oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Properly implement neg_mechs & GM_USE_MG_CRED

Browse Source 
SPNEGO was already using union creds.  Now make the mechglue know about
it, delete all of the cred-related SPNEGO stubs that are now not called
(lib/gssapi/spnego/cred_stubs.c), and implement gss_get/set_neg_mechs()
by storing the OID set in the union cred.

This commit was essentially authored as much if not more by Luke Howard
<lukeh at padl.com> as much as by the listed author.
This commit is contained in:
Nicolas Williams
2020-04-18 22:15:00 -05:00
parent 2ec9e17042
commit a54761d68a
20 changed files with 397 additions and 418 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/gssapi/spnego/accept_sec_context.c
View File

@@ -601,8 +601,7 @@ acceptor_start
gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
gss_buffer_desc mech_output_token;
gssspnego_ctx ctx;
int get_mic = 0;
int first_ok = 0;
int get_mic = 0, first_ok = 0, canonical_order;
gss_const_OID advertised_mech = GSS_C_NO_OID;
memset(&nt, 0, sizeof(nt));
@@ -676,7 +675,8 @@ acceptor_start
if (acceptor_cred_handle != GSS_C_NO_CREDENTIAL)
ret = _gss_spnego_inquire_cred_mechs(minor_status,
acceptor_cred_handle,
&supported_mechs);
&supported_mechs,
&canonical_order);
else
ret = _gss_spnego_indicate_mechs(minor_status, &supported_mechs);
if (ret != GSS_S_COMPLETE)

47
lib/gssapi/spnego/compat.c
View File

@@ -397,24 +397,21 @@ _gss_spnego_indicate_mechtypelist (OM_uint32 *minor_status,
OM_uint32 ret, minor;
OM_uint32 first_major = GSS_S_BAD_MECH, first_minor = 0;
size_t i;
int added_negoex = FALSE;
int added_negoex = FALSE, canonical_order = FALSE;
mechtypelist->len = 0;
mechtypelist->val = NULL;
if (cred_handle != GSS_C_NO_CREDENTIAL)
ret = _gss_spnego_inquire_cred_mechs(minor_status,
cred_handle, &supported_mechs);
ret = _gss_spnego_inquire_cred_mechs(minor_status, cred_handle,
&supported_mechs, &canonical_order);
else
ret = _gss_spnego_indicate_mechs(minor_status, &supported_mechs);
if (ret != GSS_S_COMPLETE)
return ret;
/*
* XXX when gss_set_neg_mechs() obeys application order this should
* apply only to the default mech list
*/
order_mechs_by_flags(supported_mechs, req_flags);
if (!canonical_order)
order_mechs_by_flags(supported_mechs, req_flags);
heim_assert(supported_mechs != GSS_C_NO_OID_SET,
"NULL mech set returned by SPNEGO inquire/indicate mechs");
@@ -626,40 +623,48 @@ _gss_spnego_indicate_mechs(OM_uint32 *minor_status,
OM_uint32
_gss_spnego_inquire_cred_mechs(OM_uint32 *minor_status,
gss_const_cred_id_t cred,
gss_OID_set *mechs_p)
gss_OID_set *mechs_p,
int *canonical_order)
{
OM_uint32 ret, junk;
gss_OID_set cred_mechs = GSS_C_NO_OID_SET;
gss_OID_set mechs = GSS_C_NO_OID_SET;
gss_OID_set negotiable_mechs = GSS_C_NO_OID_SET;
size_t i;
*mechs_p = GSS_C_NO_OID_SET;
*canonical_order = FALSE;
heim_assert(cred != GSS_C_NO_CREDENTIAL, "Invalid null credential handle");
ret = gss_inquire_cred(minor_status, cred, NULL, NULL, NULL, &cred_mechs);
ret = gss_get_neg_mechs(minor_status, cred, &cred_mechs);
if (ret == GSS_S_COMPLETE) {
*canonical_order = TRUE;
} else {
ret = gss_inquire_cred(minor_status, cred, NULL, NULL, NULL, &cred_mechs);
if (ret != GSS_S_COMPLETE)
goto out;
}
heim_assert(cred_mechs != GSS_C_NO_OID_SET && cred_mechs->count > 0,
"gss_inquire_cred succeeded but returned no mechanisms");
ret = _gss_spnego_indicate_mechs(minor_status, &negotiable_mechs);
if (ret != GSS_S_COMPLETE)
goto out;
heim_assert(cred_mechs != GSS_C_NO_OID_SET,
"gss_inquire_cred succeeded but returned null OID set");
ret = _gss_spnego_indicate_mechs(minor_status, &mechs);
if (ret != GSS_S_COMPLETE)
goto out;
heim_assert(mechs != GSS_C_NO_OID_SET,
heim_assert(negotiable_mechs != GSS_C_NO_OID_SET,
"_gss_spnego_indicate_mechs succeeded but returned null OID set");
ret = gss_create_empty_oid_set(minor_status, mechs_p);
if (ret != GSS_S_COMPLETE)
goto out;
/* Filter credential mechs by negotiable mechs, order by credential mechs */
for (i = 0; i < cred_mechs->count; i++) {
gss_OID cred_mech = &cred_mechs->elements[i];
int present = 0;
gss_test_oid_set_member(&junk, cred_mech, mechs, &present);
gss_test_oid_set_member(&junk, cred_mech, negotiable_mechs, &present);
if (!present)
continue;
@@ -672,7 +677,7 @@ out:
if (ret != GSS_S_COMPLETE)
gss_release_oid_set(&junk, mechs_p);
gss_release_oid_set(&junk, &cred_mechs);
gss_release_oid_set(&junk, &mechs);
gss_release_oid_set(&junk, &negotiable_mechs);
return ret;
}

185
lib/gssapi/spnego/cred_stubs.c
View File

@@ -1,185 +0,0 @@
/*
* Copyright (c) 2004, 2018, PADL Software Pty Ltd.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* 3. Neither the name of PADL Software nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include "spnego_locl.h"
#include <gssapi_mech.h>
/*
* For now, just a simple wrapper that avoids recursion. When
* we support gss_{get,set}_neg_mechs() we will need to expose
* more functionality.
*/
OM_uint32 GSSAPI_CALLCONV _gss_spnego_acquire_cred_from
(OM_uint32 *minor_status,
gss_const_name_t desired_name,
OM_uint32 time_req,
const gss_OID_set desired_mechs,
gss_cred_usage_t cred_usage,
gss_const_key_value_set_t cred_store,
gss_cred_id_t * output_cred_handle,
gss_OID_set * actual_mechs,
OM_uint32 * time_rec
)
{
OM_uint32 ret, tmp;
gss_OID_set mechs;
*output_cred_handle = GSS_C_NO_CREDENTIAL;
ret = _gss_spnego_indicate_mechs(minor_status, &mechs);
if (ret != GSS_S_COMPLETE)
return ret;
ret = gss_acquire_cred_from(minor_status, desired_name,
time_req, mechs,
cred_usage, cred_store,
output_cred_handle,
actual_mechs, time_rec);
gss_release_oid_set(&tmp, &mechs);
return ret;
}
OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred
(OM_uint32 * minor_status,
gss_const_cred_id_t cred_handle,
gss_name_t * name,
OM_uint32 * lifetime,
gss_cred_usage_t * cred_usage,
gss_OID_set * mechanisms
)
{
/*
* A wrapper around the mechglue is required to error out
* where cred_handle == GSS_C_NO_CREDENTIAL, otherwise we
* would infinitely recurse.
*/
if (cred_handle == GSS_C_NO_CREDENTIAL) {
*minor_status = 0;
return GSS_S_NO_CRED;
}
return gss_inquire_cred(minor_status, cred_handle, name,
lifetime, cred_usage, mechanisms);
}
OM_uint32 GSSAPI_CALLCONV _gss_spnego_inquire_cred_by_mech (
OM_uint32 * minor_status,
gss_const_cred_id_t cred_handle,
const gss_OID mech_type,
gss_name_t * name,
OM_uint32 * initiator_lifetime,
OM_uint32 * acceptor_lifetime,
gss_cred_usage_t * cred_usage
)
{
/* Similar to _gss_spnego_inquire_cred(), wrapper is required */
heim_assert(gss_oid_equal(mech_type, GSS_SPNEGO_MECHANISM),
"Mechglue called inquire_cred_by_mech with wrong OID");
*minor_status = 0;
return GSS_S_BAD_MECH;
}
OM_uint32 GSSAPI_CALLCONV
_gss_spnego_set_cred_option (OM_uint32 *minor_status,
gss_cred_id_t *cred_handle,
const gss_OID object,
const gss_buffer_t value)
{
/* Similar to _gss_spnego_inquire_cred(), wrapper is required */
if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
*minor_status = 0;
return GSS_S_NO_CRED;
}
return gss_set_cred_option(minor_status,
cred_handle,
object,
value);
}
OM_uint32 GSSAPI_CALLCONV
_gss_spnego_set_neg_mechs (OM_uint32 *minor_status,
gss_cred_id_t cred_handle,
const gss_OID_set mech_list)
{
OM_uint32 major, minor;
gss_OID_set mechs = GSS_C_NO_OID_SET;
size_t i;
if (cred_handle != GSS_C_NO_CREDENTIAL) {
major = gss_inquire_cred(minor_status, cred_handle,
NULL, NULL, NULL, &mechs);
if (GSS_ERROR(major))
return major;
for (i = 0; i < mechs->count; i++) {
int present;
major = gss_test_oid_set_member(minor_status,
&mechs->elements[i],
mech_list, &present);
if (GSS_ERROR(major))
break;
if (!present) {
major = gss_release_cred_by_mech(minor_status,
cred_handle,
&mechs->elements[i]);
if (GSS_ERROR(major))
break;
}
}
} else {
/*
* RFC 4178 says that GSS_Set_neg_mechs() on NULL credential sets
* the negotiable mechs for the default credential, but neither
* MIT nor Heimdal support this presently.
*/
major = GSS_S_NO_CRED;
}
gss_release_oid_set(&minor, &mechs);
return major;
}
OM_uint32 GSSAPI_CALLCONV
_gss_spnego_get_neg_mechs (OM_uint32 *minor_status,
gss_const_cred_id_t cred_handle,
gss_OID_set *mech_list)
{
return gss_inquire_cred(minor_status, cred_handle,
NULL, NULL, NULL, mech_list);
}

26
lib/gssapi/spnego/external.c
View File

@@ -88,9 +88,9 @@ static gssapi_mech_interface_desc spnego_mech = {
GMI_VERSION,
"spnego",
{6, rk_UNCONST("\x2b\x06\x01\x05\x05\x02") },
0,
GM_USE_MG_CRED,
NULL, /* gm_acquire_cred */
gss_release_cred,
NULL, /* gm_release_cred */
_gss_spnego_init_sec_context,
_gss_spnego_accept_sec_context,
_gss_spnego_process_context_token,
@@ -107,11 +107,11 @@ static gssapi_mech_interface_desc spnego_mech = {
_gss_spnego_import_name,
_gss_spnego_export_name,
_gss_spnego_release_name,
_gss_spnego_inquire_cred,
NULL, /* gm_inquire_cred */
_gss_spnego_inquire_context,
_gss_spnego_wrap_size_limit,
gss_add_cred,
_gss_spnego_inquire_cred_by_mech,
NULL, /* gm_add_cred */
NULL, /* gm_inquire_cred_by_mech */
_gss_spnego_export_sec_context,
_gss_spnego_import_sec_context,
NULL /* _gss_spnego_inquire_names_for_mech */,
@@ -119,17 +119,17 @@ static gssapi_mech_interface_desc spnego_mech = {
_gss_spnego_canonicalize_name,
_gss_spnego_duplicate_name,
_gss_spnego_inquire_sec_context_by_oid,
gss_inquire_cred_by_oid,
NULL, /* gm_inquire_cred_by_oid */
_gss_spnego_set_sec_context_option,
_gss_spnego_set_cred_option,
NULL, /* gm_set_cred_option */
_gss_spnego_pseudo_random,
_gss_spnego_wrap_iov,
_gss_spnego_unwrap_iov,
_gss_spnego_wrap_iov_length,
NULL,
gss_export_cred,
gss_import_cred,
_gss_spnego_acquire_cred_from,
NULL, /* gm_export_cred */
NULL, /* gm_import_cred */
NULL, /* gm_acquire_cred_from */
NULL,
NULL,
NULL,
@@ -146,11 +146,9 @@ static gssapi_mech_interface_desc spnego_mech = {
NULL, /* gm_set_name_attribute */
NULL, /* gm_delete_name_attribute */
NULL, /* gm_export_name_composite */
gss_duplicate_cred,
gss_add_cred_from,
NULL, /* gm_duplicate_cred */
NULL, /* gm_add_cred_from */
NULL, /* gm_store_cred_into */
_gss_spnego_set_neg_mechs,
_gss_spnego_get_neg_mechs,
NULL, /* gm_query_mechanism_info */
NULL, /* gm_query_meta_data */
NULL, /* gm_exchange_meta_data */