kpasswd: if a credential cache is present, use FAST

If a credentials cache is available, use it as an armor cache to enable FAST negotiation for kpasswd. This requires an attacker to attack both the user's long-term key for the old password as well as the ticket used for the armor cache in order to attack the password change. Depending on how the armor ticket is obtained, this may provide limited value. However, it provides users an easy option if they are concerned about their current password. Users can kinit with one principal to help protect changing the password of another principal.

* krb5_get_init_creds_opt_set_fast_ccache: new API to set fast ccache based on a krb5_ccache object rather than a resolvable string

* kpasswd: always open the current credential cache even if not needed
  for determining the principal. If the cache has tickets, use it as
  an armor cache.

* tests/dejagnu/krb-standalone/kadmin.exp: Arrange to test new code path

ticket: 6786

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24359 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/clients/kpasswd/kpasswd.c b/src/clients/kpasswd/kpasswd.c
index c79f2c85d6b13c0de6f3cd4926d6ba6ccb88eea0..fc91bddef35dd5d5e1f613512378020dc8a8fa9b 100644 (file)
--- a/src/clients/kpasswd/kpasswd.c
+++ b/src/clients/kpasswd/kpasswd.c
@@ -70,6 +70,10 @@ int main(int argc, char *argv[])
         com_err(argv[0], ret, "initializing kerberos library");
         exit(1);
     }
+    if ((ret = krb5_get_init_creds_opt_alloc(context, &opts))) {
+        com_err(argv[0], ret, "allocating krb5_get_init_creds_opt");
+        exit(1);
+    }
 
     /* in order, use the first of:
        - a name specified on the command line
@@ -77,40 +81,43 @@ int main(int argc, char *argv[])
        - the name corresponding to the ruid of the process
 
        otherwise, it's an error.
+       We always attempt to open  the default ccache in order to use FAST if
+       possible.
     */
-
-    if (pname) {
-        if ((ret = krb5_parse_name(context, pname, &princ))) {
-            com_err(argv[0], ret, "parsing client name");
-            exit(1);
-        }
+    ret = krb5_cc_default(context, &ccache);
+    if (ret != 0) {
+        com_err(argv[0], ret, "opening default ccache");
+        exit(1);
+    }
+    ret = krb5_cc_get_principal(context, ccache, &princ);
+    if (ret != 0 && ret != KRB5_CC_NOTFOUND && ret != KRB5_FCC_NOFILE) {
+        com_err(argv[0], ret, "getting principal from ccache");
+        exit(1);
     } else {
-        ret = krb5_cc_default(context, &ccache);
-        if (ret != 0) {
-            com_err(argv[0], ret, "opening default ccache");
-            exit(1);
-        }
-
-        ret = krb5_cc_get_principal(context, ccache, &princ);
-        if (ret != 0 && ret != KRB5_CC_NOTFOUND && ret != KRB5_FCC_NOFILE) {
-            com_err(argv[0], ret, "getting principal from ccache");
+        if (princ != NULL)
+            ret = krb5_get_init_creds_opt_set_fast_ccache(context, opts, ccache);
+        else ret = 0;
+        if (ret) {
+            com_err(argv[0], ret, "while setting default ccache name");
             exit(1);
         }
-
-        ret = krb5_cc_close(context, ccache);
-        if (ret != 0) {
-            com_err(argv[0], ret, "closing ccache");
+    }
+    ret = krb5_cc_close(context, ccache);
+    if (ret != 0) {
+        com_err(argv[0], ret, "closing ccache");
+        exit(1);
+    }
+    if (pname) {
+        krb5_free_principal(context, princ);
+        princ = NULL;
+        if ((ret = krb5_parse_name(context, pname, &princ))) {
+            com_err(argv[0], ret, "parsing client name");
             exit(1);
         }
-
-        if (princ == NULL)
-            get_name_from_passwd_file(argv[0], context, &princ);
     }
+    if (princ == NULL)
+        get_name_from_passwd_file(argv[0], context, &princ);
 
-    if ((ret = krb5_get_init_creds_opt_alloc(context, &opts))) {
-        com_err(argv[0], ret, "allocating krb5_get_init_creds_opt");
-        exit(1);
-    }
     krb5_get_init_creds_opt_set_tkt_life(opts, 5*60);
     krb5_get_init_creds_opt_set_renew_life(opts, 0);
     krb5_get_init_creds_opt_set_forwardable(opts, 0);

diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
index f49ef95e208bd81e4f46db5b052ab3074dcfb523..c81a0f21eb337d985004c54c2bbb10202e55e136 100644 (file)
--- a/src/include/krb5/krb5.hin
+++ b/src/include/krb5/krb5.hin
@@ -1434,6 +1434,11 @@ typedef struct _krb5_cccol_cursor *krb5_cccol_cursor;
 #define KRB5_TC_OPENCLOSE               0x00000001
 #define KRB5_TC_NOTICKET                0x00000002
 
+/** Retrieve the name but not type of a credential cache @returns The name of
+ * the credential cache as an alias that should not be freed or modified by the
+ * caller. This name does not include the type portion, so cannot be used as
+ * input to krb5_cc_resolve().
+ */
 const char * KRB5_CALLCONV
 krb5_cc_get_name(krb5_context context, krb5_ccache cache);
 
@@ -1484,6 +1489,9 @@ krb5_cc_set_flags(krb5_context context, krb5_ccache cache, krb5_flags flags);
 krb5_error_code KRB5_CALLCONV
 krb5_cc_get_flags(krb5_context context, krb5_ccache cache, krb5_flags *flags);
 
+/** Retrive the type of a credential cache @returns The type of a credential
+ * cache as an alias that should not be modified or freed by the caller.
+ */
 const char * KRB5_CALLCONV
 krb5_cc_get_type(krb5_context context, krb5_ccache cache);
 
@@ -2329,6 +2337,15 @@ krb5_get_init_creds_opt_set_fast_ccache_name(krb5_context context,
                                              krb5_get_init_creds_opt *opt,
                                              const char *fast_ccache_name);
 
+/** Set the FAST ccache name as in
+ * krb5_get_init_creds_opt_set_fast_ccache_name() but using a krb5_ccache
+ * rather than a name
+ */
+krb5_error_code KRB5_CALLCONV
+krb5_get_init_creds_opt_set_fast_ccache(krb5_context context,
+                                             krb5_get_init_creds_opt *opt,
+                                        krb5_ccache fast_ccache_name);
+
 /**
  * Set a ccache where resulting credentials will be stored.  If set, then the
  * krb5_get_init_creds family of APIs will write out credentials to the given

diff --git a/src/lib/krb5/krb/gic_opt.c b/src/lib/krb5/krb/gic_opt.c
index 36f4f00a1f3ff9ea4cd900c573be200685323619..dc7095bdc3935f4f99e869b4a2c12b507e9f2830 100644 (file)
--- a/src/lib/krb5/krb/gic_opt.c
+++ b/src/lib/krb5/krb/gic_opt.c
@@ -1,6 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 #include "k5-int.h"
 #include "int-proto.h"
+#include "k5-buf.h"
 
 static void
 init_common(krb5_get_init_creds_opt *opt)
@@ -430,6 +431,28 @@ krb5_get_init_creds_opt_set_fast_ccache_name(krb5_context context,
     return retval;
 }
 
+krb5_error_code KRB5_CALLCONV
+krb5_get_init_creds_opt_set_fast_ccache(
+    krb5_context context,
+    krb5_get_init_creds_opt *opt,
+    krb5_ccache ccache)
+{
+    krb5_error_code retval = 0;
+    struct k5buf buf;
+    char *cc_name;
+    krb5int_buf_init_dynamic(&buf);
+    krb5int_buf_add(&buf, krb5_cc_get_type(context, ccache));
+    krb5int_buf_add(&buf, ":");
+    krb5int_buf_add(&buf, krb5_cc_get_name(context, ccache));
+    cc_name = krb5int_buf_data(&buf);
+    if (cc_name)
+        retval =  krb5_get_init_creds_opt_set_fast_ccache_name(context, opt, cc_name);
+    else retval = ENOMEM;
+        krb5int_free_buf(&buf);
+    return retval;
+}
+
+
 krb5_error_code KRB5_CALLCONV
 krb5_get_init_creds_opt_set_out_ccache(krb5_context context,
                                        krb5_get_init_creds_opt *opt,

diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
index 413339b2a2bd014c40e3e5f1389c46a73f320e1d..b64a7dd0ed1b9386fe5792d6dcce5db48792e260 100644 (file)
--- a/src/lib/krb5/libkrb5.exports
+++ b/src/lib/krb5/libkrb5.exports
@@ -352,6 +352,7 @@ krb5_get_init_creds_opt_set_canonicalize
 krb5_get_init_creds_opt_set_change_password_prompt
 krb5_get_init_creds_opt_set_etype_list
 krb5_get_init_creds_opt_set_expire_callback
+krb5_get_init_creds_opt_set_fast_ccache
 krb5_get_init_creds_opt_set_fast_ccache_name
 krb5_get_init_creds_opt_set_fast_flags
 krb5_get_init_creds_opt_set_forwardable

diff --git a/src/tests/dejagnu/krb-standalone/kadmin.exp b/src/tests/dejagnu/krb-standalone/kadmin.exp
index 1eac9e339c0345019bbcda1ada5cf287f43c18d7..1822bc38a81a189d14cb0d848f1520adf6090103 100644 (file)
--- a/src/tests/dejagnu/krb-standalone/kadmin.exp
+++ b/src/tests/dejagnu/krb-standalone/kadmin.exp
@@ -996,10 +996,11 @@ proc kadmin_test { } {
     }
 
     # now test that we can kinit with principals/passwords.
+    # We defer kdestroying until after kpasswd at least once to test FAST automatic use in kpasswd
     if {![kadmin_add testprinc1/instance thisisatest] \
            || ![kinit testprinc1/instance thisisatest 0] \
-           || ![kdestroy] \
            || ![kpasswd_cpw testprinc1/instance thisisatest anothertest] \
+           || ![kdestroy] \
            || ![kinit testprinc1/instance anothertest 0] \
            || ![kdestroy] \
            || ![kpasswd_cpw testprinc1/instance anothertest goredsox] \