105 lines
4.2 KiB
Diff
105 lines
4.2 KiB
Diff
From 92a4b760d741494dacbb4d9db4cf2db9e3b01f2c Mon Sep 17 00:00:00 2001
|
|
From: Greg Hudson <ghudson@mit.edu>
|
|
Date: Mon, 29 Mar 2021 14:32:56 -0400
|
|
Subject: [PATCH] Fix KCM flag transmission for remove_cred
|
|
|
|
MIT krb5 uses low bits for KRB5_TC flags, while Heimdal uses high bits
|
|
so that the same flag word can also hold KRB5_GC flags. Add a mapping
|
|
function and send the Heimdal flag values when performing a
|
|
remove_cred operation.
|
|
|
|
ticket: 8995
|
|
(cherry picked from commit 11a82cf424f9c905bb73680c64524f087090d4ef)
|
|
(cherry picked from commit 04f0de4420508161ce439f262f2761ff51a07ab0)
|
|
---
|
|
src/include/kcm.h | 19 +++++++++++++++++++
|
|
src/lib/krb5/ccache/cc_kcm.c | 36 +++++++++++++++++++++++++++++++++++-
|
|
2 files changed, 54 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/include/kcm.h b/src/include/kcm.h
|
|
index e4140c3a0..9b66f1cbd 100644
|
|
--- a/src/include/kcm.h
|
|
+++ b/src/include/kcm.h
|
|
@@ -56,8 +56,27 @@
|
|
* are marshalled as zero-terminated strings. Principals and credentials are
|
|
* marshalled in the v4 FILE ccache format. UUIDs are 16 bytes. UUID lists
|
|
* are not delimited, so nothing can come after them.
|
|
+ *
|
|
+ * Flag words must use Heimdal flag values, which are not the same as MIT krb5
|
|
+ * values for KRB5_GC and KRB5_TC constants. The same flag word may contain
|
|
+ * both kinds of flags in Heimdal, but not in MIT krb5. Defines for the
|
|
+ * applicable Heimdal flag values are given below using KCM_GC and KCM_TC
|
|
+ * prefixes.
|
|
*/
|
|
|
|
+#define KCM_GC_CACHED (1U << 0)
|
|
+
|
|
+#define KCM_TC_DONT_MATCH_REALM (1U << 31)
|
|
+#define KCM_TC_MATCH_KEYTYPE (1U << 30)
|
|
+#define KCM_TC_MATCH_SRV_NAMEONLY (1U << 29)
|
|
+#define KCM_TC_MATCH_FLAGS_EXACT (1U << 28)
|
|
+#define KCM_TC_MATCH_FLAGS (1U << 27)
|
|
+#define KCM_TC_MATCH_TIMES_EXACT (1U << 26)
|
|
+#define KCM_TC_MATCH_TIMES (1U << 25)
|
|
+#define KCM_TC_MATCH_AUTHDATA (1U << 24)
|
|
+#define KCM_TC_MATCH_2ND_TKT (1U << 23)
|
|
+#define KCM_TC_MATCH_IS_SKEY (1U << 22)
|
|
+
|
|
/* Opcodes without comments are currently unused in the MIT client
|
|
* implementation. */
|
|
typedef enum kcm_opcode {
|
|
diff --git a/src/lib/krb5/ccache/cc_kcm.c b/src/lib/krb5/ccache/cc_kcm.c
|
|
index 772928e4d..1f81a2190 100644
|
|
--- a/src/lib/krb5/ccache/cc_kcm.c
|
|
+++ b/src/lib/krb5/ccache/cc_kcm.c
|
|
@@ -110,6 +110,40 @@ map_invalid(krb5_error_code code)
|
|
KRB5_KCM_MALFORMED_REPLY : code;
|
|
}
|
|
|
|
+/*
|
|
+ * Map an MIT krb5 KRB5_TC flag word to the equivalent Heimdal flag word. Note
|
|
+ * that there is no MIT krb5 equivalent for Heimdal's KRB5_TC_DONT_MATCH_REALM
|
|
+ * (which is like KRB5_TC_MATCH_SRV_NAMEONLY but also applies to the client
|
|
+ * principal) and no Heimdal equivalent for MIT krb5's KRB5_TC_SUPPORTED_KTYPES
|
|
+ * (which matches against enctypes from the krb5_context rather than the
|
|
+ * matching cred).
|
|
+ */
|
|
+static inline krb5_flags
|
|
+map_tcflags(krb5_flags mitflags)
|
|
+{
|
|
+ krb5_flags heimflags = 0;
|
|
+
|
|
+ if (mitflags & KRB5_TC_MATCH_TIMES)
|
|
+ heimflags |= KCM_TC_MATCH_TIMES;
|
|
+ if (mitflags & KRB5_TC_MATCH_IS_SKEY)
|
|
+ heimflags |= KCM_TC_MATCH_IS_SKEY;
|
|
+ if (mitflags & KRB5_TC_MATCH_FLAGS)
|
|
+ heimflags |= KCM_TC_MATCH_FLAGS;
|
|
+ if (mitflags & KRB5_TC_MATCH_TIMES_EXACT)
|
|
+ heimflags |= KCM_TC_MATCH_TIMES_EXACT;
|
|
+ if (mitflags & KRB5_TC_MATCH_FLAGS_EXACT)
|
|
+ heimflags |= KCM_TC_MATCH_FLAGS_EXACT;
|
|
+ if (mitflags & KRB5_TC_MATCH_AUTHDATA)
|
|
+ heimflags |= KCM_TC_MATCH_AUTHDATA;
|
|
+ if (mitflags & KRB5_TC_MATCH_SRV_NAMEONLY)
|
|
+ heimflags |= KCM_TC_MATCH_SRV_NAMEONLY;
|
|
+ if (mitflags & KRB5_TC_MATCH_2ND_TKT)
|
|
+ heimflags |= KCM_TC_MATCH_2ND_TKT;
|
|
+ if (mitflags & KRB5_TC_MATCH_KTYPE)
|
|
+ heimflags |= KCM_TC_MATCH_KEYTYPE;
|
|
+ return heimflags;
|
|
+}
|
|
+
|
|
/* Begin a request for the given opcode. If cache is non-null, supply the
|
|
* cache name as a request parameter. */
|
|
static void
|
|
@@ -936,7 +970,7 @@ kcm_remove_cred(krb5_context context, krb5_ccache cache, krb5_flags flags,
|
|
struct kcmreq req;
|
|
|
|
kcmreq_init(&req, KCM_OP_REMOVE_CRED, cache);
|
|
- k5_buf_add_uint32_be(&req.reqbuf, flags);
|
|
+ k5_buf_add_uint32_be(&req.reqbuf, map_tcflags(flags));
|
|
k5_marshal_mcred(&req.reqbuf, mcred);
|
|
ret = cache_call(context, cache, &req);
|
|
kcmreq_free(&req);
|