[19219] in Kerberos_V5_Development
Ticket #8152 gss_acquire_cred_with_password() ignores expired creds
daemon@ATHENA.MIT.EDU (Sorin Manolache)
Sat Jun 20 13:39:00 2015
Message-ID: <5585A520.3060707@gmail.com>
Date: Sat, 20 Jun 2015 19:38:40 +0200
From: Sorin Manolache <sorinm@gmail.com>
MIME-Version: 1.0
To: Greg Hudson <ghudson@mit.edu>, krbdev@mit.edu
In-Reply-To: <55848B1C.6060101@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 2015-06-19 23:35, Greg Hudson wrote:
> On 06/18/2015 12:13 PM, Sorin Manolache wrote:
>> I think I've found a memory leak in gss_add_cred_with_password, in krb5
>> 1.12.1 and 1.13.1.
>>
>> The gss_OID_set target_mechs in gss_add_cred_with_password
>> (lib/gssapi/mechglue/g_acquire_cred_with_pw.c) is not released if the
>> function returns GSS_S_COMPLETE.
>
> Thanks; I have filed a pull request. This should be fixed in 1.13.3 and
> probably also a 1.12.x patch release.
>
> Be aware that we are planning to change the behavior of
> gss_acquire_cred_with_password in 1.14 as discussed here:
>
> http://krbdev.mit.edu/rt/Ticket/Display.html?id=8152
>
Hello,
Thank you for the information. However I didn't get how you intend to
change the behaviour.
The ticket mentions checking with Heimdal. Here's what I could
understand from the Heimdal code:
It traverses all caches (krb5_cc_cache_match) in order to match the
principal.
if found => link the found cache to the cred
If not found => checks if the principal of the dflt cache matches
if not => fetch creds from KDC, create a new unique memory cache,
store the creds there, link the new cache to the gss_cred structure. The
destroy_cache_on_release flag is set on the gss_cred structure.
if yes => link the dflt cache to the cred.
So newly fetched creds are not stored in the default cache. They are
stored in a new memory cache that is destroyed when the gss_cred_id_t is
released.
Because the newly created cache is destroyed when the gss_cred is
released, a new invocation of gss_acquire_cred_with_password will fetch
the credentials again from the KDC.
One would benefit of the cache only if the principal of the default
cache matches the principal of the gss_acquire_cred_with_password.
Heimdal does not fetch new credentials from the KDC when the cache
contains expired credentials.
Regards,
Sorin
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
