oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

heimdal Use a seperate krb5_auth_context for the delegated credentials

Browse Source 
This makes it much more clear that the timestamp written here is not
used in mutual authentication.

Andrew Bartlett

Signed-off-by: Love Hornquist Astrand <lha@h5l.org>
This commit is contained in:
Andrew Bartlett
2010-09-29 06:44:33 +10:00
committed by Love Hornquist Astrand
parent b78419f126
commit 5cc4d5d2bd
3 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
lib/gssapi/krb5/delete_sec_context.c
View File

@@ -59,6 +59,7 @@ _gsskrb5_delete_sec_context(OM_uint32 * minor_status,
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
krb5_auth_con_free (context, ctx->auth_context); krb5_auth_con_free (context, ctx->auth_context);
krb5_auth_con_free (context, ctx->deleg_auth_context);
if (ctx->kcred) if (ctx->kcred)
krb5_free_creds(context, ctx->kcred); krb5_free_creds(context, ctx->kcred);
if(ctx->source) if(ctx->source)

1
lib/gssapi/krb5/gsskrb5_locl.h
View File

@@ -55,6 +55,7 @@ struct gss_msg_order;
typedef struct gsskrb5_ctx { typedef struct gsskrb5_ctx {
struct krb5_auth_context_data *auth_context; struct krb5_auth_context_data *auth_context;
struct krb5_auth_context_data *deleg_auth_context;
krb5_principal source, target; krb5_principal source, target;
#define IS_DCE_STYLE(ctx) (((ctx)->flags & GSS_C_DCE_STYLE) != 0) #define IS_DCE_STYLE(ctx) (((ctx)->flags & GSS_C_DCE_STYLE) != 0)
OM_uint32 flags; OM_uint32 flags;

34
lib/gssapi/krb5/init_sec_context.c
View File

@@ -117,6 +117,7 @@ _gsskrb5_create_ctx(
return GSS_S_FAILURE; return GSS_S_FAILURE;
} }
ctx->auth_context = NULL; ctx->auth_context = NULL;
ctx->deleg_auth_context = NULL;
ctx->source = NULL; ctx->source = NULL;
ctx->target = NULL; ctx->target = NULL;
ctx->kcred = NULL; ctx->kcred = NULL;
@@ -139,13 +140,34 @@ _gsskrb5_create_ctx(
return GSS_S_FAILURE; return GSS_S_FAILURE;
} }
kret = krb5_auth_con_init (context, &ctx->deleg_auth_context);
if (kret) {
*minor_status = kret;
krb5_auth_con_free(context, ctx->auth_context);
HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
return GSS_S_FAILURE;
}
kret = set_addresses(context, ctx->auth_context, input_chan_bindings); kret = set_addresses(context, ctx->auth_context, input_chan_bindings);
if (kret) { if (kret) {
*minor_status = kret; *minor_status = kret;
krb5_auth_con_free(context, ctx->auth_context);
krb5_auth_con_free(context, ctx->deleg_auth_context);
HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex); HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
return GSS_S_BAD_BINDINGS;
}
kret = set_addresses(context, ctx->deleg_auth_context, input_chan_bindings);
if (kret) {
*minor_status = kret;
krb5_auth_con_free(context, ctx->auth_context); krb5_auth_con_free(context, ctx->auth_context);
krb5_auth_con_free(context, ctx->deleg_auth_context);
HEIMDAL_MUTEX_destroy(&ctx->ctx_id_mutex);
return GSS_S_BAD_BINDINGS; return GSS_S_BAD_BINDINGS;
} }
@@ -160,6 +182,16 @@ _gsskrb5_create_ctx(
KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED, KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED,
NULL); NULL);
/*
* We need a sequence number
*/
krb5_auth_con_addflags(context,
ctx->deleg_auth_context,
KRB5_AUTH_CONTEXT_DO_SEQUENCE |
KRB5_AUTH_CONTEXT_CLEAR_FORWARDED_CRED,
NULL);
*context_handle = (gss_ctx_id_t)ctx; *context_handle = (gss_ctx_id_t)ctx;
return GSS_S_COMPLETE; return GSS_S_COMPLETE;
@@ -538,7 +570,7 @@ init_auth_restart
ap_options = 0; ap_options = 0;
if (flagmask & GSS_C_DELEG_FLAG) { if (flagmask & GSS_C_DELEG_FLAG) {
do_delegation (context, do_delegation (context,
ctx->auth_context, ctx->deleg_auth_context,
ctx->ccache, ctx->kcred, ctx->target, ctx->ccache, ctx->kcred, ctx->target,
&fwd_data, flagmask, &flags); &fwd_data, flagmask, &flags);
} }