15e01956fSGlenn Barry /*
25e01956fSGlenn Barry * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
35e01956fSGlenn Barry */
47c478bd9Sstevel@tonic-gate /*
57c478bd9Sstevel@tonic-gate * lib/krb5/krb/walk_rtree.c
67c478bd9Sstevel@tonic-gate *
77c478bd9Sstevel@tonic-gate * Copyright 1990,1991 by the Massachusetts Institute of Technology.
87c478bd9Sstevel@tonic-gate * All Rights Reserved.
97c478bd9Sstevel@tonic-gate *
107c478bd9Sstevel@tonic-gate * Export of this software from the United States of America may
117c478bd9Sstevel@tonic-gate * require a specific license from the United States Government.
127c478bd9Sstevel@tonic-gate * It is the responsibility of any person or organization contemplating
137c478bd9Sstevel@tonic-gate * export to obtain such a license before exporting.
14*55fea89dSDan Cross *
157c478bd9Sstevel@tonic-gate * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
167c478bd9Sstevel@tonic-gate * distribute this software and its documentation for any purpose and
177c478bd9Sstevel@tonic-gate * without fee is hereby granted, provided that the above copyright
187c478bd9Sstevel@tonic-gate * notice appear in all copies and that both that copyright notice and
197c478bd9Sstevel@tonic-gate * this permission notice appear in supporting documentation, and that
207c478bd9Sstevel@tonic-gate * the name of M.I.T. not be used in advertising or publicity pertaining
217c478bd9Sstevel@tonic-gate * to distribution of the software without specific, written prior
227c478bd9Sstevel@tonic-gate * permission. Furthermore if you modify this software you must label
237c478bd9Sstevel@tonic-gate * your software as modified software and not distribute it in such a
247c478bd9Sstevel@tonic-gate * fashion that it might be confused with the original M.I.T. software.
257c478bd9Sstevel@tonic-gate * M.I.T. makes no representations about the suitability of
267c478bd9Sstevel@tonic-gate * this software for any purpose. It is provided "as is" without express
277c478bd9Sstevel@tonic-gate * or implied warranty.
28*55fea89dSDan Cross *
297c478bd9Sstevel@tonic-gate *
307c478bd9Sstevel@tonic-gate * krb5_walk_realm_tree()
317c478bd9Sstevel@tonic-gate */
327c478bd9Sstevel@tonic-gate
337c478bd9Sstevel@tonic-gate /* ANL - Modified to allow Configurable Authentication Paths.
347c478bd9Sstevel@tonic-gate * This modification removes the restriction on the choice of realm
357c478bd9Sstevel@tonic-gate * names, i.e. they nolonger have to be hierarchical. This
367c478bd9Sstevel@tonic-gate * is allowed by RFC 1510: "If a hierarchical orginization is not used
377c478bd9Sstevel@tonic-gate * it may be necessary to consult some database in order to construct
387c478bd9Sstevel@tonic-gate * an authentication path between realms." The database is contained
39fe598cdcSmp * in the [capaths] section of the krb5.conf file.
407c478bd9Sstevel@tonic-gate * Client to server paths are defined. There are n**2 possible
417c478bd9Sstevel@tonic-gate * entries, but only those entries which are needed by the client
427c478bd9Sstevel@tonic-gate * or server need be present in its krb5.conf file. (n entries or 2*n
437c478bd9Sstevel@tonic-gate * entries if the same krb5.conf is used for clients and servers)
447c478bd9Sstevel@tonic-gate *
457c478bd9Sstevel@tonic-gate * for example: ESnet will be running a KDC which will share
467c478bd9Sstevel@tonic-gate * inter-realm keys with its many orginizations which include among
477c478bd9Sstevel@tonic-gate * other ANL, NERSC and PNL. Each of these orginizations wants to
487c478bd9Sstevel@tonic-gate * use its DNS name in the realm, ANL.GOV. In addition ANL wants
497c478bd9Sstevel@tonic-gate * to authenticatite to HAL.COM via a K5.MOON and K5.JUPITER
50fe598cdcSmp * A [capaths] section of the krb5.conf file for the ANL.GOV clients
517c478bd9Sstevel@tonic-gate * and servers would look like:
527c478bd9Sstevel@tonic-gate *
53fe598cdcSmp * [capaths]
547c478bd9Sstevel@tonic-gate * ANL.GOV = {
557c478bd9Sstevel@tonic-gate * NERSC.GOV = ES.NET
567c478bd9Sstevel@tonic-gate * PNL.GOV = ES.NET
577c478bd9Sstevel@tonic-gate * ES.NET = .
587c478bd9Sstevel@tonic-gate * HAL.COM = K5.MOON
597c478bd9Sstevel@tonic-gate * HAL.COM = K5.JUPITER
607c478bd9Sstevel@tonic-gate * }
617c478bd9Sstevel@tonic-gate * NERSC.GOV = {
627c478bd9Sstevel@tonic-gate * ANL.GOV = ES.NET
637c478bd9Sstevel@tonic-gate * }
647c478bd9Sstevel@tonic-gate * PNL.GOV = {
657c478bd9Sstevel@tonic-gate * ANL.GOV = ES.NET
667c478bd9Sstevel@tonic-gate * }
677c478bd9Sstevel@tonic-gate * ES.NET = {
687c478bd9Sstevel@tonic-gate * ANL.GOV = .
697c478bd9Sstevel@tonic-gate * }
707c478bd9Sstevel@tonic-gate * HAL.COM = {
717c478bd9Sstevel@tonic-gate * ANL.GOV = K5.JUPITER
727c478bd9Sstevel@tonic-gate * ANL.GOV = K5.MOON
737c478bd9Sstevel@tonic-gate * }
747c478bd9Sstevel@tonic-gate *
757c478bd9Sstevel@tonic-gate * In the above a "." is used to mean directly connected since the
767c478bd9Sstevel@tonic-gate * the profile routines cannot handle a null entry.
777c478bd9Sstevel@tonic-gate *
787c478bd9Sstevel@tonic-gate * If no client-to-server path is found, the default hierarchical path
797c478bd9Sstevel@tonic-gate * is still generated.
807c478bd9Sstevel@tonic-gate *
817c478bd9Sstevel@tonic-gate * This version of the Configurable Authentication Path modification
827c478bd9Sstevel@tonic-gate * differs from the previous versions prior to K5 beta 5 in that
837c478bd9Sstevel@tonic-gate * the profile routines are used, and the explicite path from
847c478bd9Sstevel@tonic-gate * client's realm to server's realm must be given. The modifications
857c478bd9Sstevel@tonic-gate * will work together.
867c478bd9Sstevel@tonic-gate * DEE - 5/23/95
877c478bd9Sstevel@tonic-gate */
887c478bd9Sstevel@tonic-gate #define CONFIGURABLE_AUTHENTICATION_PATH
897c478bd9Sstevel@tonic-gate #include "k5-int.h"
907c478bd9Sstevel@tonic-gate #include "int-proto.h"
915e01956fSGlenn Barry #include <locale.h>
927c478bd9Sstevel@tonic-gate
937c478bd9Sstevel@tonic-gate /* internal function, used by krb5_get_cred_from_kdc() */
947c478bd9Sstevel@tonic-gate
957c478bd9Sstevel@tonic-gate #ifndef min
967c478bd9Sstevel@tonic-gate #define min(x,y) ((x) < (y) ? (x) : (y))
977c478bd9Sstevel@tonic-gate #define max(x,y) ((x) > (y) ? (x) : (y))
987c478bd9Sstevel@tonic-gate #endif
997c478bd9Sstevel@tonic-gate
1007c478bd9Sstevel@tonic-gate /*
1017c478bd9Sstevel@tonic-gate * xxx The following function is very confusing to read and probably
1027c478bd9Sstevel@tonic-gate * is buggy. It should be documented better. Here is what I've
1037c478bd9Sstevel@tonic-gate * learned about it doing a quick bug fixing walk through. The
1047c478bd9Sstevel@tonic-gate * function takes a client and server realm name and returns the set
1057c478bd9Sstevel@tonic-gate * of realms (in a field called tree) that you need to get tickets in
1067c478bd9Sstevel@tonic-gate * in order to get from the source realm to the destination realm. It
1077c478bd9Sstevel@tonic-gate * takes a realm separater character (normally ., but presumably there
1087c478bd9Sstevel@tonic-gate * for all those X.500 realms) . There are two modes it runs in: the
109fe598cdcSmp * ANL krb5.conf mode and the hierarchy mode. The ANL mode is
1107c478bd9Sstevel@tonic-gate * fairly obvious. The hierarchy mode looks for common components in
1117c478bd9Sstevel@tonic-gate * both the client and server realms. In general, the pointer scp and
1127c478bd9Sstevel@tonic-gate * ccp are used to walk through the client and server realms. The
1137c478bd9Sstevel@tonic-gate * com_sdot and com_cdot pointers point to (I think) the beginning of
1147c478bd9Sstevel@tonic-gate * the common part of the realm names. I.E. strcmp(com_cdot,
1157c478bd9Sstevel@tonic-gate * com_sdot) ==0 is roughly an invarient. However, there are cases
1167c478bd9Sstevel@tonic-gate * where com_sdot and com_cdot are set to point before the start of
1177c478bd9Sstevel@tonic-gate * the client or server strings. I think this only happens when there
1187c478bd9Sstevel@tonic-gate * are no common components. --hartmans 2002/03/14
1197c478bd9Sstevel@tonic-gate */
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gate krb5_error_code
krb5_walk_realm_tree(krb5_context context,const krb5_data * client,const krb5_data * server,krb5_principal ** tree,int realm_branch_char)122fe598cdcSmp krb5_walk_realm_tree(krb5_context context, const krb5_data *client, const krb5_data *server, krb5_principal **tree, int realm_branch_char)
1237c478bd9Sstevel@tonic-gate {
1247c478bd9Sstevel@tonic-gate krb5_error_code retval;
1257c478bd9Sstevel@tonic-gate krb5_principal *rettree;
1267c478bd9Sstevel@tonic-gate register char *ccp, *scp;
1277c478bd9Sstevel@tonic-gate register char *prevccp = 0, *prevscp = 0;
1287c478bd9Sstevel@tonic-gate char *com_sdot = 0, *com_cdot = 0;
1297c478bd9Sstevel@tonic-gate register int i, links = 0;
130fe598cdcSmp int clen, slen = -1;
1317c478bd9Sstevel@tonic-gate krb5_data tmpcrealm, tmpsrealm;
1327c478bd9Sstevel@tonic-gate int nocommon = 1;
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate #ifdef CONFIGURABLE_AUTHENTICATION_PATH
135fe598cdcSmp const char *cap_names[4];
136fe598cdcSmp char *cap_client, *cap_server;
137fe598cdcSmp char **cap_nodes;
138fe598cdcSmp krb5_error_code cap_code;
1397c478bd9Sstevel@tonic-gate #endif
140fe598cdcSmp
141fe598cdcSmp #ifdef DEBUG_REFERRALS
142fe598cdcSmp printf("krb5_walk_realm_tree starting\n");
143fe598cdcSmp printf(" client is %s\n",client->data);
144fe598cdcSmp printf(" server is %s\n",server->data);
145fe598cdcSmp #endif
146fe598cdcSmp
1475e01956fSGlenn Barry if (!(client->data && server->data)) {
1485e01956fSGlenn Barry /* Solaris Kerberos - enhance error message */
1495e01956fSGlenn Barry if (!client->data && !server->data) {
1505e01956fSGlenn Barry krb5_set_error_message(context, KRB5_NO_TKT_IN_RLM,
1515e01956fSGlenn Barry dgettext(TEXT_DOMAIN,
1525e01956fSGlenn Barry "Cannot find ticket for requested realm: unknown client and server"));
1535e01956fSGlenn Barry } else {
1545e01956fSGlenn Barry if (!client->data) {
1555e01956fSGlenn Barry krb5_set_error_message(context, KRB5_NO_TKT_IN_RLM,
1565e01956fSGlenn Barry dgettext(TEXT_DOMAIN,
1575e01956fSGlenn Barry "Cannot find ticket for requested realm: unknown client"));
1585e01956fSGlenn Barry } else {
1595e01956fSGlenn Barry krb5_set_error_message(context, KRB5_NO_TKT_IN_RLM,
1605e01956fSGlenn Barry dgettext(TEXT_DOMAIN,
1615e01956fSGlenn Barry "Cannot find ticket for requested realm: unknown server"));
1625e01956fSGlenn Barry }
1635e01956fSGlenn Barry }
1645e01956fSGlenn Barry return KRB5_NO_TKT_IN_RLM;
1655e01956fSGlenn Barry }
1667c478bd9Sstevel@tonic-gate #ifdef CONFIGURABLE_AUTHENTICATION_PATH
167fe598cdcSmp if ((cap_client = (char *)malloc(client->length + 1)) == NULL)
168fe598cdcSmp return ENOMEM;
169fe598cdcSmp strncpy(cap_client, client->data, client->length);
170fe598cdcSmp cap_client[client->length] = '\0';
171fe598cdcSmp if ((cap_server = (char *)malloc(server->length + 1)) == NULL) {
172fe598cdcSmp krb5_xfree(cap_client);
173fe598cdcSmp return ENOMEM;
174fe598cdcSmp }
175fe598cdcSmp strncpy(cap_server, server->data, server->length);
176fe598cdcSmp cap_server[server->length] = '\0';
177fe598cdcSmp cap_names[0] = "capaths";
178fe598cdcSmp cap_names[1] = cap_client;
179fe598cdcSmp cap_names[2] = cap_server;
180fe598cdcSmp cap_names[3] = 0;
181fe598cdcSmp cap_code = profile_get_values(context->profile, cap_names, &cap_nodes);
182fe598cdcSmp krb5_xfree(cap_client); /* done with client string */
183fe598cdcSmp cap_names[1] = 0;
184fe598cdcSmp if (cap_code == 0) { /* found a path, so lets use it */
185fe598cdcSmp links = 0;
186fe598cdcSmp if (*cap_nodes[0] != '.') { /* a link of . means direct */
187fe598cdcSmp while(cap_nodes[links]) {
188fe598cdcSmp links++;
189fe598cdcSmp }
1907c478bd9Sstevel@tonic-gate }
191fe598cdcSmp if (cap_nodes[links] != NULL)
192fe598cdcSmp krb5_xfree(cap_nodes[links]);
193fe598cdcSmp
194fe598cdcSmp cap_nodes[links] = cap_server; /* put server on end of list */
195fe598cdcSmp /* this simplifies the code later and make */
196fe598cdcSmp /* cleanup eaiser as well */
197fe598cdcSmp links++; /* count the null entry at end */
198fe598cdcSmp } else { /* no path use hierarchical method */
199fe598cdcSmp krb5_xfree(cap_server); /* failed, don't need server string */
200fe598cdcSmp cap_names[2] = 0;
2017c478bd9Sstevel@tonic-gate #endif
202fe598cdcSmp clen = client->length;
203fe598cdcSmp slen = server->length;
2047c478bd9Sstevel@tonic-gate
205fe598cdcSmp for (com_cdot = ccp = client->data + clen - 1,
206fe598cdcSmp com_sdot = scp = server->data + slen - 1;
207fe598cdcSmp clen && slen && *ccp == *scp ;
208fe598cdcSmp ccp--, scp--, clen--, slen--) {
209fe598cdcSmp if (*ccp == realm_branch_char) {
210fe598cdcSmp com_cdot = ccp;
211fe598cdcSmp com_sdot = scp;
212fe598cdcSmp nocommon = 0;
213fe598cdcSmp }
2147c478bd9Sstevel@tonic-gate }
2157c478bd9Sstevel@tonic-gate
216fe598cdcSmp /* ccp, scp point to common root.
217fe598cdcSmp com_cdot, com_sdot point to common components. */
218fe598cdcSmp /* handle case of one ran out */
219fe598cdcSmp if (!clen) {
220fe598cdcSmp /* construct path from client to server, down the tree */
2215e01956fSGlenn Barry if (!slen) {
222fe598cdcSmp /* in the same realm--this means there is no ticket
223fe598cdcSmp in this realm. */
2245e01956fSGlenn Barry krb5_set_error_message(context, KRB5_NO_TKT_IN_RLM,
2255e01956fSGlenn Barry dgettext(TEXT_DOMAIN,
2265e01956fSGlenn Barry "Cannot find ticket for requested realm: client is '%s', server is '%s'"),
2275e01956fSGlenn Barry client->data, server->data);
228fe598cdcSmp return KRB5_NO_TKT_IN_RLM;
2295e01956fSGlenn Barry }
230fe598cdcSmp if (*scp == realm_branch_char) {
231fe598cdcSmp /* one is a subdomain of the other */
232fe598cdcSmp com_cdot = client->data;
233fe598cdcSmp com_sdot = scp;
234fe598cdcSmp nocommon = 0;
235fe598cdcSmp } /* else normal case of two sharing parents */
236fe598cdcSmp }
237fe598cdcSmp if (!slen) {
238fe598cdcSmp /* construct path from client to server, up the tree */
239fe598cdcSmp if (*ccp == realm_branch_char) {
240fe598cdcSmp /* one is a subdomain of the other */
241fe598cdcSmp com_sdot = server->data;
242fe598cdcSmp com_cdot = ccp;
243fe598cdcSmp nocommon = 0;
244fe598cdcSmp } /* else normal case of two sharing parents */
245fe598cdcSmp }
246fe598cdcSmp /* determine #links to/from common ancestor */
247fe598cdcSmp if (nocommon)
248fe598cdcSmp links = 1;
249fe598cdcSmp else
250fe598cdcSmp links = 2;
251fe598cdcSmp /* if no common ancestor, artificially set up common root at the last
252fe598cdcSmp component, then join with special code */
253fe598cdcSmp for (ccp = client->data; ccp < com_cdot; ccp++) {
254fe598cdcSmp if (*ccp == realm_branch_char) {
255fe598cdcSmp links++;
256fe598cdcSmp if (nocommon)
257fe598cdcSmp prevccp = ccp;
258fe598cdcSmp }
2597c478bd9Sstevel@tonic-gate }
2607c478bd9Sstevel@tonic-gate
261fe598cdcSmp for (scp = server->data; scp < com_sdot; scp++) {
262fe598cdcSmp if (*scp == realm_branch_char) {
263fe598cdcSmp links++;
264fe598cdcSmp if (nocommon)
265fe598cdcSmp prevscp = scp;
266fe598cdcSmp }
2677c478bd9Sstevel@tonic-gate }
268fe598cdcSmp if (nocommon) {
269fe598cdcSmp if (prevccp)
270fe598cdcSmp com_cdot = prevccp;
271fe598cdcSmp if (prevscp)
272fe598cdcSmp com_sdot = prevscp;
2737c478bd9Sstevel@tonic-gate
274fe598cdcSmp if(com_cdot == client->data + client->length -1)
275fe598cdcSmp com_cdot = client->data - 1 ;
276fe598cdcSmp if(com_sdot == server->data + server->length -1)
277fe598cdcSmp com_sdot = server->data - 1 ;
278fe598cdcSmp }
2797c478bd9Sstevel@tonic-gate #ifdef CONFIGURABLE_AUTHENTICATION_PATH
280fe598cdcSmp } /* end of if use hierarchical method */
2817c478bd9Sstevel@tonic-gate #endif
2827c478bd9Sstevel@tonic-gate
2837c478bd9Sstevel@tonic-gate if (!(rettree = (krb5_principal *)calloc(links+2,
2847c478bd9Sstevel@tonic-gate sizeof(krb5_principal)))) {
2857c478bd9Sstevel@tonic-gate return ENOMEM;
2867c478bd9Sstevel@tonic-gate }
2877c478bd9Sstevel@tonic-gate i = 1;
2887c478bd9Sstevel@tonic-gate if ((retval = krb5_tgtname(context, client, client, &rettree[0]))) {
2897c478bd9Sstevel@tonic-gate krb5_xfree(rettree);
2907c478bd9Sstevel@tonic-gate return retval;
2917c478bd9Sstevel@tonic-gate }
2927c478bd9Sstevel@tonic-gate #ifdef CONFIGURABLE_AUTHENTICATION_PATH
293fe598cdcSmp links--; /* dont count the null entry on end */
294fe598cdcSmp if (cap_code == 0) { /* found a path above */
295fe598cdcSmp tmpcrealm.data = client->data;
296fe598cdcSmp tmpcrealm.length = client->length;
297fe598cdcSmp while( i-1 <= links) {
298*55fea89dSDan Cross
299fe598cdcSmp tmpsrealm.data = cap_nodes[i-1];
300fe598cdcSmp /* don't count trailing whitespace from profile_get */
301fe598cdcSmp tmpsrealm.length = strcspn(cap_nodes[i-1],"\t ");
302fe598cdcSmp if ((retval = krb5_tgtname(context,
303fe598cdcSmp &tmpsrealm,
304fe598cdcSmp &tmpcrealm,
305fe598cdcSmp &rettree[i]))) {
306fe598cdcSmp while (i) {
307fe598cdcSmp krb5_free_principal(context, rettree[i-1]);
308fe598cdcSmp i--;
3097c478bd9Sstevel@tonic-gate }
310fe598cdcSmp krb5_xfree(rettree);
311fe598cdcSmp /* cleanup the cap_nodes from profile_get */
3127c478bd9Sstevel@tonic-gate for (i = 0; i<=links; i++) {
313fe598cdcSmp krb5_xfree(cap_nodes[i]);
3147c478bd9Sstevel@tonic-gate }
3157c478bd9Sstevel@tonic-gate krb5_xfree((char *)cap_nodes);
316fe598cdcSmp return retval;
317fe598cdcSmp }
318*55fea89dSDan Cross tmpcrealm.data = tmpsrealm.data;
319fe598cdcSmp tmpcrealm.length = tmpsrealm.length;
320fe598cdcSmp i++;
321fe598cdcSmp }
322fe598cdcSmp /* cleanup the cap_nodes from profile_get last one has server */
323fe598cdcSmp for (i = 0; i<=links; i++) {
324fe598cdcSmp krb5_xfree(cap_nodes[i]);
325fe598cdcSmp }
326fe598cdcSmp krb5_xfree((char *)cap_nodes);
327fe598cdcSmp } else { /* if not cap then use hierarchical method */
3287c478bd9Sstevel@tonic-gate #endif
329fe598cdcSmp for (prevccp = ccp = client->data;
330fe598cdcSmp ccp <= com_cdot;
331fe598cdcSmp ccp++) {
332fe598cdcSmp if (*ccp != realm_branch_char)
333fe598cdcSmp continue;
334fe598cdcSmp ++ccp; /* advance past dot */
335fe598cdcSmp tmpcrealm.data = prevccp;
336fe598cdcSmp tmpcrealm.length = client->length -
337fe598cdcSmp (prevccp - client->data);
338fe598cdcSmp tmpsrealm.data = ccp;
339fe598cdcSmp tmpsrealm.length = client->length -
340fe598cdcSmp (ccp - client->data);
341fe598cdcSmp if ((retval = krb5_tgtname(context, &tmpsrealm, &tmpcrealm,
342fe598cdcSmp &rettree[i]))) {
343fe598cdcSmp while (i) {
344fe598cdcSmp krb5_free_principal(context, rettree[i-1]);
345fe598cdcSmp i--;
346fe598cdcSmp }
347fe598cdcSmp krb5_xfree(rettree);
348fe598cdcSmp return retval;
3497c478bd9Sstevel@tonic-gate }
350fe598cdcSmp prevccp = ccp;
351fe598cdcSmp i++;
3527c478bd9Sstevel@tonic-gate }
353fe598cdcSmp if (nocommon) {
354fe598cdcSmp tmpcrealm.data = com_cdot + 1;
355fe598cdcSmp tmpcrealm.length = client->length -
356fe598cdcSmp (com_cdot + 1 - client->data);
357fe598cdcSmp tmpsrealm.data = com_sdot + 1;
358fe598cdcSmp tmpsrealm.length = server->length -
359fe598cdcSmp (com_sdot + 1 - server->data);
360fe598cdcSmp if ((retval = krb5_tgtname(context, &tmpsrealm, &tmpcrealm,
361fe598cdcSmp &rettree[i]))) {
362fe598cdcSmp while (i) {
363fe598cdcSmp krb5_free_principal(context, rettree[i-1]);
364fe598cdcSmp i--;
365fe598cdcSmp }
366fe598cdcSmp krb5_xfree(rettree);
367fe598cdcSmp return retval;
3687c478bd9Sstevel@tonic-gate }
369fe598cdcSmp i++;
3707c478bd9Sstevel@tonic-gate }
3717c478bd9Sstevel@tonic-gate
372fe598cdcSmp for (prevscp = com_sdot + 1, scp = com_sdot - 1;
373fe598cdcSmp scp > server->data;
374fe598cdcSmp scp--) {
375fe598cdcSmp if (*scp != realm_branch_char)
376fe598cdcSmp continue;
377fe598cdcSmp if (scp - 1 < server->data)
378fe598cdcSmp break; /* XXX only if . starts realm? */
379fe598cdcSmp tmpcrealm.data = prevscp;
380fe598cdcSmp tmpcrealm.length = server->length -
381fe598cdcSmp (prevscp - server->data);
382fe598cdcSmp tmpsrealm.data = scp + 1;
383fe598cdcSmp tmpsrealm.length = server->length -
384fe598cdcSmp (scp + 1 - server->data);
385fe598cdcSmp if ((retval = krb5_tgtname(context, &tmpsrealm, &tmpcrealm,
386fe598cdcSmp &rettree[i]))) {
387fe598cdcSmp while (i) {
388fe598cdcSmp krb5_free_principal(context, rettree[i-1]);
389fe598cdcSmp i--;
390fe598cdcSmp }
391fe598cdcSmp krb5_xfree(rettree);
392fe598cdcSmp return retval;
3937c478bd9Sstevel@tonic-gate }
394fe598cdcSmp prevscp = scp + 1;
395fe598cdcSmp i++;
3967c478bd9Sstevel@tonic-gate }
397fe598cdcSmp if (slen && com_sdot >= server->data) {
398fe598cdcSmp /* only necessary if building down tree from ancestor or client */
399fe598cdcSmp /* however, we can get here if we have only one component
400fe598cdcSmp in the server realm name, hence we make sure we found a component
401fe598cdcSmp separator there... */
402fe598cdcSmp tmpcrealm.data = prevscp;
403fe598cdcSmp tmpcrealm.length = server->length -
404fe598cdcSmp (prevscp - server->data);
405fe598cdcSmp if ((retval = krb5_tgtname(context, server, &tmpcrealm,
406fe598cdcSmp &rettree[i]))) {
407fe598cdcSmp while (i) {
408fe598cdcSmp krb5_free_principal(context, rettree[i-1]);
409fe598cdcSmp i--;
410fe598cdcSmp }
411fe598cdcSmp krb5_xfree(rettree);
412fe598cdcSmp return retval;
4137c478bd9Sstevel@tonic-gate }
4147c478bd9Sstevel@tonic-gate }
4157c478bd9Sstevel@tonic-gate #ifdef CONFIGURABLE_AUTHENTICATION_PATH
416fe598cdcSmp }
4177c478bd9Sstevel@tonic-gate #endif
4187c478bd9Sstevel@tonic-gate *tree = rettree;
419fe598cdcSmp
420fe598cdcSmp #ifdef DEBUG_REFERRALS
421fe598cdcSmp printf("krb5_walk_realm_tree ending; tree (length %d) is:\n",links);
422fe598cdcSmp for(i=0;i<links+2;i++) {
423fe598cdcSmp if ((*tree)[i])
424fe598cdcSmp krb5int_dbgref_dump_principal("krb5_walk_realm_tree tree",(*tree)[i]);
425fe598cdcSmp else
426fe598cdcSmp printf("tree element %i null\n");
427fe598cdcSmp }
428fe598cdcSmp #endif
4297c478bd9Sstevel@tonic-gate return 0;
4307c478bd9Sstevel@tonic-gate }
431fe598cdcSmp
432fe598cdcSmp #ifdef DEBUG_REFERRALS
krb5int_dbgref_dump_principal(char * d,krb5_principal p)433fe598cdcSmp void krb5int_dbgref_dump_principal(char *d, krb5_principal p)
434fe598cdcSmp {
435fe598cdcSmp int n;
436*55fea89dSDan Cross
437fe598cdcSmp printf(" **%s: ",d);
438fe598cdcSmp for (n=0;n<p->length;n++)
439fe598cdcSmp printf("%s<%.*s>",(n>0)?"/":"",p->data[n].length,p->data[n].data);
440fe598cdcSmp printf("@<%.*s> (length %d, type %d)\n",p->realm.length,p->realm.data,
441fe598cdcSmp p->length, p->type);
442fe598cdcSmp }
443fe598cdcSmp #endif
444