From 1fa33903be640f8d22757d21da294e70f0812698 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 10 Oct 2017 18:00:45 -0400 Subject: [PATCH] Only empty FILE ccaches when storing remote creds This mitigates issues when services share a ccache between two processes. We cannot fix this for FILE ccaches without introducing other issues. Signed-off-by: Robbie Harwood Reviewed-by: Simo Sorce Merges: #216 (cherry picked from commit d09e87f47a21dd250bfd7a9c59a5932b5c995057) --- proxy/src/mechglue/gpp_creds.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/proxy/src/mechglue/gpp_creds.c b/proxy/src/mechglue/gpp_creds.c index 9fe9bd1..6bdff45 100644 --- a/proxy/src/mechglue/gpp_creds.c +++ b/proxy/src/mechglue/gpp_creds.c @@ -147,6 +147,7 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds, char cred_name[creds->desired_name.display_name.octet_string_len + 1]; XDR xdrctx; bool xdrok; + const char *cc_type; *min = 0; @@ -193,13 +194,20 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds, } cred.ticket.length = xdr_getpos(&xdrctx); - /* Always initialize and destroy any existing contents to avoid pileup of - * entries */ - ret = krb5_cc_initialize(ctx, ccache, cred.client); - if (ret == 0) { - ret = krb5_cc_store_cred(ctx, ccache, &cred); + cc_type = krb5_cc_get_type(ctx, ccache); + if (strcmp(cc_type, "FILE") == 0) { + /* FILE ccaches don't handle updates properly: if they have the same + * principal name, they are blackholed. We either have to change the + * name (at which point the file grows forever) or flash the cache on + * every update. */ + ret = krb5_cc_initialize(ctx, ccache, cred.client); + if (ret != 0) { + goto done; + } } + ret = krb5_cc_store_cred(ctx, ccache, &cred); + done: if (ctx) { krb5_free_cred_contents(ctx, &cred);