You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
121 lines
4.4 KiB
121 lines
4.4 KiB
From 044f2224ca5c86b51b2f2ce2878ede9e236e41d3 Mon Sep 17 00:00:00 2001 |
|
From: Robbie Harwood <rharwood@redhat.com> |
|
Date: Fri, 15 Sep 2017 18:07:28 -0400 |
|
Subject: [PATCH] Handle outdated encrypted ccaches |
|
|
|
When the encrypting keytab changes, all credentials that it was used |
|
to encrypt must be re-created. Otherwise, we log obtuse messages and |
|
fail to do what the user wants. |
|
|
|
Signed-off-by: Robbie Harwood <rharwood@redhat.com> |
|
Reviewed-by: Simo Sorce <simo@redhat.com> |
|
Merges: #214 |
|
(cherry picked from commit 657d3c8339309dd8e2bfa4ee10f005e0f0c055e8) |
|
--- |
|
proxy/src/gp_export.c | 11 ++++++----- |
|
proxy/src/gp_rpc_accept_sec_context.c | 28 ++++++++++++++++++++++++++++ |
|
proxy/src/gp_rpc_init_sec_context.c | 2 +- |
|
3 files changed, 35 insertions(+), 6 deletions(-) |
|
|
|
diff --git a/proxy/src/gp_export.c b/proxy/src/gp_export.c |
|
index ab08bb7..0c39045 100644 |
|
--- a/proxy/src/gp_export.c |
|
+++ b/proxy/src/gp_export.c |
|
@@ -268,7 +268,7 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key, |
|
&enc_handle, |
|
&data_out); |
|
if (ret) { |
|
- return EINVAL; |
|
+ return ret; |
|
} |
|
|
|
*len = data_out.length; |
|
@@ -446,8 +446,8 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx *gpcall, |
|
{ |
|
gss_buffer_desc token = GSS_C_EMPTY_BUFFER; |
|
struct gp_creds_handle *handle = NULL; |
|
- uint32_t ret_maj; |
|
- uint32_t ret_min; |
|
+ uint32_t ret_maj = GSS_S_COMPLETE; |
|
+ uint32_t ret_min = 0; |
|
int ret; |
|
|
|
handle = gp_service_get_creds_handle(gpcall->service); |
|
@@ -469,8 +469,9 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx *gpcall, |
|
&cred->cred_handle_reference, |
|
&token.length, token.value); |
|
if (ret) { |
|
- ret_maj = GSS_S_FAILURE; |
|
- ret_min = ENOENT; |
|
+ /* Allow for re-issuance of the keytab. */ |
|
+ GPDEBUG("Stored ccache failed to decrypt; treating as empty\n"); |
|
+ *out = GSS_C_NO_CREDENTIAL; |
|
goto done; |
|
} |
|
|
|
diff --git a/proxy/src/gp_rpc_accept_sec_context.c b/proxy/src/gp_rpc_accept_sec_context.c |
|
index ae4de55..2cdc94b 100644 |
|
--- a/proxy/src/gp_rpc_accept_sec_context.c |
|
+++ b/proxy/src/gp_rpc_accept_sec_context.c |
|
@@ -25,6 +25,13 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall, |
|
int exp_creds_type; |
|
uint32_t acpt_maj; |
|
uint32_t acpt_min; |
|
+ struct gp_cred_check_handle gcch = { |
|
+ .ctx = gpcall, |
|
+ .options.options_len = arg->accept_sec_context.options.options_len, |
|
+ .options.options_val = arg->accept_sec_context.options.options_val, |
|
+ }; |
|
+ uint32_t gccn_before = 0; |
|
+ uint32_t gccn_after = 0; |
|
int ret; |
|
|
|
asca = &arg->accept_sec_context; |
|
@@ -52,6 +59,8 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall, |
|
if (ret_maj) { |
|
goto done; |
|
} |
|
+ |
|
+ gccn_before = gp_check_sync_creds(&gcch, ach); |
|
} |
|
|
|
if (ach == GSS_C_NO_CREDENTIAL) { |
|
@@ -146,6 +155,25 @@ int gp_accept_sec_context(struct gp_call_ctx *gpcall, |
|
src_name, oid, |
|
&ascr->options.options_len, |
|
&ascr->options.options_val); |
|
+ if (ret_maj) { |
|
+ goto done; |
|
+ } |
|
+ |
|
+ gccn_after = gp_check_sync_creds(&gcch, ach); |
|
+ |
|
+ if (gccn_before != gccn_after) { |
|
+ /* export creds back to client for sync up */ |
|
+ ret_maj = gp_export_sync_creds(&ret_min, gpcall, &ach, |
|
+ &ascr->options.options_val, |
|
+ &ascr->options.options_len); |
|
+ if (ret_maj) { |
|
+ /* not fatal, log and continue */ |
|
+ GPDEBUG("Failed to export sync creds (%d: %d)", |
|
+ (int)ret_maj, (int)ret_min); |
|
+ } |
|
+ } |
|
+ |
|
+ ret_maj = GSS_S_COMPLETE; |
|
|
|
done: |
|
if (ret_maj == GSS_S_COMPLETE) { |
|
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c |
|
index e4af495..f362dbc 100644 |
|
--- a/proxy/src/gp_rpc_init_sec_context.c |
|
+++ b/proxy/src/gp_rpc_init_sec_context.c |
|
@@ -91,7 +91,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall, |
|
gp_conv_gssx_to_buffer(isca->input_token, &ibuf); |
|
} |
|
|
|
- if (!isca->cred_handle) { |
|
+ if (!ich) { |
|
if (gss_oid_equal(mech_type, gss_mech_krb5)) { |
|
ret_maj = gp_add_krb5_creds(&ret_min, gpcall, |
|
ACQ_NORMAL, NULL, NULL,
|
|
|