+++ /dev/null
-From 0e04be2c1398dac40c50910a59157eed0ad5a7e4 Mon Sep 17 00:00:00 2001
-From: Simo Sorce <simo@redhat.com>
-Date: Tue, 14 Mar 2017 10:43:17 -0400
-Subject: [PATCH] Allow connection to self when impersonator set
-
-If the target of a context establishment is the impersonator itself,
-then allow it. This kind of context establishment is used by tools like
-mod_auth_gssapi to be able to inspect the ticket just obtained via
-impersonation and it is basically a noop as the acceptor and the
-impersonator are the same entitiy.
-
-Signed-off-by: Simo Sorce <simo@redhat.com>
-Reviewed-by: Robbie Harwood <rharwood@redhat.com>
-Merges: #172
-(cherry picked from commit eada55e831d12b42d3be3a555ff4e133bed7f594)
----
- proxy/src/gp_creds.c | 57 +++++++++++++++++++++++++----
- proxy/src/gp_rpc_creds.h | 3 +-
- proxy/src/gp_rpc_init_sec_context.c | 2 +-
- proxy/tests/t_impersonate.py | 35 +++++++++++++-----
- 4 files changed, 78 insertions(+), 19 deletions(-)
-
-diff --git a/proxy/src/gp_creds.c b/proxy/src/gp_creds.c
-index 95a1c48..7d89b06 100644
---- a/proxy/src/gp_creds.c
-+++ b/proxy/src/gp_creds.c
-@@ -883,7 +883,8 @@ static uint32_t get_impersonator_name(uint32_t *min, gss_cred_id_t cred,
- }
- } else if (ret_maj == GSS_S_UNAVAILABLE) {
- /* Not supported by krb5 library yet, fallback to raw krb5 calls */
-- /* TODO: Remove once we set a required dependency on MIT 1.15+ */
-+ /* TODO: Remove once we set a minimum required dependency on a
-+ * release that supports this call */
- ret_maj = get_impersonator_fallback(&ret_min, cred, impersonator);
- if (ret_maj == GSS_S_FAILURE) {
- if (ret_min == KRB5_CC_NOTFOUND) {
-@@ -899,9 +900,47 @@ done:
- return ret_maj;
- }
-
-+static uint32_t check_impersonator_name(uint32_t *min,
-+ gss_name_t target_name,
-+ const char *impersonator)
-+{
-+ gss_name_t canon_name = NULL;
-+ gss_buffer_desc buf;
-+ uint32_t ret_maj = 0;
-+ uint32_t ret_min = 0;
-+ uint32_t discard;
-+ bool match;
-+
-+ ret_maj = gss_canonicalize_name(&discard, target_name, &gp_mech_krb5,
-+ &canon_name);
-+ if (ret_maj != GSS_S_COMPLETE) {
-+ *min = ret_min;
-+ return ret_maj;
-+ }
-+
-+ ret_maj = gss_display_name(&discard, canon_name, &buf, NULL);
-+ gss_release_name(&discard, &canon_name);
-+ if (ret_maj != GSS_S_COMPLETE) {
-+ *min = ret_min;
-+ return ret_maj;
-+ }
-+
-+ match = (strncmp(impersonator, buf.value, buf.length) == 0) &&
-+ (strlen(impersonator) == buf.length);
-+ gss_release_buffer(&discard, &buf);
-+
-+ *min = 0;
-+ if (match) {
-+ return GSS_S_COMPLETE;
-+ } else {
-+ return GSS_S_UNAUTHORIZED;
-+ }
-+}
-+
- uint32_t gp_cred_allowed(uint32_t *min,
- struct gp_call_ctx *gpcall,
-- gss_cred_id_t cred)
-+ gss_cred_id_t cred,
-+ gss_name_t target_name)
- {
- char *impersonator = NULL;
- uint32_t ret_maj = 0;
-@@ -924,11 +963,11 @@ uint32_t gp_cred_allowed(uint32_t *min,
- if (ret_maj) goto done;
-
- /* if we find an impersonator entry we bail as that is not authorized,
-- * if it were then gpcall->service->allow_const_deleg would have caused
-- * the ealier check to return GSS_S_COMPLETE already */
-+ * *unless* the target is the impersonator itself! If the operation
-+ * were authorized then gpcall->service->allow_const_deleg would have
-+ * caused the ealier check to return GSS_S_COMPLETE already */
- if (impersonator != NULL) {
-- ret_min = 0;
-- ret_maj = GSS_S_UNAUTHORIZED;
-+ ret_maj = check_impersonator_name(&ret_min, target_name, impersonator);
- }
-
- done:
-@@ -937,7 +976,11 @@ done:
- GPDEBUGN(2, "Unauthorized impersonator credentials detected\n");
- break;
- case GSS_S_COMPLETE:
-- GPDEBUGN(2, "No impersonator credentials detected\n");
-+ if (impersonator) {
-+ GPDEBUGN(2, "Credentials allowed for 'self'\n");
-+ } else {
-+ GPDEBUGN(2, "No impersonator credentials detected\n");
-+ }
- break;
- default:
- GPDEBUG("Failure while checking credentials\n");
-diff --git a/proxy/src/gp_rpc_creds.h b/proxy/src/gp_rpc_creds.h
-index 54fe482..c116e53 100644
---- a/proxy/src/gp_rpc_creds.h
-+++ b/proxy/src/gp_rpc_creds.h
-@@ -34,7 +34,8 @@ uint32_t gp_add_krb5_creds(uint32_t *min,
-
- uint32_t gp_cred_allowed(uint32_t *min,
- struct gp_call_ctx *gpcall,
-- gss_cred_id_t cred);
-+ gss_cred_id_t cred,
-+ gss_name_t target_name);
-
- void gp_filter_flags(struct gp_call_ctx *gpcall, uint32_t *flags);
-
-diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
-index 767a3ff..413e2ec 100644
---- a/proxy/src/gp_rpc_init_sec_context.c
-+++ b/proxy/src/gp_rpc_init_sec_context.c
-@@ -108,7 +108,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
- }
- }
-
-- ret_maj = gp_cred_allowed(&ret_min, gpcall, ich);
-+ ret_maj = gp_cred_allowed(&ret_min, gpcall, ich, target_name);
- if (ret_maj) {
- goto done;
- }
-diff --git a/proxy/tests/t_impersonate.py b/proxy/tests/t_impersonate.py
-index 3e25962..29f9a41 100755
---- a/proxy/tests/t_impersonate.py
-+++ b/proxy/tests/t_impersonate.py
-@@ -34,19 +34,20 @@ IMPERSONATE_CONF_TEMPLATE = '''
-
- '''
-
--def run_cmd(testdir, env, conf, name, socket, cmd, expected_failure):
-+def run_cmd(testdir, env, conf, name, socket, cmd, keytab, expected_failure):
-
- logfile = conf['logfile']
- testenv = env.copy()
- testenv.update({'KRB5CCNAME': os.path.join(testdir, 't' + conf['prefix'] +
- '_impersonate.ccache'),
-- 'KRB5_KTNAME': os.path.join(testdir, PROXY_KTNAME),
-+ 'KRB5_KTNAME': os.path.join(testdir, keytab),
- 'KRB5_TRACE': os.path.join(testdir, 't' + conf['prefix'] +
- '_impersonate.trace'),
- 'GSS_USE_PROXY': 'yes',
- 'GSSPROXY_SOCKET': socket,
- 'GSSPROXY_BEHAVIOR': 'REMOTE_FIRST'})
-
-+ print("\nTesting: [%s]" % (name,), file=logfile)
- print("[COMMAND]\n%s\n[ENVIRONMENT]\n%s\n" % (cmd, testenv), file=logfile)
- logfile.flush()
-
-@@ -74,45 +75,59 @@ def run(testdir, env, conf):
- rets = []
-
- # Test all permitted
-+ msg = "Impersonate"
- socket = os.path.join(testdir, 'impersonate.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache']
-- r = run_cmd(testdir, env, conf, "Impersonate", socket, cmd, False)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
- rets.append(r)
-
-- #Test fail
-+ #Test self fail
-+ msg = "Impersonate fail self"
- socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache']
-- r = run_cmd(testdir, env, conf, "Impersonate fail self", socket, cmd, True)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
- rets.append(r)
-
-- #Test fail
-+ #Test proxy fail
-+ msg = "Impersonate fail proxy"
- socket = os.path.join(testdir, 'impersonate-selfonly.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache']
-- r = run_cmd(testdir, env, conf, "Impersonate fail proxy", socket, cmd, True)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
- rets.append(r)
-
- #Test s4u2self half succeed
-+ msg = "s4u2self delegation"
- socket = os.path.join(testdir, 'impersonate-selfonly.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache', 's4u2self']
-- r = run_cmd(testdir, env, conf, "s4u2self delegation", socket, cmd, False)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
-+ rets.append(r)
-+
-+ #Test proxy to self succeed
-+ msg = "Impersonate to self"
-+ socket = os.path.join(testdir, 'impersonate-selfonly.socket')
-+ cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, HOST_GSS,
-+ path_prefix + 'impersonate.cache', 's4u2proxy']
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, SVC_KTNAME, False)
- rets.append(r)
-
- #Test s4u2proxy half fail
-+ msg = "s4u2proxy fail"
- socket = os.path.join(testdir, 'impersonate-selfonly.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache', 's4u2proxy']
-- r = run_cmd(testdir, env, conf, "s4u2proxy fail", socket, cmd, True)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
- rets.append(r)
-
- #Test s4u2proxy half succeed
-+ msg = "s4u2proxy"
- socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
- cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
- path_prefix + 'impersonate.cache', 's4u2proxy']
-- r = run_cmd(testdir, env, conf, "s4u2proxy", socket, cmd, False)
-+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
- rets.append(r)
-
- # Reset back gssproxy conf
Code Review / pti / rtp.git / blobdiff