diff --git a/lib/gssapi/test_add_store_cred.c b/lib/gssapi/test_add_store_cred.c index 03c3dc95a..714f96ae7 100644 --- a/lib/gssapi/test_add_store_cred.c +++ b/lib/gssapi/test_add_store_cred.c @@ -99,6 +99,8 @@ static int help_flag = 0; static int env_flag = 0; static int def_flag = 0; static int overwrite_flag = 0; +static int store_cred_flag = 0; +static char *password = NULL; static struct getargs args[] = { {"version", 0, arg_flag, &version_flag, "print version", NULL }, @@ -109,16 +111,133 @@ static struct getargs args[] = { "switch credential store default principal", NULL }, {"overwrite", 0, arg_flag, &overwrite_flag, "overwrite matching credential", NULL }, + {"store-cred", 0, arg_flag, &store_cred_flag, + "use gss_store_cred instead of gss_store_cred_into2", NULL }, + {"password", 0, arg_string, &password, + "acquire source credential with this password", "password" }, }; static void usage(int ret) { arg_printusage(args, sizeof(args)/sizeof(*args), - NULL, "from_ccache to_ccache"); + NULL, "from_ccache to_ccache | source_name target_name"); exit(ret); } +static void +add_krb5_mech(gss_OID_set *mechs) +{ + OM_uint32 major, minor; + + major = gss_create_empty_oid_set(&minor, mechs); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_C_NO_OID, + "failed to create OID set"); + + major = gss_add_oid_set_member(&minor, GSS_KRB5_MECHANISM, mechs); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_C_NO_OID, + "failed to add krb5 mechanism to OID set"); +} + +static void +acquire_from_password(const char *source_name, + const char *source_password, + gss_cred_id_t *cred) +{ + OM_uint32 major, minor; + gss_buffer_desc namebuf, pwbuf; + gss_name_t name = GSS_C_NO_NAME; + gss_OID_set mechs = GSS_C_NO_OID_SET; + + namebuf.value = rk_UNCONST(source_name); + namebuf.length = strlen(source_name); + major = gss_import_name(&minor, &namebuf, GSS_C_NT_USER_NAME, &name); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_C_NO_OID, + "failed to import source name %s", source_name); + + pwbuf.value = rk_UNCONST(source_password); + pwbuf.length = strlen(source_password); + add_krb5_mech(&mechs); + major = gss_acquire_cred_with_password(&minor, name, &pwbuf, + GSS_C_INDEFINITE, mechs, + GSS_C_INITIATE, cred, NULL, NULL); + (void) gss_release_oid_set(&minor, &mechs); + (void) gss_release_name(&minor, &name); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_KRB5_MECHANISM, + "failed to acquire creds with password for %s", source_name); +} + +static void +check_init_sec_context(gss_cred_id_t cred, const char *target) +{ + OM_uint32 major, minor; + gss_buffer_desc namebuf; + gss_buffer_desc output_token = { 0, NULL }; + gss_name_t target_name = GSS_C_NO_NAME; + gss_ctx_id_t ctx = GSS_C_NO_CONTEXT; + + namebuf.value = rk_UNCONST(target); + namebuf.length = strlen(target); + major = gss_import_name(&minor, &namebuf, GSS_C_NT_HOSTBASED_SERVICE, + &target_name); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_C_NO_OID, + "failed to import target name %s", target); + + major = gss_init_sec_context(&minor, cred, &ctx, target_name, + GSS_KRB5_MECHANISM, 0, GSS_C_INDEFINITE, + GSS_C_NO_CHANNEL_BINDINGS, + GSS_C_NO_BUFFER, NULL, &output_token, + NULL, NULL); + (void) gss_release_buffer(&minor, &output_token); + (void) gss_delete_sec_context(&minor, &ctx, GSS_C_NO_BUFFER); + (void) gss_release_name(&minor, &target_name); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_KRB5_MECHANISM, + "failed to use source cred for %s after storing", target); +} + +static void +acquire_from_ccache(const char *ccache, gss_cred_id_t *cred) +{ + OM_uint32 major, minor; + gss_key_value_element_desc element; + gss_key_value_set_desc store; + + element.key = "ccache"; + element.value = ccache; + store.count = 1; + store.elements = &element; + + major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, + GSS_KRB5_MECHANISM, GSS_C_INITIATE, + GSS_C_INDEFINITE, GSS_C_INDEFINITE, + &store, cred, NULL, NULL, NULL); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_KRB5_MECHANISM, + "failed to acquire stored creds from %s", ccache); +} + +static void +check_default_ccache(gss_cred_id_t from_cred, const char *target) +{ + OM_uint32 minor; + const char *ccache = getenv("KRB5CCNAME"); + gss_cred_id_t to_cred = GSS_C_NO_CREDENTIAL; + + if (ccache == NULL) + errx(1, "KRB5CCNAME not set"); + + acquire_from_ccache(ccache, &to_cred); + check_init_sec_context(from_cred, target); + check_init_sec_context(to_cred, target); + (void) gss_release_cred(&minor, &to_cred); +} + int main(int argc, char **argv) { @@ -157,30 +276,42 @@ main(int argc, char **argv) if (argc > 2) errx(1, "too many arguments"); - from_elements.key = "ccache"; - from_elements.value = argv[0]; - from.count = 1; - from.elements = &from_elements; + if (password) { + if (!store_cred_flag) + errx(1, "--password requires --store-cred"); + acquire_from_password(argv[0], password, &from_cred); + } else { + from_elements.key = "ccache"; + from_elements.value = argv[0]; + from.count = 1; + from.elements = &from_elements; - to_elements.key = "ccache"; - to_elements.value = argv[1]; - to.count = 1; - to.elements = &to_elements; + major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, + GSS_KRB5_MECHANISM, GSS_C_INITIATE, + GSS_C_INDEFINITE, GSS_C_INDEFINITE, + &from, &from_cred, NULL, NULL, NULL); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_KRB5_MECHANISM, + "failed to acquire creds from %s", argv[0]); + } - major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, - GSS_KRB5_MECHANISM, GSS_C_INITIATE, - GSS_C_INDEFINITE, GSS_C_INDEFINITE, - &from, &from_cred, NULL, NULL, NULL); + if (store_cred_flag) { + major = gss_store_cred(&minor, from_cred, GSS_C_INITIATE, + GSS_KRB5_MECHANISM, overwrite_flag, def_flag, + NULL, NULL); + } else { + to_elements.key = "ccache"; + to_elements.value = argv[1]; + to.count = 1; + to.elements = &to_elements; + + major = gss_store_cred_into2(&minor, from_cred, GSS_C_INITIATE, + GSS_KRB5_MECHANISM, store_flags, &to, NULL, + NULL, env_flag ? &env : NULL); + } if (major != GSS_S_COMPLETE) gss_err(1, major, minor, GSS_KRB5_MECHANISM, - "failed to acquire creds from %s", argv[0]); - - major = gss_store_cred_into2(&minor, from_cred, GSS_C_INITIATE, - GSS_KRB5_MECHANISM, store_flags, &to, NULL, - NULL, env_flag ? &env : NULL); - if (major != GSS_S_COMPLETE) - gss_err(1, major, minor, GSS_KRB5_MECHANISM, - "failed to store creds into %s", argv[1]); + "failed to store creds"); if (env_flag) { size_t i; @@ -204,6 +335,22 @@ main(int argc, char **argv) "gss_store_cred_into2()"); } + if (password) + check_default_ccache(from_cred, argv[1]); + + if (store_cred_flag) { + (void) gss_release_cred(&minor, &from_cred); + return 0; + } + + major = gss_add_cred_from(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME, + GSS_KRB5_MECHANISM, GSS_C_INITIATE, + GSS_C_INDEFINITE, GSS_C_INDEFINITE, + &to, &to_cred, NULL, NULL, NULL); + if (major != GSS_S_COMPLETE) + gss_err(1, major, minor, GSS_KRB5_MECHANISM, + "failed to acquire stored creds from %s", argv[1]); + (void) gss_release_cred(&minor, &from_cred); (void) gss_release_cred(&minor, &to_cred); diff --git a/tests/gss/check-basic.in b/tests/gss/check-basic.in index ae69476a8..2aed18199 100644 --- a/tests/gss/check-basic.in +++ b/tests/gss/check-basic.in @@ -112,6 +112,16 @@ test_section "copy ccache with gss_store_cred" test_run ${test_add_store_cred} --default --overwrite --env ${cache} "${cache2}%{null}" test_run ${klist} -c ${cache2} +test_section "copy ccache to MEMORY with gss_store_cred" +test_run ${test_add_store_cred} --default --overwrite --env \ + ${cache} MEMORY:gss-store-cred-issue132 + +test_section "store password-acquired cred with gss_store_cred" +KRB5CCNAME=MEMORY:gss-store-cred-issue132-default +test_run ${test_add_store_cred} --store-cred --default --overwrite \ + --password=upw user@${R} host@host.test.h5l.se +KRB5CCNAME=${cache} + test_section "keytab" test_run ${acquire_cred} \ --acquire-type=accept \