sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-22 13:34:15 +03:00
Code

Avoid overriding default ccache for ads operations.

Browse Source 
Avoid overriding default ccache for ads operations.

Nowadays various samba components may need to use GSSAPI and a default cred
cache to perform their tasks.
This code was completely overriding the whole process default ccache name, thus
altering the current credentials and sometimes hijacking them (or getting
preemptively hijaked).

By using gss_krb5_import_cred we can instead use a private ccache (necessary
sometimes to use a different set of credentials fromt he default
cifs/fqdn@realm one, for example when contacting foreign DCs using trust
credentials) that does not affect the rest of the process.

For the kerberos versions which don't have gss_krb5_import_cred
we fallback to temp override of KRB5CCNAME and gss_acquire_cred.

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Signed-off-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Wed Sep 12 21:18:09 CEST 2012 on sn-devel-104
This commit is contained in:
Simo Sorce 2012-09-07 14:14:08 -04:00 committed by Alexander Bokovoy
parent a11e45f1c5
commit 893b213876
8 changed files with 102 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
source3/include/ads.h
View File

@ -45,6 +45,7 @@ typedef struct ads_struct {
char *kdc_server;
unsigned flags;
int time_offset;
char *ccache_name;
time_t tgt_expire;
time_t tgs_expire;
time_t renewable;

2
source3/include/proto.h
View File

@ -768,7 +768,7 @@ int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
const char *principal, int time_offset,
DATA_BLOB *targ,
DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
time_t *expire_time);
const char *ccname, time_t *expire_time);
bool spnego_parse_challenge(TALLOC_CTX *ctx, const DATA_BLOB blob,
DATA_BLOB *chal1, DATA_BLOB *chal2);
DATA_BLOB spnego_gen_auth(TALLOC_CTX *ctx, DATA_BLOB blob);

1
source3/libads/ads_struct.c
View File

@ -201,6 +201,7 @@ void ads_destroy(ADS_STRUCT **ads)
SAFE_FREE((*ads)->auth.password);
SAFE_FREE((*ads)->auth.user_name);
SAFE_FREE((*ads)->auth.kdc_server);
SAFE_FREE((*ads)->auth.ccache_name);
SAFE_FREE((*ads)->config.realm);
SAFE_FREE((*ads)->config.bind_path);

8
source3/libads/kerberos_util.c
View File

@ -63,9 +63,11 @@ int ads_kinit_password(ADS_STRUCT *ads)
return KRB5_LIBOS_CANTREADPWD;
}
ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
&ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable,
NULL);
ret = kerberos_kinit_password_ext(s, ads->auth.password,
ads->auth.time_offset,
&ads->auth.tgt_expire, NULL,
ads->auth.ccache_name, false, false,
ads->auth.renewable, NULL);
if (ret) {
DEBUG(0,("kerberos_kinit_password %s failed: %s\n",

92
source3/libads/sasl.c
View File

@ -271,6 +271,74 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
}
#ifdef HAVE_KRB5
static ADS_STATUS ads_init_gssapi_cred(ADS_STRUCT *ads, gss_cred_id_t *cred)
{
ADS_STATUS status;
krb5_context kctx;
krb5_error_code kerr;
krb5_ccache kccache = NULL;
uint32_t maj, min;
*cred = GSS_C_NO_CREDENTIAL;
if (!ads->auth.ccache_name) {
return ADS_SUCCESS;
}
kerr = krb5_init_context(&kctx);
if (kerr) {
return ADS_ERROR_KRB5(kerr);
}
#ifdef HAVE_GSS_KRB5_IMPORT_CRED
kerr = krb5_cc_resolve(kctx, ads->auth.ccache_name, &kccache);
if (kerr) {
status = ADS_ERROR_KRB5(kerr);
goto done;
}
maj = gss_krb5_import_cred(&min, kccache, NULL, NULL, cred);
if (maj != GSS_S_COMPLETE) {
status = ADS_ERROR_GSS(maj, min);
goto done;
}
#else
/* We need to fallback to overriding the default creds.
* This operation is not thread safe as it changes the process
* environment variable, but we do not have any better option
* with older kerberos libraries */
{
const char *oldccname = NULL;
oldccname = getenv("KRB5CCNAME");
setenv("KRB5CCNAME", ads->auth.ccache_name, 1);
maj = gss_acquire_cred(&min, GSS_C_NO_NAME, GSS_C_INDEFINITE,
NULL, GSS_C_INITIATE, cred, NULL, NULL);
if (oldccname) {
setenv("KRB5CCNAME", oldccname, 1);
} else {
unsetenv("KRB5CCNAME");
}
if (maj != GSS_S_COMPLETE) {
status = ADS_ERROR_GSS(maj, min);
goto done;
}
}
#endif
status = ADS_SUCCESS;
done:
if (!ADS_ERR_OK(status) && kccache != NULL) {
krb5_cc_close(kctx, kccache);
}
krb5_free_context(kctx);
return status;
}
static ADS_STATUS ads_sasl_gssapi_wrap(ADS_STRUCT *ads, uint8 *buf, uint32 len)
{
gss_ctx_id_t context_handle = (gss_ctx_id_t)ads->ldap.wrap_private_data;
@ -377,6 +445,7 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
bool ok;
uint32 minor_status;
int gss_rc, rc;
gss_cred_id_t gss_cred = GSS_C_NO_CREDENTIAL;
gss_OID_desc krb5_mech_type =
{9, discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02") };
gss_OID mech_type = &krb5_mech_type;
@ -390,6 +459,11 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
DATA_BLOB wrapped;
struct berval cred, *scred = NULL;
status = ads_init_gssapi_cred(ads, &gss_cred);
if (!ADS_ERR_OK(status)) {
goto failed;
}
input_token.value = NULL;
input_token.length = 0;
@ -407,7 +481,7 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
/* Note: here we explicit ask for the krb5 mech_type */
gss_rc = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
gss_cred,
&context_handle,
serv_name,
mech_type,
@ -544,7 +618,7 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
* to gssapi
*/
gss_rc = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
gss_cred,
&context_handle,
serv_name,
mech_type,
@ -606,6 +680,8 @@ static ADS_STATUS ads_sasl_spnego_gsskrb5_bind(ADS_STRUCT *ads, const gss_name_t
status = ADS_SUCCESS;
failed:
if (gss_cred != GSS_C_NO_CREDENTIAL)
gss_release_cred(&minor_status, &gss_cred);
if (context_handle != GSS_C_NO_CONTEXT)
gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);
return status;
@ -791,6 +867,7 @@ static ADS_STATUS ads_sasl_spnego_rawkrb5_bind(ADS_STRUCT *ads, const char *prin
rc = spnego_gen_krb5_negTokenInit(talloc_tos(), principal,
ads->auth.time_offset, &blob, &session_key, 0,
ads->auth.ccache_name,
&ads->auth.tgs_expire);
if (rc) {
@ -952,6 +1029,7 @@ failed:
static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv_name)
{
uint32 minor_status;
gss_cred_id_t gss_cred = GSS_C_NO_CREDENTIAL;
gss_ctx_id_t context_handle = GSS_C_NO_CONTEXT;
gss_OID mech_type = GSS_C_NULL_OID;
gss_buffer_desc output_token, input_token;
@ -969,6 +1047,11 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
input_token.value = NULL;
input_token.length = 0;
status = ads_init_gssapi_cred(ads, &gss_cred);
if (!ADS_ERR_OK(status)) {
goto failed;
}
/*
* Note: here we always ask the gssapi for sign and seal
* as this is negotiated later after the mutal
@ -978,7 +1061,7 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
for (i=0; i < MAX_GSS_PASSES; i++) {
gss_rc = gss_init_sec_context(&minor_status,
GSS_C_NO_CREDENTIAL,
gss_cred,
&context_handle,
serv_name,
mech_type,
@ -1137,7 +1220,8 @@ static ADS_STATUS ads_sasl_gssapi_do_bind(ADS_STRUCT *ads, const gss_name_t serv
}
failed:
if (gss_cred != GSS_C_NO_CREDENTIAL)
gss_release_cred(&minor_status, &gss_cred);
if (context_handle != GSS_C_NO_CONTEXT)
gss_delete_sec_context(&minor_status, &context_handle, GSS_C_NO_BUFFER);

2
source3/libsmb/cliconnect.c
View File

@ -1461,7 +1461,7 @@ static struct tevent_req *cli_session_setup_kerberos_send(
* we have to acquire a ticket. To be fixed later :-)
*/
rc = spnego_gen_krb5_negTokenInit(state, principal, 0, &state->negTokenTarg,
&state->session_key_krb5, 0, NULL);
&state->session_key_krb5, 0, NULL, NULL);
if (rc) {
DEBUG(1, ("cli_session_setup_kerberos: "
"spnego_gen_krb5_negTokenInit failed: %s\n",

4
source3/libsmb/clispnego.c
View File

@ -255,7 +255,7 @@ int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
const char *principal, int time_offset,
DATA_BLOB *targ,
DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
time_t *expire_time)
const char *ccname, time_t *expire_time)
{
int retval;
DATA_BLOB tkt, tkt_wrapped;
@ -264,7 +264,7 @@ int spnego_gen_krb5_negTokenInit(TALLOC_CTX *ctx,
/* get a kerberos ticket for the service and extract the session key */
retval = cli_krb5_get_ticket(ctx, principal, time_offset,
&tkt, session_key_krb5,
extra_ap_opts, NULL,
extra_ap_opts, ccname,
expire_time, NULL);
if (retval) {
return retval;

6
source3/winbindd/winbindd_ads.c
View File

@ -78,15 +78,15 @@ static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
}
}
/* we don't want this to affect the users ccache */
setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
ads = ads_init(domain->alt_name, domain->name, NULL);
if (!ads) {
DEBUG(1,("ads_init for domain %s failed\n", domain->name));
return NULL;
}
/* we don't want ads operations to affect the default ccache */
ads->auth.ccache_name = SMB_STRDUP("MEMORY:winbind_ccache");
/* the machine acct password might have change - fetch it every time */
SAFE_FREE(ads->auth.password);