1 From 5fa4e2d5d484df17ebd9a585a6dfdf4522320426 Mon Sep 17 00:00:00 2001
2 From: Robbie Harwood <rharwood@redhat.com>
3 Date: Mon, 20 Nov 2017 14:09:04 -0500
4 Subject: [PATCH] Properly locate credentials in collection caches in mechglue
6 Previously, we would just put the credentials in the default cache for
7 a collection type, which lead to some mysterious failures.
9 Signed-off-by: Robbie Harwood <rharwood@redhat.com>
10 Reviewed-by: Simo Sorce <simo@redhat.com>
12 (cherry picked from commit 670240a6cd4d5e2ecf13e481621098693cdbaa89)
14 proxy/src/mechglue/gpp_creds.c | 81 +++++++++++++++++++++++----------
15 proxy/src/mechglue/gss_plugin.h | 2 +-
16 2 files changed, 59 insertions(+), 24 deletions(-)
18 diff --git a/proxy/src/mechglue/gpp_creds.c b/proxy/src/mechglue/gpp_creds.c
19 index 3ebd726..187ada7 100644
20 --- a/proxy/src/mechglue/gpp_creds.c
21 +++ b/proxy/src/mechglue/gpp_creds.c
22 @@ -170,7 +170,16 @@ static krb5_error_code gpp_construct_cred(gssx_cred *creds, krb5_context ctx,
26 -uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
27 +/* Store creds from remote in a local ccache, updating where possible.
29 + * If store_as_default_cred is true, the cred is made default for its
30 + * collection, if there is one. Note that if the ccache is not of a
31 + * collection type, the creds will overwrite the ccache.
33 + * If no "ccache" entry is specified in cred_store, the default ccache for a
34 + * new context will be used.
36 +uint32_t gpp_store_remote_creds(uint32_t *min, bool store_as_default_cred,
37 gss_const_key_value_set_t cred_store,
40 @@ -179,7 +188,7 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
43 char cred_name[creds->desired_name.display_name.octet_string_len + 1];
44 - const char *cc_type;
45 + const char *cc_name;
49 @@ -191,38 +200,64 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
54 - for (unsigned i = 0; i < cred_store->count; i++) {
55 - if (strcmp(cred_store->elements[i].key, "ccache") == 0) {
56 - ret = krb5_cc_resolve(ctx, cred_store->elements[i].value,
61 + for (unsigned i = 0; cred_store && i < cred_store->count; i++) {
62 + if (strcmp(cred_store->elements[i].key, "ccache") == 0) {
63 + /* krb5 creates new ccaches based off the default name. */
64 + ret = krb5_cc_set_default_name(ctx,
65 + cred_store->elements[i].value);
73 - if (!default_creds) {
77 - ret = krb5_cc_default(ctx, &ccache);
81 - cc_type = krb5_cc_get_type(ctx, ccache);
82 - if (strcmp(cc_type, "FILE") == 0) {
83 + cc_name = krb5_cc_default_name(ctx);
84 + if (strncmp(cc_name, "FILE:", 5) == 0 || !strchr(cc_name, ':')) {
85 /* FILE ccaches don't handle updates properly: if they have the same
86 * principal name, they are blackholed. We either have to change the
87 * name (at which point the file grows forever) or flash the cache on
89 - ret = krb5_cc_initialize(ctx, ccache, cred.client);
91 + ret = krb5_cc_default(ctx, &ccache);
96 + ret = krb5_cc_initialize(ctx, ccache, cred.client);
100 + ret = krb5_cc_store_cred(ctx, ccache, &cred);
104 + ret = krb5_cc_cache_match(ctx, cred.client, &ccache);
105 + if (ret == KRB5_CC_NOTFOUND) {
106 + /* A new ccache within the collection whose name is based off the
107 + * default_name for the context. krb5_cc_new_unique only accepts the
108 + * leading component of a name as a type. */
112 + p = strchr(cc_name, ':'); /* can't be FILE here */
113 + cc_type = strndup(cc_name, p - cc_name);
119 + ret = krb5_cc_new_unique(ctx, cc_type, NULL, &ccache);
125 ret = krb5_cc_store_cred(ctx, ccache, &cred);
129 + if (store_as_default_cred) {
130 + ret = krb5_cc_switch(ctx, ccache);
135 diff --git a/proxy/src/mechglue/gss_plugin.h b/proxy/src/mechglue/gss_plugin.h
136 index 333d63c..c0e8870 100644
137 --- a/proxy/src/mechglue/gss_plugin.h
138 +++ b/proxy/src/mechglue/gss_plugin.h
139 @@ -76,7 +76,7 @@ uint32_t gpp_cred_handle_init(uint32_t *min, bool defcred, const char *ccache,
140 struct gpp_cred_handle **out_handle);
141 uint32_t gpp_cred_handle_free(uint32_t *min, struct gpp_cred_handle *handle);
142 bool gpp_creds_are_equal(gssx_cred *a, gssx_cred *b);
143 -uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
144 +uint32_t gpp_store_remote_creds(uint32_t *min, bool store_as_default_cred,
145 gss_const_key_value_set_t cred_store,