GSS_C_NO_CREDENTIAL should accept any principal

If a context is accepted with GSS_C_NO_CREDENTIAL or if a credential
is acquired with GSS_C_NO_NAME as the acceptor name  then allow any
principal in the keytab  to be  used as the acceptor name.

This means that gss_inquire_cred can return GSS_C_NO_NAME from a
credential.

ticket: new
Tags: enhancement
cc: nicolas.williams@sun.com
cc: krbdev@mit.edu

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15218 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/gssapi/krb5/ChangeLog b/src/lib/gssapi/krb5/ChangeLog
index b85af053e88cd880ed0586118fd7b9d3fb759120..e6f06e2a1799d7c40cdbc78da62d79406172328e 100644 (file)
--- a/src/lib/gssapi/krb5/ChangeLog
+++ b/src/lib/gssapi/krb5/ChangeLog
@@ -1,3 +1,25 @@
+2003-03-02  Sam Hartman  <hartmans@mit.edu>
+
+       * accept_sec_context.c (krb5_gss_accept_sec_context): Deal with
+       creds without rcache available.  They will be slower.
+
+       * add_cred.c (krb5_gss_add_cred): Deal with princ being null
+
+       * accept_sec_context.c (krb5_gss_accept_sec_context): Populate
+       ctx->here from ticket->server instead of cred->princ.  If
+       cred->princ exists it will be the same, but the previous change
+       may make it null
+
+       * inq_cred.c (krb5_gss_inquire_cred): Allow for null princ
+       component of credentials
+
+       * acquire_cred.c: When acquiring acceptor credentials, allow
+       GSS_C_NO_NAME to mean that we accept any credential.  In this case
+       we do not look to see if the principal is found in the keytab and
+       we leave princ null in the context.  This means you get
+       GSS_C_NO_NAME out from inquire_cred.   If cred->princ is null
+       don't set up a rcache
+
 2003-03-01  Tom Yu  <tlyu@mit.edu>
 
        * accept_sec_context.c (krb5_gss_accept_sec_context): Don't

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index be212b526293de14e2ee2eb9497c4521419feef9..899ca5a2f7b1b38a31577e99f9be452c35e2611a 100644 (file)
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -360,9 +360,11 @@ krb5_gss_accept_sec_context(minor_status, context_handle,
    }
    krb5_auth_con_setflags(context, auth_context,
                          KRB5_AUTH_CONTEXT_DO_SEQUENCE);
-   if ((code = krb5_auth_con_setrcache(context, auth_context, cred->rcache))) {
-       major_status = GSS_S_FAILURE;
-       goto fail;
+   if (cred->rcache) {
+       if ((code = krb5_auth_con_setrcache(context, auth_context, cred->rcache))) {
+          major_status = GSS_S_FAILURE;
+          goto fail;
+       }
    }
    if ((code = krb5_auth_con_setaddrs(context, auth_context, NULL, paddr))) {
        major_status = GSS_S_FAILURE;
@@ -580,7 +582,7 @@ krb5_gss_accept_sec_context(minor_status, context_handle,
        goto fail;
    }
 
-   if ((code = krb5_copy_principal(context, cred->princ, &ctx->here))) {
+   if ((code = krb5_copy_principal(context, ticket->server, &ctx->here))) {
        major_status = GSS_S_FAILURE;
        goto fail;
    }

diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index daa900a314906de85f678e86b2d1ffadf025db57..23a17b86368f58556a1aeeed391b487d00976536 100644 (file)
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -108,42 +108,31 @@ acquire_accept_cred(context, minor_status, desired_name, output_princ, cred)
       return(GSS_S_CRED_UNAVAIL);
    }
 
-   /* figure out what principal to use.  If the default name is
-      requested, use the default sn2princ output */
-
-   if (desired_name == (gss_name_t) NULL) {
-      if ((code = krb5_sname_to_principal(context, NULL, NULL, KRB5_NT_SRV_HST,
-                                         &princ))) {
-        (void) krb5_kt_close(context, kt);
-        *minor_status = code;
-        return(GSS_S_FAILURE);
-      }
-      *output_princ = princ;
-   } else {
-      princ = (krb5_principal) desired_name;
-   }
-
-   if ((code = krb5_kt_get_entry(context, kt, princ, 0, 0, &entry))) {
+if (desired_name != GSS_C_NO_NAME) {
+    princ = (krb5_principal) desired_name;
+    if ((code = krb5_kt_get_entry(context, kt, princ, 0, 0, &entry))) {
        (void) krb5_kt_close(context, kt);
        if (code == KRB5_KT_NOTFOUND)
-            *minor_status = KG_KEYTAB_NOMATCH;
+           *minor_status = KG_KEYTAB_NOMATCH;
        else
-            *minor_status = code;
+           *minor_status = code;
        return(GSS_S_CRED_UNAVAIL);
-   }
-   krb5_kt_free_entry(context, &entry);
+    }
+    krb5_kt_free_entry(context, &entry);
 
-   /* hooray.  we made it */
+    /* Open the replay cache for this principal. */
+    if ((code = krb5_get_server_rcache(context,
+                                      krb5_princ_component(context, princ, 0),
+                                      &cred->rcache))) {
+       *minor_status = code;
+       return(GSS_S_FAILURE);
+    }
 
-   cred->keytab = kt;
+}
 
-   /* Open the replay cache for this principal. */
-   if ((code = krb5_get_server_rcache(context,
-                                     krb5_princ_component(context, princ, 0),
-                                     &cred->rcache))) {
-       *minor_status = code;
-       return(GSS_S_FAILURE);
-   }
+/* hooray.  we made it */
+
+   cred->keytab = kt;
 
    return(GSS_S_COMPLETE);
 }
@@ -413,7 +402,7 @@ krb5_gss_acquire_cred(minor_status, desired_name, time_req,
 
    /* if the princ wasn't filled in already, fill it in now */
 
-   if (!cred->princ)
+   if (!cred->princ && (desired_name != GSS_C_NO_CREDENTIAL))
       if ((code = krb5_copy_principal(context, (krb5_principal) desired_name,
                                      &(cred->princ)))) {
         if (cred->ccache)

diff --git a/src/lib/gssapi/krb5/add_cred.c b/src/lib/gssapi/krb5/add_cred.c
index 4bbee5ef367b0dce50a5f39ec88043d7f55b68ad..254abfe06828fc455c447264f17240af2d460554 100644 (file)
--- a/src/lib/gssapi/krb5/add_cred.c
+++ b/src/lib/gssapi/krb5/add_cred.c
@@ -181,7 +181,8 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
        new_cred->rfc_mech = cred->rfc_mech;
        new_cred->tgt_expire = cred->tgt_expire;
 
-       code = krb5_copy_principal(context, cred->princ, &new_cred->princ);
+       if (cred->princ)
+           code = krb5_copy_principal(context, cred->princ, &new_cred->princ);
        if (code) {
            xfree(new_cred);
 
@@ -192,7 +193,8 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
        if (cred->keytab) {
            kttype = krb5_kt_get_type(context, cred->keytab);
            if ((strlen(kttype)+2) > sizeof(ktboth)) {
-               krb5_free_principal(context, new_cred->princ);
+               if (new_cred->princ)
+                   krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
                *minor_status = ENOMEM;
@@ -207,7 +209,8 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
                                    ktboth+strlen(ktboth),
                                    sizeof(ktboth)-strlen(ktboth));
            if (code) {
-               krb5_free_principal(context, new_cred->princ);
+               if(new_cred->princ)
+                   krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
                *minor_status = code;
@@ -216,6 +219,7 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
 
            code = krb5_kt_resolve(context, ktboth, &new_cred->keytab);
            if (code) {
+               if (new_cred->princ)
                krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
@@ -233,7 +237,8 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
                                               &new_cred->rcache))) {
                if (new_cred->keytab)
                    krb5_kt_close(context, new_cred->keytab);
-               krb5_free_principal(context, new_cred->princ);
+               if (new_cred->princ)
+                   krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
                *minor_status = code;
@@ -252,6 +257,7 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
                    krb5_rc_close(context, new_cred->rcache);
                if (new_cred->keytab)
                    krb5_kt_close(context, new_cred->keytab);
+               if (new_cred->princ)
                krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
@@ -270,7 +276,8 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
                    krb5_rc_close(context, new_cred->rcache);
                if (new_cred->keytab)
                    krb5_kt_close(context, new_cred->keytab);
-               krb5_free_principal(context, new_cred->princ);
+               if (new_cred->princ)
+                   krb5_free_principal(context, new_cred->princ);
                xfree(new_cred);
 
                *minor_status = code;
@@ -289,6 +296,7 @@ krb5_gss_add_cred(minor_status, input_cred_handle,
                krb5_rc_close(context, new_cred->rcache);
            if (new_cred->keytab)
                krb5_kt_close(context, new_cred->keytab);
+           if (new_cred->princ)
            krb5_free_principal(context, new_cred->princ);
            xfree(new_cred);
 

diff --git a/src/lib/gssapi/krb5/inq_cred.c b/src/lib/gssapi/krb5/inq_cred.c
index 88001ff4edee86e90ba8e28a4f947c06ab0bc524..a79034d9ec43877e9180cb2c9b5ac2c1513877d0 100644 (file)
--- a/src/lib/gssapi/krb5/inq_cred.c
+++ b/src/lib/gssapi/krb5/inq_cred.c
@@ -129,7 +129,8 @@ krb5_gss_inquire_cred(minor_status, cred_handle, name, lifetime_ret,
        lifetime = GSS_C_INDEFINITE;
 
    if (name) {
-      if ((code = krb5_copy_principal(context, cred->princ, &ret_name))) {
+      if (cred->princ &&
+         (code = krb5_copy_principal(context, cred->princ, &ret_name))) {
         *minor_status = code;
         return(GSS_S_FAILURE);
       }

diff --git a/src/lib/krb5/krb/ChangeLog b/src/lib/krb5/krb/ChangeLog
index 036e8ed5188d8c94760cceba91b4830e87c12dac..55cf03d5c3255e6c8f9c66069da1355752ab6a7c 100644 (file)
--- a/src/lib/krb5/krb/ChangeLog
+++ b/src/lib/krb5/krb/ChangeLog
@@ -1,3 +1,9 @@
+2003-03-02  Sam Hartman  <hartmans@mit.edu>
+
+       * srv_rcache.c (krb5_get_server_rcache): If punctuation or graphic characters in replay ccache name then use  escaping
+
+       * rd_req.c (krb5_rd_req): Allow initializing the replay cache from  the ticket
+
 2003-02-25  Tom Yu  <tlyu@mit.edu>
 
        * gic_pwd.c (krb5_get_init_creds_password): Don't pass a NULL

diff --git a/src/lib/krb5/krb/rd_req.c b/src/lib/krb5/krb/rd_req.c
index bc4586e28a6fb255ededc32603a7625e83275184..f844e3cd64a037a8ab215f69b83f72c611dfb891 100644 (file)
--- a/src/lib/krb5/krb/rd_req.c
+++ b/src/lib/krb5/krb/rd_req.c
@@ -79,6 +79,9 @@ krb5_rd_req(krb5_context context, krb5_auth_context *auth_context, const krb5_da
         *auth_context = new_auth_context;
     }
 
+    if (!server) {
+       server = request->ticket->server;
+    }
     /* Get an rcache if necessary. */
     if (((*auth_context)->rcache == NULL) && server) {
        if ((retval = krb5_get_server_rcache(context,

diff --git a/src/lib/krb5/krb/srv_rcache.c b/src/lib/krb5/krb/srv_rcache.c
index e6abcfb9026370c97b0e61dc4942ff6e035cbe3d..290f869e574bc408b470c8c45e66b6c18d748a28 100644 (file)
--- a/src/lib/krb5/krb/srv_rcache.c
+++ b/src/lib/krb5/krb/srv_rcache.c
@@ -31,6 +31,8 @@
 #include <ctype.h>
 #include <stdio.h>
 
+/* Macro for valid RC name characters*/
+#define isinvalidrcname(x) (isgraph(x)||ispunct(x))
 krb5_error_code KRB5_CALLCONV
 krb5_get_server_rcache(krb5_context context, const krb5_data *piece, krb5_rcache *rcptr)
 {
@@ -58,7 +60,7 @@ krb5_get_server_rcache(krb5_context context, const krb5_data *piece, krb5_rcache
     for (i = 0; i < piece->length; i++) {
        if (piece->data[i] == '\\')
            len++;
-       else if (!isgraph((int) piece->data[i]))
+       else if (!isinvalidrcname((int) piece->data[i]))
            len += 3;
     }
 
@@ -81,7 +83,7 @@ krb5_get_server_rcache(krb5_context context, const krb5_data *piece, krb5_rcache
            cachename[p++] = '\\';
            continue;
        }
-       if (!isgraph((int) piece->data[i])) {
+       if (!isinvalidrcname((int) piece->data[i])) {
            sprintf(tmp, "%03o", piece->data[i]);
            cachename[p++] = '\\';
            cachename[p++] = tmp[0];