Blame SOURCES/Allow-connection-to-self-when-impersonator-set.patch

31d59b
From 0e04be2c1398dac40c50910a59157eed0ad5a7e4 Mon Sep 17 00:00:00 2001
31d59b
From: Simo Sorce <simo@redhat.com>
31d59b
Date: Tue, 14 Mar 2017 10:43:17 -0400
31d59b
Subject: [PATCH] Allow connection to self when impersonator set
31d59b
31d59b
If the target of a context establishment is the impersonator itself,
31d59b
then allow it. This kind of context establishment is used by tools like
31d59b
mod_auth_gssapi to be able to inspect the ticket just obtained via
31d59b
impersonation and it is basically a noop as the acceptor and the
31d59b
impersonator are the same entitiy.
31d59b
31d59b
Signed-off-by: Simo Sorce <simo@redhat.com>
31d59b
Reviewed-by: Robbie Harwood <rharwood@redhat.com>
31d59b
Merges: #172
31d59b
(cherry picked from commit eada55e831d12b42d3be3a555ff4e133bed7f594)
31d59b
---
68bf20
 proxy/src/gp_creds.c                | 57 +++++++++++++++++++++++++----
31d59b
 proxy/src/gp_rpc_creds.h            |  3 +-
31d59b
 proxy/src/gp_rpc_init_sec_context.c |  2 +-
68bf20
 proxy/tests/t_impersonate.py        | 35 +++++++++++++-----
31d59b
 4 files changed, 78 insertions(+), 19 deletions(-)
31d59b
31d59b
diff --git a/proxy/src/gp_creds.c b/proxy/src/gp_creds.c
31d59b
index 95a1c48..7d89b06 100644
31d59b
--- a/proxy/src/gp_creds.c
31d59b
+++ b/proxy/src/gp_creds.c
31d59b
@@ -883,7 +883,8 @@ static uint32_t get_impersonator_name(uint32_t *min, gss_cred_id_t cred,
31d59b
         }
31d59b
     } else if (ret_maj == GSS_S_UNAVAILABLE) {
31d59b
         /* Not supported by krb5 library yet, fallback to raw krb5 calls */
31d59b
-        /* TODO: Remove once we set a required dependency on MIT 1.15+ */
31d59b
+        /* TODO: Remove once we set a minimum required dependency on a
31d59b
+         * release that supports this call */
31d59b
         ret_maj = get_impersonator_fallback(&ret_min, cred, impersonator);
31d59b
         if (ret_maj == GSS_S_FAILURE) {
31d59b
             if (ret_min == KRB5_CC_NOTFOUND) {
31d59b
@@ -899,9 +900,47 @@ done:
31d59b
     return ret_maj;
31d59b
 }
31d59b
 
31d59b
+static uint32_t check_impersonator_name(uint32_t *min,
31d59b
+                                        gss_name_t target_name,
31d59b
+                                        const char *impersonator)
31d59b
+{
31d59b
+    gss_name_t canon_name = NULL;
31d59b
+    gss_buffer_desc buf;
31d59b
+    uint32_t ret_maj = 0;
31d59b
+    uint32_t ret_min = 0;
31d59b
+    uint32_t discard;
31d59b
+    bool match;
31d59b
+
31d59b
+    ret_maj = gss_canonicalize_name(&discard, target_name, &gp_mech_krb5,
31d59b
+                                    &canon_name);
31d59b
+    if (ret_maj != GSS_S_COMPLETE) {
31d59b
+        *min = ret_min;
31d59b
+        return ret_maj;
31d59b
+    }
31d59b
+
31d59b
+    ret_maj = gss_display_name(&discard, canon_name, &buf, NULL);
31d59b
+    gss_release_name(&discard, &canon_name);
31d59b
+    if (ret_maj != GSS_S_COMPLETE) {
31d59b
+        *min = ret_min;
31d59b
+        return ret_maj;
31d59b
+    }
31d59b
+
31d59b
+    match = (strncmp(impersonator, buf.value, buf.length) == 0) &&
31d59b
+            (strlen(impersonator) == buf.length);
31d59b
+    gss_release_buffer(&discard, &buf;;
31d59b
+
31d59b
+    *min = 0;
31d59b
+    if (match) {
31d59b
+        return GSS_S_COMPLETE;
31d59b
+    } else {
31d59b
+        return GSS_S_UNAUTHORIZED;
31d59b
+    }
31d59b
+}
31d59b
+
31d59b
 uint32_t gp_cred_allowed(uint32_t *min,
31d59b
                          struct gp_call_ctx *gpcall,
31d59b
-                         gss_cred_id_t cred)
31d59b
+                         gss_cred_id_t cred,
31d59b
+                         gss_name_t target_name)
31d59b
 {
31d59b
     char *impersonator = NULL;
31d59b
     uint32_t ret_maj = 0;
31d59b
@@ -924,11 +963,11 @@ uint32_t gp_cred_allowed(uint32_t *min,
31d59b
     if (ret_maj) goto done;
31d59b
 
31d59b
     /* if we find an impersonator entry we bail as that is not authorized,
31d59b
-     * if it were then gpcall->service->allow_const_deleg would have caused
31d59b
-     * the ealier check to return GSS_S_COMPLETE already */
31d59b
+     * *unless* the target is the impersonator itself! If the operation
31d59b
+     * were authorized then gpcall->service->allow_const_deleg would have
31d59b
+     * caused the ealier check to return GSS_S_COMPLETE already */
31d59b
     if (impersonator != NULL) {
31d59b
-        ret_min = 0;
31d59b
-        ret_maj = GSS_S_UNAUTHORIZED;
31d59b
+        ret_maj = check_impersonator_name(&ret_min, target_name, impersonator);
31d59b
     }
31d59b
 
31d59b
 done:
31d59b
@@ -937,7 +976,11 @@ done:
31d59b
         GPDEBUGN(2, "Unauthorized impersonator credentials detected\n");
31d59b
         break;
31d59b
     case GSS_S_COMPLETE:
31d59b
-        GPDEBUGN(2, "No impersonator credentials detected\n");
31d59b
+        if (impersonator) {
31d59b
+            GPDEBUGN(2, "Credentials allowed for 'self'\n");
31d59b
+        } else {
31d59b
+            GPDEBUGN(2, "No impersonator credentials detected\n");
31d59b
+        }
31d59b
         break;
31d59b
     default:
31d59b
         GPDEBUG("Failure while checking credentials\n");
31d59b
diff --git a/proxy/src/gp_rpc_creds.h b/proxy/src/gp_rpc_creds.h
31d59b
index 54fe482..c116e53 100644
31d59b
--- a/proxy/src/gp_rpc_creds.h
31d59b
+++ b/proxy/src/gp_rpc_creds.h
31d59b
@@ -34,7 +34,8 @@ uint32_t gp_add_krb5_creds(uint32_t *min,
31d59b
 
31d59b
 uint32_t gp_cred_allowed(uint32_t *min,
31d59b
                          struct gp_call_ctx *gpcall,
31d59b
-                         gss_cred_id_t cred);
31d59b
+                         gss_cred_id_t cred,
31d59b
+                         gss_name_t target_name);
31d59b
 
31d59b
 void gp_filter_flags(struct gp_call_ctx *gpcall, uint32_t *flags);
31d59b
 
31d59b
diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c
31d59b
index 767a3ff..413e2ec 100644
31d59b
--- a/proxy/src/gp_rpc_init_sec_context.c
31d59b
+++ b/proxy/src/gp_rpc_init_sec_context.c
31d59b
@@ -108,7 +108,7 @@ int gp_init_sec_context(struct gp_call_ctx *gpcall,
31d59b
         }
31d59b
     }
31d59b
 
31d59b
-    ret_maj = gp_cred_allowed(&ret_min, gpcall, ich);
31d59b
+    ret_maj = gp_cred_allowed(&ret_min, gpcall, ich, target_name);
31d59b
     if (ret_maj) {
31d59b
         goto done;
31d59b
     }
31d59b
diff --git a/proxy/tests/t_impersonate.py b/proxy/tests/t_impersonate.py
31d59b
index 3e25962..29f9a41 100755
31d59b
--- a/proxy/tests/t_impersonate.py
31d59b
+++ b/proxy/tests/t_impersonate.py
31d59b
@@ -34,19 +34,20 @@ IMPERSONATE_CONF_TEMPLATE = '''
31d59b
 
31d59b
 '''
31d59b
 
31d59b
-def run_cmd(testdir, env, conf, name, socket, cmd, expected_failure):
31d59b
+def run_cmd(testdir, env, conf, name, socket, cmd, keytab, expected_failure):
31d59b
 
31d59b
     logfile = conf['logfile']
31d59b
     testenv = env.copy()
31d59b
     testenv.update({'KRB5CCNAME': os.path.join(testdir, 't' + conf['prefix'] +
31d59b
                                                '_impersonate.ccache'),
31d59b
-                    'KRB5_KTNAME': os.path.join(testdir, PROXY_KTNAME),
31d59b
+                    'KRB5_KTNAME': os.path.join(testdir, keytab),
31d59b
                     'KRB5_TRACE': os.path.join(testdir, 't' + conf['prefix'] +
31d59b
                                                '_impersonate.trace'),
31d59b
                     'GSS_USE_PROXY': 'yes',
31d59b
                     'GSSPROXY_SOCKET': socket,
31d59b
                     'GSSPROXY_BEHAVIOR': 'REMOTE_FIRST'})
31d59b
 
31d59b
+    print("\nTesting: [%s]" % (name,), file=logfile)
31d59b
     print("[COMMAND]\n%s\n[ENVIRONMENT]\n%s\n" % (cmd, testenv), file=logfile)
31d59b
     logfile.flush()
31d59b
 
31d59b
@@ -74,45 +75,59 @@ def run(testdir, env, conf):
31d59b
     rets = []
31d59b
 
31d59b
     # Test all permitted
31d59b
+    msg = "Impersonate"
31d59b
     socket = os.path.join(testdir, 'impersonate.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache']
31d59b
-    r = run_cmd(testdir, env, conf, "Impersonate", socket, cmd, False)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
31d59b
     rets.append(r)
31d59b
 
31d59b
-    #Test fail
31d59b
+    #Test self fail
31d59b
+    msg = "Impersonate fail self"
31d59b
     socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache']
31d59b
-    r = run_cmd(testdir, env, conf, "Impersonate fail self", socket, cmd, True)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
31d59b
     rets.append(r)
31d59b
 
31d59b
-    #Test fail
31d59b
+    #Test proxy fail
31d59b
+    msg = "Impersonate fail proxy"
31d59b
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache']
31d59b
-    r = run_cmd(testdir, env, conf, "Impersonate fail proxy", socket, cmd, True)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
31d59b
     rets.append(r)
31d59b
 
31d59b
     #Test s4u2self half succeed
31d59b
+    msg = "s4u2self delegation"
31d59b
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache', 's4u2self']
31d59b
-    r = run_cmd(testdir, env, conf, "s4u2self delegation", socket, cmd, False)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
31d59b
+    rets.append(r)
31d59b
+
31d59b
+    #Test proxy to self succeed
31d59b
+    msg = "Impersonate to self"
31d59b
+    socket = os.path.join(testdir, 'impersonate-selfonly.socket')
31d59b
+    cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, HOST_GSS,
31d59b
+           path_prefix + 'impersonate.cache', 's4u2proxy']
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, SVC_KTNAME, False)
31d59b
     rets.append(r)
31d59b
 
31d59b
     #Test s4u2proxy half fail
31d59b
+    msg = "s4u2proxy fail"
31d59b
     socket = os.path.join(testdir, 'impersonate-selfonly.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache', 's4u2proxy']
31d59b
-    r = run_cmd(testdir, env, conf, "s4u2proxy fail", socket, cmd, True)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, True)
31d59b
     rets.append(r)
31d59b
 
31d59b
     #Test s4u2proxy half succeed
31d59b
+    msg = "s4u2proxy"
31d59b
     socket = os.path.join(testdir, 'impersonate-proxyonly.socket')
31d59b
     cmd = ["./tests/t_impersonate", USR_NAME, HOST_GSS, PROXY_GSS,
31d59b
            path_prefix + 'impersonate.cache', 's4u2proxy']
31d59b
-    r = run_cmd(testdir, env, conf, "s4u2proxy", socket, cmd, False)
31d59b
+    r = run_cmd(testdir, env, conf, msg, socket, cmd, PROXY_KTNAME, False)
31d59b
     rets.append(r)
31d59b
 
31d59b
     # Reset back gssproxy conf