[31565] in CVS-changelog-for-Kerberos-V5
krb5 commit: Relax gss_init_sec_context() proxy self check
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Aug 17 17:01:57 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260817210151.9AA7E10559A@krbdev.mit.edu>
Date: Mon, 17 Aug 2026 17:01:51 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/473b51b640bef2e97c490d6f2985658befa89c16
commit 473b51b640bef2e97c490d6f2985658befa89c16
Author: Alexander Bokovoy <abokovoy@redhat.com>
Date: Fri Mar 27 13:48:59 2026 +0200
Relax gss_init_sec_context() proxy self check
If the krb5 gss_init_sec_context() detects a proxy ccache, we check in
get_credentials() whether the requested server principal matches the
cache's impersonator principal. For a host-based server name, this
match will fail if krb5_sname_to_principal() yielded an empty realm,
as it does in most configurations.
As host-based principals generally only exist in one realm for a given
FQDN, we can ignore the realm for this comparison when the server name
is host-based.
[ghudson@mit.edu: rewrote comment and commit message; adjusted code to
use krb5_principal_compare_flags()]
ticket: 9225 (new)
src/lib/gssapi/krb5/init_sec_context.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c
index 27011d0c9..208d4eefd 100644
--- a/src/lib/gssapi/krb5/init_sec_context.c
+++ b/src/lib/gssapi/krb5/init_sec_context.c
@@ -124,7 +124,7 @@ get_credentials(krb5_context context, krb5_gss_cred_id_t cred,
{
krb5_error_code code;
krb5_creds in_creds, evidence_creds, mcreds, *result_creds = NULL;
- krb5_flags flags = 0;
+ krb5_flags flags = 0, cmpflag = 0;
krb5_principal_data server_data;
*out_creds = NULL;
@@ -163,10 +163,17 @@ get_credentials(krb5_context context, krb5_gss_cred_id_t cred,
/* Try constrained delegation if we have proxy credentials. */
if (cred->impersonator != NULL) {
- /* If we are trying to get a ticket to ourselves, we should use the
- * the evidence ticket directly from cache. */
- if (krb5_principal_compare(context, cred->impersonator,
- server->princ)) {
+ /*
+ * If we are trying to get a ticket to the impersonator, we should use
+ * the the evidence ticket directly from the cache. If the server name
+ * is host-based, ignore the realm for this comparison;
+ * krb5_sname_to_principal() probably yielded an empty realm, and
+ * host-based principals generally only exist in one realm.
+ */
+ if (server->princ->type == KRB5_NT_SRV_HST)
+ cmpflag = KRB5_PRINCIPAL_COMPARE_IGNORE_REALM;
+ if (krb5_principal_compare_flags(context, cred->impersonator,
+ server->princ, cmpflag)) {
flags |= KRB5_GC_CACHED;
} else {
memset(&mcreds, 0, sizeof(mcreds));
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
