meta-starlingx/meta-stx-distro/recipes-security/gssproxy/files/Separate-cred-and-ccache-manipulation-in-gpp_store_r.patch

   1 From 1451b65fec69ff35e029b4770dcb4927ba57060a Mon Sep 17 00:00:00 2001
   2 From: Robbie Harwood <rharwood@redhat.com>
   3 Date: Fri, 17 Nov 2017 13:53:37 -0500
   4 Subject: [PATCH] Separate cred and ccache manipulation in
   5  gpp_store_remote_creds()
   6
   7 Signed-off-by: Robbie Harwood <rharwood@redhat.com>
   8 Reviewed-by: Simo Sorce <simo@redhat.com>
   9 (cherry picked from commit 221b553bfb4082085d05b40da9a04c1f7e4af533)
  10 ---
  11  proxy/src/mechglue/gpp_creds.c | 62 +++++++++++++++++++++-------------
  12  1 file changed, 39 insertions(+), 23 deletions(-)
  13
  14 diff --git a/proxy/src/mechglue/gpp_creds.c b/proxy/src/mechglue/gpp_creds.c
  15 index 6bdff45..3ebd726 100644
  16 --- a/proxy/src/mechglue/gpp_creds.c
  17 +++ b/proxy/src/mechglue/gpp_creds.c
  18 @@ -136,6 +136,40 @@ bool gpp_creds_are_equal(gssx_cred *a, gssx_cred *b)
  19      return true;
  20  }
  21
  22 +static krb5_error_code gpp_construct_cred(gssx_cred *creds, krb5_context ctx,
  23 +                                          krb5_creds *cred, char *cred_name)
  24 +{
  25 +    XDR xdrctx;
  26 +    bool xdrok;
  27 +    krb5_error_code ret = 0;
  28 +
  29 +    memset(cred, 0, sizeof(*cred));
  30 +
  31 +    memcpy(cred_name, creds->desired_name.display_name.octet_string_val,
  32 +           creds->desired_name.display_name.octet_string_len);
  33 +    cred_name[creds->desired_name.display_name.octet_string_len] = '\0';
  34 +
  35 +    ret = krb5_parse_name(ctx, cred_name, &cred->client);
  36 +    if (ret) {
  37 +        return ret;
  38 +    }
  39 +
  40 +    ret = krb5_parse_name(ctx, GPKRB_SRV_NAME, &cred->server);
  41 +    if (ret) {
  42 +        return ret;
  43 +    }
  44 +
  45 +    cred->ticket.data = malloc(GPKRB_MAX_CRED_SIZE);
  46 +    xdrmem_create(&xdrctx, cred->ticket.data, GPKRB_MAX_CRED_SIZE,
  47 +                  XDR_ENCODE);
  48 +    xdrok = xdr_gssx_cred(&xdrctx, creds);
  49 +    if (!xdrok) {
  50 +        return ENOSPC;
  51 +    }
  52 +    cred->ticket.length = xdr_getpos(&xdrctx);
  53 +    return 0;
  54 +}
  55 +
  56  uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
  57                                  gss_const_key_value_set_t cred_store,
  58                                  gssx_cred *creds)
  59 @@ -145,17 +179,18 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
  60      krb5_creds cred;
  61      krb5_error_code ret;
  62      char cred_name[creds->desired_name.display_name.octet_string_len + 1];
  63 -    XDR xdrctx;
  64 -    bool xdrok;
  65      const char *cc_type;
  66
  67      *min = 0;
  68
  69 -    memset(&cred, 0, sizeof(cred));
  70 -
  71      ret = krb5_init_context(&ctx);
  72      if (ret) return ret;
  73
  74 +    ret = gpp_construct_cred(creds, ctx, &cred, cred_name);
  75 +    if (ret) {
  76 +        goto done;
  77 +    }
  78 +
  79      if (cred_store) {
  80          for (unsigned i = 0; i < cred_store->count; i++) {
  81              if (strcmp(cred_store->elements[i].key, "ccache") == 0) {
  82 @@ -175,25 +210,6 @@ uint32_t gpp_store_remote_creds(uint32_t *min, bool default_creds,
  83          if (ret) goto done;
  84      }
  85
  86 -    memcpy(cred_name, creds->desired_name.display_name.octet_string_val,
  87 -           creds->desired_name.display_name.octet_string_len);
  88 -    cred_name[creds->desired_name.display_name.octet_string_len] = '\0';
  89 -
  90 -    ret = krb5_parse_name(ctx, cred_name, &cred.client);
  91 -    if (ret) goto done;
  92 -
  93 -    ret = krb5_parse_name(ctx, GPKRB_SRV_NAME, &cred.server);
  94 -    if (ret) goto done;
  95 -
  96 -    cred.ticket.data = malloc(GPKRB_MAX_CRED_SIZE);
  97 -    xdrmem_create(&xdrctx, cred.ticket.data, GPKRB_MAX_CRED_SIZE, XDR_ENCODE);
  98 -    xdrok = xdr_gssx_cred(&xdrctx, creds);
  99 -    if (!xdrok) {
 100 -        ret = ENOSPC;
 101 -        goto done;
 102 -    }
 103 -    cred.ticket.length = xdr_getpos(&xdrctx);
 104 -
 105      cc_type = krb5_cc_get_type(ctx, ccache);
 106      if (strcmp(cc_type, "FILE") == 0) {
 107          /* FILE ccaches don't handle updates properly: if they have the same