oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

krb5: _krb5_principal_is_anonymous() helper API

Browse Source 
Add _krb5_principal_is_anonymous() private API for checking if a principal is
anonymous or not. The third argument determines whether to match authenticated
anonymous, unauthenticated anonymous, or both types of principal.
This commit is contained in:
Luke Howard
2019-05-04 16:10:13 +10:00
committed by Jeffrey Altman
parent 4559618391
commit bcc90f1b87
8 changed files with 38 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/krb5/krb5_locl.h
View File

@@ -402,4 +402,9 @@ struct krb5_plugin_data {
krb5_get_instance_func_t get_instance;
};
/* _krb5_principal_is_anonymous() */
#define KRB5_ANON_MATCH_AUTHENTICATED 1 /* authenticated with anon flag */
#define KRB5_ANON_MATCH_UNAUTHENTICATED 2 /* anonymous PKINIT */
#define KRB5_ANON_MATCH_ANY ( KRB5_ANON_MATCH_AUTHENTICATED | KRB5_ANON_MATCH_UNAUTHENTICATED )
#endif /* __KRB5_LOCL_H__ */

1
lib/krb5/libkrb5-exports.def.in
View File

@@ -776,6 +776,7 @@ EXPORTS
_krb5_pk_octetstring2key
_krb5_plugin_run_f
_krb5_enctype_requires_random_salt
_krb5_principal_is_anonymous
_krb5_principal2principalname
_krb5_principalname2krb5_principal
_krb5_put_int

26
lib/krb5/principal.c
View File

@@ -1247,6 +1247,32 @@ krb5_principal_is_root_krbtgt(krb5_context context, krb5_const_principal p)
strcmp(p->name.name_string.val[1], p->realm) == 0;
}
/**
* Returns true iff name is WELLKNOWN/ANONYMOUS
*
* @ingroup krb5_principal
*/
krb5_boolean KRB5_LIB_FUNCTION
_krb5_principal_is_anonymous(krb5_context context,
krb5_const_principal p,
unsigned int flags)
{
int anon_realm;
if ((p->name.name_type != KRB5_NT_WELLKNOWN &&
p->name.name_type != KRB5_NT_UNKNOWN) ||
p->name.name_string.len != 2 ||
strcmp(p->name.name_string.val[0], KRB5_WELLKNOWN_NAME) != 0 ||
strcmp(p->name.name_string.val[1], KRB5_ANON_NAME) != 0)
return FALSE;
anon_realm = strcmp(p->realm, KRB5_ANON_REALM) == 0;
return ((flags & KRB5_ANON_MATCH_AUTHENTICATED) && !anon_realm) ||
((flags & KRB5_ANON_MATCH_UNAUTHENTICATED) && anon_realm);
}
static int
tolower_ascii(int c)
{

14
lib/krb5/ticket.c
View File

@@ -527,18 +527,6 @@ noreferral:
}
static krb5_boolean
is_anonymous_principal(krb5_context context, krb5_const_principal principal)
{
if ((principal->name.name_type != KRB5_NT_WELLKNOWN &&
principal->name.name_type != KRB5_NT_UNKNOWN) ||
principal->name.name_string.len != 2 ||
strcmp(principal->name.name_string.val[0], KRB5_WELLKNOWN_NAME) != 0 ||
strcmp(principal->name.name_string.val[1], KRB5_ANON_NAME) != 0)
return 0;
return 1;
}
/*
* Verify returned client principal name in anonymous/referral case
*/
@@ -551,7 +539,7 @@ check_client_mismatch(krb5_context context,
krb5_keyblock const * key)
{
if (rep->enc_part.flags.anonymous) {
if (!is_anonymous_principal(context, mapped)) {
if (!_krb5_principal_is_anonymous(context, mapped, KRB5_ANON_MATCH_ANY)) {
krb5_set_error_message(context, KRB5KRB_AP_ERR_MODIFIED,
N_("Anonymous ticket does not contain anonymous "
"principal", ""));

1
lib/krb5/version-script.map
View File

@@ -767,6 +767,7 @@ HEIMDAL_KRB5_2.0 {
_krb5_pk_mk_ContentInfo;
_krb5_pk_octetstring2key;
_krb5_plugin_run_f;
_krb5_principal_is_anonymous;
_krb5_principal2principalname;
_krb5_principalname2krb5_principal;
_krb5_put_int;