1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* lib/krb5/os/hostream_domain.c - domain hostrealm module */
3 /*
4 * Copyright (C) 1990,1991,2002,2008,2009,2013 by the Massachusetts Institute
5 * of Technology. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
24 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
28 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
30 * OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /*
34 * This file implements the built-in domain module for the hostrealm interface,
35 * which uses domain-based heuristics to determine the fallback realm of a
36 * host.
37 */
38
39 #include "k5-int.h"
40 #include "os-proto.h"
41 #include <krb5/hostrealm_plugin.h>
42 #include <ctype.h>
43
44 static krb5_error_code
domain_fallback_realm(krb5_context context,krb5_hostrealm_moddata data,const char * host,char *** realms_out)45 domain_fallback_realm(krb5_context context, krb5_hostrealm_moddata data,
46 const char *host, char ***realms_out)
47 {
48 krb5_error_code ret;
49 struct serverlist slist;
50 krb5_data drealm;
51 char *uhost = NULL, *p;
52 const char *suffix, *dot;
53 int limit;
54
55 *realms_out = NULL;
56
57 /* These heuristics don't apply to address literals. */
58 if (k5_is_numeric_address(host))
59 return KRB5_PLUGIN_NO_HANDLE;
60
61 /* Make an uppercase copy of host. */
62 uhost = strdup(host);
63 if (uhost == NULL)
64 return ENOMEM;
65 for (p = uhost; *p != '\0'; p++) {
66 if (islower((unsigned char)*p))
67 *p = toupper((unsigned char)*p);
68 }
69
70 /*
71 * Try searching domain suffixes as realms. This heuristic is turned off
72 * by default. If DNS lookups for KDCs are enabled (as they are by
73 * default), an attacker could control which domain component is used as
74 * the realm for a host.
75 *
76 * A realm_try_domains value of -1 (the default) means not to search at
77 * all, a value of 0 means to try only the full domain itself, 1 means to
78 * also try the parent domain, etc.. We will stop searching when we reach
79 * a suffix with only one label.
80 */
81 ret = profile_get_integer(context->profile, KRB5_CONF_LIBDEFAULTS,
82 KRB5_CONF_REALM_TRY_DOMAINS, 0, -1, &limit);
83 if (ret)
84 goto cleanup;
85 suffix = uhost;
86 while (limit-- >= 0 && (dot = strchr(suffix, '.')) != NULL) {
87 drealm = string2data((char *)suffix);
88 if (k5_locate_kdc(context, &drealm, &slist, FALSE, FALSE) == 0) {
89 k5_free_serverlist(&slist);
90 ret = k5_make_realmlist(suffix, realms_out);
91 goto cleanup;
92 }
93 suffix = dot + 1;
94 }
95
96 /*
97 * If that didn't succeed, use the upper-cased parent domain of the
98 * hostname, regardless of whether we can actually look it up as a realm.
99 */
100 dot = strchr(uhost, '.');
101 if (dot != NULL)
102 ret = k5_make_realmlist(dot + 1, realms_out);
103 else
104 ret = KRB5_PLUGIN_NO_HANDLE;
105
106 cleanup:
107 free(uhost);
108 return ret;
109 }
110
111 static void
domain_free_realmlist(krb5_context context,krb5_hostrealm_moddata data,char ** list)112 domain_free_realmlist(krb5_context context, krb5_hostrealm_moddata data,
113 char **list)
114 {
115 krb5_free_host_realm(context, list);
116 }
117
118 krb5_error_code
hostrealm_domain_initvt(krb5_context context,int maj_ver,int min_ver,krb5_plugin_vtable vtable)119 hostrealm_domain_initvt(krb5_context context, int maj_ver, int min_ver,
120 krb5_plugin_vtable vtable)
121 {
122 krb5_hostrealm_vtable vt = (krb5_hostrealm_vtable)vtable;
123
124 vt->name = "domain";
125 vt->fallback_realm = domain_fallback_realm;
126 vt->free_list = domain_free_realmlist;
127 return 0;
128 }
129