1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* lib/krb5/os/hostream_dns.c - dns hostrealm module */
3 /*
4 * Copyright (C) 1990,1991,2002,2008,2009,2013 by the Massachusetts Institute
5 * of Technology. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * * Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
24 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
28 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
30 * OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /*
34 * This file implements the built-in dns module for the hostrealm interface,
35 * which uses TXT records in the DNS to determine the default realm or the
36 * fallback realm of a host.
37 */
38
39 #include "k5-int.h"
40 #include "os-proto.h"
41 #include <krb5/hostrealm_plugin.h>
42
43 #ifdef KRB5_DNS_LOOKUP
44
45 /* Try a _kerberos TXT lookup for fqdn and each parent domain; return the
46 * resulting realm (caller must free) or NULL. */
47 static char *
txt_lookup(krb5_context context,const char * fqdn)48 txt_lookup(krb5_context context, const char *fqdn)
49 {
50 char *realm;
51
52 while (fqdn != NULL && *fqdn != '\0') {
53 if (k5_try_realm_txt_rr(context, "_kerberos", fqdn, &realm) == 0)
54 return realm;
55 fqdn = strchr(fqdn, '.');
56 if (fqdn != NULL)
57 fqdn++;
58 }
59 return NULL;
60 }
61
62 static krb5_error_code
dns_fallback_realm(krb5_context context,krb5_hostrealm_moddata data,const char * host,char *** realms_out)63 dns_fallback_realm(krb5_context context, krb5_hostrealm_moddata data,
64 const char *host, char ***realms_out)
65 {
66 krb5_error_code ret;
67 char *realm;
68
69 *realms_out = NULL;
70 if (!_krb5_use_dns_realm(context) || k5_is_numeric_address(host))
71 return KRB5_PLUGIN_NO_HANDLE;
72
73 /* Try a TXT record lookup for each component of host. */
74 realm = txt_lookup(context, host);
75 if (realm == NULL)
76 return KRB5_PLUGIN_NO_HANDLE;
77 ret = k5_make_realmlist(realm, realms_out);
78 free(realm);
79 return ret;
80 }
81
82 static krb5_error_code
dns_default_realm(krb5_context context,krb5_hostrealm_moddata data,char *** realms_out)83 dns_default_realm(krb5_context context, krb5_hostrealm_moddata data,
84 char ***realms_out)
85 {
86 krb5_error_code ret;
87 char *localhost, *realm;
88
89 *realms_out = NULL;
90 if (!_krb5_use_dns_realm(context))
91 return KRB5_PLUGIN_NO_HANDLE;
92
93 ret = krb5int_get_fq_local_hostname(&localhost);
94 if (ret)
95 return ret;
96
97 /* If we don't find a TXT record for localhost or any parent, look for a
98 * global record. */
99 realm = txt_lookup(context, localhost);
100 free(localhost);
101 if (realm == NULL)
102 (void)k5_try_realm_txt_rr(context, "_kerberos", NULL, &realm);
103
104 if (realm == NULL)
105 return KRB5_PLUGIN_NO_HANDLE;
106 ret = k5_make_realmlist(realm, realms_out);
107 free(realm);
108 return ret;
109 }
110
111 static void
dns_free_realmlist(krb5_context context,krb5_hostrealm_moddata data,char ** list)112 dns_free_realmlist(krb5_context context, krb5_hostrealm_moddata data,
113 char **list)
114 {
115 krb5_free_host_realm(context, list);
116 }
117
118 krb5_error_code
hostrealm_dns_initvt(krb5_context context,int maj_ver,int min_ver,krb5_plugin_vtable vtable)119 hostrealm_dns_initvt(krb5_context context, int maj_ver, int min_ver,
120 krb5_plugin_vtable vtable)
121 {
122 krb5_hostrealm_vtable vt = (krb5_hostrealm_vtable)vtable;
123
124 vt->name = "dns";
125 vt->fallback_realm = dns_fallback_realm;
126 vt->default_realm = dns_default_realm;
127 vt->free_list = dns_free_realmlist;
128 return 0;
129 }
130
131 #else /* KRB5_DNS_LOOKUP */
132
133 krb5_error_code
hostrealm_dns_initvt(krb5_context context,int maj_ver,int min_ver,krb5_plugin_vtable vtable)134 hostrealm_dns_initvt(krb5_context context, int maj_ver, int min_ver,
135 krb5_plugin_vtable vtable)
136 {
137 krb5_hostrealm_vtable vt = (krb5_hostrealm_vtable)vtable;
138
139 vt->name = "dns";
140 return 0;
141 }
142
143 #endif /* KRB5_DNS_LOOKUP */
144