Attachment 3487 Details for Bug 5614 – Adds support to cifs.upcall for spnego MS_KRB5 wrapping

[patch] Adds support to cifs.upcall for spnego MS_KRB5 wrapping

0001-Adds-support-to-cifs.upcall-for.patch (text/plain), 4.35 KB, created by Igor Mammedov on 2008-08-18 09:17:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Igor Mammedov

Created: 2008-08-18 09:17:01 UTC

Size: 4.35 KB

patch

obsolete

>From 992fed22dcbc3a21662e735fd299acb8e50556e9 Mon Sep 17 00:00:00 2001
>From: Igor Mammedov <niallain@gmail.com>
>Date: Mon, 18 Aug 2008 17:58:34 +0400
>Subject: [PATCH] Adds support to cifs.upcall for spnego MS_KRB5 wrapping
>
>Signed-off-by: Igor Mammedov <niallain@gmail.com>
>---
> source/client/cifs.upcall.c |   48 ++++++++++++++++++++++++++++++++++--------
> 1 files changed, 39 insertions(+), 9 deletions(-)
>
>diff --git a/source/client/cifs.upcall.c b/source/client/cifs.upcall.c
>index aa5eb57..6cf8bc3 100644
>--- a/source/client/cifs.upcall.c
>+++ b/source/client/cifs.upcall.c
>@@ -29,7 +29,7 @@ create dns_resolver * * /usr/local/sbin/cifs.upcall %k
> 
> #include "cifs_spnego.h"
> 
>-const char *CIFSSPNEGO_VERSION = "1.1";
>+const char *CIFSSPNEGO_VERSION = "1.2";
> static const char *prog = "cifs.upcall";
> typedef enum _secType {
> 	KRB5,
>@@ -73,7 +73,7 @@ int handle_krb5_mech(const char *oid, const char *principal,
> 	tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
> 
> 	/* and wrap that in a shiny SPNEGO wrapper */
>-	*secblob = gen_negTokenInit(OID_KERBEROS5, tkt_wrapped);
>+	*secblob = gen_negTokenInit(oid, tkt_wrapped);
> 
> 	data_blob_free(&tkt_wrapped);
> 	data_blob_free(&tkt);
>@@ -86,20 +86,20 @@ int handle_krb5_mech(const char *oid, const char *principal,
> #define DKD_HAVE_IPV4		8
> #define DKD_HAVE_IPV6		16
> #define DKD_HAVE_UID		32
>-#define DKD_MUSTHAVE_SET (DKD_HAVE_HOSTNAME|DKD_HAVE_VERSION|DKD_HAVE_SEC)
>+#define DKD_HAVE_MIC		64
>+#define DKD_MUSTHAVE_SET (DKD_HAVE_VERSION|DKD_HAVE_SEC)
> 
> int decode_key_description(const char *desc, int *ver, secType_t * sec,
>-			   char **hostname, uid_t * uid)
>+			   char **hostname, char **mic, uid_t * uid)
> {
>+	const char *tkn = desc;
> 	int retval = 0;
> 	char *pos;
>-	const char *tkn = desc;
>+	int len;
> 
> 	do {
> 		pos = index(tkn, ';');
> 		if (strncmp(tkn, "host=", 5) == 0) {
>-			int len;
>-
> 			if (pos == NULL) {
> 				len = strlen(tkn);
> 			} else {
>@@ -110,6 +110,17 @@ int decode_key_description(const char *desc, int *ver, secType_t * sec,
> 			*hostname = SMB_XMALLOC_ARRAY(char, len);
> 			strlcpy(*hostname, tkn + 5, len);
> 			retval |= DKD_HAVE_HOSTNAME;
>+		} else if (strncmp(tkn, "mic=", 4) == 0) {
>+			if (pos == NULL) {
>+				len = strlen(tkn);
>+			} else {
>+				len = pos - tkn;
>+			}
>+			len -= 3;
>+			SAFE_FREE(*mic);
>+			*mic = SMB_XMALLOC_ARRAY(char, len);
>+			strlcpy(*mic, tkn + 4, len);
>+			retval |= DKD_HAVE_MIC;
> 		} else if (strncmp(tkn, "ipv4=", 5) == 0) {
> 			/* BB: do we need it if we have hostname already? */
> 		} else if (strncmp(tkn, "ipv6=", 5) == 0) {
>@@ -118,6 +129,9 @@ int decode_key_description(const char *desc, int *ver, secType_t * sec,
> 			if (strncmp(tkn + 4, "krb5", 4) == 0) {
> 				retval |= DKD_HAVE_SEC;
> 				*sec = KRB5;
>+			} else if (strncmp(tkn + 4, "mskrb5", 6) == 0) {
>+				retval |= DKD_HAVE_SEC;
>+				*sec = MS_KRB5;
> 			}
> 		} else if (strncmp(tkn, "uid=", 4) == 0) {
> 			errno = 0;
>@@ -219,7 +233,7 @@ int main(const int argc, char *const argv[])
> 	uid_t uid;
> 	int kernel_upcall_version;
> 	int c, use_cifs_service_prefix = 0;
>-	char *buf, *hostname = NULL;
>+	char *buf, *hostname = NULL, *mic = NULL;
> 
> 	openlog(prog, 0, LOG_DAEMON);
> 
>@@ -270,7 +284,7 @@ int main(const int argc, char *const argv[])
> 	}
> 
> 	rc = decode_key_description(buf, &kernel_upcall_version, &sectype,
>-				    &hostname, &uid);
>+				    &hostname, &mic, &uid);
> 	if ((rc & DKD_MUSTHAVE_SET) != DKD_MUSTHAVE_SET) {
> 		syslog(LOG_WARNING,
> 		       "unable to get from description necessary params");
>@@ -280,6 +294,16 @@ int main(const int argc, char *const argv[])
> 	}
> 	SAFE_FREE(buf);
> 
>+	if (sectype == MS_KRB5 && !(rc & DKD_HAVE_MIC)) {
>+		syslog(LOG_ERR, "mskrb5 requires missing mic option");
>+		goto out;
>+	}
>+
>+	if (sectype == KRB5 && !(rc & DKD_HAVE_HOSTNAME)) {
>+		syslog(LOG_ERR, "krb5 requires missing host option");
>+		goto out;
>+	}
>+
> 	if (kernel_upcall_version != CIFS_SPNEGO_UPCALL_VERSION) {
> 		syslog(LOG_WARNING,
> 		       "incompatible kernel upcall version: 0x%x",
>@@ -301,6 +325,11 @@ int main(const int argc, char *const argv[])
> 
> 	// do mech specific authorization
> 	switch (sectype) {
>+	case MS_KRB5:{
>+			rc = handle_krb5_mech(OID_KERBEROS5_OLD, mic,
>+					&secblob, &sess_key);
>+			break;
>+		     }
> 	case KRB5:{
> 			char *princ;
> 			size_t len;
>@@ -373,6 +402,7 @@ out:
> 	data_blob_free(&secblob);
> 	data_blob_free(&sess_key);
> 	SAFE_FREE(hostname);
>+	SAFE_FREE(mic);
> 	SAFE_FREE(keydata);
> 	return rc;
> }
>-- 
>1.5.3.7
>

Actions: View

Attachments on bug 5614: 3408 | 3409 | 3411 | 3414 | 3418 | 3450 | 3483 | 3484 | 3487