1 From 24d776205605f3c113fdc2cb356d4c28b8033676 Mon Sep 17 00:00:00 2001
2 From: Robbie Harwood <rharwood@redhat.com>
3 Date: Fri, 15 Sep 2017 18:07:28 -0400
4 Subject: [PATCH] Handle outdated encrypted ccaches
6 When the encrypting keytab changes, all credentials that it was used
7 to encrypt must be re-created. Otherwise, we log obtuse messages and
8 fail to do what the user wants.
10 Signed-off-by: Robbie Harwood <rharwood@redhat.com>
11 Reviewed-by: Simo Sorce <simo@redhat.com>
13 (cherry picked from commit 657d3c8339309dd8e2bfa4ee10f005e0f0c055e8)
15 proxy/src/gp_export.c | 11 ++++++-----
16 proxy/src/gp_rpc_accept_sec_context.c | 28 +++++++++++++++++++++++++++
17 proxy/src/gp_rpc_init_sec_context.c | 2 +-
18 3 files changed, 35 insertions(+), 6 deletions(-)
20 diff --git a/proxy/src/gp_export.c b/proxy/src/gp_export.c
21 index ab08bb7..0c39045 100644
22 --- a/proxy/src/gp_export.c
23 +++ b/proxy/src/gp_export.c
24 @@ -268,7 +268,7 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key,
32 *len = data_out.length;
33 @@ -446,8 +446,8 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx *gpcall,
35 gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
36 struct gp_creds_handle *handle = NULL;
39 + uint32_t ret_maj = GSS_S_COMPLETE;
40 + uint32_t ret_min = 0;
43 handle = gp_service_get_creds_handle(gpcall->service);
44 @@ -469,8 +469,9 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx *gpcall,
45 &cred->cred_handle_reference,
46 &token.length, token.value);
48 - ret_maj = GSS_S_FAILURE;
50 + /* Allow for re-issuance of the keytab. */
51 + GPDEBUG("Stored ccache failed to decrypt; treating as empty\n");
52 + *out = GSS_C_NO_CREDENTIAL;
56 diff --git a/proxy/src/gp_rpc_accept_sec_context.c b/proxy/src/gp_rpc_accept_sec_context.c
57 index ae4de55..2cdc94b 100644
58 --- a/proxy/src/gp_rpc_accept_sec_context.c
59 +++ b/proxy/src/gp_rpc_accept_sec_context.c
60 @@ -25,6 +25,13 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
64 + struct gp_cred_check_handle gcch = {
66 + .options.options_len = arg->accept_sec_context.options.options_len,
67 + .options.options_val = arg->accept_sec_context.options.options_val,
69 + uint32_t gccn_before = 0;
70 + uint32_t gccn_after = 0;
73 asca = &arg->accept_sec_context;
74 @@ -52,6 +59,8 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
79 + gccn_before = gp_check_sync_creds(&gcch, ach);
82 if (ach == GSS_C_NO_CREDENTIAL) {
83 @@ -146,6 +155,25 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
85 &ascr->options.options_len,
86 &ascr->options.options_val);
91 + gccn_after = gp_check_sync_creds(&gcch, ach);
93 + if (gccn_before != gccn_after) {
94 + /* export creds back to client for sync up */
95 + ret_maj = gp_export_sync_creds(&ret_min, gpcall, &ach,
96 + &ascr->options.options_val,
97 + &ascr->options.options_len);
99 + /* not fatal, log and continue */
100 + GPDEBUG("Failed to export sync creds (%d: %d)",
101 + (int)ret_maj, (int)ret_min);
105 + ret_maj = GSS_S_COMPLETE;
108 if (ret_maj == GSS_S_COMPLETE) {
109 diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
110 index e4af495..f362dbc 100644
111 --- a/proxy/src/gp_rpc_init_sec_context.c
112 +++ b/proxy/src/gp_rpc_init_sec_context.c
113 @@ -91,7 +91,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
114 gp_conv_gssx_to_buffer(isca->input_token, &ibuf);
117 - if (!isca->cred_handle) {
119 if (gss_oid_equal(mech_type, gss_mech_krb5)) {
120 ret_maj = gp_add_krb5_creds(&ret_min, gpcall,
121 ACQ_NORMAL, NULL, NULL,