From 0e04be2c1398dac40c50910a59157eed0ad5a7e4 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Tue, 14 Mar 2017 10:43:17 -0400
Subject: [PATCH] Allow connection to self when impersonator set
If the target of a context establishment is the impersonator itself,
then allow it. This kind of context establishment is used by tools like
mod_auth_gssapi to be able to inspect the ticket just obtained via
impersonation and it is basically a noop as the acceptor and the
impersonator are the same entitiy.
Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Robbie Harwood <rharwood@redhat.com>
Merges: #172
(cherry picked from commit eada55e831d12b42d3be3a555ff4e133bed7f594)
---
proxy/src/gp_creds.c | 57 ++++++++++++++++++++++++++++++++-----
proxy/src/gp_rpc_creds.h | 3 +-
proxy/src/gp_rpc_init_sec_context.c | 2 +-
proxy/tests/t_impersonate.py | 35 ++++++++++++++++-------
4 files changed, 78 insertions(+), 19 deletions(-)
diff --git a/proxy/src/gp_creds.c b/proxy/src/gp_creds.c
index 95a1c48..7d89b06 100644
--- a/proxy/src/gp_creds.c
+++ b/proxy/src/gp_creds.c
@@ -883,7 +883,8 @@ static uint32_t get_impersonator_name(uint32_t *min, gss_cred_id_t cred,
}
} else if (ret_maj == GSS_S_UNAVAILABLE) {
/* Not supported by krb5 library yet, fallback to raw krb5 calls */
- /* TODO: Remove once we set a required dependency on MIT 1.15+ */
+ /* TODO: Remove once we set a minimum required dependency on a
+ * release that supports this call */
ret_maj = get_impersonator_fallback(&ret_min, cred, impersonator);
if (ret_maj == GSS_S_FAILURE) {
if (ret_min == KRB5_CC_NOTFOUND) {
@@ -899,9 +900,47 @@ done:
return ret_maj;
}
+static uint32_t check_impersonator_name(uint32_t *min,
+ gss_name_t target_name,
+ const char *impersonator)
+{
+ gss_name_t canon_name = NULL;
+ gss_buffer_desc buf;
+ uint32_t ret_maj = 0;
+ uint32_t ret_min = 0;
+ uint32_t discard;
+ bool match;
+
+ ret_maj = gss_canonicalize_name(&discard, target_name, &gp_mech_krb5,
+ &canon_name);
+ if (ret_maj != GSS_S_COMPLETE) {
+ *min = ret_min;
+ return ret_maj;
+ }
+
+ ret_maj = gss_display_name(&discard, canon_name, &buf, NULL);
+ gss_release_name(&discard, &canon_name);
+ if (ret_maj != GSS_S_COMPLETE) {
+ *min = ret_min;
+ return ret_maj;
+ }
+
+ match = (strncmp(impersonator, buf.value, buf.length) == 0) &&
+ (strlen(impersonator) == buf.length);
+ gss_release_buffer(&discard, &buf);
+
+ *min = 0;
+ if (match) {
+ return GSS_S_COMPLETE;
+ } else {
+ return GSS_S_UNAUTHORIZED;
+ }
+}
+
uint32_t gp_cred_allowed(uint32_t *min,
struct gp_call_ctx *gpcall,
- gss_cred_id_t cred)
+ gss_cred_id_t cred,
+ gss_name_t target_name)
{
char *impersonator = NULL;
uint32_t ret_maj = 0;
@@ -924,11 +963,11 @@ uint32_t gp_cred_allowed(uint32_t *min,
if (ret_maj) goto done;
/* if we find an impersonator entry we bail as that is not authorized,
- * if it were then gpcall->service->allow_const_deleg would have caused
- * the ealier check to return GSS_S_COMPLETE already */
+ * *unless* the target is the impersonator itself! If the operation
+ * were authorized then gpcall->service->allow_const_deleg would have
+ * caused the ealier check to return GSS_S_COMPLETE already */
if (impersonator != NULL) {
- ret_min = 0;
- ret_maj = GSS_S_UNAUTHORIZED;
+ ret_maj = check_impersonator_name(&ret_min, target_name, impersonator);
}
done:
@@ -937,7 +976,11 @@ done:
GPDEBUGN(2, "Unauthorized impersonator credentials detected\n");
break;
case GSS_S_COMPLETE:
- GPDEBUGN(2, "No impersonator credentials detected\n");
+ if (impersonator) {
+ GPDEBUGN(2, "Credentials allowed for 'self'\n");
+ } else {
+ GPDEBUGN(2, "No impersonator credentials detected\n");
+ }
break;
default:
GPDEBUG("Failure while checking credentials\n");
diff --git a/proxy/src/gp_rpc_creds.h b/proxy/src/gp_rpc_creds.h
index 54fe482..c116e53 100644
--- a/proxy/src/gp_rpc_creds.h
+++ b/proxy/src/gp_rpc_creds.h
@@ -34,7 +34,8 @@ uint32_t gp_add_krb5_creds(uint32_t *min,
uint32_t gp_cred_allowed(uint32_t *min,
struct gp_call_ctx *gpcall,
- gss_cred_id_t cred);
+ gss_cred_id_t cred,
+ gss_name_t target_name);
void gp_filter_flags(struct gp_call_ctx *gpcall, uint32_t *flags);
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
index 767a3ff..413e2ec 100644
--- a/proxy/src/gp_rpc_init_sec_context.c
+++ b/proxy/src/gp_rpc_init_sec_context.c
@@ -108,7 +108,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
}
}
- ret_maj = gp_cred_allowed(&ret_min, gpcall, ich);
+ ret_maj = gp_cred_allowed(&ret_min, gpcall, ich, target_name);
if (ret_maj) {
goto done;
}
diff --git a/proxy/tests/t_impersonate.py b/proxy/tests/t_impersonate.py
index 3e25962..29f9a41 100755
--- a/proxy/tests/t_impersonate.py
+++ b/proxy/tests/t_impersonate.py
@@ -34,19 +34,20 @@ IMPERSONATE_CONF_TEMPLATE = '''
'''
-def run_cmd(testdir, env, conf, name, socket, cmd, expected_failure):
+def run_cmd(testdir, env, conf, name, socket, cmd, keytab, expected_failure):
logfile = conf['logfile']
testenv = env.copy()
testenv.update({'KRB5CCNAME': os.path.join(testdir, 't' + conf['prefix'] +
'_impersonate.ccache'),
- 'KRB5_KTNAME': os.path.join(testdir, PROXY_KTNAME),
+ 'KRB5_KTNAME': os.path.join(testdir, keytab),
'KRB5_TRACE': os.path.join(testdir, 't' + conf['prefix'] +
'_impersonate.trace'),
'GSS_USE_PROXY': 'yes',
'GSSPROXY_SOCKET': socket,
'GSSPROXY_BEHAVIOR': 'REMOTE_FIRST'})
+ print("\nTesting: [%s]" % (name,), file=logfile)
print("[COMMAND]\n%s\n[ENVIRONMENT]\n%s\n" % (cmd, testenv), file=logfile)
logfile.flush()
@@ -74,45 +75,59 @@ def run(testdir, env, conf):
rets = []
# Test all permitted
+ msg = "Impersonate"
socket = os.path.join(testdir, 'impersonate.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache']
- r = run_cmd(testdir, env, conf, "Impersonate", socket, cmd, False)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
rets.append(r)
- #Test fail
+ #Test self fail
+ msg = "Impersonate fail self"
socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache']
- r = run_cmd(testdir, env, conf, "Impersonate fail self", socket, cmd, True)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
rets.append(r)
- #Test fail
+ #Test proxy fail
+ msg = "Impersonate fail proxy"
socket = os.path.join(testdir, 'impersonate-selfonly.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache']
- r = run_cmd(testdir, env, conf, "Impersonate fail proxy", socket, cmd, True)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
rets.append(r)
#Test s4u2self half succeed
+ msg = "s4u2self delegation"
socket = os.path.join(testdir, 'impersonate-selfonly.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache', 's4u2self']
- r = run_cmd(testdir, env, conf, "s4u2self delegation", socket, cmd, False)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
+ rets.append(r)
+
+ #Test proxy to self succeed
+ msg = "Impersonate to self"
+ socket = os.path.join(testdir, 'impersonate-selfonly.socket')
+ cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, HOST_GSS,
+ path_prefix + 'impersonate.cache', 's4u2proxy']
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, SVC_KTNAME, False)
rets.append(r)
#Test s4u2proxy half fail
+ msg = "s4u2proxy fail"
socket = os.path.join(testdir, 'impersonate-selfonly.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache', 's4u2proxy']
- r = run_cmd(testdir, env, conf, "s4u2proxy fail", socket, cmd, True)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
rets.append(r)
#Test s4u2proxy half succeed
+ msg = "s4u2proxy"
socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
path_prefix + 'impersonate.cache', 's4u2proxy']
- r = run_cmd(testdir, env, conf, "s4u2proxy", socket, cmd, False)
+ r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
rets.append(r)
# Reset back gssproxy conf