[19494] in Kerberos_V5_Development
Re: end of pointer arrays in krb5_creds
daemon@ATHENA.MIT.EDU (Greg Hudson)
Sun Sep 18 02:05:51 2016
To: Rick van Rein <rick@openfortress.nl>, krbdev@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <e3bb4d9a-15ef-5be7-890b-dda759d26a71@mit.edu>
Date: Sun, 18 Sep 2016 02:05:35 -0400
MIME-Version: 1.0
In-Reply-To: <57DBAFEC.5020603@openfortress.nl>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 09/16/2016 04:40 AM, Rick van Rein wrote:
> The hostaddresses are OPTIONAL, so I would have expected the array pointer (so the **) to be NULL when no host addresses are present in the krb5_creds structure. However, when using "kinit -A" to login, I do find an array but its first element is NULL.
(kinit -A is normally the default, right?)
Most of the time, your instinct is correct; in Kerberos ASN.1 objects,
sequences like this are usually optional but non-empty when present, and
the corresponding MIT krb5 C structures contain a NULL pointer when the
sequence is absent. For instance, EncTicketPart contains the field
"caddr [9] HostAddresses OPTIONAL", where HostAddresses has the comment
"HostAddresses is always used as an OPTIONAL field and should not be
empty." And in a krb5_enc_tkt_part object, the caddrs field will be
NULL if no address restrictions are present in the ticket.
However, the krb5_creds type is marshalled to and from ccache files
using a different subsystem, and the unmarshalling code always creates
an array for the addresses and authdata fields. This is a historical
inconsistency, which there probably isn't much benefit in fixing.
> Normally I would have assumed that a list is prescribing, unless absent. But it seems that the empty list is an exception, and treated as a carte blanche re. host addresses.
Enforcement of address restrictions isn't done using a krb5_creds
object. When you acquire a ticket, the KDC tells the client what
address restrictions are present in the ticket for the client's
information, and the client notes that in the krb5_creds object that it
marshals out to the ccache. That information can be shown with klist
-a, but otherwise isn't used (as far as I know).
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
