sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

heimdal:lib/krb5: verify_logonname() to handle multi component principal

Browse Source 
FreeIPA can generate tickets with a client principal of
'host/hostname.example.com'.

verify_logonname() should just verify the principal name
in the PAC_LOGON_NAME is the same as the principal of
the client principal (without realm) of the ticket.

Samba commit b7cc8c1187
break this. We try to compare ['host']['hostname.example.com']
with ['host/hostname.example.com]' (as we interpret it as enterprise principal)
this fail if we don't compare them as strings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11142

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2015-05-20 13:40:58 +00:00
parent 88d1b44d15
commit 47a3f9cc5a
1 changed files with 22 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
source4/heimdal/lib/krb5/pac.c
View File

@ -595,11 +595,12 @@ verify_logonname(krb5_context context,
krb5_const_principal principal) krb5_const_principal principal)
{ {
krb5_error_code ret; krb5_error_code ret;
krb5_principal p2;
uint32_t time1, time2; uint32_t time1, time2;
krb5_storage *sp; krb5_storage *sp;
uint16_t len; uint16_t len;
char *s; char *s = NULL;
char *principal_string = NULL;
char *logon_string = NULL;
sp = krb5_storage_from_readonly_mem((const char *)data->data + logon_name->offset_lo, sp = krb5_storage_from_readonly_mem((const char *)data->data + logon_name->offset_lo,
logon_name->buffersize); logon_name->buffersize);
@ -664,31 +665,36 @@ verify_logonname(krb5_context context,
return ret; return ret;
} }
u8len += 1; /* Add space for NUL */ u8len += 1; /* Add space for NUL */
s = malloc(u8len); logon_string = malloc(u8len);
if (s == NULL) { if (logon_string == NULL) {
free(ucs2); free(ucs2);
return krb5_enomem(context); return krb5_enomem(context);
} }
ret = wind_ucs2utf8(ucs2, ucs2len, s, &u8len); ret = wind_ucs2utf8(ucs2, ucs2len, logon_string, &u8len);
free(ucs2); free(ucs2);
if (ret) { if (ret) {
free(s); free(logon_string);
krb5_set_error_message(context, ret, "Failed to convert to UTF-8"); krb5_set_error_message(context, ret, "Failed to convert to UTF-8");
return ret; return ret;
} }
} }
ret = krb5_parse_name_flags(context, s, ret = krb5_unparse_name_flags(context, principal,
KRB5_PRINCIPAL_PARSE_NO_REALM | KRB5_PRINCIPAL_UNPARSE_NO_REALM |
KRB5_PRINCIPAL_PARSE_ENTERPRISE, &p2); KRB5_PRINCIPAL_UNPARSE_DISPLAY,
free(s); &principal_string);
if (ret) if (ret) {
free(logon_string);
return ret; return ret;
if (krb5_principal_compare_any_realm(context, principal, p2) != TRUE) {
ret = EINVAL;
krb5_set_error_message(context, ret, "PAC logon name mismatch");
} }
krb5_free_principal(context, p2);
ret = strcmp(logon_string, principal_string);
if (ret != 0) {
ret = EINVAL;
krb5_set_error_message(context, ret, "PAC logon name [%s] mismatch principal name [%s]",
logon_string, principal_string);
}
free(logon_string);
free(principal_string);
return ret; return ret;
out: out:
return ret; return ret;