1 /* 2 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 /* 7 * lib/krb5/os/sn2princ.c 8 * 9 * Copyright 1991,2002 by the Massachusetts Institute of Technology. 10 * All Rights Reserved. 11 * 12 * Export of this software from the United States of America may 13 * require a specific license from the United States Government. 14 * It is the responsibility of any person or organization contemplating 15 * export to obtain such a license before exporting. 16 * 17 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 18 * distribute this software and its documentation for any purpose and 19 * without fee is hereby granted, provided that the above copyright 20 * notice appear in all copies and that both that copyright notice and 21 * this permission notice appear in supporting documentation, and that 22 * the name of M.I.T. not be used in advertising or publicity pertaining 23 * to distribution of the software without specific, written prior 24 * permission. Furthermore if you modify this software you must label 25 * your software as modified software and not distribute it in such a 26 * fashion that it might be confused with the original M.I.T. software. 27 * M.I.T. makes no representations about the suitability of 28 * this software for any purpose. It is provided "as is" without express 29 * or implied warranty. 30 * 31 * 32 * Convert a hostname and service name to a principal in the "standard" 33 * form. 34 */ 35 36 #include "k5-int.h" 37 #include "os-proto.h" 38 #include "fake-addrinfo.h" 39 #include <ctype.h> 40 #ifdef HAVE_SYS_PARAM_H 41 #include <sys/param.h> 42 #endif 43 44 #if !defined(DEFAULT_RDNS_LOOKUP) 45 /* Solaris Kerberos */ 46 #define DEFAULT_RDNS_LOOKUP 0 47 #endif 48 49 /* 50 * Solaris Kerberos: 51 * The following prototypes are needed because these are 52 * private interfaces that do not have prototypes in any .h 53 */ 54 extern struct hostent *res_getipnodebyname(const char *, int, int, int *); 55 extern struct hostent *res_getipnodebyaddr(const void *, size_t, int, int *); 56 extern void res_freehostent(struct hostent *); 57 58 static int 59 maybe_use_reverse_dns (krb5_context context, int defalt) 60 { 61 krb5_error_code code; 62 char * value = NULL; 63 int use_rdns = 0; 64 65 code = profile_get_string(context->profile, "libdefaults", 66 "rdns", 0, 0, &value); 67 if (code) 68 return defalt; 69 70 if (value == 0) 71 return defalt; 72 73 use_rdns = _krb5_conf_boolean(value); 74 profile_release_string(value); 75 return use_rdns; 76 } 77 78 79 /* 80 * Solaris Kerberos: 81 * Note, krb5_sname_to_principal() allocates memory for ret_princ. Be sure to 82 * use krb5_free_principal() on ret_princ to free it when done referencing it. 83 */ 84 krb5_error_code KRB5_CALLCONV 85 krb5_sname_to_principal(krb5_context context, const char *hostname, const char *sname, krb5_int32 type, krb5_principal *ret_princ) 86 { 87 char **hrealms, *realm, *remote_host; 88 krb5_error_code retval; 89 register char *cp; 90 char localname[MAXHOSTNAMELEN]; 91 /* Solaris Kerberos */ 92 KRB5_LOG0(KRB5_INFO, "krb5_sname_to_principal() start"); 93 #ifdef DEBUG_REFERRALS 94 printf("krb5_sname_to_principal(host=%s, sname=%s, type=%d)\n",hostname,sname,type); 95 printf(" name types: 0=unknown, 3=srv_host\n"); 96 #endif 97 98 if ((type == KRB5_NT_UNKNOWN) || 99 (type == KRB5_NT_SRV_HST)) { 100 101 /* if hostname is NULL, use local hostname */ 102 if (! hostname) { 103 if (gethostname(localname, MAXHOSTNAMELEN)) { 104 /* Solaris Kerberos */ 105 KRB5_LOG0(KRB5_ERR, "krb5_sname_to_principal()" 106 " gethostname failed"); 107 return SOCKET_ERRNO; 108 } 109 hostname = localname; 110 } 111 112 /* if sname is NULL, use "host" */ 113 if (! sname) 114 sname = "host"; 115 116 /* copy the hostname into non-volatile storage */ 117 118 if (type == KRB5_NT_SRV_HST) { 119 /* Solaris Kerberos */ 120 struct hostent *hp = NULL; 121 struct hostent *hp2 = NULL; 122 int err; 123 int addr_family; 124 125 /* Note that the old code would accept numeric addresses, 126 and if the gethostbyaddr step could convert them to 127 real hostnames, you could actually get reasonable 128 results. If the mapping failed, you'd get dotted 129 triples as realm names. *sigh* 130 131 The latter has been fixed in hst_realm.c, but we should 132 keep supporting numeric addresses if they do have 133 hostnames associated. */ 134 135 /* 136 * Solaris kerberos: using res_getipnodebyname() to force dns name 137 * resolution. Note, res_getaddrinfo() isn't exported by libreolv 138 * so we use res_getipnodebyname() (MIT uses getaddrinfo()). 139 */ 140 KRB5_LOG(KRB5_INFO, "krb5_sname_to_principal() hostname %s", 141 hostname); 142 143 addr_family = AF_INET; 144 try_getipnodebyname_again: 145 hp = res_getipnodebyname(hostname, addr_family, 0, &err); 146 if (!hp) { 147 #ifdef DEBUG_REFERRALS 148 printf("sname_to_princ: probably punting due to bad hostname of %s\n",hostname); 149 #endif 150 if (addr_family == AF_INET) { 151 KRB5_LOG(KRB5_INFO, "krb5_sname_to_principal()" 152 " can't get AF_INET addr, err = %d", err); 153 /* Just in case it's an IPv6-only name. */ 154 addr_family = AF_INET6; 155 goto try_getipnodebyname_again; 156 } 157 KRB5_LOG(KRB5_ERR, "krb5_sname_to_principal()" 158 " can't get AF_INET or AF_INET6 addr," 159 " err = %d", err); 160 return KRB5_ERR_BAD_HOSTNAME; 161 } 162 remote_host = strdup(hp ? hp->h_name : hostname); 163 if (!remote_host) { 164 if (hp != NULL) 165 res_freehostent(hp); 166 return ENOMEM; 167 } 168 169 if (maybe_use_reverse_dns(context, DEFAULT_RDNS_LOOKUP)) { 170 /* 171 * Do a reverse resolution to get the full name, just in 172 * case there's some funny business going on. If there 173 * isn't an in-addr record, give up. 174 */ 175 /* XXX: This is *so* bogus. There are several cases where 176 this won't get us the canonical name of the host, but 177 this is what we've trained people to expect. We'll 178 probably fix it at some point, but let's try to 179 preserve the current behavior and only shake things up 180 once when it comes time to fix this lossage. */ 181 hp2 = res_getipnodebyaddr(hp->h_addr, hp->h_length, 182 hp->h_addrtype, &err); 183 184 if (hp2 != NULL) { 185 free(remote_host); 186 remote_host = strdup(hp2->h_name); 187 if (!remote_host) { 188 res_freehostent(hp2); 189 if (hp != NULL) 190 res_freehostent(hp); 191 return ENOMEM; 192 } 193 KRB5_LOG(KRB5_INFO, "krb5_sname_to_principal() remote_host %s", 194 remote_host); 195 } 196 } 197 198 if (hp != NULL) { 199 res_freehostent(hp); 200 } 201 202 if (hp2 != NULL) { 203 res_freehostent(hp2); 204 } 205 206 } else /* type == KRB5_NT_UNKNOWN */ { 207 remote_host = strdup(hostname); 208 } 209 if (!remote_host) 210 return ENOMEM; 211 #ifdef DEBUG_REFERRALS 212 printf("sname_to_princ: hostname <%s> after rdns processing\n",remote_host); 213 #endif 214 215 if (type == KRB5_NT_SRV_HST) 216 for (cp = remote_host; *cp; cp++) 217 if (isupper((unsigned char) (*cp))) 218 *cp = tolower((unsigned char) (*cp)); 219 220 /* 221 * Windows NT5's broken resolver gratuitously tacks on a 222 * trailing period to the hostname (at least it does in 223 * Beta2). Find and remove it. 224 */ 225 if (remote_host[0]) { 226 cp = remote_host + strlen(remote_host)-1; 227 if (*cp == '.') 228 *cp = 0; 229 } 230 231 232 if ((retval = krb5_get_host_realm(context, remote_host, &hrealms))) { 233 free(remote_host); 234 return retval; 235 } 236 237 #ifdef DEBUG_REFERRALS 238 printf("sname_to_princ: realm <%s> after krb5_get_host_realm\n",hrealms[0]); 239 #endif 240 241 if (!hrealms[0]) { 242 free(remote_host); 243 krb5_xfree(hrealms); 244 return KRB5_ERR_HOST_REALM_UNKNOWN; 245 } 246 realm = hrealms[0]; 247 248 retval = krb5_build_principal(context, ret_princ, strlen(realm), 249 realm, sname, remote_host, 250 (char *)0); 251 252 if (retval == 0) 253 krb5_princ_type(context, *ret_princ) = type; 254 255 #ifdef DEBUG_REFERRALS 256 printf("krb5_sname_to_principal returning\n"); 257 printf("realm: <%s>, sname: <%s>, remote_host: <%s>\n", 258 realm,sname,remote_host); 259 krb5int_dbgref_dump_principal("krb5_sname_to_principal",*ret_princ); 260 #endif 261 262 free(remote_host); 263 264 krb5_free_host_realm(context, hrealms); 265 return retval; 266 } else { 267 return KRB5_SNAME_UNSUPP_NAMETYPE; 268 } 269 } 270 271