From 436cf4c15b7659b21205affd6743aa6159c55b5c Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Wed, 28 Aug 2019 14:22:49 +0200

Subject: [PATCH 54/55] KCM: Allow modifications of ccache's principal

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Related:

https://pagure.io/SSSD/sssd/issue/4017

This patch will be useful to fix credential delegation.

Reviewed-by: Michal Židek <mzidek@redhat.com>

---

 src/responder/kcm/kcmsrv_ccache.c         | 37 +++++++++++++++++++++--

 src/responder/kcm/kcmsrv_ccache.h         |  5 +--

 src/responder/kcm/kcmsrv_ccache_mem.c     |  8 ++++-

 src/responder/kcm/kcmsrv_ccache_secdb.c   |  8 ++++-

 src/responder/kcm/kcmsrv_ccache_secrets.c |  9 +++++-

 src/responder/kcm/kcmsrv_ops.c            |  4 +--

 6 files changed, 60 insertions(+), 11 deletions(-)

diff --git a/src/responder/kcm/kcmsrv_ccache.c b/src/responder/kcm/kcmsrv_ccache.c

index 085cc4464..e24da9aa2 100644

--- a/src/responder/kcm/kcmsrv_ccache.c

+++ b/src/responder/kcm/kcmsrv_ccache.c

@@ -1089,25 +1089,56 @@ errno_t kcm_ccdb_create_cc_recv(struct tevent_req *req)

     return EOK;

 }

-void kcm_mod_ctx_clear(struct kcm_mod_ctx *mod_ctx)

+static void kcm_mod_ctx_clear(struct kcm_mod_ctx *mod_ctx)

 {

     if (mod_ctx == NULL) {

         return;

     }

     mod_ctx->kdc_offset = INT32_MAX;

+    if (mod_ctx->client != NULL) {

+        krb5_free_principal(NULL, mod_ctx->client);

+        mod_ctx->client = NULL;

+    }

+

+    return;

+}

+

+struct kcm_mod_ctx *kcm_mod_ctx_new(TALLOC_CTX *mem_ctx)

+{

+    struct kcm_mod_ctx *mod_ctx;

+

+    mod_ctx = talloc_zero(mem_ctx, struct kcm_mod_ctx);

+    if (mod_ctx == NULL) {

+        return NULL;

+    }

+

+    kcm_mod_ctx_clear(mod_ctx);

+    return mod_ctx;

 }

-void kcm_mod_cc(struct kcm_ccache *cc, struct kcm_mod_ctx *mod_ctx)

+errno_t kcm_mod_cc(struct kcm_ccache *cc, struct kcm_mod_ctx *mod_ctx)

 {

     if (cc == NULL || mod_ctx == NULL) {

-        return;

+        return EINVAL;

     }

     if (mod_ctx->kdc_offset != INT32_MAX) {

         cc->kdc_offset = mod_ctx->kdc_offset;

     }

+    if (mod_ctx->client != NULL) {

+        krb5_error_code kret;

+

+        kret = krb5_copy_principal(NULL, mod_ctx->client, &cc->client);

+        if (kret != 0) {

+            DEBUG(SSSDBG_OP_FAILURE,

+                "krb5_copy_principal failed: %d\n", kret);

+            return ERR_INTERNAL;

+        }

+    }

+

+    return EOK;

 }

 struct kcm_ccdb_mod_cc_state {

diff --git a/src/responder/kcm/kcmsrv_ccache.h b/src/responder/kcm/kcmsrv_ccache.h

index 199b75b16..220220ca9 100644

--- a/src/responder/kcm/kcmsrv_ccache.h

+++ b/src/responder/kcm/kcmsrv_ccache.h

@@ -257,13 +257,14 @@ errno_t kcm_ccdb_create_cc_recv(struct tevent_req *req);

  */

 struct kcm_mod_ctx {

     int32_t kdc_offset;

+    krb5_principal client;

     /* More settable properties (like name, when we support renames

      * will be added later

      */

 };

-void kcm_mod_ctx_clear(struct kcm_mod_ctx *mod_ctx);

-void kcm_mod_cc(struct kcm_ccache *cc, struct kcm_mod_ctx *mod_ctx);

+struct kcm_mod_ctx *kcm_mod_ctx_new(TALLOC_CTX *mem_ctx);

+errno_t kcm_mod_cc(struct kcm_ccache *cc, struct kcm_mod_ctx *mod_ctx);

 struct tevent_req *kcm_ccdb_mod_cc_send(TALLOC_CTX *mem_ctx,

                                         struct tevent_context *ev,

diff --git a/src/responder/kcm/kcmsrv_ccache_mem.c b/src/responder/kcm/kcmsrv_ccache_mem.c

index 35955b2f4..18c3878ad 100644

--- a/src/responder/kcm/kcmsrv_ccache_mem.c

+++ b/src/responder/kcm/kcmsrv_ccache_mem.c

@@ -676,7 +676,13 @@ static struct tevent_req *ccdb_mem_mod_send(TALLOC_CTX *mem_ctx,

         goto immediate;

     }

-    kcm_mod_cc(ccwrap->cc, mod_cc);

+    ret = kcm_mod_cc(ccwrap->cc, mod_cc);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Cannot modify ccache [%d]: %s\n",

+              ret, sss_strerror(ret));

+        goto immediate;

+    }

     ret = EOK;

 immediate:

diff --git a/src/responder/kcm/kcmsrv_ccache_secdb.c b/src/responder/kcm/kcmsrv_ccache_secdb.c

index 26ee1032d..32137a66e 100644

--- a/src/responder/kcm/kcmsrv_ccache_secdb.c

+++ b/src/responder/kcm/kcmsrv_ccache_secdb.c

@@ -1290,7 +1290,13 @@ static struct tevent_req *ccdb_secdb_mod_send(TALLOC_CTX *mem_ctx,

         goto immediate;

     }

-    kcm_mod_cc(cc, mod_cc);

+    ret = kcm_mod_cc(cc, mod_cc);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Cannot modify ccache [%d]: %s\n",

+              ret, sss_strerror(ret));

+        goto immediate;

+    }

     ret = kcm_ccache_to_sec_input(state, cc, client, &payload);

     if (ret != EOK) {

diff --git a/src/responder/kcm/kcmsrv_ccache_secrets.c b/src/responder/kcm/kcmsrv_ccache_secrets.c

index 7b019fded..83c16974d 100644

--- a/src/responder/kcm/kcmsrv_ccache_secrets.c

+++ b/src/responder/kcm/kcmsrv_ccache_secrets.c

@@ -1846,7 +1846,14 @@ static void ccdb_sec_mod_cred_get_done(struct tevent_req *subreq)

         return;

     }

-    kcm_mod_cc(cc, state->mod_cc);

+    ret = kcm_mod_cc(cc, state->mod_cc);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_OP_FAILURE,

+              "Cannot modify ccache [%d]: %s\n",

+              ret, sss_strerror(ret));

+        tevent_req_error(req, ret);

+        return;

+    }

     ret = kcm_ccache_to_sec_kv(state, cc, state->client, &url, &payload);

     if (ret != EOK) {

diff --git a/src/responder/kcm/kcmsrv_ops.c b/src/responder/kcm/kcmsrv_ops.c

index d8a7b03c5..8bd63165b 100644

--- a/src/responder/kcm/kcmsrv_ops.c

+++ b/src/responder/kcm/kcmsrv_ops.c

@@ -1990,13 +1990,11 @@ static void kcm_op_set_kdc_offset_getbyname_done(struct tevent_req *subreq)

         return;

     }

-    mod_ctx = talloc(state, struct kcm_mod_ctx);

+    mod_ctx = kcm_mod_ctx_new(state);

     if (mod_ctx == NULL) {

         tevent_req_error(req, ENOMEM);

         return;

     }

-

-    kcm_mod_ctx_clear(mod_ctx);

     mod_ctx->kdc_offset = be32toh(offset_be);

     subreq = kcm_ccdb_mod_cc_send(state,

-- 

2.20.1