From e8a466e5d84a478f06e35387083323afb81991bb Mon Sep 17 00:00:00 2001
From: "Jacques A. Vidrine" <n@nectar.com>
Date: Wed, 28 Aug 2002 13:36:57 +0000
Subject: [PATCH] = Add a knob `dns_lookup_realm' to control global use of
 dns-locate for   domain to realm mappings.

= Add a special token (`dns_locate') to control use of dns-locate
  on a domain-by-domain basis in the [domain_realms] section.

= Add a knob `dns_lookup_realm_labels' to specify which labels
  to use with dns-locate.  The default is to use only `_kerberos'.
  Set to `dns_lookup_realm_labels = krb5-realm _kerberos' for
  compatibility with previous releases.


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@11245 ec53bebd-3082-4978-b11e-865c3cabbd6b
---
 lib/krb5/get_host_realm.c | 59 ++++++++++++++++++++++++++-------------
 1 file changed, 39 insertions(+), 20 deletions(-)

diff --git a/lib/krb5/get_host_realm.c b/lib/krb5/get_host_realm.c
index 624b3ea53..09c7ba249 100644
--- a/lib/krb5/get_host_realm.c
+++ b/lib/krb5/get_host_realm.c
@@ -40,13 +40,13 @@ RCSID("$Id$");
  * [domain_realm] in krb5.conf) add a text record for your domain with
  * the name of your realm, like this:
  *
- * krb5-realm	IN	TXT	FOO.SE
+ * _kerberos	IN	TXT	"FOO.SE"
  *
  * The search is recursive, so you can add entries for specific
  * hosts. To find the realm of host a.b.c, it first tries
- * krb5-realm.a.b.c, then krb5-realm.b.c and so on.
+ * _kerberos.a.b.c, then _kerberos.b.c and so on.
  *
- * Also supported is _kerberos (following draft-ietf-cat-krb-dns-locate-01.txt)
+ * This method is described in draft-ietf-cat-krb-dns-locate-03.txt.
  *
  */
 
@@ -92,23 +92,33 @@ copy_txt_to_realms (struct resource_record *head,
 static int
 dns_find_realm(krb5_context context,
 	       const char *domain,
-	       const char *dom_string,
 	       krb5_realm **realms)
 {
+    static char *default_labels[] = { "_kerberos", NULL };
     char dom[MAXHOSTNAMELEN];
     struct dns_reply *r;
-    int ret;
+    char **labels;
+    int i, ret;
     
+    labels = krb5_config_get_strings(context, NULL, "libdefaults",
+	"dns_lookup_realm_labels", NULL);
+    if(labels == NULL)
+	labels = default_labels;
     if(*domain == '.')
 	domain++;
-    snprintf(dom, sizeof(dom), "%s.%s.", dom_string, domain);
-    r = dns_lookup(dom, "TXT");
-    if(r == NULL)
-	return -1;
-
-    ret = copy_txt_to_realms (r->head, realms);
-    dns_free_data(r);
-    return ret;
+    for (i = 0; labels[i] != NULL; i++) {
+	if(snprintf(dom, sizeof(dom), "%s.%s.", labels[i], domain) >=
+	    sizeof(dom))
+	    return -1;
+    	r = dns_lookup(dom, "TXT");
+    	if(r != NULL) {
+	    ret = copy_txt_to_realms (r->head, realms);
+	    dns_free_data(r);
+	    if(ret == 0)
+		return 0;
+	}
+    }
+    return -1;
 }
 
 /*
@@ -145,15 +155,24 @@ krb5_get_host_realm_int (krb5_context context,
 			 krb5_boolean use_dns,
 			 krb5_realm **realms)
 {
-    const char *p;
+    const char *p, *q;
+    krb5_boolean dns_locate_enable;
 
+    dns_locate_enable = krb5_config_get_bool_default(context, NULL, TRUE,
+	"libdefaults", "dns_lookup_realm", NULL);
     for (p = host; p != NULL; p = strchr (p + 1, '.')) {
-	if(config_find_realm(context, p, realms) == 0)
-	    return 0;
-	else if(use_dns) {
-	    if(dns_find_realm(context, p, "krb5-realm", realms) == 0)
-		return 0;
-	    if(dns_find_realm(context, p, "_kerberos", realms) == 0)
+	if(config_find_realm(context, p, realms) == 0) {
+	    if(strcasecmp(*realms[0], "dns_locate") == 0) {
+		if(use_dns)
+		    for (q = host; q != NULL; q = strchr(q + 1, '.'))
+			if(dns_find_realm(context, q, realms) == 0)
+			    return 0;
+		continue; 
+	    } else 
+	    	return 0;
+	}
+	else if(use_dns && dns_locate_enable) {
+	    if(dns_find_realm(context, p, realms) == 0)
 		return 0;
 	}
     }