[30363] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.15]: Don't rely on default realm in S4U2Self
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Oct 30 12:28:36 2018
Date: Tue, 30 Oct 2018 12:27:46 -0400
From: Greg Hudson <ghudson@mit.edu>
Message-Id: <201810301627.w9UGRkEk012026@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/505622085c5487bfbae0ca3dde47af9add9781bb
commit 505622085c5487bfbae0ca3dde47af9add9781bb
Author: Isaac Boukris <iboukris@gmail.com>
Date: Sat Sep 15 10:28:48 2018 +0300
Don't rely on default realm in S4U2Self client
When converting server principal to enterprise name (to be possibly
used for cross-realm), ignore the realm when reparsing, to avoid a
spurious error if a default realm isn't configured.
[ghudson@mit.edu: added rewritten test case; edited commit message]
(cherry picked from commit 13967567ca65a306c2d5fcb4a4aff71fb422cd80)
ticket: 8741
version_fixed: 1.15.4
src/lib/krb5/krb/s4u_creds.c | 4 +++-
src/tests/gssapi/t_s4u.py | 6 +++++-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
index ed05b67..91c02aa 100644
--- a/src/lib/krb5/krb/s4u_creds.c
+++ b/src/lib/krb5/krb/s4u_creds.c
@@ -452,7 +452,9 @@ convert_to_enterprise(krb5_context context, krb5_principal princ,
code = krb5_unparse_name(context, princ, &str);
if (code != 0)
return code;
- code = krb5_parse_name_flags(context, str, KRB5_PRINCIPAL_PARSE_ENTERPRISE,
+ code = krb5_parse_name_flags(context, str,
+ KRB5_PRINCIPAL_PARSE_ENTERPRISE |
+ KRB5_PRINCIPAL_PARSE_IGNORE_REALM,
eprinc_out);
krb5_free_unparsed_name(context, str);
return code;
diff --git a/src/tests/gssapi/t_s4u.py b/src/tests/gssapi/t_s4u.py
index 7366e39..07e6d5a 100755
--- a/src/tests/gssapi/t_s4u.py
+++ b/src/tests/gssapi/t_s4u.py
@@ -146,9 +146,13 @@ realm.stop()
# Exercise cross-realm S4U2Self. The query in the foreign realm will
# fail, but we can check that the right server principal was used.
+# Include a regression test for #8741 by unsetting the default realm.
r1, r2 = cross_realms(2, create_user=False)
r1.run([kinit, '-k', r1.host_princ])
-out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1)
+remove_default = {'libdefaults': {'default_realm': None}}
+no_default = r1.special_env('no_default', False, krb5_conf=remove_default)
+out = r1.run(['./t_s4u', 'p:' + r2.host_princ], expected_code=1,
+ env=no_default)
if 'Server not found in Kerberos database' not in out:
fail('cross-realm s4u2self (t_s4u output)')
r1.stop()
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
