2 * Copyright (c) 1997-2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * @page krb5_principal_intro The principal handing functions.
37 * A Kerberos principal is a email address looking string that
38 * contains to parts separeted by a @. The later part is the kerbero
39 * realm the principal belongs to and the former is a list of 0 or
40 * more components. For example
43 host/hummel.it.su.se@SU.SE
47 * See the library functions here: @ref krb5_principal
50 #include "krb5_locl.h"
51 #ifdef HAVE_RES_SEARCH
54 #ifdef HAVE_ARPA_NAMESER_H
55 #include <arpa/nameser.h>
60 #define princ_num_comp(P) ((P)->name.name_string.len)
61 #define princ_type(P) ((P)->name.name_type)
62 #define princ_comp(P) ((P)->name.name_string.val)
63 #define princ_ncomp(P, N) ((P)->name.name_string.val[(N)])
64 #define princ_realm(P) ((P)->realm)
67 * Frees a Kerberos principal allocated by the library with
68 * krb5_parse_name(), krb5_make_principal() or any other related
69 * principal functions.
71 * @param context A Kerberos context.
72 * @param p a principal to free.
74 * @return An krb5 error code, see krb5_get_error_message().
76 * @ingroup krb5_principal
79 void KRB5_LIB_FUNCTION
80 krb5_free_principal(krb5_context context,
90 * Set the type of the principal
92 * @param context A Kerberos context.
93 * @param principal principal to set the type for
94 * @param type the new type
96 * @return An krb5 error code, see krb5_get_error_message().
98 * @ingroup krb5_principal
101 void KRB5_LIB_FUNCTION
102 krb5_principal_set_type(krb5_context context,
103 krb5_principal principal,
106 princ_type(principal) = type;
109 int KRB5_LIB_FUNCTION
110 krb5_principal_get_type(krb5_context context,
111 krb5_const_principal principal)
113 return princ_type(principal);
116 const char* KRB5_LIB_FUNCTION
117 krb5_principal_get_realm(krb5_context context,
118 krb5_const_principal principal)
120 return princ_realm(principal);
123 const char* KRB5_LIB_FUNCTION
124 krb5_principal_get_comp_string(krb5_context context,
125 krb5_const_principal principal,
126 unsigned int component)
128 if(component >= princ_num_comp(principal))
130 return princ_ncomp(principal, component);
134 * Get number of component is principal.
136 * @param context Kerberos 5 context
137 * @param principal principal to query
139 * @return number of components in string
141 * @ingroup krb5_principal
144 unsigned int KRB5_LIB_FUNCTION
145 krb5_principal_get_num_comp(krb5_context context,
146 krb5_const_principal principal)
148 return princ_num_comp(principal);
151 krb5_error_code KRB5_LIB_FUNCTION
152 krb5_parse_name_flags(krb5_context context,
155 krb5_principal *principal)
158 heim_general_string *comp;
159 heim_general_string realm = NULL;
171 int enterprise = (flags & KRB5_PRINCIPAL_PARSE_ENTERPRISE);
175 #define RFLAGS (KRB5_PRINCIPAL_PARSE_NO_REALM|KRB5_PRINCIPAL_PARSE_REQUIRE_REALM)
177 if ((flags & RFLAGS) == RFLAGS) {
178 krb5_set_error_message(context, KRB5_ERR_NO_SERVICE,
179 N_("Can't require both realm and "
180 "no realm at the same time", ""));
181 return KRB5_ERR_NO_SERVICE;
185 /* count number of component,
186 * enterprise names only have one component
190 for(p = name; *p; p++){
193 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
194 N_("trailing \\ in principal name", ""));
195 return KRB5_PARSE_MALFORMED;
204 comp = calloc(ncomp, sizeof(*comp));
206 krb5_set_error_message(context, ENOMEM,
207 N_("malloc: out of memory", ""));
212 p = start = q = s = strdup(name);
215 krb5_set_error_message(context, ENOMEM,
216 N_("malloc: out of memory", ""));
232 ret = KRB5_PARSE_MALFORMED;
233 krb5_set_error_message(context, ret,
234 N_("trailing \\ in principal name", ""));
237 }else if(enterprise && first_at) {
240 }else if((c == '/' && !enterprise) || c == '@'){
242 ret = KRB5_PARSE_MALFORMED;
243 krb5_set_error_message(context, ret,
244 N_("part after realm in principal name", ""));
247 comp[n] = malloc(q - start + 1);
248 if (comp[n] == NULL) {
250 krb5_set_error_message(context, ret,
251 N_("malloc: out of memory", ""));
254 memcpy(comp[n], start, q - start);
255 comp[n][q - start] = 0;
263 if(got_realm && (c == '/' || c == '\0')) {
264 ret = KRB5_PARSE_MALFORMED;
265 krb5_set_error_message(context, ret,
266 N_("part after realm in principal name", ""));
272 if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
273 ret = KRB5_PARSE_MALFORMED;
274 krb5_set_error_message(context, ret,
275 N_("realm found in 'short' principal "
276 "expected to be without one", ""));
279 realm = malloc(q - start + 1);
282 krb5_set_error_message(context, ret,
283 N_("malloc: out of memory", ""));
286 memcpy(realm, start, q - start);
287 realm[q - start] = 0;
289 if (flags & KRB5_PRINCIPAL_PARSE_REQUIRE_REALM) {
290 ret = KRB5_PARSE_MALFORMED;
291 krb5_set_error_message(context, ret,
292 N_("realm NOT found in principal "
293 "expected to be with one", ""));
295 } else if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
298 ret = krb5_get_default_realm (context, &realm);
303 comp[n] = malloc(q - start + 1);
304 if (comp[n] == NULL) {
306 krb5_set_error_message(context, ret,
307 N_("malloc: out of memory", ""));
310 memcpy(comp[n], start, q - start);
311 comp[n][q - start] = 0;
314 *principal = malloc(sizeof(**principal));
315 if (*principal == NULL) {
317 krb5_set_error_message(context, ret,
318 N_("malloc: out of memory", ""));
322 (*principal)->name.name_type = KRB5_NT_ENTERPRISE_PRINCIPAL;
324 (*principal)->name.name_type = KRB5_NT_PRINCIPAL;
325 (*principal)->name.name_string.val = comp;
326 princ_num_comp(*principal) = n;
327 (*principal)->realm = realm;
340 krb5_error_code KRB5_LIB_FUNCTION
341 krb5_parse_name(krb5_context context,
343 krb5_principal *principal)
345 return krb5_parse_name_flags(context, name, 0, principal);
348 static const char quotable_chars[] = " \n\t\b\\/@";
349 static const char replace_chars[] = " ntb\\/@";
350 static const char nq_chars[] = " \\/@";
352 #define add_char(BASE, INDEX, LEN, C) do { if((INDEX) < (LEN)) (BASE)[(INDEX)++] = (C); }while(0);
355 quote_string(const char *s, char *out, size_t idx, size_t len, int display)
358 for(p = s; *p && idx < len; p++){
359 q = strchr(quotable_chars, *p);
361 add_char(out, idx, len, replace_chars[q - quotable_chars]);
363 add_char(out, idx, len, '\\');
364 add_char(out, idx, len, replace_chars[q - quotable_chars]);
366 add_char(out, idx, len, *p);
374 static krb5_error_code
375 unparse_name_fixed(krb5_context context,
376 krb5_const_principal principal,
383 int short_form = (flags & KRB5_PRINCIPAL_UNPARSE_SHORT) != 0;
384 int no_realm = (flags & KRB5_PRINCIPAL_UNPARSE_NO_REALM) != 0;
385 int display = (flags & KRB5_PRINCIPAL_UNPARSE_DISPLAY) != 0;
387 if (!no_realm && princ_realm(principal) == NULL) {
388 krb5_set_error_message(context, ERANGE,
389 N_("Realm missing from principal, "
390 "can't unparse", ""));
394 for(i = 0; i < princ_num_comp(principal); i++){
396 add_char(name, idx, len, '/');
397 idx = quote_string(princ_ncomp(principal, i), name, idx, len, display);
399 krb5_set_error_message(context, ERANGE,
400 N_("Out of space printing principal", ""));
404 /* add realm if different from default realm */
405 if(short_form && !no_realm) {
408 ret = krb5_get_default_realm(context, &r);
411 if(strcmp(princ_realm(principal), r) != 0)
415 if(!short_form && !no_realm) {
416 add_char(name, idx, len, '@');
417 idx = quote_string(princ_realm(principal), name, idx, len, display);
419 krb5_set_error_message(context, ERANGE,
420 N_("Out of space printing "
421 "realm of principal", ""));
429 * Unparse the principal name to a fixed buffer
431 * @param context A Kerberos context.
432 * @param principal principal to unparse
433 * @param name buffer to write name to
434 * @param len length of buffer
436 * @return An krb5 error code, see krb5_get_error_message().
438 * @ingroup krb5_principal
441 krb5_error_code KRB5_LIB_FUNCTION
442 krb5_unparse_name_fixed(krb5_context context,
443 krb5_const_principal principal,
447 return unparse_name_fixed(context, principal, name, len, 0);
451 * Unparse the principal name to a fixed buffer. The realm is skipped
452 * if its a default realm.
454 * @param context A Kerberos context.
455 * @param principal principal to unparse
456 * @param name buffer to write name to
457 * @param len length of buffer
459 * @return An krb5 error code, see krb5_get_error_message().
461 * @ingroup krb5_principal
464 krb5_error_code KRB5_LIB_FUNCTION
465 krb5_unparse_name_fixed_short(krb5_context context,
466 krb5_const_principal principal,
470 return unparse_name_fixed(context, principal, name, len,
471 KRB5_PRINCIPAL_UNPARSE_SHORT);
475 * Unparse the principal name with unparse flags to a fixed buffer.
477 * @param context A Kerberos context.
478 * @param principal principal to unparse
479 * @param flags unparse flags
480 * @param name buffer to write name to
481 * @param len length of buffer
483 * @return An krb5 error code, see krb5_get_error_message().
485 * @ingroup krb5_principal
488 krb5_error_code KRB5_LIB_FUNCTION
489 krb5_unparse_name_fixed_flags(krb5_context context,
490 krb5_const_principal principal,
495 return unparse_name_fixed(context, principal, name, len, flags);
498 static krb5_error_code
499 unparse_name(krb5_context context,
500 krb5_const_principal principal,
504 size_t len = 0, plen;
508 if (princ_realm(principal)) {
509 plen = strlen(princ_realm(principal));
511 if(strcspn(princ_realm(principal), quotable_chars) == plen)
517 for(i = 0; i < princ_num_comp(principal); i++){
518 plen = strlen(princ_ncomp(principal, i));
519 if(strcspn(princ_ncomp(principal, i), quotable_chars) == plen)
528 krb5_set_error_message(context, ENOMEM,
529 N_("malloc: out of memory", ""));
532 ret = unparse_name_fixed(context, principal, *name, len, flags);
541 * Unparse the Kerberos name into a string
543 * @param context Kerberos 5 context
544 * @param principal principal to query
545 * @param name resulting string, free with krb5_xfree()
547 * @return An krb5 error code, see krb5_get_error_message().
549 * @ingroup krb5_principal
552 krb5_error_code KRB5_LIB_FUNCTION
553 krb5_unparse_name(krb5_context context,
554 krb5_const_principal principal,
557 return unparse_name(context, principal, name, 0);
561 * Unparse the Kerberos name into a string
563 * @param context Kerberos 5 context
564 * @param principal principal to query
565 * @param flags flag to determine the behavior
566 * @param name resulting string, free with krb5_xfree()
568 * @return An krb5 error code, see krb5_get_error_message().
570 * @ingroup krb5_principal
573 krb5_error_code KRB5_LIB_FUNCTION
574 krb5_unparse_name_flags(krb5_context context,
575 krb5_const_principal principal,
579 return unparse_name(context, principal, name, flags);
583 * Unparse the principal name to a allocated buffer. The realm is
584 * skipped if its a default realm.
586 * @param context A Kerberos context.
587 * @param principal principal to unparse
588 * @param name returned buffer, free with krb5_xfree()
590 * @return An krb5 error code, see krb5_get_error_message().
592 * @ingroup krb5_principal
595 krb5_error_code KRB5_LIB_FUNCTION
596 krb5_unparse_name_short(krb5_context context,
597 krb5_const_principal principal,
600 return unparse_name(context, principal, name, KRB5_PRINCIPAL_UNPARSE_SHORT);
604 * Set a new realm for a principal, and as a side-effect free the
607 * @param context A Kerberos context.
608 * @param principal principal set the realm for
609 * @param realm the new realm to set
611 * @return An krb5 error code, see krb5_get_error_message().
613 * @ingroup krb5_principal
616 krb5_error_code KRB5_LIB_FUNCTION
617 krb5_principal_set_realm(krb5_context context,
618 krb5_principal principal,
619 krb5_const_realm realm)
621 if (princ_realm(principal))
622 free(princ_realm(principal));
624 princ_realm(principal) = strdup(realm);
625 if (princ_realm(principal) == NULL) {
626 krb5_set_error_message(context, ENOMEM,
627 N_("malloc: out of memory", ""));
634 krb5_error_code KRB5_LIB_FUNCTION
635 krb5_build_principal(krb5_context context,
636 krb5_principal *principal,
638 krb5_const_realm realm,
644 ret = krb5_build_principal_va(context, principal, rlen, realm, ap);
649 static krb5_error_code
650 append_component(krb5_context context, krb5_principal p,
654 heim_general_string *tmp;
655 size_t len = princ_num_comp(p);
657 tmp = realloc(princ_comp(p), (len + 1) * sizeof(*tmp));
659 krb5_set_error_message(context, ENOMEM,
660 N_("malloc: out of memory", ""));
664 princ_ncomp(p, len) = malloc(comp_len + 1);
665 if (princ_ncomp(p, len) == NULL) {
666 krb5_set_error_message(context, ENOMEM,
667 N_("malloc: out of memory", ""));
670 memcpy (princ_ncomp(p, len), comp, comp_len);
671 princ_ncomp(p, len)[comp_len] = '\0';
677 va_ext_princ(krb5_context context, krb5_principal p, va_list ap)
682 len = va_arg(ap, int);
685 s = va_arg(ap, const char*);
686 append_component(context, p, s, len);
691 va_princ(krb5_context context, krb5_principal p, va_list ap)
695 s = va_arg(ap, const char*);
698 append_component(context, p, s, strlen(s));
702 static krb5_error_code
703 build_principal(krb5_context context,
704 krb5_principal *principal,
706 krb5_const_realm realm,
707 void (*func)(krb5_context, krb5_principal, va_list),
712 p = calloc(1, sizeof(*p));
714 krb5_set_error_message(context, ENOMEM,
715 N_("malloc: out of memory", ""));
718 princ_type(p) = KRB5_NT_PRINCIPAL;
720 princ_realm(p) = strdup(realm);
721 if(p->realm == NULL){
723 krb5_set_error_message(context, ENOMEM,
724 N_("malloc: out of memory", ""));
728 (*func)(context, p, ap);
733 krb5_error_code KRB5_LIB_FUNCTION
734 krb5_make_principal(krb5_context context,
735 krb5_principal *principal,
736 krb5_const_realm realm,
743 ret = krb5_get_default_realm(context, &r);
749 ret = krb5_build_principal_va(context, principal, strlen(realm), realm, ap);
756 krb5_error_code KRB5_LIB_FUNCTION
757 krb5_build_principal_va(krb5_context context,
758 krb5_principal *principal,
760 krb5_const_realm realm,
763 return build_principal(context, principal, rlen, realm, va_princ, ap);
766 krb5_error_code KRB5_LIB_FUNCTION
767 krb5_build_principal_va_ext(krb5_context context,
768 krb5_principal *principal,
770 krb5_const_realm realm,
773 return build_principal(context, principal, rlen, realm, va_ext_princ, ap);
777 krb5_error_code KRB5_LIB_FUNCTION
778 krb5_build_principal_ext(krb5_context context,
779 krb5_principal *principal,
781 krb5_const_realm realm,
787 ret = krb5_build_principal_va_ext(context, principal, rlen, realm, ap);
793 krb5_error_code KRB5_LIB_FUNCTION
794 krb5_copy_principal(krb5_context context,
795 krb5_const_principal inprinc,
796 krb5_principal *outprinc)
798 krb5_principal p = malloc(sizeof(*p));
800 krb5_set_error_message(context, ENOMEM,
801 N_("malloc: out of memory", ""));
804 if(copy_Principal(inprinc, p)) {
806 krb5_set_error_message(context, ENOMEM,
807 N_("malloc: out of memory", ""));
815 * Return TRUE iff princ1 == princ2 (without considering the realm)
817 * @param context Kerberos 5 context
818 * @param princ1 first principal to compare
819 * @param princ2 second principal to compare
821 * @return non zero if equal, 0 if not
823 * @ingroup krb5_principal
826 krb5_boolean KRB5_LIB_FUNCTION
827 krb5_principal_compare_any_realm(krb5_context context,
828 krb5_const_principal princ1,
829 krb5_const_principal princ2)
832 if(princ_num_comp(princ1) != princ_num_comp(princ2))
834 for(i = 0; i < princ_num_comp(princ1); i++){
835 if(strcmp(princ_ncomp(princ1, i), princ_ncomp(princ2, i)) != 0)
841 krb5_boolean KRB5_LIB_FUNCTION
842 _krb5_principal_compare_PrincipalName(krb5_context context,
843 krb5_const_principal princ1,
844 PrincipalName *princ2)
847 if (princ_num_comp(princ1) != princ2->name_string.len)
849 for(i = 0; i < princ_num_comp(princ1); i++){
850 if(strcmp(princ_ncomp(princ1, i), princ2->name_string.val[i]) != 0)
858 * return TRUE iff princ1 == princ2
861 krb5_boolean KRB5_LIB_FUNCTION
862 krb5_principal_compare(krb5_context context,
863 krb5_const_principal princ1,
864 krb5_const_principal princ2)
866 if(!krb5_realm_compare(context, princ1, princ2))
868 return krb5_principal_compare_any_realm(context, princ1, princ2);
872 * return TRUE iff realm(princ1) == realm(princ2)
875 krb5_boolean KRB5_LIB_FUNCTION
876 krb5_realm_compare(krb5_context context,
877 krb5_const_principal princ1,
878 krb5_const_principal princ2)
880 return strcmp(princ_realm(princ1), princ_realm(princ2)) == 0;
884 * return TRUE iff princ matches pattern
887 krb5_boolean KRB5_LIB_FUNCTION
888 krb5_principal_match(krb5_context context,
889 krb5_const_principal princ,
890 krb5_const_principal pattern)
893 if(princ_num_comp(princ) != princ_num_comp(pattern))
895 if(fnmatch(princ_realm(pattern), princ_realm(princ), 0) != 0)
897 for(i = 0; i < princ_num_comp(princ); i++){
898 if(fnmatch(princ_ncomp(pattern, i), princ_ncomp(princ, i), 0) != 0)
904 #if defined(KRB4) || !defined(HEIMDAL_SMALLER)
906 static struct v4_name_convert {
909 } default_v4_name_convert[] = {
911 { "hprop", "hprop" },
924 * return the converted instance name of `name' in `realm'.
925 * look in the configuration file and then in the default set above.
926 * return NULL if no conversion is appropriate.
930 get_name_conversion(krb5_context context, const char *realm, const char *name)
932 struct v4_name_convert *q;
935 p = krb5_config_get_string(context, NULL, "realms", realm,
936 "v4_name_convert", "host", name, NULL);
938 p = krb5_config_get_string(context, NULL, "libdefaults",
939 "v4_name_convert", "host", name, NULL);
943 /* XXX should be possible to override default list */
944 p = krb5_config_get_string(context, NULL,
953 p = krb5_config_get_string(context, NULL,
961 for(q = default_v4_name_convert; q->from; q++)
962 if(strcmp(q->from, name) == 0)
968 * convert the v4 principal `name.instance@realm' to a v5 principal in `princ'.
969 * if `resolve', use DNS.
970 * if `func', use that function for validating the conversion
973 krb5_error_code KRB5_LIB_FUNCTION
974 krb5_425_conv_principal_ext2(krb5_context context,
976 const char *instance,
978 krb5_boolean (*func)(krb5_context,
979 void *, krb5_principal),
981 krb5_boolean resolve,
982 krb5_principal *princ)
987 char host[MAXHOSTNAMELEN];
988 char local_hostname[MAXHOSTNAMELEN];
990 /* do the following: if the name is found in the
991 `v4_name_convert:host' part, is assumed to be a `host' type
992 principal, and the instance is looked up in the
993 `v4_instance_convert' part. if not found there the name is
994 (optionally) looked up as a hostname, and if that doesn't yield
995 anything, the `default_domain' is appended to the instance
1000 if(instance[0] == 0){
1004 p = get_name_conversion(context, realm, name);
1008 p = krb5_config_get_string(context, NULL, "realms", realm,
1009 "v4_instance_convert", instance, NULL);
1012 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
1015 if(func == NULL || (*func)(context, funcctx, pr)){
1019 krb5_free_principal(context, pr);
1021 krb5_clear_error_message (context);
1022 return HEIM_ERR_V4_PRINC_NO_CONV;
1025 krb5_boolean passed = FALSE;
1028 struct rk_dns_reply *r;
1030 r = rk_dns_lookup(instance, "aaaa");
1032 if (r->head && r->head->type == rk_ns_t_aaaa) {
1033 inst = strdup(r->head->domain);
1036 rk_dns_free_data(r);
1038 r = rk_dns_lookup(instance, "a");
1040 if(r->head && r->head->type == rk_ns_t_a) {
1041 inst = strdup(r->head->domain);
1044 rk_dns_free_data(r);
1048 struct addrinfo hints, *ai;
1050 memset (&hints, 0, sizeof(hints));
1051 hints.ai_flags = AI_CANONNAME;
1052 ret = getaddrinfo(instance, NULL, &hints, &ai);
1054 const struct addrinfo *a;
1055 for (a = ai; a != NULL; a = a->ai_next) {
1056 if (a->ai_canonname != NULL) {
1057 inst = strdup (a->ai_canonname);
1067 krb5_set_error_message(context, ENOMEM,
1068 N_("malloc: out of memory", ""));
1072 ret = krb5_make_principal(context, &pr, realm, name, inst,
1076 if(func == NULL || (*func)(context, funcctx, pr)){
1080 krb5_free_principal(context, pr);
1085 snprintf(host, sizeof(host), "%s.%s", instance, realm);
1087 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1090 if((*func)(context, funcctx, pr)){
1094 krb5_free_principal(context, pr);
1098 * if the instance is the first component of the local hostname,
1099 * the converted host should be the long hostname.
1103 gethostname (local_hostname, sizeof(local_hostname)) == 0 &&
1104 strncmp(instance, local_hostname, strlen(instance)) == 0 &&
1105 local_hostname[strlen(instance)] == '.') {
1106 strlcpy(host, local_hostname, sizeof(host));
1111 char **domains, **d;
1112 domains = krb5_config_get_strings(context, NULL, "realms", realm,
1113 "v4_domains", NULL);
1114 for(d = domains; d && *d; d++){
1115 snprintf(host, sizeof(host), "%s.%s", instance, *d);
1116 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1118 krb5_config_free_strings(domains);
1121 if(func == NULL || (*func)(context, funcctx, pr)){
1123 krb5_config_free_strings(domains);
1126 krb5_free_principal(context, pr);
1128 krb5_config_free_strings(domains);
1132 p = krb5_config_get_string(context, NULL, "realms", realm,
1133 "default_domain", NULL);
1135 /* this should be an error, just faking a name is not good */
1136 krb5_clear_error_message (context);
1137 return HEIM_ERR_V4_PRINC_NO_CONV;
1142 snprintf(host, sizeof(host), "%s.%s", instance, p);
1144 ret = krb5_make_principal(context, &pr, realm, name, host, NULL);
1147 if(func == NULL || (*func)(context, funcctx, pr)){
1151 krb5_free_principal(context, pr);
1152 krb5_clear_error_message (context);
1153 return HEIM_ERR_V4_PRINC_NO_CONV;
1155 p = krb5_config_get_string(context, NULL,
1163 p = krb5_config_get_string(context, NULL,
1172 ret = krb5_make_principal(context, &pr, realm, name, instance, NULL);
1175 if(func == NULL || (*func)(context, funcctx, pr)){
1179 krb5_free_principal(context, pr);
1180 krb5_clear_error_message (context);
1181 return HEIM_ERR_V4_PRINC_NO_CONV;
1186 #ifndef HEIMDAL_SMALLER
1189 check_list(const krb5_config_binding *l, const char *name, const char **out)
1192 if (l->type != krb5_config_string)
1194 if(strcmp(name, l->u.string) == 0) {
1204 name_convert(krb5_context context, const char *name, const char *realm,
1207 const krb5_config_binding *l;
1208 l = krb5_config_get_list (context,
1215 if(l && check_list(l, name, out))
1216 return KRB5_NT_SRV_HST;
1217 l = krb5_config_get_list (context,
1223 if(l && check_list(l, name, out))
1224 return KRB5_NT_SRV_HST;
1225 l = krb5_config_get_list (context,
1232 if(l && check_list(l, name, out))
1233 return KRB5_NT_UNKNOWN;
1234 l = krb5_config_get_list (context,
1240 if(l && check_list(l, name, out))
1241 return KRB5_NT_UNKNOWN;
1243 /* didn't find it in config file, try built-in list */
1246 struct v4_name_convert *q;
1247 for(q = default_v4_name_convert; q->from; q++) {
1248 if(strcmp(name, q->to) == 0) {
1250 return KRB5_NT_SRV_HST;
1259 * convert the v5 principal in `principal' into a v4 corresponding one
1260 * in `name, instance, realm'
1261 * this is limited interface since there's no length given for these
1262 * three parameters. They have to be 40 bytes each (ANAME_SZ).
1265 krb5_error_code KRB5_LIB_FUNCTION
1266 krb5_524_conv_principal(krb5_context context,
1267 const krb5_principal principal,
1272 const char *n, *i, *r;
1274 int type = princ_type(principal);
1275 const int aname_sz = 40;
1277 r = principal->realm;
1279 switch(principal->name.name_string.len){
1281 n = principal->name.name_string.val[0];
1285 n = principal->name.name_string.val[0];
1286 i = principal->name.name_string.val[1];
1289 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1290 N_("cannot convert a %d "
1291 "component principal", ""),
1292 principal->name.name_string.len);
1293 return KRB5_PARSE_MALFORMED;
1298 int t = name_convert(context, n, r, &tmp);
1305 if(type == KRB5_NT_SRV_HST){
1308 strlcpy (tmpinst, i, sizeof(tmpinst));
1309 p = strchr(tmpinst, '.');
1315 if (strlcpy (name, n, aname_sz) >= aname_sz) {
1316 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1317 N_("too long name component to convert", ""));
1318 return KRB5_PARSE_MALFORMED;
1320 if (strlcpy (instance, i, aname_sz) >= aname_sz) {
1321 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1322 N_("too long instance component to convert", ""));
1323 return KRB5_PARSE_MALFORMED;
1325 if (strlcpy (realm, r, aname_sz) >= aname_sz) {
1326 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1327 N_("too long realm component to convert", ""));
1328 return KRB5_PARSE_MALFORMED;
1333 #endif /* !HEIMDAL_SMALLER */
1336 * Create a principal for the service running on hostname. If
1337 * KRB5_NT_SRV_HST is used, the hostname is canonization using DNS (or
1338 * some other service), this is potentially insecure.
1340 * @param context A Kerberos context.
1341 * @param hostname hostname to use
1342 * @param sname Service name to use
1343 * @param type name type of pricipal, use KRB5_NT_SRV_HST or KRB5_NT_UNKNOWN.
1344 * @param ret_princ return principal, free with krb5_free_principal().
1346 * @return An krb5 error code, see krb5_get_error_message().
1348 * @ingroup krb5_principal
1351 krb5_error_code KRB5_LIB_FUNCTION
1352 krb5_sname_to_principal (krb5_context context,
1353 const char *hostname,
1356 krb5_principal *ret_princ)
1358 krb5_error_code ret;
1359 char localhost[MAXHOSTNAMELEN];
1360 char **realms, *host = NULL;
1362 if(type != KRB5_NT_SRV_HST && type != KRB5_NT_UNKNOWN) {
1363 krb5_set_error_message(context, KRB5_SNAME_UNSUPP_NAMETYPE,
1364 N_("unsupported name type %d", ""),
1366 return KRB5_SNAME_UNSUPP_NAMETYPE;
1368 if(hostname == NULL) {
1369 ret = gethostname(localhost, sizeof(localhost) - 1);
1372 krb5_set_error_message(context, ret,
1373 N_("Failed to get local hostname", ""));
1376 localhost[sizeof(localhost) - 1] = '\0';
1377 hostname = localhost;
1381 if(type == KRB5_NT_SRV_HST) {
1382 ret = krb5_expand_hostname_realms (context, hostname,
1389 ret = krb5_get_host_realm(context, hostname, &realms);
1394 ret = krb5_make_principal(context, ret_princ, realms[0], sname,
1398 krb5_free_host_realm(context, realms);
1402 static const struct {
1406 { "UNKNOWN", KRB5_NT_UNKNOWN },
1407 { "PRINCIPAL", KRB5_NT_PRINCIPAL },
1408 { "SRV_INST", KRB5_NT_SRV_INST },
1409 { "SRV_HST", KRB5_NT_SRV_HST },
1410 { "SRV_XHST", KRB5_NT_SRV_XHST },
1411 { "UID", KRB5_NT_UID },
1412 { "X500_PRINCIPAL", KRB5_NT_X500_PRINCIPAL },
1413 { "SMTP_NAME", KRB5_NT_SMTP_NAME },
1414 { "ENTERPRISE_PRINCIPAL", KRB5_NT_ENTERPRISE_PRINCIPAL },
1415 { "ENT_PRINCIPAL_AND_ID", KRB5_NT_ENT_PRINCIPAL_AND_ID },
1416 { "MS_PRINCIPAL", KRB5_NT_MS_PRINCIPAL },
1417 { "MS_PRINCIPAL_AND_ID", KRB5_NT_MS_PRINCIPAL_AND_ID },
1422 krb5_parse_nametype(krb5_context context, const char *str, int32_t *nametype)
1426 for(i = 0; nametypes[i].type; i++) {
1427 if (strcasecmp(nametypes[i].type, str) == 0) {
1428 *nametype = nametypes[i].value;
1432 krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
1433 N_("Failed to find name type %s", ""), str);
1434 return KRB5_PARSE_MALFORMED;