oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gss: allow source/target to be null on export/import

Browse Source 
Allow the source and target names to be NULL when exporting or importing a
security context for the krb5 mechanism. This will be used in the future to
support skeletal contexts that only provide RFC4121 message protection
services.
This commit is contained in:
Luke Howard
2020-04-14 12:34:44 +10:00
parent 865fffb0f5
commit 33137a8c82
3 changed files with 62 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
lib/gssapi/krb5/export_sec_context.c
View File

@@ -82,6 +82,10 @@ _gsskrb5_export_sec_context(
flags |= SC_LOCAL_SUBKEY;
if (ac->remote_subkey)
flags |= SC_REMOTE_SUBKEY;
if (ctx->source)
flags |= SC_SOURCE_NAME;
if (ctx->target)
flags |= SC_TARGET_NAME;
kret = krb5_store_int32 (sp, flags);
if (kret) {
@@ -164,7 +168,7 @@ _gsskrb5_export_sec_context(
}
/* names */
if (ctx->source) {
ret = _gsskrb5_export_name (minor_status,
(gss_name_t)ctx->source, &buffer);
if (ret)
@@ -173,26 +177,30 @@ _gsskrb5_export_sec_context(
data.length = buffer.length;
kret = krb5_store_data (sp, data);
_gsskrb5_release_buffer (&minor, &buffer);
ret = GSS_S_FAILURE;
if (kret) {
*minor_status = kret;
goto failure;
}
}
if (ctx->target) {
ret = _gsskrb5_export_name (minor_status,
(gss_name_t)ctx->target, &buffer);
if (ret)
goto failure;
data.data = buffer.value;
data.length = buffer.length;
ret = GSS_S_FAILURE;
kret = krb5_store_data (sp, data);
_gsskrb5_release_buffer (&minor, &buffer);
ret = GSS_S_FAILURE;
if (kret) {
*minor_status = kret;
goto failure;
}
}
kret = krb5_store_int32 (sp, ctx->flags);
if (kret) {

2
lib/gssapi/krb5/gsskrb5_locl.h
View File

@@ -134,5 +134,7 @@ extern HEIMDAL_MUTEX gssapi_keytab_mutex;
#define SC_KEYBLOCK 0x04
#define SC_LOCAL_SUBKEY 0x08
#define SC_REMOTE_SUBKEY 0x10
#define SC_SOURCE_NAME 0x20
#define SC_TARGET_NAME 0x40
#endif

5
lib/gssapi/krb5/import_sec_context.c
View File

@@ -149,7 +149,7 @@ _gsskrb5_import_sec_context (
ac->cksumtype = tmp;
/* names */
if (flags & SC_SOURCE_NAME) {
if (krb5_ret_data (sp, &data))
goto failure;
buffer.value = data.data;
@@ -167,7 +167,9 @@ _gsskrb5_import_sec_context (
}
ctx->source = (krb5_principal)name;
krb5_data_free (&data);
}
if (flags & SC_TARGET_NAME) {
if (krb5_ret_data (sp, &data) != 0)
goto failure;
buffer.value = data.data;
@@ -185,6 +187,7 @@ _gsskrb5_import_sec_context (
}
ctx->target = (krb5_principal)name;
krb5_data_free (&data);
}
if (krb5_ret_int32 (sp, &tmp))
goto failure;