This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master in repository gssproxy.
commit eada55e831d12b42d3be3a555ff4e133bed7f594 Author: Simo Sorce simo@redhat.com Date: Tue Mar 14 10:43:17 2017 -0400
Allow connection to self when impersonator set
If the target of a context establishment is the impersonator itself, then allow it. This kind of context establishment is used by tools like mod_auth_gssapi to be able to inspect the ticket just obtained via impersonation and it is basically a noop as the acceptor and the impersonator are the same entitiy.
Signed-off-by: Simo Sorce simo@redhat.com Reviewed-by: Robbie Harwood rharwood@redhat.com Merges: #172 --- proxy/src/gp_creds.c | 57 ++++++++++++++++++++++++++++++++----- proxy/src/gp_rpc_creds.h | 3 +- proxy/src/gp_rpc_init_sec_context.c | 2 +- proxy/tests/t_impersonate.py | 35 ++++++++++++++++------- 4 files changed, 78 insertions(+), 19 deletions(-)
diff --git a/proxy/src/gp_creds.c b/proxy/src/gp_creds.c index 95a1c48..7d89b06 100644 --- a/proxy/src/gp_creds.c +++ b/proxy/src/gp_creds.c @@ -883,7 +883,8 @@ static uint32_t get_impersonator_name(uint32_t *min, gss_cred_id_t cred, } } else if (ret_maj == GSS_S_UNAVAILABLE) { /* Not supported by krb5 library yet, fallback to raw krb5 calls */ - /* TODO: Remove once we set a required dependency on MIT 1.15+ */ + /* TODO: Remove once we set a minimum required dependency on a + * release that supports this call */ ret_maj = get_impersonator_fallback(&ret_min, cred, impersonator); if (ret_maj == GSS_S_FAILURE) { if (ret_min == KRB5_CC_NOTFOUND) { @@ -899,9 +900,47 @@ done: return ret_maj; }
+static uint32_t check_impersonator_name(uint32_t *min, + gss_name_t target_name, + const char *impersonator) +{ + gss_name_t canon_name = NULL; + gss_buffer_desc buf; + uint32_t ret_maj = 0; + uint32_t ret_min = 0; + uint32_t discard; + bool match; + + ret_maj = gss_canonicalize_name(&discard, target_name, &gp_mech_krb5, + &canon_name); + if (ret_maj != GSS_S_COMPLETE) { + *min = ret_min; + return ret_maj; + } + + ret_maj = gss_display_name(&discard, canon_name, &buf, NULL); + gss_release_name(&discard, &canon_name); + if (ret_maj != GSS_S_COMPLETE) { + *min = ret_min; + return ret_maj; + } + + match = (strncmp(impersonator, buf.value, buf.length) == 0) && + (strlen(impersonator) == buf.length); + gss_release_buffer(&discard, &buf); + + *min = 0; + if (match) { + return GSS_S_COMPLETE; + } else { + return GSS_S_UNAUTHORIZED; + } +} + uint32_t gp_cred_allowed(uint32_t *min, struct gp_call_ctx *gpcall, - gss_cred_id_t cred) + gss_cred_id_t cred, + gss_name_t target_name) { char *impersonator = NULL; uint32_t ret_maj = 0; @@ -924,11 +963,11 @@ uint32_t gp_cred_allowed(uint32_t *min, if (ret_maj) goto done;
/* if we find an impersonator entry we bail as that is not authorized, - * if it were then gpcall->service->allow_const_deleg would have caused - * the ealier check to return GSS_S_COMPLETE already */ + * *unless* the target is the impersonator itself! If the operation + * were authorized then gpcall->service->allow_const_deleg would have + * caused the ealier check to return GSS_S_COMPLETE already */ if (impersonator != NULL) { - ret_min = 0; - ret_maj = GSS_S_UNAUTHORIZED; + ret_maj = check_impersonator_name(&ret_min, target_name, impersonator); }
done: @@ -937,7 +976,11 @@ done: GPDEBUGN(2, "Unauthorized impersonator credentials detected\n"); break; case GSS_S_COMPLETE: - GPDEBUGN(2, "No impersonator credentials detected\n"); + if (impersonator) { + GPDEBUGN(2, "Credentials allowed for 'self'\n"); + } else { + GPDEBUGN(2, "No impersonator credentials detected\n"); + } break; default: GPDEBUG("Failure while checking credentials\n"); diff --git a/proxy/src/gp_rpc_creds.h b/proxy/src/gp_rpc_creds.h index 54fe482..c116e53 100644 --- a/proxy/src/gp_rpc_creds.h +++ b/proxy/src/gp_rpc_creds.h @@ -34,7 +34,8 @@ uint32_t gp_add_krb5_creds(uint32_t *min,
uint32_t gp_cred_allowed(uint32_t *min, struct gp_call_ctx *gpcall, - gss_cred_id_t cred); + gss_cred_id_t cred, + gss_name_t target_name);
void gp_filter_flags(struct gp_call_ctx *gpcall, uint32_t *flags);
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c index 767a3ff..413e2ec 100644 --- a/proxy/src/gp_rpc_init_sec_context.c +++ b/proxy/src/gp_rpc_init_sec_context.c @@ -108,7 +108,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall, } }
- ret_maj = gp_cred_allowed(&ret_min, gpcall, ich); + ret_maj = gp_cred_allowed(&ret_min, gpcall, ich, target_name); if (ret_maj) { goto done; } diff --git a/proxy/tests/t_impersonate.py b/proxy/tests/t_impersonate.py index 3e25962..29f9a41 100755 --- a/proxy/tests/t_impersonate.py +++ b/proxy/tests/t_impersonate.py @@ -34,19 +34,20 @@ IMPERSONATE_CONF_TEMPLATE = '''
'''
-def run_cmd(testdir, env, conf, name, socket, cmd, expected_failure): +def run_cmd(testdir, env, conf, name, socket, cmd, keytab, expected_failure):
logfile = conf['logfile'] testenv = env.copy() testenv.update({'KRB5CCNAME': os.path.join(testdir, 't' + conf['prefix'] + '_impersonate.ccache'), - 'KRB5_KTNAME': os.path.join(testdir, PROXY_KTNAME), + 'KRB5_KTNAME': os.path.join(testdir, keytab), 'KRB5_TRACE': os.path.join(testdir, 't' + conf['prefix'] + '_impersonate.trace'), 'GSS_USE_PROXY': 'yes', 'GSSPROXY_SOCKET': socket, 'GSSPROXY_BEHAVIOR': 'REMOTE_FIRST'})
+ print("\nTesting: [%s]" % (name,), file=logfile) print("[COMMAND]\n%s\n[ENVIRONMENT]\n%s\n" % (cmd, testenv), file=logfile) logfile.flush()
@@ -74,45 +75,59 @@ def run(testdir, env, conf): rets = []
# Test all permitted + msg = "Impersonate" socket = os.path.join(testdir, 'impersonate.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache'] - r = run_cmd(testdir, env, conf, "Impersonate", socket, cmd, False) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False) rets.append(r)
- #Test fail + #Test self fail + msg = "Impersonate fail self" socket = os.path.join(testdir, 'impersonate-proxyonly.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache'] - r = run_cmd(testdir, env, conf, "Impersonate fail self", socket, cmd, True) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True) rets.append(r)
- #Test fail + #Test proxy fail + msg = "Impersonate fail proxy" socket = os.path.join(testdir, 'impersonate-selfonly.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache'] - r = run_cmd(testdir, env, conf, "Impersonate fail proxy", socket, cmd, True) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True) rets.append(r)
#Test s4u2self half succeed + msg = "s4u2self delegation" socket = os.path.join(testdir, 'impersonate-selfonly.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache', 's4u2self'] - r = run_cmd(testdir, env, conf, "s4u2self delegation", socket, cmd, False) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False) + rets.append(r) + + #Test proxy to self succeed + msg = "Impersonate to self" + socket = os.path.join(testdir, 'impersonate-selfonly.socket') + cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, HOST_GSS, + path_prefix + 'impersonate.cache', 's4u2proxy'] + r = run_cmd(testdir, env, conf, msg, socket, cmd, SVC_KTNAME, False) rets.append(r)
#Test s4u2proxy half fail + msg = "s4u2proxy fail" socket = os.path.join(testdir, 'impersonate-selfonly.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache', 's4u2proxy'] - r = run_cmd(testdir, env, conf, "s4u2proxy fail", socket, cmd, True) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True) rets.append(r)
#Test s4u2proxy half succeed + msg = "s4u2proxy" socket = os.path.join(testdir, 'impersonate-proxyonly.socket') cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS, path_prefix + 'impersonate.cache', 's4u2proxy'] - r = run_cmd(testdir, env, conf, "s4u2proxy", socket, cmd, False) + r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False) rets.append(r)
# Reset back gssproxy conf