal) = *realm;
385 krb5_build_principal(krb5_context context,
386 krb5_principal *principal,
388 krb5_const_realm realm,
394 ret = krb5_build_principal_va(context, principal, rlen, realm, ap);
399 static krb5_error_code
400 append_component(krb5_context context, krb5_principal p,
405 size_t len = princ_num_comp(p);
407 tmp = realloc(princ_comp(p), (len + 1) * sizeof(*tmp));
409 krb5_set_error_string (context, "malloc: out of memory");
413 princ_ncomp(p, len) = malloc(comp_len + 1);
414 if (princ_ncomp(p, len) == NULL) {
415 krb5_set_error_string (context, "malloc: out of memory");
418 memcpy (princ_ncomp(p, len), comp, comp_len);
419 princ_ncomp(p, len)[comp_len] = '\0';
425 va_ext_princ(krb5_context context, krb5_principal p, va_list ap)
430 len = va_arg(ap, int);
433 s = va_arg(ap, const char*);
434 append_component(context, p, s, len);
439 va_princ(krb5_context context, krb5_principal p, va_list ap)
443 s = va_arg(ap, const char*);
446 append_component(context, p, s, strlen(s));
451 static krb5_error_code
452 build_principal(krb5_context context,
453 krb5_principal *principal,
455 krb5_const_realm realm,
456 void (*func)(krb5_context, krb5_principal, va_list),
461 p = calloc(1, sizeof(*p));
463 krb5_set_error_string (context, "malloc: out of memory");
466 princ_type(p) = KRB5_NT_PRINCIPAL;
468 princ_realm(p) = strdup(realm);
469 if(p->realm == NULL){
471 krb5_set_error_string (context, "malloc: out of memory");
475 (*func)(context, p, ap);
481 krb5_make_principal(krb5_context context,
482 krb5_principal *principal,
483 krb5_const_realm realm,
490 ret = krb5_get_default_realm(context, &r);
496 ret = krb5_build_principal_va(context, principal, strlen(realm), realm, ap);
504 krb5_build_principal_va(krb5_context context,
505 krb5_principal *principal,
507 krb5_const_realm realm,
510 return build_principal(context, principal, rlen, realm, va_princ, ap);
514 krb5_build_principal_va_ext(krb5_context context,
515 krb5_principal *principal,
517 krb5_const_realm realm,
520 return build_principal(context, principal, rlen, realm, va_ext_princ, ap);
525 krb5_build_principal_ext(krb5_context context,
526 krb5_principal *principal,
528 krb5_const_realm realm,
534 ret = krb5_build_principal_va_ext(context, principal, rlen, realm, ap);
541 krb5_copy_principal(krb5_context context,
542 krb5_const_principal inprinc,
543 krb5_principal *outprinc)
545 krb5_principal p = malloc(sizeof(*p));
547 krb5_set_error_string (context, "malloc: out of memory");
550 if(copy_Principal(inprinc, p)) {
552 krb5_set_error_string (context, "malloc: out of memory");
560 * return TRUE iff princ1 == princ2 (without considering the realm)
564 krb5_principal_compare_any_realm(krb5_context context,
565 krb5_const_principal princ1,
566 krb5_const_principal princ2)
569 if(princ_num_comp(princ1) != princ_num_comp(princ2))
571 for(i = 0; i < princ_num_comp(princ1); i++){
572 if(strcmp(princ_ncomp(princ1, i), princ_ncomp(princ2, i)) != 0)
579 * return TRUE iff princ1 == princ2
583 krb5_principal_compare(krb5_context context,
584 krb5_const_principal princ1,
585 krb5_const_principal princ2)
587 if(!krb5_realm_compare(context, princ1, princ2))
589 return krb5_principal_compare_any_realm(context, princ1, princ2);
593 * return TRUE iff realm(princ1) == realm(princ2)
597 krb5_realm_compare(krb5_context context,
598 krb5_const_principal princ1,
599 krb5_const_principal princ2)
601 return strcmp(princ_realm(princ1), princ_realm(princ2)) == 0;
605 * return TRUE iff princ matches pattern
609 krb5_principal_match(krb5_context context,
610 krb5_const_principal princ,
611 krb5_const_principal pattern)
614 if(princ_num_comp(princ) != princ_num_comp(pattern))
616 if(fnmatch(princ_realm(pattern), princ_realm(princ), 0) != 0)
618 for(i = 0; i < princ_num_comp(princ); i++){
619 if(fnmatch(princ_ncomp(pattern, i), princ_ncomp(princ, i), 0) != 0)
626 struct v4_name_convert {
629 } default_v4_name_convert[] = {
631 { "hprop", "hprop" },
640 * return the converted instance name of `name' in `realm'.
641 * look in the configuration file and then in the default set above.
642 * return NULL if no conversion is appropriate.
646 get_name_conversion(krb5_context context, const char *realm, const char *name)
648 struct v4_name_convert *q;
651 p = krb5_config_get_string(context, NULL, "realms", realm,
652 "v4_name_convert", "host", name, NULL);
654 p = krb5_config_get_string(context, NULL, "libdefaults",
655 "v4_name_convert", "host", name, NULL);
659 /* XXX should be possible to override default list */
660 p = krb5_config_get_string(context, NULL,
669 p = krb5_config_get_string(context, NULL,
677 for(q = default_v4_name_convert; q->from; q++)
678 if(strcmp(q->from, name) == 0)
684 * convert the v4 principal `name.instance@realm' to a v5 principal in `princ'.
685 * if `resolve', use DNS.
686 * if `func', use that function for validating the conversion
690 krb5_425_conv_principal_ext(krb5_context context,
692 const char *instance,
694 krb5_boolean (*func)(krb5_context, krb5_principal),
695 krb5_boolean resolve,
696 krb5_principal *princ)
701 char host[MAXHOSTNAMELEN];
702 char local_hostname[MAXHOSTNAMELEN];
704 /* do the following: if the name is found in the
705 `v4_name_convert:host' part, is is assumed to be a `host' type
706 principal, and the instance is looked up in the
707 `v4_instance_convert' part. if not found there the name is
708 (optionally) looked up as a hostname, and if that doesn't yield
709 anything, the `default_domain' is appended to the instance
714 if(instance[0] == 0){
718 p = get_name_conversion(context, realm, name);
722 p = krb5_config_get_string(context, NULL, "realms", realm,
723 "v4_instance_convert", instance, NULL);
726 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
727 if(func == NULL || (*func)(context, pr)){
731 krb5_free_principal(context, pr);
733 krb5_clear_error_string (context);
734 return HEIM_ERR_V4_PRINC_NO_CONV;
737 krb5_boolean passed = FALSE;
742 r = dns_lookup(instance, "aaaa");
743 if (r && r->head && r->head->type == T_AAAA) {
744 inst = strdup(r->head->domain);
748 r = dns_lookup(instance, "a");
749 if(r && r->head && r->head->type == T_A) {
750 inst = strdup(r->head->domain);
756 struct addrinfo hints, *ai;
759 memset (&hints, 0, sizeof(hints));
760 hints.ai_flags = AI_CANONNAME;
761 ret = getaddrinfo(instance, NULL, &hints, &ai);
763 const struct addrinfo *a;
764 for (a = ai; a != NULL; a = a->ai_next) {
765 if (a->ai_canonname != NULL) {
766 inst = strdup (a->ai_canonname);
776 krb5_set_error_string (context, "malloc: out of memory");
780 ret = krb5_make_principal(context, &pr, realm, name, inst,
784 if(func == NULL || (*func)(context, pr)){
788 krb5_free_principal(context, pr);
793 snprintf(host, sizeof(host), "%s.%s", instance, realm);
795 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
796 if((*func)(context, pr)){
800 krb5_free_principal(context, pr);
804 * if the instance is the first component of the local hostname,
805 * the converted host should be the long hostname.
809 gethostname (local_hostname, sizeof(local_hostname)) == 0 &&
810 strncmp(instance, local_hostname, strlen(instance)) == 0 &&
811 local_hostname[strlen(instance)] == '.') {
812 strlcpy(host, local_hostname, sizeof(host));
818 domains = krb5_config_get_strings(context, NULL, "realms", realm,
820 for(d = domains; d && *d; d++){
821 snprintf(host, sizeof(host), "%s.%s", instance, *d);
822 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
823 if(func == NULL || (*func)(context, pr)){
825 krb5_config_free_strings(domains);
828 krb5_free_principal(context, pr);
830 krb5_config_free_strings(domains);
834 p = krb5_config_get_string(context, NULL, "realms", realm,
835 "default_domain", NULL);
837 /* this should be an error, just faking a name is not good */
838 krb5_clear_error_string (context);
839 return HEIM_ERR_V4_PRINC_NO_CONV;
844 snprintf(host, sizeof(host), "%s.%s", instance, p);
846 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
847 if(func == NULL || (*func)(context, pr)){
851 krb5_free_principal(context, pr);
852 krb5_clear_error_string (context);
853 return HEIM_ERR_V4_PRINC_NO_CONV;
855 p = krb5_config_get_string(context, NULL,
863 p = krb5_config_get_string(context, NULL,
872 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
873 if(func == NULL || (*func)(context, pr)){
877 krb5_free_principal(context, pr);
878 krb5_clear_error_string (context);
879 return HEIM_ERR_V4_PRINC_NO_CONV;
883 krb5_425_conv_principal(krb5_context context,
885 const char *instance,
887 krb5_principal *princ)
889 krb5_boolean resolve = krb5_config_get_bool(context,
892 "v4_instance_resolve",
895 return krb5_425_conv_principal_ext(context, name, instance, realm,
896 NULL, resolve, princ);
901 check_list(const krb5_config_binding *l, const char *name, const char **out)
904 if (l->type != krb5_config_string)
906 if(strcmp(name, l->u.string) == 0) {
916 name_convert(krb5_context context, const char *name, const char *realm,
919 const krb5_config_binding *l;
920 l = krb5_config_get_list (context,
927 if(l && check_list(l, name, out))
928 return KRB5_NT_SRV_HST;
929 l = krb5_config_get_list (context,
935 if(l && check_list(l, name, out))
936 return KRB5_NT_SRV_HST;
937 l = krb5_config_get_list (context,
944 if(l && check_list(l, name, out))
945 return KRB5_NT_UNKNOWN;
946 l = krb5_config_get_list (context,
952 if(l && check_list(l, name, out))
953 return KRB5_NT_UNKNOWN;
955 /* didn't find it in config file, try built-in list */
957 struct v4_name_convert *q;
958 for(q = default_v4_name_convert; q->from; q++) {
959 if(strcmp(name, q->to) == 0) {
961 return KRB5_NT_SRV_HST;
969 * convert the v5 principal in `principal' into a v4 corresponding one
970 * in `name, instance, realm'
971 * this is limited interface since there's no length given for these
972 * three parameters. They have to be 40 bytes each (ANAME_SZ).
976 krb5_524_conv_principal(krb5_context context,
977 const krb5_principal principal,
982 const char *n, *i, *r;
984 int type = princ_type(principal);
985 const int aname_sz = 40;
987 r = principal->realm;
989 switch(principal->name.name_string.len){
991 n = principal->name.name_string.val[0];
995 n = principal->name.name_string.val[0];
996 i = principal->name.name_string.val[1];
999 krb5_set_error_string (context,
1000 "cannot convert a %d component principal",
1001 principal->name.name_string.len);
1002 return KRB5_PARSE_MALFORMED;
1007 int t = name_convert(context, n, r, &tmp);
1014 if(type == KRB5_NT_SRV_HST){
1017 strlcpy (tmpinst, i, sizeof(tmpinst));
1018 p = strchr(tmpinst, '.');
1024 if (strlcpy (name, n, aname_sz) >= aname_sz) {
1025 krb5_set_error_string (context,
1026 "too long name component to convert");
1027 return KRB5_PARSE_MALFORMED;
1029 if (strlcpy (instance, i, aname_sz) >= aname_sz) {
1030 krb5_set_error_string (context,
1031 "too long instance component to convert");
1032 return KRB5_PARSE_MALFORMED;
1034 if (strlcpy (realm, r, aname_sz) >= aname_sz) {
1035 krb5_set_error_string (context,
1036 "too long realm component to convert");
1037 return KRB5_PARSE_MALFORMED;
1043 * Create a principal in `ret_princ' for the service `sname' running
1044 * on host `hostname'. */
1047 krb5_sname_to_principal (krb5_context context,
1048 const char *hostname,
1051 krb5_principal *ret_princ)
1053 krb5_error_code ret;
1054 char localhost[MAXHOSTNAMELEN];
1055 char **realms, *host = NULL;
1057 if(type != KRB5_NT_SRV_HST && type != KRB5_NT_UNKNOWN) {
1058 krb5_set_error_string (context, "unsupported name type %d",
1060 return KRB5_SNAME_UNSUPP_NAMETYPE;
1062 if(hostname == NULL) {
1063 gethostname(localhost, sizeof(localhost));
1064 hostname = localhost;
1068 if(type == KRB5_NT_SRV_HST) {
1069 ret = krb5_expand_hostname_realms (context, hostname,
1076 ret = krb5_get_host_realm(context, hostname, &realms);
1081 ret = krb5_make_principal(context, ret_princ, realms[0], sname,
1085 krb5_free_host_realm(context, realms);