oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc-plugin: also pass astgs_request_t to the pac related functions

Browse Source 
This is more consistent and allows the pac hooks to be more flexible.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Stefan Metzmacher
2022-02-24 18:27:09 +01:00
committed by Luke Howard
parent 419610aa14
commit 11d8a053f5
6 changed files with 24 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
kdc/fast.c
View File

@@ -870,7 +870,7 @@ _kdc_fast_check_armor_pac(astgs_request_t r)
if (ret) if (ret)
goto out; goto out;
ret = _kdc_check_pac(r->context, r->config, armor_client_principal, NULL, ret = _kdc_check_pac(r, armor_client_principal, NULL,
armor_client, r->armor_server, armor_client, r->armor_server,
r->armor_server, r->armor_server, r->armor_server, r->armor_server,
&r->armor_key->key, &r->armor_key->key, &r->armor_key->key, &r->armor_key->key,

28
kdc/kdc-plugin.c
View File

@@ -72,7 +72,7 @@ krb5_kdc_plugin_init(krb5_context context)
} }
struct generate_uc { struct generate_uc {
krb5_kdc_configuration *config; astgs_request_t r;
hdb_entry *client; hdb_entry *client;
hdb_entry *server; hdb_entry *server;
const krb5_keyblock *reply_key; const krb5_keyblock *reply_key;
@@ -90,8 +90,7 @@ generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
return KRB5_PLUGIN_NO_HANDLE; return KRB5_PLUGIN_NO_HANDLE;
return ft->pac_generate((void *)plug, return ft->pac_generate((void *)plug,
context, uc->r,
uc->config,
uc->client, uc->client,
uc->server, uc->server,
uc->reply_key, uc->reply_key,
@@ -101,8 +100,7 @@ generate(krb5_context context, const void *plug, void *plugctx, void *userctx)
krb5_error_code krb5_error_code
_kdc_pac_generate(krb5_context context, _kdc_pac_generate(astgs_request_t r,
krb5_kdc_configuration *config,
hdb_entry *client, hdb_entry *client,
hdb_entry *server, hdb_entry *server,
const krb5_keyblock *reply_key, const krb5_keyblock *reply_key,
@@ -114,20 +112,20 @@ _kdc_pac_generate(krb5_context context,
*pac = NULL; *pac = NULL;
if (krb5_config_get_bool_default(context, NULL, FALSE, "realms", if (krb5_config_get_bool_default(r->context, NULL, FALSE, "realms",
client->principal->realm, client->principal->realm,
"disable_pac", NULL)) "disable_pac", NULL))
return 0; return 0;
if (have_plugin) { if (have_plugin) {
uc.config = config; uc.r = r;
uc.client = client; uc.client = client;
uc.server = server; uc.server = server;
uc.reply_key = reply_key; uc.reply_key = reply_key;
uc.pac = pac; uc.pac = pac;
uc.pac_attributes = pac_attributes; uc.pac_attributes = pac_attributes;
ret = _krb5_plugin_run_f(context, &kdc_plugin_data, ret = _krb5_plugin_run_f(r->context, &kdc_plugin_data,
0, &uc, generate); 0, &uc, generate);
if (ret != KRB5_PLUGIN_NO_HANDLE) if (ret != KRB5_PLUGIN_NO_HANDLE)
return ret; return ret;
@@ -135,13 +133,13 @@ _kdc_pac_generate(krb5_context context,
} }
if (*pac == NULL) if (*pac == NULL)
ret = krb5_pac_init(context, pac); ret = krb5_pac_init(r->context, pac);
return ret; return ret;
} }
struct verify_uc { struct verify_uc {
krb5_kdc_configuration *config; astgs_request_t r;
krb5_principal client_principal; krb5_principal client_principal;
krb5_principal delegated_proxy_principal; krb5_principal delegated_proxy_principal;
hdb_entry *client; hdb_entry *client;
@@ -161,8 +159,7 @@ verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
return KRB5_PLUGIN_NO_HANDLE; return KRB5_PLUGIN_NO_HANDLE;
ret = ft->pac_verify((void *)plug, ret = ft->pac_verify((void *)plug,
context, uc->r,
uc->config,
uc->client_principal, uc->client_principal,
uc->delegated_proxy_principal, uc->delegated_proxy_principal,
uc->client, uc->server, uc->krbtgt, uc->pac); uc->client, uc->server, uc->krbtgt, uc->pac);
@@ -170,8 +167,7 @@ verify(krb5_context context, const void *plug, void *plugctx, void *userctx)
} }
krb5_error_code krb5_error_code
_kdc_pac_verify(krb5_context context, _kdc_pac_verify(astgs_request_t r,
krb5_kdc_configuration *config,
const krb5_principal client_principal, const krb5_principal client_principal,
const krb5_principal delegated_proxy_principal, const krb5_principal delegated_proxy_principal,
hdb_entry *client, hdb_entry *client,
@@ -184,7 +180,7 @@ _kdc_pac_verify(krb5_context context,
if (!have_plugin) if (!have_plugin)
return KRB5_PLUGIN_NO_HANDLE; return KRB5_PLUGIN_NO_HANDLE;
uc.config = config; uc.r = r;
uc.client_principal = client_principal; uc.client_principal = client_principal;
uc.delegated_proxy_principal = delegated_proxy_principal; uc.delegated_proxy_principal = delegated_proxy_principal;
uc.client = client; uc.client = client;
@@ -192,7 +188,7 @@ _kdc_pac_verify(krb5_context context,
uc.krbtgt = krbtgt; uc.krbtgt = krbtgt;
uc.pac = pac; uc.pac = pac;
return _krb5_plugin_run_f(context, &kdc_plugin_data, return _krb5_plugin_run_f(r->context, &kdc_plugin_data,
0, &uc, verify); 0, &uc, verify);
} }

6
kdc/kdc-plugin.h
View File

@@ -48,8 +48,7 @@
typedef krb5_error_code typedef krb5_error_code
(KRB5_CALLCONV *krb5plugin_kdc_pac_generate)(void *, (KRB5_CALLCONV *krb5plugin_kdc_pac_generate)(void *,
krb5_context, /* context */ astgs_request_t,
krb5_kdc_configuration *, /* configuration */
hdb_entry *, /* client */ hdb_entry *, /* client */
hdb_entry *, /* server */ hdb_entry *, /* server */
const krb5_keyblock *, /* pk_replykey */ const krb5_keyblock *, /* pk_replykey */
@@ -64,8 +63,7 @@ typedef krb5_error_code
typedef krb5_error_code typedef krb5_error_code
(KRB5_CALLCONV *krb5plugin_kdc_pac_verify)(void *, (KRB5_CALLCONV *krb5plugin_kdc_pac_verify)(void *,
krb5_context, /* context */ astgs_request_t,
krb5_kdc_configuration *, /* configuration */
const krb5_principal, /* new ticket client */ const krb5_principal, /* new ticket client */
const krb5_principal, /* delegation proxy */ const krb5_principal, /* delegation proxy */
hdb_entry *,/* client */ hdb_entry *,/* client */

3
kdc/kerberos5.c
View File

@@ -1849,8 +1849,7 @@ generate_pac(astgs_request_t r, const Key *skey, const Key *tkey,
* Validate a PA mech was actually used before doing this. * Validate a PA mech was actually used before doing this.
*/ */
ret = _kdc_pac_generate(r->context, ret = _kdc_pac_generate(r,
r->config,
r->client, r->client,
r->server, r->server,
r->pa_used && !pa_used_flag_isset(r, PA_USES_LONG_TERM_KEY) r->pa_used && !pa_used_flag_isset(r, PA_USES_LONG_TERM_KEY)

11
kdc/krb5tgs.c
View File

@@ -76,8 +76,7 @@ _kdc_synthetic_princ_used_p(krb5_context context, krb5_ticket *ticket)
*/ */
krb5_error_code krb5_error_code
_kdc_check_pac(krb5_context context, _kdc_check_pac(astgs_request_t r,
krb5_kdc_configuration *config,
const krb5_principal client_principal, const krb5_principal client_principal,
const krb5_principal delegated_proxy_principal, const krb5_principal delegated_proxy_principal,
hdb_entry *client, hdb_entry *client,
@@ -92,6 +91,8 @@ _kdc_check_pac(krb5_context context,
krb5_principal *pac_canon_name, krb5_principal *pac_canon_name,
uint64_t *pac_attributes) uint64_t *pac_attributes)
{ {
krb5_context context = r->context;
krb5_kdc_configuration *config = r->config;
krb5_pac pac = NULL; krb5_pac pac = NULL;
krb5_error_code ret; krb5_error_code ret;
krb5_boolean signedticket; krb5_boolean signedticket;
@@ -122,7 +123,7 @@ _kdc_check_pac(krb5_context context,
} }
/* Verify the KDC signatures. */ /* Verify the KDC signatures. */
ret = _kdc_pac_verify(context, config, ret = _kdc_pac_verify(r,
client_principal, delegated_proxy_principal, client_principal, delegated_proxy_principal,
client, server, krbtgt, &pac); client, server, krbtgt, &pac);
if (ret == 0) { if (ret == 0) {
@@ -1770,7 +1771,7 @@ server_lookup:
} }
/* Verify the PAC of the TGT. */ /* Verify the PAC of the TGT. */
ret = _kdc_check_pac(context, config, user2user_princ, NULL, ret = _kdc_check_pac(priv, user2user_princ, NULL,
user2user_client, user2user_krbtgt, user2user_krbtgt, user2user_krbtgt, user2user_client, user2user_krbtgt, user2user_krbtgt, user2user_krbtgt,
&uukey->key, &priv->ticket_key->key, &adtkt, &uukey->key, &priv->ticket_key->key, &adtkt,
&user2user_kdc_issued, &user2user_pac, NULL, NULL); &user2user_kdc_issued, &user2user_pac, NULL, NULL);
@@ -1897,7 +1898,7 @@ server_lookup:
flags &= ~HDB_F_SYNTHETIC_OK; flags &= ~HDB_F_SYNTHETIC_OK;
priv->clientdb = clientdb; priv->clientdb = clientdb;
ret = _kdc_check_pac(context, config, priv->client_princ, NULL, ret = _kdc_check_pac(priv, priv->client_princ, NULL,
priv->client, priv->server, priv->client, priv->server,
priv->krbtgt, priv->krbtgt, priv->krbtgt, priv->krbtgt,
&priv->ticket_key->key, &priv->ticket_key->key, tgt, &priv->ticket_key->key, &priv->ticket_key->key, tgt,

5
kdc/mssfu.c
View File

@@ -252,8 +252,7 @@ validate_protocol_transition(astgs_request_t r)
if (ret) if (ret)
goto out; /* kdc_check_flags() calls kdc_audit_addreason() */ goto out; /* kdc_check_flags() calls kdc_audit_addreason() */
ret = _kdc_pac_generate(r->context, ret = _kdc_pac_generate(r,
r->config,
s4u_client, s4u_client,
r->server, r->server,
NULL, NULL,
@@ -473,7 +472,7 @@ validate_constrained_delegation(astgs_request_t r)
* TODO: pass in t->sname and t->realm and build * TODO: pass in t->sname and t->realm and build
* a S4U_DELEGATION_INFO blob to the PAC. * a S4U_DELEGATION_INFO blob to the PAC.
*/ */
ret = _kdc_check_pac(r->context, r->config, s4u_client_name, s4u_server_name, ret = _kdc_check_pac(r, s4u_client_name, s4u_server_name,
s4u_client, r->server, r->krbtgt, r->client, s4u_client, r->server, r->krbtgt, r->client,
&clientkey->key, &r->ticket_key->key, &evidence_tkt, &clientkey->key, &r->ticket_key->key, &evidence_tkt,
&ad_kdc_issued, &s4u_pac, &ad_kdc_issued, &s4u_pac,