294 lines
10 KiB
Diff
294 lines
10 KiB
Diff
From 632575ab12fc5d6c9bdc83cb8200fb8f4f422b83 Mon Sep 17 00:00:00 2001
|
|
From: Robbie Harwood <rharwood@redhat.com>
|
|
Date: Wed, 23 Aug 2017 17:25:17 -0400
|
|
Subject: [PATCH] Add hostname-based ccselect module
|
|
|
|
The hostname module selects the ccache whose realm is the longest
|
|
parent domain tail of the uppercase server hostname.
|
|
|
|
[ghudson@mit.edu: minor edits]
|
|
|
|
ticket: 8613 (new)
|
|
(cherry picked from commit a4ddc6cf576b4155e6b994307902567f26f752b2)
|
|
---
|
|
doc/admin/conf_files/krb5_conf.rst | 4 +
|
|
src/lib/krb5/ccache/Makefile.in | 3 +
|
|
src/lib/krb5/ccache/cc-int.h | 4 +
|
|
src/lib/krb5/ccache/ccselect.c | 5 ++
|
|
src/lib/krb5/ccache/ccselect_hostname.c | 146 ++++++++++++++++++++++++++++++++
|
|
src/tests/gssapi/t_ccselect.py | 9 ++
|
|
6 files changed, 171 insertions(+)
|
|
create mode 100644 src/lib/krb5/ccache/ccselect_hostname.c
|
|
|
|
diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
|
|
index 1d9bc9e34..9c1ee94a4 100644
|
|
--- a/doc/admin/conf_files/krb5_conf.rst
|
|
+++ b/doc/admin/conf_files/krb5_conf.rst
|
|
@@ -745,6 +745,10 @@ disabled with the disable tag):
|
|
Uses the service realm to guess an appropriate cache from the
|
|
collection
|
|
|
|
+**hostname**
|
|
+ If the service principal is host-based, uses the service hostname
|
|
+ to guess an appropriate cache from the collection
|
|
+
|
|
.. _pwqual:
|
|
|
|
pwqual interface
|
|
diff --git a/src/lib/krb5/ccache/Makefile.in b/src/lib/krb5/ccache/Makefile.in
|
|
index 5ac870728..f84cf793e 100644
|
|
--- a/src/lib/krb5/ccache/Makefile.in
|
|
+++ b/src/lib/krb5/ccache/Makefile.in
|
|
@@ -34,6 +34,7 @@ STLIBOBJS= \
|
|
ccdefops.o \
|
|
ccmarshal.o \
|
|
ccselect.o \
|
|
+ ccselect_hostname.o \
|
|
ccselect_k5identity.o \
|
|
ccselect_realm.o \
|
|
cc_dir.o \
|
|
@@ -52,6 +53,7 @@ OBJS= $(OUTPRE)ccbase.$(OBJEXT) \
|
|
$(OUTPRE)ccdefops.$(OBJEXT) \
|
|
$(OUTPRE)ccmarshal.$(OBJEXT) \
|
|
$(OUTPRE)ccselect.$(OBJEXT) \
|
|
+ $(OUTPRE)ccselect_hostname.$(OBJEXT) \
|
|
$(OUTPRE)ccselect_k5identity.$(OBJEXT) \
|
|
$(OUTPRE)ccselect_realm.$(OBJEXT) \
|
|
$(OUTPRE)cc_dir.$(OBJEXT) \
|
|
@@ -70,6 +72,7 @@ SRCS= $(srcdir)/ccbase.c \
|
|
$(srcdir)/ccdefops.c \
|
|
$(srcdir)/ccmarshal.c \
|
|
$(srcdir)/ccselect.c \
|
|
+ $(srcdir)/ccselect_hostname.c \
|
|
$(srcdir)/ccselect_k5identity.c \
|
|
$(srcdir)/ccselect_realm.c \
|
|
$(srcdir)/cc_dir.c \
|
|
diff --git a/src/lib/krb5/ccache/cc-int.h b/src/lib/krb5/ccache/cc-int.h
|
|
index ee9b5e0e9..d920367ce 100644
|
|
--- a/src/lib/krb5/ccache/cc-int.h
|
|
+++ b/src/lib/krb5/ccache/cc-int.h
|
|
@@ -123,6 +123,10 @@ k5_cccol_force_unlock(void);
|
|
krb5_error_code
|
|
krb5int_fcc_new_unique(krb5_context context, char *template, krb5_ccache *id);
|
|
|
|
+krb5_error_code
|
|
+ccselect_hostname_initvt(krb5_context context, int maj_ver, int min_ver,
|
|
+ krb5_plugin_vtable vtable);
|
|
+
|
|
krb5_error_code
|
|
ccselect_realm_initvt(krb5_context context, int maj_ver, int min_ver,
|
|
krb5_plugin_vtable vtable);
|
|
diff --git a/src/lib/krb5/ccache/ccselect.c b/src/lib/krb5/ccache/ccselect.c
|
|
index ee4b83a9b..393d39733 100644
|
|
--- a/src/lib/krb5/ccache/ccselect.c
|
|
+++ b/src/lib/krb5/ccache/ccselect.c
|
|
@@ -71,6 +71,11 @@ load_modules(krb5_context context)
|
|
if (ret != 0)
|
|
goto cleanup;
|
|
|
|
+ ret = k5_plugin_register(context, PLUGIN_INTERFACE_CCSELECT, "hostname",
|
|
+ ccselect_hostname_initvt);
|
|
+ if (ret != 0)
|
|
+ goto cleanup;
|
|
+
|
|
ret = k5_plugin_load_all(context, PLUGIN_INTERFACE_CCSELECT, &modules);
|
|
if (ret != 0)
|
|
goto cleanup;
|
|
diff --git a/src/lib/krb5/ccache/ccselect_hostname.c b/src/lib/krb5/ccache/ccselect_hostname.c
|
|
new file mode 100644
|
|
index 000000000..475cfabae
|
|
--- /dev/null
|
|
+++ b/src/lib/krb5/ccache/ccselect_hostname.c
|
|
@@ -0,0 +1,146 @@
|
|
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
|
|
+/* lib/krb5/ccache/ccselect_hostname.c - hostname ccselect module */
|
|
+/*
|
|
+ * Copyright (C) 2017 by Red Hat, Inc.
|
|
+ * All rights reserved.
|
|
+ *
|
|
+ * Redistribution and use in source and binary forms, with or without
|
|
+ * modification, are permitted provided that the following conditions
|
|
+ * are met:
|
|
+ *
|
|
+ * * Redistributions of source code must retain the above copyright
|
|
+ * notice, this list of conditions and the following disclaimer.
|
|
+ *
|
|
+ * * Redistributions in binary form must reproduce the above copyright
|
|
+ * notice, this list of conditions and the following disclaimer in
|
|
+ * the documentation and/or other materials provided with the
|
|
+ * distribution.
|
|
+ *
|
|
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
+ * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
+ */
|
|
+
|
|
+#include "k5-int.h"
|
|
+#include "cc-int.h"
|
|
+#include <ctype.h>
|
|
+#include <krb5/ccselect_plugin.h>
|
|
+
|
|
+/* Swap a and b, using tmp as an intermediate. */
|
|
+#define SWAP(a, b, tmp) \
|
|
+ tmp = a; \
|
|
+ a = b; \
|
|
+ b = tmp;
|
|
+
|
|
+static krb5_error_code
|
|
+hostname_init(krb5_context context, krb5_ccselect_moddata *data_out,
|
|
+ int *priority_out)
|
|
+{
|
|
+ *data_out = NULL;
|
|
+ *priority_out = KRB5_CCSELECT_PRIORITY_HEURISTIC;
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+static krb5_error_code
|
|
+hostname_choose(krb5_context context, krb5_ccselect_moddata data,
|
|
+ krb5_principal server, krb5_ccache *ccache_out,
|
|
+ krb5_principal *princ_out)
|
|
+{
|
|
+ krb5_error_code ret;
|
|
+ char *p, *host = NULL;
|
|
+ size_t hostlen;
|
|
+ krb5_cccol_cursor col_cursor;
|
|
+ krb5_ccache ccache, tmp_ccache, best_ccache = NULL;
|
|
+ krb5_principal princ, tmp_princ, best_princ = NULL;
|
|
+ krb5_data domain;
|
|
+
|
|
+ *ccache_out = NULL;
|
|
+ *princ_out = NULL;
|
|
+
|
|
+ if (server->type != KRB5_NT_SRV_HST || server->length < 2)
|
|
+ return KRB5_PLUGIN_NO_HANDLE;
|
|
+
|
|
+ /* Compute upper-case hostname. */
|
|
+ hostlen = server->data[1].length;
|
|
+ host = k5memdup0(server->data[1].data, hostlen, &ret);
|
|
+ if (host == NULL)
|
|
+ return ret;
|
|
+ for (p = host; *p != '\0'; p++) {
|
|
+ if (islower(*p))
|
|
+ *p = toupper(*p);
|
|
+ }
|
|
+
|
|
+ /* Scan the collection for a cache with a client principal whose realm is
|
|
+ * the longest tail of the server hostname. */
|
|
+ ret = krb5_cccol_cursor_new(context, &col_cursor);
|
|
+ if (ret)
|
|
+ goto done;
|
|
+
|
|
+ for (ret = krb5_cccol_cursor_next(context, col_cursor, &ccache);
|
|
+ ret == 0 && ccache != NULL;
|
|
+ ret = krb5_cccol_cursor_next(context, col_cursor, &ccache)) {
|
|
+ ret = krb5_cc_get_principal(context, ccache, &princ);
|
|
+ if (ret) {
|
|
+ krb5_cc_close(context, ccache);
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ /* Check for a longer match than we have. */
|
|
+ domain = make_data(host, hostlen);
|
|
+ while (best_princ == NULL ||
|
|
+ best_princ->realm.length < domain.length) {
|
|
+ if (data_eq(princ->realm, domain)) {
|
|
+ SWAP(best_ccache, ccache, tmp_ccache);
|
|
+ SWAP(best_princ, princ, tmp_princ);
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ /* Try the next parent domain. */
|
|
+ p = memchr(domain.data, '.', domain.length);
|
|
+ if (p == NULL)
|
|
+ break;
|
|
+ domain = make_data(p + 1, hostlen - (p + 1 - host));
|
|
+ }
|
|
+
|
|
+ if (ccache != NULL)
|
|
+ krb5_cc_close(context, ccache);
|
|
+ krb5_free_principal(context, princ);
|
|
+ }
|
|
+
|
|
+ krb5_cccol_cursor_free(context, &col_cursor);
|
|
+
|
|
+ if (best_ccache != NULL) {
|
|
+ *ccache_out = best_ccache;
|
|
+ *princ_out = best_princ;
|
|
+ } else {
|
|
+ ret = KRB5_PLUGIN_NO_HANDLE;
|
|
+ }
|
|
+
|
|
+done:
|
|
+ free(host);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+krb5_error_code
|
|
+ccselect_hostname_initvt(krb5_context context, int maj_ver, int min_ver,
|
|
+ krb5_plugin_vtable vtable)
|
|
+{
|
|
+ krb5_ccselect_vtable vt;
|
|
+
|
|
+ if (maj_ver != 1)
|
|
+ return KRB5_PLUGIN_VER_NOTSUPP;
|
|
+ vt = (krb5_ccselect_vtable)vtable;
|
|
+ vt->name = "hostname";
|
|
+ vt->init = hostname_init;
|
|
+ vt->choose = hostname_choose;
|
|
+ return 0;
|
|
+}
|
|
diff --git a/src/tests/gssapi/t_ccselect.py b/src/tests/gssapi/t_ccselect.py
|
|
index 668a2cc62..3503f9269 100755
|
|
--- a/src/tests/gssapi/t_ccselect.py
|
|
+++ b/src/tests/gssapi/t_ccselect.py
|
|
@@ -33,6 +33,7 @@ host1 = 'p:' + r1.host_princ
|
|
host2 = 'p:' + r2.host_princ
|
|
foo = 'foo.krbtest.com'
|
|
foo2 = 'foo.krbtest2.com'
|
|
+foobar = "foo.bar.krbtest.com"
|
|
|
|
# These strings specify the target as a GSS name. The resulting
|
|
# principal will have the host-based type, with the referral realm
|
|
@@ -42,6 +43,7 @@ foo2 = 'foo.krbtest2.com'
|
|
# single component.
|
|
gssserver = 'h:host@' + foo
|
|
gssserver2 = 'h:host@' + foo2
|
|
+gssserver_bar = 'h:host@' + foobar
|
|
gsslocal = 'h:host@localhost'
|
|
|
|
# refserver specifies the target as a principal in the referral realm.
|
|
@@ -77,10 +79,12 @@ r1.addprinc('host/localhost')
|
|
r2.addprinc('host/localhost')
|
|
r1.addprinc('host/' + foo)
|
|
r2.addprinc('host/' + foo2)
|
|
+r1.addprinc('host/' + foobar)
|
|
r1.extract_keytab('host/localhost', r1.keytab)
|
|
r2.extract_keytab('host/localhost', r2.keytab)
|
|
r1.extract_keytab('host/' + foo, r1.keytab)
|
|
r2.extract_keytab('host/' + foo2, r2.keytab)
|
|
+r1.extract_keytab('host/' + foobar, r1.keytab)
|
|
|
|
# Get tickets for one user in each realm (zaphod will be primary).
|
|
r1.kinit(alice, password('alice'))
|
|
@@ -128,6 +132,11 @@ output = r2.run(['./t_ccselect', gsslocal])
|
|
if output != (zaphod + '\n'):
|
|
fail('zaphod not chosen via default realm fallback')
|
|
|
|
+# Check that realm ccselect fallback works correctly
|
|
+r1.run(['./t_ccselect', gssserver_bar], expected_msg=alice)
|
|
+r2.kinit(zaphod, password('zaphod'))
|
|
+r1.run(['./t_ccselect', gssserver_bar], expected_msg=alice)
|
|
+
|
|
# Get a second cred in r1 (bob will be primary).
|
|
r1.kinit(bob, password('bob'))
|
|
|