base/SOURCES/Allow-connection-to-self-when-impersonator-set.patch

From 0e04be2c1398dac40c50910a59157eed0ad5a7e4 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Tue, 14 Mar 2017 10:43:17 -0400
Subject: [PATCH] Allow connection to self when impersonator set

If the target of a context establishment is the impersonator itself,
then allow it. This kind of context establishment is used by tools like
mod_auth_gssapi to be able to inspect the ticket just obtained via
impersonation and it is basically a noop as the acceptor and the
impersonator are the same entitiy.

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Robbie Harwood <rharwood@redhat.com>
Merges: #172
(cherry picked from commit eada55e831d12b42d3be3a555ff4e133bed7f594)
---
 proxy/src/gp_creds.c                | 57 ++++++++++++++++++++++++++++++++-----
 proxy/src/gp_rpc_creds.h            |  3 +-
 proxy/src/gp_rpc_init_sec_context.c |  2 +-
 proxy/tests/t_impersonate.py        | 35 ++++++++++++++++-------
 4 files changed, 78 insertions(+), 19 deletions(-)

diff --git a/proxy/src/gp_creds.c b/proxy/src/gp_creds.c
index 95a1c48..7d89b06 100644
--- a/proxy/src/gp_creds.c
+++ b/proxy/src/gp_creds.c
@@ -883,7 +883,8 @@ static uint32_t get_impersonator_name(uint32_t *min, gss_cred_id_t cred,
         }
     } else if (ret_maj == GSS_S_UNAVAILABLE) {
         /* Not supported by krb5 library yet, fallback to raw krb5 calls */
-        /* TODO: Remove once we set a required dependency on MIT 1.15+ */
+        /* TODO: Remove once we set a minimum required dependency on a
+         * release that supports this call */
         ret_maj = get_impersonator_fallback(&ret_min, cred, impersonator);
         if (ret_maj == GSS_S_FAILURE) {
             if (ret_min == KRB5_CC_NOTFOUND) {
@@ -899,9 +900,47 @@ done:
     return ret_maj;
 }
 
+static uint32_t check_impersonator_name(uint32_t *min,
+                                        gss_name_t target_name,
+                                        const char *impersonator)
+{
+    gss_name_t canon_name = NULL;
+    gss_buffer_desc buf;
+    uint32_t ret_maj = 0;
+    uint32_t ret_min = 0;
+    uint32_t discard;
+    bool match;
+
+    ret_maj = gss_canonicalize_name(&discard, target_name, &gp_mech_krb5,
+                                    &canon_name);
+    if (ret_maj != GSS_S_COMPLETE) {
+        *min = ret_min;
+        return ret_maj;
+    }
+
+    ret_maj = gss_display_name(&discard, canon_name, &buf, NULL);
+    gss_release_name(&discard, &canon_name);
+    if (ret_maj != GSS_S_COMPLETE) {
+        *min = ret_min;
+        return ret_maj;
+    }
+
+    match = (strncmp(impersonator, buf.value, buf.length) == 0) &&
+            (strlen(impersonator) == buf.length);
+    gss_release_buffer(&discard, &buf);
+
+    *min = 0;
+    if (match) {
+        return GSS_S_COMPLETE;
+    } else {
+        return GSS_S_UNAUTHORIZED;
+    }
+}
+
 uint32_t gp_cred_allowed(uint32_t *min,
                          struct gp_call_ctx *gpcall,
-                         gss_cred_id_t cred)
+                         gss_cred_id_t cred,
+                         gss_name_t target_name)
 {
     char *impersonator = NULL;
     uint32_t ret_maj = 0;
@@ -924,11 +963,11 @@ uint32_t gp_cred_allowed(uint32_t *min,
     if (ret_maj) goto done;
 
     /* if we find an impersonator entry we bail as that is not authorized,
-     * if it were then gpcall->service->allow_const_deleg would have caused
-     * the ealier check to return GSS_S_COMPLETE already */
+     * *unless* the target is the impersonator itself! If the operation
+     * were authorized then gpcall->service->allow_const_deleg would have
+     * caused the ealier check to return GSS_S_COMPLETE already */
     if (impersonator != NULL) {
-        ret_min = 0;
-        ret_maj = GSS_S_UNAUTHORIZED;
+        ret_maj = check_impersonator_name(&ret_min, target_name, impersonator);
     }
 
 done:
@@ -937,7 +976,11 @@ done:
         GPDEBUGN(2, "Unauthorized impersonator credentials detected\n");
         break;
     case GSS_S_COMPLETE:
-        GPDEBUGN(2, "No impersonator credentials detected\n");
+        if (impersonator) {
+            GPDEBUGN(2, "Credentials allowed for 'self'\n");
+        } else {
+            GPDEBUGN(2, "No impersonator credentials detected\n");
+        }
         break;
     default:
         GPDEBUG("Failure while checking credentials\n");
diff --git a/proxy/src/gp_rpc_creds.h b/proxy/src/gp_rpc_creds.h
index 54fe482..c116e53 100644
--- a/proxy/src/gp_rpc_creds.h
+++ b/proxy/src/gp_rpc_creds.h
@@ -34,7 +34,8 @@ uint32_t gp_add_krb5_creds(uint32_t *min,
 
 uint32_t gp_cred_allowed(uint32_t *min,
                          struct gp_call_ctx *gpcall,
-                         gss_cred_id_t cred);
+                         gss_cred_id_t cred,
+                         gss_name_t target_name);
 
 void gp_filter_flags(struct gp_call_ctx *gpcall, uint32_t *flags);
 
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
index 767a3ff..413e2ec 100644
--- a/proxy/src/gp_rpc_init_sec_context.c
+++ b/proxy/src/gp_rpc_init_sec_context.c
@@ -108,7 +108,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
         }
     }
 
-    ret_maj = gp_cred_allowed(&ret_min, gpcall, ich);
+    ret_maj = gp_cred_allowed(&ret_min, gpcall, ich, target_name);
     if (ret_maj) {
         goto done;
     }
diff --git a/proxy/tests/t_impersonate.py b/proxy/tests/t_impersonate.py
index 3e25962..29f9a41 100755
--- a/proxy/tests/t_impersonate.py
+++ b/proxy/tests/t_impersonate.py
@@ -34,19 +34,20 @@ IMPERSONATE_CONF_TEMPLATE = '''
 
 '''
 
-def run_cmd(testdir, env, conf, name, socket, cmd, expected_failure):
+def run_cmd(testdir, env, conf, name, socket, cmd, keytab, expected_failure):
 
     logfile = conf['logfile']
     testenv = env.copy()
     testenv.update({'KRB5CCNAME': os.path.join(testdir, 't' + conf['prefix'] +
                                                '_impersonate.ccache'),
-                    'KRB5_KTNAME': os.path.join(testdir, PROXY_KTNAME),
+                    'KRB5_KTNAME': os.path.join(testdir, keytab),
                     'KRB5_TRACE': os.path.join(testdir, 't' + conf['prefix'] +
                                                '_impersonate.trace'),
                     'GSS_USE_PROXY': 'yes',
                     'GSSPROXY_SOCKET': socket,
                     'GSSPROXY_BEHAVIOR': 'REMOTE_FIRST'})
 
+    print("\nTesting: [%s]" % (name,), file=logfile)
     print("[COMMAND]\n%s\n[ENVIRONMENT]\n%s\n" % (cmd, testenv), file=logfile)
     logfile.flush()
 
@@ -74,45 +75,59 @@ def run(testdir, env, conf):
     rets = []
 
     # Test all permitted
+    msg = "Impersonate"
     socket = os.path.join(testdir, 'impersonate.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache']
-    r = run_cmd(testdir, env, conf, "Impersonate", socket, cmd, False)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
     rets.append(r)
 
-    #Test fail
+    #Test self fail
+    msg = "Impersonate fail self"
     socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache']
-    r = run_cmd(testdir, env, conf, "Impersonate fail self", socket, cmd, True)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
     rets.append(r)
 
-    #Test fail
+    #Test proxy fail
+    msg = "Impersonate fail proxy"
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache']
-    r = run_cmd(testdir, env, conf, "Impersonate fail proxy", socket, cmd, True)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
     rets.append(r)
 
     #Test s4u2self half succeed
+    msg = "s4u2self delegation"
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache', 's4u2self']
-    r = run_cmd(testdir, env, conf, "s4u2self delegation", socket, cmd, False)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
+    rets.append(r)
+
+    #Test proxy to self succeed
+    msg = "Impersonate to self"
+    socket = os.path.join(testdir, 'impersonate-selfonly.socket')
+    cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, HOST_GSS,
+           path_prefix + 'impersonate.cache', 's4u2proxy']
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, SVC_KTNAME, False)
     rets.append(r)
 
     #Test s4u2proxy half fail
+    msg = "s4u2proxy fail"
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache', 's4u2proxy']
-    r = run_cmd(testdir, env, conf, "s4u2proxy fail", socket, cmd, True)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
     rets.append(r)
 
     #Test s4u2proxy half succeed
+    msg = "s4u2proxy"
     socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
            path_prefix + 'impersonate.cache', 's4u2proxy']
-    r = run_cmd(testdir, env, conf, "s4u2proxy", socket, cmd, False)
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
     rets.append(r)
 
     # Reset back gssproxy conf