oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

lib/gssapi/krb5: implement GSS_C_CHANNEL_BOUND_FLAG for gss_init_sec_context()

Browse Source 
This will force KERB_AP_OPTIONS_CBT to be sent.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Stefan Metzmacher
2024-03-01 13:17:41 +01:00
committed by Jeffrey Altman
parent 6b08c05258
commit ba8c3dbc62
6 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/gssapi/krb5/8003.c
View File

@@ -87,6 +87,11 @@ _gsskrb5_create_8003_checksum (
{
u_char *p;
#define _GSS_C_NON_8003_WIRE_FLAGS \
GSS_C_CHANNEL_BOUND_FLAG
flags &= ~_GSS_C_NON_8003_WIRE_FLAGS;
/*
* see rfc1964 (section 1.1.1 (Initial Token), and the checksum value
* field's format) */

7
lib/gssapi/krb5/init_sec_context.c
View File

@@ -498,6 +498,7 @@ init_auth_restart
krb5_data fwd_data, timedata;
int32_t offset = 0, oldoffset = 0;
uint32_t flagmask;
krb5_boolean channel_bound = FALSE;
krb5_data_zero(&outbuf);
krb5_data_zero(&fwd_data);
@@ -587,6 +588,11 @@ init_auth_restart
}
flags |= GSS_C_TRANS_FLAG;
if (req_flags & GSS_C_CHANNEL_BOUND_FLAG) {
flags |= GSS_C_CHANNEL_BOUND_FLAG;
channel_bound = TRUE;
}
if (ret_flags)
*ret_flags = flags;
ctx->flags = flags;
@@ -626,6 +632,7 @@ init_auth_restart
enctype,
ctx->kcred,
&cksum,
channel_bound,
&authenticator,
KRB5_KU_AP_REQ_AUTH);

4
lib/gssapi/test_context.c
View File

@@ -82,6 +82,7 @@ static int token_split = 0;
static int version_flag = 0;
static int verbose_flag = 0;
static int help_flag = 0;
static int i_channel_bound = 0;
static char *i_channel_bindings = NULL;
static char *a_channel_bindings = NULL;
@@ -287,6 +288,8 @@ loop(gss_OID mechoid,
flags |= GSS_C_DELEG_FLAG;
if (policy_deleg_flag)
flags |= GSS_C_DELEG_POLICY_FLAG;
if (i_channel_bound)
flags |= GSS_C_CHANNEL_BOUND_FLAG;
input_token.value = rk_UNCONST(target);
input_token.length = strlen(target);
@@ -904,6 +907,7 @@ static struct getargs args[] = {
{"client-name", 0, arg_string, &client_name, "client name", NULL },
{"client-password", 0, arg_string, &client_password, "client password", NULL },
{"anonymous", 0, arg_flag, &anon_flag, "anonymous auth", NULL },
{"i-channel-bound",0, arg_flag, &i_channel_bound, "initiator channel bound", NULL },
{"i-channel-bindings", 0, arg_string, &i_channel_bindings, "initiator channel binding data", NULL },
{"a-channel-bindings", 0, arg_string, &a_channel_bindings, "acceptor channel binding data", NULL },
{"limit-enctype",0, arg_string, &limit_enctype_string, "enctype", NULL },