[16696] in Kerberos-V5-bugs
[krbdev.mit.edu #8971] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Fri Jan 8 12:53:43 2021
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.4-86063-1610128395-1173.8971-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #8971":;
Date: Fri, 08 Jan 2021 12:53:16 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8971 >
Implement fallback for GSS acceptor names
Commit 3fcc365a6f049730b3f47168f7112c03997c5c0b added fallback support
to krb5_rd_req(), but acquiring acceptor creds for a host-based name
could still fail within check_keytab() in the krb5 mech.
Add an internal libkrb5 API k5_kt_have_match() to check for a matching
keytab entry with canonicalization, and use it in check_keytab(). Add
a library-internal function k5_sname_wildcard_host() to share logic
between rd_req and k5_kt_have_match().
(cherry picked from commit 7e0a2a7a3a76205ebd7192f06a99f23bad8dc5bd)
https://github.com/krb5/krb5/commit/196be3c474881dcaf76332375c1dffbd3a9140f6
Author: Greg Hudson <ghudson@mit.edu>
Commit: 196be3c474881dcaf76332375c1dffbd3a9140f6
Branch: krb5-1.19
src/include/k5-int.h | 3 ++
src/lib/gssapi/krb5/acquire_cred.c | 18 +-----------
src/lib/krb5/keytab/ktfns.c | 49 ++++++++++++++++++++++++++++++++++++
src/lib/krb5/krb/int-proto.h | 5 +++
src/lib/krb5/krb/rd_req_dec.c | 6 +---
src/lib/krb5/krb/sname_match.c | 13 +++++++++
src/lib/krb5/libkrb5.exports | 1 +
src/lib/krb5_32.def | 1 +
src/tests/gssapi/t_gssapi.py | 24 +++++++++++++++++-
9 files changed, 99 insertions(+), 21 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
