oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Properly implement neg_mechs & GM_USE_MG_CRED

Browse Source 
SPNEGO was already using union creds.  Now make the mechglue know about
it, delete all of the cred-related SPNEGO stubs that are now not called
(lib/gssapi/spnego/cred_stubs.c), and implement gss_get/set_neg_mechs()
by storing the OID set in the union cred.

This commit was essentially authored as much if not more by Luke Howard
<lukeh at padl.com> as much as by the listed author.
This commit is contained in:
Nicolas Williams
2020-04-18 22:15:00 -05:00
parent 2ec9e17042
commit a54761d68a
20 changed files with 397 additions and 418 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/gssapi/mech/cred.c
View File

@@ -42,7 +42,11 @@ release_mech_cred(OM_uint32 *minor, struct _gss_mechanism_cred *mc)
{
OM_uint32 major;
major = mc->gmc_mech->gm_release_cred(minor, &mc->gmc_cred);
if (mc->gmc_mech->gm_release_cred != NULL)
major = mc->gmc_mech->gm_release_cred(minor, &mc->gmc_cred);
else
major = GSS_S_COMPLETE;
free(mc);
return major;

1
lib/gssapi/mech/cred.h
View File

@@ -37,6 +37,7 @@ HEIM_TAILQ_HEAD(_gss_mechanism_cred_list, _gss_mechanism_cred);
struct _gss_cred {
struct _gss_mechanism_cred_list gc_mc;
gss_OID_set gc_neg_mechs;
};
struct _gss_cred *

52
lib/gssapi/mech/gss_acquire_cred_from.c
View File

@@ -149,7 +149,7 @@ gss_acquire_cred_from(OM_uint32 *minor_status,
struct _gss_cred *cred = NULL;
size_t i;
OM_uint32 min_time = GSS_C_INDEFINITE;
gss_OID_set mechs;
gss_OID_set mechs = GSS_C_NO_OID_SET;
*minor_status = 0;
if (output_cred_handle == NULL)
@@ -162,28 +162,40 @@ gss_acquire_cred_from(OM_uint32 *minor_status,
_gss_load_mech();
if (desired_mechs) {
int match = 0;
if (desired_mechs != GSS_C_NO_OID_SET) {
int only_mg_cred_mechs = -1;
for (i = 0; i < desired_mechs->count; i++) {
gss_test_oid_set_member(minor_status, &desired_mechs->elements[i],
_gss_mech_oids, &match);
if (match)
break;
m = __gss_get_mechanism(&desired_mechs->elements[i]);
if (m != NULL) {
if ((m->gm_flags & GM_USE_MG_CRED) == 0)
only_mg_cred_mechs = 0;
else if (only_mg_cred_mechs == -1)
only_mg_cred_mechs = 1;
}
}
if (!match) {
/*
* Now SPNEGO supports GM_USE_MG_CRED it's no longer necessary
* to specifically acquire SPNEGO credentials. If the caller
* did not specify any concrete mechanisms then we will acquire
* credentials for all of them.
*/
if (only_mg_cred_mechs == -1) {
*minor_status = 0;
major_status = GSS_S_BAD_MECH;
goto cleanup;
}
mechs = desired_mechs;
} else if (only_mg_cred_mechs == 0)
mechs = desired_mechs;
else
mechs = _gss_mech_oids;
} else
mechs = _gss_mech_oids;
cred = _gss_mg_alloc_cred();
if (cred == NULL) {
*minor_status = ENOMEM;
return GSS_S_FAILURE;
major_status = GSS_S_FAILURE;
goto cleanup;
}
if (actual_mechs) {
@@ -251,6 +263,24 @@ gss_acquire_cred_from(OM_uint32 *minor_status,
goto cleanup;
}
/* add all GM_USE_MG_CRED mechs such as SPNEGO */
if (actual_mechs != NULL) {
struct _gss_mech_switch *ms;
HEIM_TAILQ_FOREACH(ms, &_gss_mechs, gm_link) {
m = &ms->gm_mech;
if ((m->gm_flags & GM_USE_MG_CRED) == 0)
continue;
major_status = gss_add_oid_set_member(minor_status,
&m->gm_mech_oid,
actual_mechs);
if (GSS_ERROR(major_status))
goto cleanup;
}
}
*minor_status = 0;
major_status = GSS_S_COMPLETE;

161
lib/gssapi/mech/gss_add_cred_from.c
View File

@@ -88,14 +88,75 @@ _gss_mg_add_mech_cred(OM_uint32 *minor_status,
} else
major_status = GSS_S_UNAVAILABLE;
if (major_status == GSS_S_COMPLETE && out)
if (major_status == GSS_S_COMPLETE && out) {
heim_assert(new_mc->gmc_cred != GSS_C_NO_CREDENTIAL,
"mechanism gss_add_cred did not return a cred");
*out = new_mc;
else
} else
free(new_mc);
return major_status;
}
static OM_uint32
add_mech_cred_internal(OM_uint32 *minor_status,
gss_const_name_t desired_name,
gssapi_mech_interface m,
gss_cred_usage_t cred_usage,
OM_uint32 initiator_time_req,
OM_uint32 acceptor_time_req,
gss_const_key_value_set_t cred_store,
struct _gss_cred *mut_cred,
OM_uint32 *initiator_time_rec,
OM_uint32 *acceptor_time_rec)
{
OM_uint32 major_status;
struct _gss_mechanism_cred *mc;
struct _gss_mechanism_name *mn;
heim_assert((m->gm_flags & GM_USE_MG_CRED) == 0,
"add_mech_cred_internal must be called with concrete mechanism");
if (desired_name != GSS_C_NO_NAME) {
major_status = _gss_find_mn(minor_status,
(struct _gss_name *)desired_name,
&m->gm_mech_oid, &mn);
if (major_status != GSS_S_COMPLETE)
return major_status;
} else
mn = NULL;
/*
* If we have an existing mechanism credential for mechanism m, then
* add the desired credential to it; otherwise, create a new one and
* add it to mut_cred.
*/
HEIM_TAILQ_FOREACH(mc, &mut_cred->gc_mc, gmc_link) {
if (gss_oid_equal(&m->gm_mech_oid, mc->gmc_mech_oid))
break;
}
if (mc) {
major_status = _gss_mg_add_mech_cred(minor_status, m,
mc, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, NULL,
initiator_time_rec, acceptor_time_rec);
} else {
struct _gss_mechanism_cred *new_mc = NULL;
major_status = _gss_mg_add_mech_cred(minor_status, m,
NULL, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, &new_mc,
initiator_time_rec, acceptor_time_rec);
if (major_status == GSS_S_COMPLETE)
HEIM_TAILQ_INSERT_TAIL(&mut_cred->gc_mc, new_mc, gmc_link);
}
return major_status;
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_add_cred_from(OM_uint32 *minor_status,
gss_cred_id_t input_cred_handle,
@@ -114,9 +175,6 @@ gss_add_cred_from(OM_uint32 *minor_status,
gssapi_mech_interface m;
gss_cred_id_t release_cred = GSS_C_NO_CREDENTIAL;
struct _gss_cred *mut_cred;
struct _gss_mechanism_cred *mc;
struct _gss_mechanism_cred *new_mc = NULL;
struct _gss_mechanism_name *mn = NULL;
OM_uint32 junk;
*minor_status = 0;
@@ -130,8 +188,7 @@ gss_add_cred_from(OM_uint32 *minor_status,
*acceptor_time_rec = 0;
if (actual_mechs)
*actual_mechs = GSS_C_NO_OID_SET;
if ((m = __gss_get_mechanism(desired_mech)) == NULL ||
(m->gm_flags & GM_USE_MG_CRED))
if ((m = __gss_get_mechanism(desired_mech)) == NULL)
return GSS_S_BAD_MECH;
if (input_cred_handle == GSS_C_NO_CREDENTIAL &&
output_cred_handle == NULL) {
@@ -162,45 +219,62 @@ gss_add_cred_from(OM_uint32 *minor_status,
release_cred = (gss_cred_id_t)mut_cred;
}
/* Find an MN, if any */
if (desired_name) {
major_status = _gss_find_mn(minor_status,
(struct _gss_name *)desired_name,
desired_mech, &mn);
if (major_status != GSS_S_COMPLETE)
goto done;
if (m->gm_flags & GM_USE_MG_CRED) {
struct _gss_mech_switch *ms;
OM_uint32 initiator_time_min = GSS_C_INDEFINITE;
OM_uint32 acceptor_time_min = GSS_C_INDEFINITE;
major_status = GSS_S_UNAVAILABLE; /* in case of no mechs */
if (input_cred_handle == GSS_C_NO_CREDENTIAL) {
HEIM_TAILQ_FOREACH(ms, &_gss_mechs, gm_link) {
m = &ms->gm_mech; /* for _gss_mg_error() */
if (m->gm_flags & GM_USE_MG_CRED)
continue;
major_status = add_mech_cred_internal(minor_status, desired_name, m,
cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, mut_cred,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE)
continue;
if (initiator_time_rec && *initiator_time_rec < initiator_time_min)
initiator_time_min = *initiator_time_rec;
if (acceptor_time_rec && *acceptor_time_rec < acceptor_time_min)
acceptor_time_min = *acceptor_time_rec;
}
} else {
OM_uint32 lifetime;
gss_cred_usage_t usage = GSS_C_BOTH;
major_status = gss_inquire_cred(minor_status, input_cred_handle,
NULL, &lifetime, &usage, NULL);
if (major_status == GSS_S_COMPLETE) {
if (usage == GSS_C_BOTH || usage == GSS_C_INITIATE)
initiator_time_min = lifetime;
if (usage == GSS_C_BOTH || usage == GSS_C_ACCEPT)
acceptor_time_min = lifetime;
}
}
if (initiator_time_rec)
*initiator_time_rec = initiator_time_min;
if (acceptor_time_rec)
*acceptor_time_rec = acceptor_time_min;
} else {
major_status = add_mech_cred_internal(minor_status, desired_name, m,
cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, mut_cred,
initiator_time_rec, acceptor_time_rec);
}
/*
* We go through all the mc attached to the input_cred_handle and check the
* mechanism. If it matches, we call gss_add_cred for that mechanism,
* otherwise we just add a new mc.
*/
HEIM_TAILQ_FOREACH(mc, &mut_cred->gc_mc, gmc_link) {
if (!gss_oid_equal(mc->gmc_mech_oid, desired_mech))
continue;
major_status = _gss_mg_add_mech_cred(minor_status, m,
mc, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, NULL,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE)
_gss_mg_error(m, *minor_status);
goto done;
}
if (major_status != GSS_S_COMPLETE)
_gss_mg_error(m, *minor_status);
major_status = _gss_mg_add_mech_cred(minor_status, m, NULL, mn, cred_usage,
initiator_time_req, acceptor_time_req,
cred_store, &new_mc,
initiator_time_rec, acceptor_time_rec);
if (major_status != GSS_S_COMPLETE) {
_gss_mg_error(m, *minor_status);
goto done;
}
HEIM_TAILQ_INSERT_TAIL(&mut_cred->gc_mc, new_mc, gmc_link);
new_mc = NULL;
done:
/* Lastly, we have to inquire the cred to get the actual_mechs */
if (major_status == GSS_S_COMPLETE && actual_mechs != NULL) {
major_status = gss_inquire_cred(minor_status,
@@ -213,7 +287,6 @@ done:
} else {
gss_release_cred(&junk, &release_cred);
}
free(new_mc);
return major_status;
}

125
lib/gssapi/mech/gss_cred.c
View File

@@ -34,12 +34,56 @@
#include "mech_locl.h"
#include <krb5.h>
static OM_uint32
export_oid_set(OM_uint32 *minor_status,
gss_const_OID mech,
gss_const_OID_set oids,
krb5_storage *sp)
{
krb5_error_code ret;
krb5_data data;
size_t i, len;
data.length = mech->length;
data.data = mech->elements;
ret = krb5_store_data(sp, data);
if (ret)
goto out;
for (i = 0, len = 0; i < oids->count; i++)
len += 4 + oids->elements[i].length;
ret = krb5_store_uint32(sp, len);
if (ret)
goto out;
for (i = 0; i < oids->count; i++) {
data.length = oids->elements[i].length;
data.data = oids->elements[i].elements;
ret = krb5_store_data(sp, data);
if (ret)
goto out;
}
ret = krb5_storage_to_data(sp, &data);
if (ret)
goto out;
out:
*minor_status = ret;
return ret ? GSS_S_FAILURE : GSS_S_COMPLETE;
}
/*
* format: any number of:
* mech-len: int32
* mech-data: char * (not alligned)
* cred-len: int32
* cred-data char * (not alligned)
*
* where neg_mechs is encoded for GSS_SPNEGO_MECHANISM
*/
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
@@ -99,6 +143,15 @@ gss_export_cred(OM_uint32 * minor_status,
_gss_secure_release_buffer(minor_status, &buffer);
}
if (cred->gc_neg_mechs != GSS_C_NO_OID_SET) {
major = export_oid_set(minor_status, GSS_SPNEGO_MECHANISM,
cred->gc_neg_mechs, sp);
if (major != GSS_S_COMPLETE) {
krb5_storage_free(sp);
return major;
}
}
ret = krb5_storage_to_data(sp, &data);
krb5_storage_free(sp);
if (ret) {
@@ -120,6 +173,66 @@ gss_export_cred(OM_uint32 * minor_status,
return GSS_S_COMPLETE;
}
static OM_uint32
import_oid_set(OM_uint32 *minor_status,
gss_const_buffer_t token,
gss_OID_set *oids)
{
OM_uint32 major, junk;
krb5_error_code ret;
krb5_storage *sp = NULL;
*oids = GSS_C_NO_OID_SET;
if (token->length == 0)
return GSS_S_COMPLETE;
major = gss_create_empty_oid_set(minor_status, oids);
if (major != GSS_S_COMPLETE)
goto out;
sp = krb5_storage_from_readonly_mem(token->value, token->length);
if (sp == NULL) {
*minor_status = ENOMEM;
major = GSS_S_FAILURE;
goto out;
}
while (1) {
gss_OID_desc oid;
krb5_data data;
ret = krb5_ret_data(sp, &data);
if (ret == HEIM_ERR_EOF)
break;
else if (ret) {
*minor_status = ret;
major = GSS_S_FAILURE;
goto out;
}
oid.elements = data.data;
oid.length = (OM_uint32)data.length;
major = gss_add_oid_set_member(minor_status, &oid, oids);
if (major != GSS_S_COMPLETE) {
krb5_data_free(&data);
goto out;
}
krb5_data_free(&data);
}
major = GSS_S_COMPLETE;
*minor_status = 0;
out:
if (major != GSS_S_COMPLETE)
gss_release_oid_set(&junk, oids);
krb5_storage_free(sp);
return major;
}
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_import_cred(OM_uint32 * minor_status,
gss_buffer_t token,
@@ -179,7 +292,8 @@ gss_import_cred(OM_uint32 * minor_status,
goto out;
}
if (m->gm_import_cred == NULL) {
if (m->gm_import_cred == NULL &&
!gss_oid_equal(&m->gm_mech_oid, GSS_SPNEGO_MECHANISM)) {
*minor_status = 0;
major = GSS_S_BAD_MECH;
goto out;
@@ -195,6 +309,15 @@ gss_import_cred(OM_uint32 * minor_status,
buffer.value = data.data;
buffer.length = data.length;
if (gss_oid_equal(&m->gm_mech_oid, GSS_SPNEGO_MECHANISM)) {
major = import_oid_set(minor_status, &buffer, &cred->gc_neg_mechs);
krb5_data_free(&data);
if (major != GSS_S_COMPLETE)
goto out;
else
continue;
}
major = m->gm_import_cred(minor_status,
&buffer, &mcred);
krb5_data_free(&data);

73
lib/gssapi/mech/gss_get_neg_mechs.c
View File

@@ -33,81 +33,22 @@
#include "mech_locl.h"
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_get_neg_mechs (OM_uint32 *minor_status,
gss_const_cred_id_t cred_handle,
gss_OID_set *mechs)
gss_get_neg_mechs(OM_uint32 *minor_status,
gss_const_cred_id_t cred_handle,
gss_OID_set *mechs)
{
struct _gss_cred *cred = (struct _gss_cred *)cred_handle;
OM_uint32 major, minor;
gss_cred_id_t tmp_cred = GSS_C_NO_CREDENTIAL;
struct _gss_mechanism_cred *mc;
if (minor_status == NULL)
return GSS_S_CALL_INACCESSIBLE_WRITE;
*minor_status = 0;
if (mechs == NULL)
return GSS_S_CALL_INACCESSIBLE_WRITE;
*mechs = GSS_C_NO_OID_SET;
_gss_load_mech();
if (cred->gc_neg_mechs != GSS_C_NO_OID_SET)
return gss_duplicate_oid_set(minor_status, cred->gc_neg_mechs, mechs);
if (cred == NULL) {
major = gss_acquire_cred(minor_status, GSS_C_NO_NAME, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_BOTH,
&tmp_cred, NULL, NULL);
if (GSS_ERROR(major))
return major;
cred = (struct _gss_cred *)tmp_cred;
}
major = gss_create_empty_oid_set(minor_status, mechs);
if (GSS_ERROR(major))
goto cleanup;
major = GSS_S_UNAVAILABLE;
HEIM_TAILQ_FOREACH(mc, &cred->gc_mc, gmc_link) {
gssapi_mech_interface m;
gss_OID_set mechs2 = GSS_C_NO_OID_SET;
size_t i;
m = mc->gmc_mech;
if (m == NULL) {
major = GSS_S_BAD_MECH;
goto cleanup;
}
if (m->gm_get_neg_mechs == NULL)
continue;
major = m->gm_get_neg_mechs(minor_status, mc->gmc_cred, &mechs2);
if (GSS_ERROR(major))
goto cleanup;
if (mechs2 == GSS_C_NO_OID_SET)
continue;
for (i = 0; i < mechs2->count; i++) {
major = gss_add_oid_set_member(minor_status, &mechs2->elements[i],
mechs);
if (GSS_ERROR(major)) {
gss_release_oid_set(&minor, &mechs2);
goto cleanup;
}
}
gss_release_oid_set(&minor, &mechs2);
}
cleanup:
if (tmp_cred)
gss_release_cred(&minor, &tmp_cred);
if (major == GSS_S_COMPLETE && *mechs == GSS_C_NO_OID_SET)
major = GSS_S_NO_CRED;
if (GSS_ERROR(major))
gss_release_oid_set(&minor, mechs);
return major;
return GSS_S_UNAVAILABLE;
}

17
lib/gssapi/mech/gss_inquire_cred.c
View File

@@ -99,6 +99,9 @@ gss_inquire_cred(OM_uint32 *minor_status,
gss_name_t mc_name = GSS_C_NO_NAME;
OM_uint32 mc_lifetime = GSS_C_INDEFINITE;
heim_assert((mc->gmc_mech->gm_flags & GM_USE_MG_CRED) == 0,
"should not have mech creds for GM_USE_MG_CRED mechs");
if (mc->gmc_mech->gm_inquire_cred == NULL)
continue;
@@ -137,7 +140,8 @@ gss_inquire_cred(OM_uint32 *minor_status,
gss_name_t mc_name;
OM_uint32 mc_lifetime;
if (m->gm_mech.gm_inquire_cred == NULL)
if (m->gm_mech.gm_inquire_cred == NULL ||
(m->gm_mech.gm_flags & GM_USE_MG_CRED))
continue;
major_status = m->gm_mech.gm_inquire_cred(minor_status,
@@ -174,6 +178,17 @@ gss_inquire_cred(OM_uint32 *minor_status,
}
}
if (found && mechanisms) {
/* GM_USE_MG_CRED mechs (SPNEGO) always can be used */
HEIM_TAILQ_FOREACH(m, &_gss_mechs, gm_link) {
if ((m->gm_mech.gm_flags & GM_USE_MG_CRED) == 0)
continue;
gss_add_oid_set_member(minor_status,
m->gm_mech_oid, mechanisms);
}
}
if (found == 0 || min_lifetime == 0) {
gss_name_t n = (gss_name_t)name;
if (n)

2
lib/gssapi/mech/gss_mech_switch.c
View File

@@ -417,8 +417,6 @@ _gss_load_mech(void)
OPTSYM(duplicate_cred);
OPTSYM(add_cred_from);
OPTSYM(store_cred_into);
OPTSYM(set_neg_mechs);
OPTSYM(get_neg_mechs);
OPTSPISYM(authorize_localname);
OPTSPISPISYM(query_mechanism_info);
OPTSPISPISYM(query_meta_data);

59
lib/gssapi/mech/gss_set_neg_mechs.c
View File

@@ -33,61 +33,28 @@
#include "mech_locl.h"
GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_set_neg_mechs (OM_uint32 *minor_status,
gss_cred_id_t cred_handle,
const gss_OID_set mechs)
gss_set_neg_mechs(OM_uint32 *minor_status,
gss_cred_id_t cred_handle,
const gss_OID_set mechs)
{
struct _gss_cred *cred = (struct _gss_cred *)cred_handle;
OM_uint32 major;
int found = 0;
OM_uint32 major_status, junk;
gss_OID_set tmp_mechs;
if (minor_status == NULL)
return GSS_S_CALL_INACCESSIBLE_WRITE;
*minor_status = 0;
if (mechs == GSS_C_NO_OID_SET)
if (cred_handle == GSS_C_NO_CREDENTIAL || mechs == GSS_C_NO_OID_SET)
return GSS_S_CALL_INACCESSIBLE_READ;
_gss_load_mech();
major_status = gss_duplicate_oid_set(minor_status, mechs, &tmp_mechs);
if (major_status != GSS_S_COMPLETE)
return major_status;
major = GSS_S_UNAVAILABLE;
gss_release_oid_set(&junk, &cred->gc_neg_mechs);
cred->gc_neg_mechs = tmp_mechs;
if (cred == NULL) {
struct _gss_mech_switch *m;
HEIM_TAILQ_FOREACH(m, &_gss_mechs, gm_link) {
if (m->gm_mech.gm_set_neg_mechs == NULL)
continue;
major = m->gm_mech.gm_set_neg_mechs(minor_status,
GSS_C_NO_CREDENTIAL, mechs);
if (major == GSS_S_COMPLETE)
found++;
else
_gss_mg_error(&m->gm_mech, *minor_status);
}
} else {
struct _gss_mechanism_cred *mc;
HEIM_TAILQ_FOREACH(mc, &cred->gc_mc, gmc_link) {
gssapi_mech_interface m;
m = mc->gmc_mech;
if (m == NULL)
return GSS_S_BAD_MECH;
if (m->gm_set_neg_mechs == NULL)
continue;
major = m->gm_set_neg_mechs(minor_status, mc->gmc_cred, mechs);
if (major == GSS_S_COMPLETE)
found++;
else
_gss_mg_error(m, *minor_status);
}
}
if (found) {
*minor_status = 0;
return GSS_S_COMPLETE;
}
return major;
return GSS_S_COMPLETE;
}