HEIMDAL:lib/gssapi/krb5: add GSS_KRB5_CRED_ITERATE_ACCEPTOR_KEYTAB_X

This allows krb5_rd_req_in_set_iterate_keytab() to be used via the
gssapi layer.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12907
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14125

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h b/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
index eb19bba4bfba97fff46bd066bef4e5812590abaf..a05e526dbad461b7d09e24fe37bcfab3ed578506 100644 (file)
--- a/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
+++ b/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
@@ -175,6 +175,9 @@ extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_sanon_x25519_mechanism_oid_desc;
 extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_cred_skip_transit_check_x_oid_desc;
 #define GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X (&__gss_krb5_cred_skip_transit_check_x_oid_desc)
 
+extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_cred_iterate_acceptor_keytab_x_oid_desc;
+#define GSS_KRB5_CRED_ITERATE_ACCEPTOR_KEYTAB_X (&__gss_krb5_cred_iterate_acceptor_keytab_x_oid_desc)
+
 /*
  * OID mappings with name and short description and and slightly longer description
  */

diff --git a/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c b/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
index 9dd250fd7fcd700b2bbff07d7b56668bf2fbadf6..501c86b5d784fb71b63b7d3bf807f434e6dfeffc 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
+++ b/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
@@ -431,11 +431,16 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
        krb5_rd_req_in_ctx in = NULL;
        krb5_rd_req_out_ctx out = NULL;
        krb5_principal server = NULL;
+       krb5_boolean iterate_keytab = FALSE;
        krb5_flags verify_ap_req_flags = 0;
 
        if (acceptor_cred) {
            server = acceptor_cred->principal;
 
+           if (acceptor_cred->cred_flags & GSS_CF_ITERATE_ACCEPTOR_KEYTAB) {
+               iterate_keytab = TRUE;
+           }
+
            if (acceptor_cred->cred_flags & GSS_CF_SKIP_TRANSIT_CHECK) {
                verify_ap_req_flags |= KRB5_VERIFY_AP_REQ_SKIP_TRANSITED_CHECK;
            }
@@ -444,6 +449,8 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
        kret = krb5_rd_req_in_ctx_alloc(context, &in);
        if (kret == 0)
            kret = krb5_rd_req_in_set_keytab(context, in, keytab);
+       if (kret == 0 && iterate_keytab)
+           kret = krb5_rd_req_in_set_iterate_keytab(context, in, TRUE);
        if (kret == 0)
            kret = krb5_rd_req_in_set_verify_ap_req_flags(context, in,
                                                          verify_ap_req_flags);

diff --git a/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h b/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
index 8173e39a51263419f817b5e8c585a6573a33cdbe..1b45853bd12fef8397d57dff87985d81f2ee42fe 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
+++ b/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
@@ -102,6 +102,7 @@ typedef struct {
 #define GSS_CF_DESTROY_CRED_ON_RELEASE 1
 #define GSS_CF_NO_CI_FLAGS             2
 #define GSS_CF_SKIP_TRANSIT_CHECK      4
+#define GSS_CF_ITERATE_ACCEPTOR_KEYTAB 8
   struct krb5_keytab_data *keytab;
   time_t endtime;
   gss_cred_usage_t usage;

diff --git a/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c b/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
index 77cb6de8a65224af1774fc16835dcaccf991c506..4e95cb5a4e7bad3fdc4ccf366550e33b5e1aa763 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
+++ b/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
@@ -216,6 +216,25 @@ no_ci_flags(OM_uint32 *minor_status,
 
 }
 
+static OM_uint32
+iterate_acceptor_keytab(OM_uint32 *minor_status,
+                       krb5_context context,
+                       gss_cred_id_t *cred_handle,
+                       const gss_buffer_t value)
+{
+    gsskrb5_cred cred;
+
+    if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    cred = (gsskrb5_cred)*cred_handle;
+    cred->cred_flags |= GSS_CF_ITERATE_ACCEPTOR_KEYTAB;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
 
 static OM_uint32
 skip_transit_check(OM_uint32 *minor_status,
@@ -267,6 +286,10 @@ _gsskrb5_set_cred_option
        return skip_transit_check(minor_status, context, cred_handle, value);
     }
 
+    if (gss_oid_equal(desired_object, GSS_KRB5_CRED_ITERATE_ACCEPTOR_KEYTAB_X)) {
+       return iterate_acceptor_keytab(minor_status, context, cred_handle, value);
+    }
+
     *minor_status = EINVAL;
     return GSS_S_FAILURE;
 }

diff --git a/third_party/heimdal/lib/gssapi/mech/gss_oid.c b/third_party/heimdal/lib/gssapi/mech/gss_oid.c
index 8309e687d01aeb6a666849d7ceb19ac8e4140add..a3fa92b905e715cb9582b2fe61961efd0eaeebde 100644 (file)
--- a/third_party/heimdal/lib/gssapi/mech/gss_oid.c
+++ b/third_party/heimdal/lib/gssapi/mech/gss_oid.c
@@ -160,6 +160,9 @@ gss_OID_desc GSSAPI_LIB_VARIABLE __gss_sanon_x25519_mechanism_oid_desc = { 10, r
 /* GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X - 1.3.6.1.4.1.7165.4.7.1 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_cred_skip_transit_check_x_oid_desc = { 10, rk_UNCONST("\x2b\x06\x01\x04\x01\xb7\x7d\x04\x07\x01") };
 
+/* GSS_KRB5_CRED_ITERATE_ACCEPTOR_KEYTAB_X - 1.3.6.1.4.1.7165.4.7.2 */
+gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_cred_iterate_acceptor_keytab_x_oid_desc = { 10, rk_UNCONST("\x2b\x06\x01\x04\x01\xb7\x7d\x04\x07\x02") };
+
 /* GSS_C_MA_MECH_CONCRETE - 1.3.6.1.5.5.13.1 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_mech_concrete_oid_desc = { 7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0d\x01") };
 

diff --git a/third_party/heimdal/lib/gssapi/version-script.map b/third_party/heimdal/lib/gssapi/version-script.map
index 1b3dfed06d2657c2ed69560f25d6c8b0ea04a707..be4d01d8cf043a49947758358db5dba30c026ed9 100644 (file)
--- a/third_party/heimdal/lib/gssapi/version-script.map
+++ b/third_party/heimdal/lib/gssapi/version-script.map
@@ -164,6 +164,7 @@ HEIMDAL_GSS_2.0 {
                __gss_c_ntlm_v2_oid_desc;
                __gss_c_ntlm_session_key_oid_desc;
                __gss_c_ntlm_force_v1_oid_desc;
+               __gss_krb5_cred_iterate_acceptor_keytab_x_oid_desc;
                __gss_krb5_cred_no_ci_flags_x_oid_desc;
                __gss_krb5_cred_skip_transit_check_x_oid_desc;
                __gss_krb5_import_cred_x_oid_desc;