oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: pass down the delegated_proxy_principal to the verify_pac() function

Browse Source 
This is needed in order to add the S4U_DELEGATION_INFO to the pac.

metze

Signed-off-by: Love Hörnquist Åstrand <lha@h5l.org>
This commit is contained in:
Stefan Metzmacher
2011-06-28 13:24:50 +02:00
committed by Love Hörnquist Åstrand
parent 626d2607d5
commit 296548d34a
3 changed files with 42 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
kdc/krb5tgs.c
View File

@@ -279,6 +279,7 @@ static krb5_error_code
check_PAC(krb5_context context, check_PAC(krb5_context context,
krb5_kdc_configuration *config, krb5_kdc_configuration *config,
const krb5_principal client_principal, const krb5_principal client_principal,
const krb5_principal delegated_proxy_principal,
hdb_entry_ex *client, hdb_entry_ex *client,
hdb_entry_ex *server, hdb_entry_ex *server,
hdb_entry_ex *krbtgt, hdb_entry_ex *krbtgt,
@@ -336,6 +337,7 @@ check_PAC(krb5_context context,
} }
ret = _kdc_pac_verify(context, client_principal, ret = _kdc_pac_verify(context, client_principal,
delegated_proxy_principal,
client, server, krbtgt, &pac, &signed_pac); client, server, krbtgt, &pac, &signed_pac);
if (ret) { if (ret) {
krb5_pac_free(context, pac); krb5_pac_free(context, pac);
@@ -1480,9 +1482,9 @@ tgs_build_reply(krb5_context context,
const struct sockaddr *from_addr) const struct sockaddr *from_addr)
{ {
krb5_error_code ret; krb5_error_code ret;
krb5_principal cp = NULL, sp = NULL, tp = NULL; krb5_principal cp = NULL, sp = NULL, tp = NULL, dp = NULL;
krb5_principal krbtgt_principal = NULL; krb5_principal krbtgt_principal = NULL;
char *spn = NULL, *cpn = NULL, *tpn = NULL; char *spn = NULL, *cpn = NULL, *tpn = NULL, *dpn = NULL;
hdb_entry_ex *server = NULL, *client = NULL, *s4u2self_impersonated_client = NULL; hdb_entry_ex *server = NULL, *client = NULL, *s4u2self_impersonated_client = NULL;
HDB *clientdb, *s4u2self_impersonated_clientdb; HDB *clientdb, *s4u2self_impersonated_clientdb;
krb5_realm ref_realm = NULL; krb5_realm ref_realm = NULL;
@@ -1805,7 +1807,7 @@ server_lookup:
krb5_free_error_message(context, msg); krb5_free_error_message(context, msg);
} }
ret = check_PAC(context, config, cp, ret = check_PAC(context, config, cp, NULL,
client, server, krbtgt, client, server, krbtgt,
&tkey_check->key, &tkey_check->key, &tkey_check->key, &tkey_check->key,
ekey, &tkey_sign->key, ekey, &tkey_sign->key,
@@ -2032,12 +2034,23 @@ server_lookup:
if (ret) if (ret)
goto out; goto out;
ret = _krb5_principalname2krb5_principal(context,
&dp,
t->sname,
t->realm);
if (ret)
goto out;
ret = krb5_unparse_name(context, dp, &dpn);
if (ret)
goto out;
/* check that ticket is valid */ /* check that ticket is valid */
if (adtkt.flags.forwardable == 0) { if (adtkt.flags.forwardable == 0) {
kdc_log(context, config, 0, kdc_log(context, config, 0,
"Missing forwardable flag on ticket for " "Missing forwardable flag on ticket for "
"constrained delegation from %s as %s to %s ", "constrained delegation from %s (%s) as %s to %s ",
cpn, tpn, spn); cpn, dpn, tpn, spn);
ret = KRB5KDC_ERR_BADOPTION; ret = KRB5KDC_ERR_BADOPTION;
goto out; goto out;
} }
@@ -2046,8 +2059,8 @@ server_lookup:
client, server, sp); client, server, sp);
if (ret) { if (ret) {
kdc_log(context, config, 0, kdc_log(context, config, 0,
"constrained delegation from %s as %s to %s not allowed", "constrained delegation from %s (%s) as %s to %s not allowed",
cpn, tpn, spn); cpn, dpn, tpn, spn);
goto out; goto out;
} }
@@ -2064,7 +2077,7 @@ server_lookup:
* TODO: pass in t->sname and t->realm and build * TODO: pass in t->sname and t->realm and build
* a S4U_DELEGATION_INFO blob to the PAC. * a S4U_DELEGATION_INFO blob to the PAC.
*/ */
ret = check_PAC(context, config, tp, ret = check_PAC(context, config, tp, dp,
client, server, krbtgt, client, server, krbtgt,
&clientkey->key, &tkey_check->key, &clientkey->key, &tkey_check->key,
ekey, &tkey_sign->key, ekey, &tkey_sign->key,
@@ -2073,8 +2086,8 @@ server_lookup:
const char *msg = krb5_get_error_message(context, ret); const char *msg = krb5_get_error_message(context, ret);
kdc_log(context, config, 0, kdc_log(context, config, 0,
"Verify delegated PAC failed to %s for client" "Verify delegated PAC failed to %s for client"
"%s as %s from %s with %s", "%s (%s) as %s from %s with %s",
spn, cpn, tpn, from, msg); spn, cpn, dpn, tpn, from, msg);
krb5_free_error_message(context, msg); krb5_free_error_message(context, msg);
goto out; goto out;
} }
@@ -2093,9 +2106,9 @@ server_lookup:
const char *msg = krb5_get_error_message(context, ret); const char *msg = krb5_get_error_message(context, ret);
kdc_log(context, config, 0, kdc_log(context, config, 0,
"KRB5SignedPath check from service %s failed " "KRB5SignedPath check from service %s failed "
"for delegation to %s for client %s " "for delegation to %s for client %s (%s)"
"from %s failed with %s", "from %s failed with %s",
spn, tpn, cpn, from, msg); spn, tpn, dpn, cpn, from, msg);
krb5_free_error_message(context, msg); krb5_free_error_message(context, msg);
goto out; goto out;
} }
@@ -2104,14 +2117,14 @@ server_lookup:
ret = KRB5KDC_ERR_BADOPTION; ret = KRB5KDC_ERR_BADOPTION;
kdc_log(context, config, 0, kdc_log(context, config, 0,
"Ticket not signed with PAC nor SignedPath service %s failed " "Ticket not signed with PAC nor SignedPath service %s failed "
"for delegation to %s for client %s " "for delegation to %s for client %s (%s)"
"from %s", "from %s",
spn, tpn, cpn, from); spn, tpn, dpn, cpn, from);
goto out; goto out;
} }
kdc_log(context, config, 0, "constrained delegation for %s " kdc_log(context, config, 0, "constrained delegation for %s "
"from %s to %s", tpn, cpn, spn); "from %s (%s) to %s", tpn, cpn, dpn, spn);
} }
/* /*
@@ -2208,6 +2221,8 @@ out:
free(tpn); free(tpn);
free(spn); free(spn);
free(cpn); free(cpn);
if (dpn)
free(dpn);
krb5_data_free(&rspac); krb5_data_free(&rspac);
krb5_free_keyblock_contents(context, &sessionkey); krb5_free_keyblock_contents(context, &sessionkey);
@@ -2224,6 +2239,8 @@ out:
krb5_free_principal(context, tp); krb5_free_principal(context, tp);
if (cp) if (cp)
krb5_free_principal(context, cp); krb5_free_principal(context, cp);
if (dp)
krb5_free_principal(context, dp);
if (sp) if (sp)
krb5_free_principal(context, sp); krb5_free_principal(context, sp);
if (ref_realm) if (ref_realm)

5
kdc/windc.c
View File

@@ -84,6 +84,7 @@ _kdc_pac_generate(krb5_context context,
krb5_error_code krb5_error_code
_kdc_pac_verify(krb5_context context, _kdc_pac_verify(krb5_context context,
const krb5_principal client_principal, const krb5_principal client_principal,
const krb5_principal delegated_proxy_principal,
hdb_entry_ex *client, hdb_entry_ex *client,
hdb_entry_ex *server, hdb_entry_ex *server,
hdb_entry_ex *krbtgt, hdb_entry_ex *krbtgt,
@@ -96,7 +97,9 @@ _kdc_pac_verify(krb5_context context,
return 0; return 0;
ret = windcft->pac_verify(windcctx, context, ret = windcft->pac_verify(windcctx, context,
client_principal, client, server, krbtgt, pac); client_principal,
delegated_proxy_principal,
client, server, krbtgt, pac);
if (ret == 0) if (ret == 0)
*verified = 1; *verified = 1;
return ret; return ret;

11
kdc/windc_plugin.h
View File

@@ -57,10 +57,11 @@ typedef krb5_error_code
typedef krb5_error_code typedef krb5_error_code
(*krb5plugin_windc_pac_verify)(void *, krb5_context, (*krb5plugin_windc_pac_verify)(void *, krb5_context,
const krb5_principal, const krb5_principal, /* new ticket client */
struct hdb_entry_ex *, const krb5_principal, /* delegation proxy */
struct hdb_entry_ex *, struct hdb_entry_ex *,/* client */
struct hdb_entry_ex *, struct hdb_entry_ex *,/* server */
struct hdb_entry_ex *,/* krbtgt */
krb5_pac *); krb5_pac *);
typedef krb5_error_code typedef krb5_error_code
@@ -72,7 +73,7 @@ typedef krb5_error_code
KDC_REQ *, krb5_data *); KDC_REQ *, krb5_data *);
#define KRB5_WINDC_PLUGIN_MINOR 5 #define KRB5_WINDC_PLUGIN_MINOR 6
#define KRB5_WINDC_PLUGING_MINOR KRB5_WINDC_PLUGIN_MINOR #define KRB5_WINDC_PLUGING_MINOR KRB5_WINDC_PLUGIN_MINOR
typedef struct krb5plugin_windc_ftable { typedef struct krb5plugin_windc_ftable {