oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gss: allow source/target to be null on export/import

Browse Source 
Allow the source and target names to be NULL when exporting or importing a
security context for the krb5 mechanism. This will be used in the future to
support skeletal contexts that only provide RFC4121 message protection
services.
This commit is contained in:
Luke Howard
2020-04-14 12:34:44 +10:00
parent 865fffb0f5
commit 33137a8c82
3 changed files with 62 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
lib/gssapi/krb5/export_sec_context.c
View File

@@ -82,6 +82,10 @@ _gsskrb5_export_sec_context(
flags |= SC_LOCAL_SUBKEY; flags |= SC_LOCAL_SUBKEY;
if (ac->remote_subkey) if (ac->remote_subkey)
flags |= SC_REMOTE_SUBKEY; flags |= SC_REMOTE_SUBKEY;
if (ctx->source)
flags |= SC_SOURCE_NAME;
if (ctx->target)
flags |= SC_TARGET_NAME;
kret = krb5_store_int32 (sp, flags); kret = krb5_store_int32 (sp, flags);
if (kret) { if (kret) {
@@ -164,34 +168,38 @@ _gsskrb5_export_sec_context(
} }
/* names */ /* names */
if (ctx->source) {
ret = _gsskrb5_export_name (minor_status,
(gss_name_t)ctx->source, &buffer);
if (ret)
goto failure;
data.data = buffer.value;
data.length = buffer.length;
kret = krb5_store_data (sp, data);
_gsskrb5_release_buffer (&minor, &buffer);
ret = _gsskrb5_export_name (minor_status, ret = GSS_S_FAILURE;
(gss_name_t)ctx->source, &buffer); if (kret) {
if (ret) *minor_status = kret;
goto failure; goto failure;
data.data = buffer.value; }
data.length = buffer.length;
kret = krb5_store_data (sp, data);
_gsskrb5_release_buffer (&minor, &buffer);
if (kret) {
*minor_status = kret;
goto failure;
} }
ret = _gsskrb5_export_name (minor_status, if (ctx->target) {
(gss_name_t)ctx->target, &buffer); ret = _gsskrb5_export_name (minor_status,
if (ret) (gss_name_t)ctx->target, &buffer);
goto failure; if (ret)
data.data = buffer.value; goto failure;
data.length = buffer.length; data.data = buffer.value;
data.length = buffer.length;
kret = krb5_store_data (sp, data);
_gsskrb5_release_buffer (&minor, &buffer);
ret = GSS_S_FAILURE; ret = GSS_S_FAILURE;
if (kret) {
kret = krb5_store_data (sp, data); *minor_status = kret;
_gsskrb5_release_buffer (&minor, &buffer); goto failure;
if (kret) { }
*minor_status = kret;
goto failure;
} }
kret = krb5_store_int32 (sp, ctx->flags); kret = krb5_store_int32 (sp, ctx->flags);

2
lib/gssapi/krb5/gsskrb5_locl.h
View File

@@ -134,5 +134,7 @@ extern HEIMDAL_MUTEX gssapi_keytab_mutex;
#define SC_KEYBLOCK 0x04 #define SC_KEYBLOCK 0x04
#define SC_LOCAL_SUBKEY 0x08 #define SC_LOCAL_SUBKEY 0x08
#define SC_REMOTE_SUBKEY 0x10 #define SC_REMOTE_SUBKEY 0x10
#define SC_SOURCE_NAME 0x20
#define SC_TARGET_NAME 0x40
#endif #endif

53
lib/gssapi/krb5/import_sec_context.c
View File

@@ -149,42 +149,45 @@ _gsskrb5_import_sec_context (
ac->cksumtype = tmp; ac->cksumtype = tmp;
/* names */ /* names */
if (flags & SC_SOURCE_NAME) {
if (krb5_ret_data (sp, &data))
goto failure;
buffer.value = data.data;
buffer.length = data.length;
if (krb5_ret_data (sp, &data)) ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME,
goto failure;
buffer.value = data.data;
buffer.length = data.length;
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME,
&name);
if (ret) {
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
&name); &name);
if (ret) { if (ret) {
krb5_data_free (&data); ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
goto failure; &name);
if (ret) {
krb5_data_free (&data);
goto failure;
}
} }
ctx->source = (krb5_principal)name;
krb5_data_free (&data);
} }
ctx->source = (krb5_principal)name;
krb5_data_free (&data);
if (krb5_ret_data (sp, &data) != 0) if (flags & SC_TARGET_NAME) {
goto failure; if (krb5_ret_data (sp, &data) != 0)
buffer.value = data.data; goto failure;
buffer.length = data.length; buffer.value = data.data;
buffer.length = data.length;
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME, ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME,
&name);
if (ret) {
ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
&name); &name);
if (ret) { if (ret) {
krb5_data_free (&data); ret = _gsskrb5_import_name (minor_status, &buffer, GSS_C_NO_OID,
goto failure; &name);
if (ret) {
krb5_data_free (&data);
goto failure;
}
} }
ctx->target = (krb5_principal)name;
krb5_data_free (&data);
} }
ctx->target = (krb5_principal)name;
krb5_data_free (&data);
if (krb5_ret_int32 (sp, &tmp)) if (krb5_ret_int32 (sp, &tmp))
goto failure; goto failure;