Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:Update
krb5.27489
0121-Fix-impersonate_name-to-work-with-interpos...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0121-Fix-impersonate_name-to-work-with-interposers.patch of Package krb5.27489
From 2589230a0263174dea82ad2ecaf5b3c860aa4bcf Mon Sep 17 00:00:00 2001 From: Simo Sorce <simo@redhat.com> Date: Fri, 13 Nov 2015 14:54:11 -0500 Subject: [PATCH 3/3] Fix impersonate_name to work with interposers This follows the same modifications applied to gss_acquire_cred_with_password() when interposer plugins were introduced. [ghudson@mit.edu: minor whitespace changes; initialize out_mcred in spnego_gss_acquire_cred_impersonate_name() since it is released in the cleanup handler] ticket: 8280 (new) (Cherry picked from commit b3901af6970fb7bde88eb16d51c8d05db6f37746) --- .../gssapi/mechglue/g_acquire_cred_imp_name.c | 58 ++++++++++++------- src/lib/gssapi/spnego/spnego_mech.c | 28 ++++----- 2 files changed, 51 insertions(+), 35 deletions(-) diff --git a/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c b/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c index 0dd4f87fa..9eab25e4c 100644 --- a/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c +++ b/src/lib/gssapi/mechglue/g_acquire_cred_imp_name.c @@ -334,6 +334,8 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, gss_cred_id_t cred = NULL; gss_OID new_mechs_array = NULL; gss_cred_id_t * new_cred_array = NULL; + gss_OID_set target_mechs = GSS_C_NO_OID_SET; + gss_OID selected_mech = GSS_C_NO_OID; status = val_add_cred_impersonate_name_args(minor_status, input_cred_handle, @@ -350,7 +352,12 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, if (status != GSS_S_COMPLETE) return (status); - mech = gssint_get_mechanism(desired_mech); + status = gssint_select_mech_type(minor_status, desired_mech, + &selected_mech); + if (status != GSS_S_COMPLETE) + return status; + + mech = gssint_get_mechanism(selected_mech); if (!mech) return GSS_S_BAD_MECH; else if (!mech->gss_acquire_cred_impersonate_name) @@ -367,27 +374,26 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, internal_name = GSS_C_NO_NAME; } else { union_cred = (gss_union_cred_t)input_cred_handle; - if (gssint_get_mechanism_cred(union_cred, desired_mech) != + if (gssint_get_mechanism_cred(union_cred, selected_mech) != GSS_C_NO_CREDENTIAL) return (GSS_S_DUPLICATE_ELEMENT); } mech_impersonator_cred = gssint_get_mechanism_cred((gss_union_cred_t)impersonator_cred_handle, - desired_mech); + selected_mech); if (mech_impersonator_cred == GSS_C_NO_CREDENTIAL) return (GSS_S_NO_CRED); /* may need to create a mechanism specific name */ union_name = (gss_union_name_t)desired_name; if (union_name->mech_type && - g_OID_equal(union_name->mech_type, - &mech->mech_type)) + g_OID_equal(union_name->mech_type, selected_mech)) internal_name = union_name->mech_name; else { if (gssint_import_internal_name(minor_status, - &mech->mech_type, union_name, - &allocated_name) != GSS_S_COMPLETE) + selected_mech, union_name, + &allocated_name) != GSS_S_COMPLETE) return (GSS_S_BAD_NAME); internal_name = allocated_name; } @@ -402,11 +408,21 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, else time_req = 0; + status = gss_create_empty_oid_set(minor_status, &target_mechs); + if (status != GSS_S_COMPLETE) + goto errout; + + status = gss_add_oid_set_member(minor_status, + gssint_get_public_oid(selected_mech), + &target_mechs); + if (status != GSS_S_COMPLETE) + goto errout; + status = mech->gss_acquire_cred_impersonate_name(minor_status, mech_impersonator_cred, internal_name, time_req, - GSS_C_NULL_OID_SET, + target_mechs, cred_usage, &cred, NULL, @@ -445,19 +461,15 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, new_cred_array[union_cred->count] = cred; if ((new_mechs_array[union_cred->count].elements = - malloc(mech->mech_type.length)) == NULL) + malloc(selected_mech->length)) == NULL) goto errout; - g_OID_copy(&new_mechs_array[union_cred->count], - &mech->mech_type); + g_OID_copy(&new_mechs_array[union_cred->count], selected_mech); if (actual_mechs != NULL) { - gss_OID_set_desc oids; - - oids.count = union_cred->count + 1; - oids.elements = new_mechs_array; - - status = generic_gss_copy_oid_set(minor_status, &oids, actual_mechs); + status = gssint_make_public_oid_set(minor_status, new_mechs_array, + union_cred->count + 1, + actual_mechs); if (GSS_ERROR(status)) { free(new_mechs_array[union_cred->count].elements); goto errout; @@ -486,10 +498,12 @@ gss_add_cred_impersonate_name(OM_uint32 *minor_status, /* We're done with the internal name. Free it if we allocated it. */ if (allocated_name) - (void) gssint_release_internal_name(&temp_minor_status, - &mech->mech_type, + (void) gssint_release_internal_name(&temp_minor_status, selected_mech, &allocated_name); + if (target_mechs) + (void) gss_release_oid_set(&temp_minor_status, &target_mechs); + return (GSS_S_COMPLETE); errout: @@ -503,8 +517,10 @@ errout: if (allocated_name) (void) gssint_release_internal_name(&temp_minor_status, - &mech->mech_type, - &allocated_name); + selected_mech, &allocated_name); + + if (target_mechs) + (void) gss_release_oid_set(&temp_minor_status, &target_mechs); if (input_cred_handle == GSS_C_NO_CREDENTIAL && union_cred) free(union_cred); diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 718df2742..9697ffec5 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -2649,10 +2649,10 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, gss_OID_set *actual_mechs, OM_uint32 *time_rec) { - OM_uint32 status; + OM_uint32 status, tmpmin; gss_OID_set amechs = GSS_C_NULL_OID_SET; spnego_gss_cred_id_t imp_spcred = NULL, out_spcred = NULL; - gss_cred_id_t imp_mcred, out_mcred; + gss_cred_id_t imp_mcred, out_mcred = GSS_C_NO_CREDENTIAL; dsyslog("Entering spnego_gss_acquire_cred_impersonate_name\n"); @@ -2664,30 +2664,30 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, imp_spcred = (spnego_gss_cred_id_t)impersonator_cred_handle; imp_mcred = imp_spcred ? imp_spcred->mcred : GSS_C_NO_CREDENTIAL; - if (desired_mechs == GSS_C_NO_OID_SET) { - status = gss_inquire_cred(minor_status, imp_mcred, NULL, NULL, - NULL, &amechs); - if (status != GSS_S_COMPLETE) - return status; - - desired_mechs = amechs; - } + status = gss_inquire_cred(minor_status, imp_mcred, NULL, NULL, + NULL, &amechs); + if (status != GSS_S_COMPLETE) + return status; status = gss_acquire_cred_impersonate_name(minor_status, imp_mcred, desired_name, time_req, - desired_mechs, cred_usage, + amechs, cred_usage, &out_mcred, actual_mechs, time_rec); - - if (amechs != GSS_C_NULL_OID_SET) - (void) gss_release_oid_set(minor_status, &amechs); + if (status != GSS_S_COMPLETE) { + gss_release_oid_set(&tmpmin, &amechs); + gss_release_cred(minor_status, &out_mcred); + return status; + } out_spcred = malloc(sizeof(spnego_gss_cred_id_rec)); if (out_spcred == NULL) { + gss_release_oid_set(&tmpmin, &amechs); gss_release_cred(minor_status, &out_mcred); *minor_status = ENOMEM; return (GSS_S_FAILURE); } + out_mcred = GSS_C_NO_CREDENTIAL; out_spcred->mcred = out_mcred; out_spcred->neg_mechs = GSS_C_NULL_OID_SET; *output_cred_handle = (gss_cred_id_t)out_spcred; -- 2.22.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
