109 lines
4.6 KiB
Diff
109 lines
4.6 KiB
Diff
From 69c8662190bcd46f2300d0cea139681001ea5b26 Mon Sep 17 00:00:00 2001
|
|
From: Christian Heimes <cheimes@redhat.com>
|
|
Date: Mon, 8 Aug 2016 12:38:17 +0200
|
|
Subject: [PATCH] Add Host HTTP header to MS-KKDCP requests
|
|
|
|
Some web servers require a Host HTTP header for TLS connections with
|
|
SNI (server name indicator). It is also required for virtual hosts.
|
|
|
|
ticket: 8472 (new)
|
|
target_version: 1.14-next
|
|
tags: pullup
|
|
---
|
|
src/lib/krb5/os/sendto_kdc.c | 18 +++++++++++++-----
|
|
1 file changed, 13 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
|
|
index c85fdba..a2b7359 100644
|
|
--- a/src/lib/krb5/os/sendto_kdc.c
|
|
+++ b/src/lib/krb5/os/sendto_kdc.c
|
|
@@ -78,6 +78,7 @@
|
|
#define MAX_PASS 3
|
|
#define DEFAULT_UDP_PREF_LIMIT 1465
|
|
#define HARD_UDP_LIMIT 32700 /* could probably do 64K-epsilon ? */
|
|
+#define PORT_LENGTH 6 /* decimal repr of UINT16_MAX */
|
|
|
|
/* Select state flags. */
|
|
#define SSF_READ 0x01
|
|
@@ -138,6 +139,7 @@ struct conn_state {
|
|
struct {
|
|
const char *uri_path;
|
|
const char *servername;
|
|
+ char port[PORT_LENGTH];
|
|
char *https_request;
|
|
k5_tls_handle tls;
|
|
} http;
|
|
@@ -611,6 +613,8 @@ make_proxy_request(struct conn_state *state, const krb5_data *realm,
|
|
k5_buf_init_dynamic(&buf);
|
|
uri_path = (state->http.uri_path != NULL) ? state->http.uri_path : "";
|
|
k5_buf_add_fmt(&buf, "POST /%s HTTP/1.0\r\n", uri_path);
|
|
+ k5_buf_add_fmt(&buf, "Host: %s:%s\r\n", state->http.servername,
|
|
+ state->http.port);
|
|
k5_buf_add(&buf, "Cache-Control: no-cache\r\n");
|
|
k5_buf_add(&buf, "Pragma: no-cache\r\n");
|
|
k5_buf_add(&buf, "User-Agent: kerberos/1.0\r\n");
|
|
@@ -673,7 +677,7 @@ static krb5_error_code
|
|
add_connection(struct conn_state **conns, k5_transport transport,
|
|
krb5_boolean defer, struct addrinfo *ai, size_t server_index,
|
|
const krb5_data *realm, const char *hostname,
|
|
- const char *uri_path, char **udpbufp)
|
|
+ const char *port, const char *uri_path, char **udpbufp)
|
|
{
|
|
struct conn_state *state, **tailptr;
|
|
|
|
@@ -695,11 +699,13 @@ add_connection(struct conn_state **conns, k5_transport transport,
|
|
state->service_write = service_tcp_write;
|
|
state->service_read = service_tcp_read;
|
|
} else if (transport == HTTPS) {
|
|
+ assert(hostname != NULL && port != NULL);
|
|
state->service_connect = service_tcp_connect;
|
|
state->service_write = service_https_write;
|
|
state->service_read = service_https_read;
|
|
state->http.uri_path = uri_path;
|
|
state->http.servername = hostname;
|
|
+ strlcpy(state->http.port, port, PORT_LENGTH);
|
|
} else {
|
|
state->service_connect = NULL;
|
|
state->service_write = NULL;
|
|
@@ -785,7 +791,7 @@ resolve_server(krb5_context context, const krb5_data *realm,
|
|
struct addrinfo *addrs, *a, hint, ai;
|
|
krb5_boolean defer;
|
|
int err, result;
|
|
- char portbuf[64];
|
|
+ char portbuf[PORT_LENGTH];
|
|
|
|
/* Skip UDP entries if we don't want UDP. */
|
|
if (strategy == NO_UDP && entry->transport == UDP)
|
|
@@ -800,7 +806,7 @@ resolve_server(krb5_context context, const krb5_data *realm,
|
|
ai.ai_addr = (struct sockaddr *)&entry->addr;
|
|
defer = (entry->transport != transport);
|
|
return add_connection(conns, entry->transport, defer, &ai, ind, realm,
|
|
- NULL, entry->uri_path, udpbufp);
|
|
+ NULL, NULL, entry->uri_path, udpbufp);
|
|
}
|
|
|
|
/* If the entry has a specified transport, use it. */
|
|
@@ -826,7 +832,8 @@ resolve_server(krb5_context context, const krb5_data *realm,
|
|
retval = 0;
|
|
for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
|
|
retval = add_connection(conns, transport, FALSE, a, ind, realm,
|
|
- entry->hostname, entry->uri_path, udpbufp);
|
|
+ entry->hostname, portbuf, entry->uri_path,
|
|
+ udpbufp);
|
|
}
|
|
|
|
/* For TCP_OR_UDP entries, add each address again with the non-preferred
|
|
@@ -836,7 +843,8 @@ resolve_server(krb5_context context, const krb5_data *realm,
|
|
for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
|
|
a->ai_socktype = socktype_for_transport(transport);
|
|
retval = add_connection(conns, transport, TRUE, a, ind, realm,
|
|
- entry->hostname, entry->uri_path, udpbufp);
|
|
+ entry->hostname, portbuf,
|
|
+ entry->uri_path, udpbufp);
|
|
}
|
|
}
|
|
freeaddrinfo(addrs);
|
|
--
|
|
2.8.1
|
|
|