[gssproxy] 01/01: Handle outdated encrypted ccaches

[git repository hosting]

This is an automated email from the git hooks/post-receive script.

rharwood pushed a commit to branch master
in repository gssproxy.

commit 657d3c8339309dd8e2bfa4ee10f005e0f0c055e8
Author: Robbie Harwood <rharwood(a)redhat.com&gt;
Date:   Fri Sep 15 18:07:28 2017 -0400

    Handle outdated encrypted ccaches
    
    When the encrypting keytab changes, all credentials that it was used
    to encrypt must be re-created.  Otherwise, we log obtuse messages and
    fail to do what the user wants.
    
    Signed-off-by: Robbie Harwood <rharwood(a)redhat.com&gt;
    Reviewed-by: Simo Sorce <simo(a)redhat.com&gt;
    Merges: #214
---
 proxy/src/gp_export.c                 | 11 ++++++-----
 proxy/src/gp_rpc_accept_sec_context.c | 28 ++++++++++++++++++++++++++++
 proxy/src/gp_rpc_init_sec_context.c   |  2 +-
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/proxy/src/gp_export.c b/proxy/src/gp_export.c
index 2e3dd07..c9f5fd4 100644
--- a/proxy/src/gp_export.c
+++ b/proxy/src/gp_export.c
@@ -268,7 +268,7 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock
*key,
                          &enc_handle,
                          &data_out);
     if (ret) {
-        return EINVAL;
+        return ret;
     }
 
     *len = data_out.length;
@@ -446,8 +446,8 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx
*gpcall,
 {
     gss_buffer_desc token = GSS_C_EMPTY_BUFFER;
     struct gp_creds_handle *handle = NULL;
-    uint32_t ret_maj;
-    uint32_t ret_min;
+    uint32_t ret_maj = GSS_S_COMPLETE;
+    uint32_t ret_min = 0;
     int ret;
 
     handle = gp_service_get_creds_handle(gpcall->service);
@@ -469,8 +469,9 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx
*gpcall,
                             &cred->cred_handle_reference,
                             &token.length, token.value);
     if (ret) {
-        ret_maj = GSS_S_FAILURE;
-        ret_min = ENOENT;
+        /* Allow for re-issuance of the keytab. */
+        GPDEBUG("Stored ccache failed to decrypt; treating as empty\n");
+        *out = GSS_C_NO_CREDENTIAL;
         goto done;
     }
 
diff --git a/proxy/src/gp_rpc_accept_sec_context.c
b/proxy/src/gp_rpc_accept_sec_context.c
index ae4de55..2cdc94b 100644
--- a/proxy/src/gp_rpc_accept_sec_context.c
+++ b/proxy/src/gp_rpc_accept_sec_context.c
@@ -25,6 +25,13 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
     int exp_creds_type;
     uint32_t acpt_maj;
     uint32_t acpt_min;
+    struct gp_cred_check_handle gcch = {
+        .ctx = gpcall,
+        .options.options_len = arg->accept_sec_context.options.options_len,
+        .options.options_val = arg->accept_sec_context.options.options_val,
+    };
+    uint32_t gccn_before = 0;
+    uint32_t gccn_after = 0;
     int ret;
 
     asca = &arg->accept_sec_context;
@@ -52,6 +59,8 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
         if (ret_maj) {
             goto done;
         }
+
+        gccn_before = gp_check_sync_creds(&gcch, ach);
     }
 
     if (ach == GSS_C_NO_CREDENTIAL) {
@@ -146,6 +155,25 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall,
                                               src_name, oid,
                                               &ascr->options.options_len,
                                               &ascr->options.options_val);
+    if (ret_maj) {
+        goto done;
+    }
+
+    gccn_after = gp_check_sync_creds(&gcch, ach);
+
+    if (gccn_before != gccn_after) {
+        /* export creds back to client for sync up */
+        ret_maj = gp_export_sync_creds(&ret_min, gpcall, &ach,
+                                       &ascr->options.options_val,
+                                       &ascr->options.options_len);
+        if (ret_maj) {
+            /* not fatal, log and continue */
+            GPDEBUG("Failed to export sync creds (%d: %d)",
+                    (int)ret_maj, (int)ret_min);
+        }
+    }
+
+    ret_maj = GSS_S_COMPLETE;
 
 done:
     if (ret_maj == GSS_S_COMPLETE) {
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
index e4af495..f362dbc 100644
--- a/proxy/src/gp_rpc_init_sec_context.c
+++ b/proxy/src/gp_rpc_init_sec_context.c
@@ -91,7 +91,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
         gp_conv_gssx_to_buffer(isca->input_token, &ibuf);
     }
 
-    if (!isca->cred_handle) {
+    if (!ich) {
         if (gss_oid_equal(mech_type, gss_mech_krb5)) {
             ret_maj = gp_add_krb5_creds(&ret_min, gpcall,
                                         ACQ_NORMAL, NULL, NULL,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.