diff options
author | Greg Hudson <ghudson@mit.edu> | 2021-01-15 13:51:34 -0500 |
---|---|---|
committer | Greg Hudson <ghudson@mit.edu> | 2021-01-28 10:57:46 -0500 |
commit | c374ab40dd059a5938ffc0440d87457ac5da3a46 (patch) | |
tree | f6afbc4cc0390d860c08e4cc490b1667b2945c48 /src/lib/gssapi | |
parent | 225fffe4e912772acea3a01d45bafb60bfb80948 (diff) | |
download | krb5-c374ab40dd059a5938ffc0440d87457ac5da3a46.zip krb5-c374ab40dd059a5938ffc0440d87457ac5da3a46.tar.gz krb5-c374ab40dd059a5938ffc0440d87457ac5da3a46.tar.bz2 |
Support host-based GSS initiator names
When checking if we can get initial credentials in the GSS krb5 mech,
use krb5_kt_have_match() to support fallback iteration. When scanning
the ccache or getting initial credentials, rewrite cred->name->princ
to the canonical client name. When a name check is necessary (such as
when the caller specifies both a name and ccache), use a new internal
API k5_sname_compare() to support fallback iteration. Add fallback
iteration to krb5_cc_cache_match() to allow host-based names to be
canonicalized against the cache collection.
Create and store the matching principal for acceptor names in
acquire_accept_cred() so that it isn't affected by changes in
cred->name->princ during acquire_init_cred().
ticket: 8978 (new)
Diffstat (limited to 'src/lib/gssapi')
-rw-r--r-- | src/lib/gssapi/krb5/accept_sec_context.c | 15 | ||||
-rw-r--r-- | src/lib/gssapi/krb5/acquire_cred.c | 89 | ||||
-rw-r--r-- | src/lib/gssapi/krb5/gssapiP_krb5.h | 1 | ||||
-rw-r--r-- | src/lib/gssapi/krb5/rel_cred.c | 1 |
4 files changed, 57 insertions, 49 deletions
diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index 75f071c..cb62a25 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -683,7 +683,6 @@ kg_accept_krb5(minor_status, context_handle, krb5_flags ap_req_options = 0; krb5_enctype negotiated_etype; krb5_authdata_context ad_context = NULL; - krb5_principal accprinc = NULL; krb5_ap_req *request = NULL; code = krb5int_accessor (&kaccess, KRB5INT_ACCESS_VERSION); @@ -849,17 +848,9 @@ kg_accept_krb5(minor_status, context_handle, } } - if (!cred->default_identity) { - if ((code = kg_acceptor_princ(context, cred->name, &accprinc))) { - major_status = GSS_S_FAILURE; - goto fail; - } - } - - code = krb5_rd_req_decoded(context, &auth_context, request, accprinc, - cred->keytab, &ap_req_options, NULL); - - krb5_free_principal(context, accprinc); + code = krb5_rd_req_decoded(context, &auth_context, request, + cred->acceptor_mprinc, cred->keytab, + &ap_req_options, NULL); if (code) { major_status = GSS_S_FAILURE; goto fail; diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c index 632ee7d..e226a02 100644 --- a/src/lib/gssapi/krb5/acquire_cred.c +++ b/src/lib/gssapi/krb5/acquire_cred.c @@ -123,11 +123,11 @@ gss_krb5int_register_acceptor_identity(OM_uint32 *minor_status, /* Try to verify that keytab contains at least one entry for name. Return 0 if * it does, KRB5_KT_NOTFOUND if it doesn't, or another error as appropriate. */ static krb5_error_code -check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) +check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name, + krb5_principal mprinc) { krb5_error_code code; krb5_keytab_entry ent; - krb5_principal accprinc = NULL; char *princname; if (name->service == NULL) { @@ -141,21 +141,15 @@ check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name) if (kt->ops->start_seq_get == NULL) return 0; - /* Get the partial principal for the acceptor name. */ - code = kg_acceptor_princ(context, name, &accprinc); - if (code) - return code; - - /* Scan the keytab for host-based entries matching accprinc. */ - code = k5_kt_have_match(context, kt, accprinc); + /* Scan the keytab for host-based entries matching mprinc. */ + code = k5_kt_have_match(context, kt, mprinc); if (code == KRB5_KT_NOTFOUND) { - if (krb5_unparse_name(context, accprinc, &princname) == 0) { + if (krb5_unparse_name(context, mprinc, &princname) == 0) { k5_setmsg(context, code, _("No key table entry found matching %s"), princname); free(princname); } } - krb5_free_principal(context, accprinc); return code; } @@ -202,8 +196,14 @@ acquire_accept_cred(krb5_context context, OM_uint32 *minor_status, } if (cred->name != NULL) { + code = kg_acceptor_princ(context, cred->name, &cred->acceptor_mprinc); + if (code) { + major = GSS_S_FAILURE; + goto cleanup; + } + /* Make sure we have keys matching the desired name in the keytab. */ - code = check_keytab(context, kt, cred->name); + code = check_keytab(context, kt, cred->name, cred->acceptor_mprinc); if (code) { if (code == KRB5_KT_NOTFOUND) { k5_change_error_message_code(context, code, KG_KEYTAB_NOMATCH); @@ -324,7 +324,6 @@ static krb5_boolean can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) { krb5_error_code code; - krb5_keytab_entry entry; if (cred->password != NULL) return TRUE; @@ -336,20 +335,21 @@ can_get_initial_creds(krb5_context context, krb5_gss_cred_id_rec *cred) if (cred->name == NULL) return !krb5_kt_have_content(context, cred->client_keytab); - /* Check if we have a keytab key for the client principal. */ - code = krb5_kt_get_entry(context, cred->client_keytab, cred->name->princ, - 0, 0, &entry); - if (code) { - krb5_clear_error_message(context); - return FALSE; - } - krb5_free_keytab_entry_contents(context, &entry); - return TRUE; + /* + * Check if we have a keytab key for the client principal. This is a bit + * more permissive than we really want because krb5_kt_have_match() + * supports wildcarding and obeys ignore_acceptor_hostname, but that should + * generally be harmless. + */ + code = k5_kt_have_match(context, cred->client_keytab, cred->name->princ); + return code == 0; } -/* Scan cred->ccache for name, expiry time, impersonator, refresh time. */ +/* Scan cred->ccache for name, expiry time, impersonator, refresh time. If + * check_name is true, verify the cache name against the credential name. */ static krb5_error_code -scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) +scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred, + krb5_boolean check_name) { krb5_error_code code; krb5_ccache ccache = cred->ccache; @@ -365,23 +365,31 @@ scan_ccache(krb5_context context, krb5_gss_cred_id_rec *cred) if (code) return code; - /* Credentials cache principal must match the initiator name. */ code = krb5_cc_get_principal(context, ccache, &ccache_princ); if (code != 0) goto cleanup; - if (cred->name != NULL && - !krb5_principal_compare(context, ccache_princ, cred->name->princ)) { - code = KG_CCACHE_NOMATCH; - goto cleanup; - } - /* Save the ccache principal as the credential name if not already set. */ - if (!cred->name) { + if (cred->name == NULL) { + /* Save the ccache principal as the credential name. */ code = kg_init_name(context, ccache_princ, NULL, NULL, NULL, KG_INIT_NAME_NO_COPY, &cred->name); if (code) goto cleanup; ccache_princ = NULL; + } else { + /* Check against the desired name if needed. */ + if (check_name) { + if (!k5_sname_compare(context, cred->name->princ, ccache_princ)) { + code = KG_CCACHE_NOMATCH; + goto cleanup; + } + } + + /* Replace the credential name principal with the canonical client + * principal, retaining acceptor_mprinc if set. */ + krb5_free_principal(context, cred->name->princ); + cred->name->princ = ccache_princ; + ccache_princ = NULL; } assert(cred->name->princ != NULL); @@ -447,7 +455,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) assert(cred->name != NULL && cred->ccache == NULL); #ifdef USE_LEASH code = get_ccache_leash(context, cred->name->princ, &cred->ccache); - return code ? code : scan_ccache(context, cred); + return code ? code : scan_ccache(context, cred, TRUE); #else /* Check first whether we can acquire tickets, to avoid overwriting the * extended error message from krb5_cc_cache_match. */ @@ -456,7 +464,7 @@ get_cache_for_name(krb5_context context, krb5_gss_cred_id_rec *cred) /* Look for an existing cache for the client principal. */ code = krb5_cc_cache_match(context, cred->name->princ, &cred->ccache); if (code == 0) - return scan_ccache(context, cred); + return scan_ccache(context, cred, FALSE); if (code != KRB5_CC_NOTFOUND || !can_get) return code; krb5_clear_error_message(context); @@ -633,6 +641,13 @@ get_initial_cred(krb5_context context, const struct verify_params *verify, kg_cred_set_initial_refresh(context, cred, &creds.times); cred->have_tgt = TRUE; cred->expire = creds.times.endtime; + + /* Steal the canonical client principal name from creds and save it in the + * credential name, retaining acceptor_mprinc if set. */ + krb5_free_principal(context, cred->name->princ); + cred->name->princ = creds.client; + creds.client = NULL; + krb5_free_cred_contents(context, &creds); cleanup: krb5_get_init_creds_opt_free(context, opt); @@ -721,7 +736,7 @@ acquire_init_cred(krb5_context context, OM_uint32 *minor_status, if (cred->ccache != NULL) { /* The caller specified a ccache; check what's in it. */ - code = scan_ccache(context, cred); + code = scan_ccache(context, cred, TRUE); if (code == KRB5_FCC_NOFILE) { /* See if we can get initial creds. If the caller didn't specify * a name, pick one from the client keytab. */ @@ -984,7 +999,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, } } if (cred->ccache != NULL) { - code = scan_ccache(context, cred); + code = scan_ccache(context, cred, FALSE); if (code) goto kerr; } @@ -996,7 +1011,7 @@ kg_cred_resolve(OM_uint32 *minor_status, krb5_context context, code = krb5int_cc_default(context, &cred->ccache); if (code) goto kerr; - code = scan_ccache(context, cred); + code = scan_ccache(context, cred, FALSE); if (code == KRB5_FCC_NOFILE) { /* Default ccache doesn't exist; fall through to client keytab. */ krb5_cc_close(context, cred->ccache); diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h index a7e0e63..d8553e7 100644 --- a/src/lib/gssapi/krb5/gssapiP_krb5.h +++ b/src/lib/gssapi/krb5/gssapiP_krb5.h @@ -175,6 +175,7 @@ typedef struct _krb5_gss_cred_id_rec { /* name/type of credential */ gss_cred_usage_t usage; krb5_gss_name_t name; + krb5_principal acceptor_mprinc; krb5_principal impersonator; unsigned int default_identity : 1; unsigned int iakerb_mech : 1; diff --git a/src/lib/gssapi/krb5/rel_cred.c b/src/lib/gssapi/krb5/rel_cred.c index a9515da..0da6c1b 100644 --- a/src/lib/gssapi/krb5/rel_cred.c +++ b/src/lib/gssapi/krb5/rel_cred.c @@ -72,6 +72,7 @@ krb5_gss_release_cred(minor_status, cred_handle) if (cred->name) kg_release_name(context, &cred->name); + krb5_free_principal(context, cred->acceptor_mprinc); krb5_free_principal(context, cred->impersonator); if (cred->req_enctypes) |