[19636] in Kerberos_V5_Development
pkinit plugin logic in pkinit_srv.c
daemon@ATHENA.MIT.EDU (Craig Huckabee)
Thu Aug 24 10:40:48 2017
From: Craig Huckabee <craig.huckabee@spawar.navy.mil>
Message-Id: <3B62B9BA-C297-4753-907D-D7CEF67F21F8@spawar.navy.mil>
Date: Thu, 24 Aug 2017 09:39:22 -0400
To: krbdev@mit.edu
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Content-Type: multipart/mixed; boundary="===============3548341745157244431=="
Errors-To: krbdev-bounces@mit.edu
--===============3548341745157244431==
Content-Type: multipart/signed;
boundary="Apple-Mail=_E68246D8-58B1-4012-B68B-C868FE6F0424";
protocol="application/pkcs7-signature"; micalg=sha1
--Apple-Mail=_E68246D8-58B1-4012-B68B-C868FE6F0424
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
While running some tests with the latest development builds, I noticed =
that the plugin test logic in pkinit_srv.c might be flawed. The comment =
in the plugin check codes says:
/*
* Check the certificate against each certauth module. For the =
certificate
* to be authorized at least one module must return 0, and no module =
can an
* error code other than KRB5_PLUGIN_NO_HANDLE (pass). Add =
indicators from
* modules that return 0 or pass.
*/
but that=E2=80=99s not really true as each plugin returns =
KRB5KDC_ERR_CLIENT_NAME_MISMATCH when a match is not found. This means =
the first plugin that fails kicks out of that loop and no other checks =
are performed. I noticed this specifically because we were testing with =
certs that need the dbmatch module to work but it was never being =
called.
Attached is a small patch that allows KRB5KDC_ERR_CLIENT_NAME_MISMATCH =
to be ignored and that will jump out of the loop on the first accepted =
match.
=E2=80=94Craig
--Apple-Mail=_E68246D8-58B1-4012-B68B-C868FE6F0424
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIEsTCCBK0w
ggOVoAMCAQICAwGY/jANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T
LiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxDDAKBgNVBAsTA1BLSTEYMBYGA1UEAxMPRE9EIElE
IFNXIENBLTM4MB4XDTE3MDQxODEyMDQ1M1oXDTIwMDQxODEyMDQ1M1owdzELMAkGA1UEBhMCVVMx
GDAWBgNVBAoTD1UuUy4gR292ZXJubWVudDEMMAoGA1UECxMDRG9EMQwwCgYDVQQLEwNQS0kxDDAK
BgNVBAsTA1VTTjEkMCIGA1UEAxMbSFVDS0FCRUUuREFSWUwuQy4xMjQ5MzUzNTYyMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqyUPtaILBJCZufwFTQScISrbcIUQyJx9kK4vKyTCxujo
IkLHe/hnrPgZBrZIxx1mhy0+g1vGGIpJV2PHjVTBAY8ultmi/7+O6JT0mCM/zxVZP4yXqJXuzeGb
vQUEJUROJlYSkleORTmidKmZlk3fSIsXJ7+eQmOv71fkm1kNwonwzBxO3m/BnL7IteWbalQ3hSSp
/QAT3yn0UjMYfDHszTZBR6KgJU3FqXiqWABm00086QOTdKeWpxCQgWg1t4tPGv4p77+uH9GJOPx1
ZgGGwxZxKjuZYMIrmqo02A8wy8XjW6GSx9xf3SQJ98ebNvKHQ/kPd6OipxLEkL559vyjPQIDAQAB
o4IBWjCCAVYwHwYDVR0jBBgwFoAUjsW5zPzOjlO0Ks7oESrPmylsZ8owOQYDVR0fBDIwMDAuoCyg
KoYoaHR0cDovL2NybC5kaXNhLm1pbC9jcmwvRE9ESURTV0NBXzM4LmNybDAOBgNVHQ8BAf8EBAMC
B4AwFgYDVR0gBA8wDTALBglghkgBZQIBCycwHQYDVR0OBBYEFPVBl8LA3XVPDh3jVnP/Gfq+Dgv4
MGcGCCsGAQUFBwEBBFswWTA1BggrBgEFBQcwAoYpaHR0cDovL2NybC5kaXNhLm1pbC9zaWduL0RP
RElEU1dDQV8zOC5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3NwLmRpc2EubWlsMCkGA1UdEQQi
MCCBHmNyYWlnLmh1Y2thYmVlQHNwYXdhci5uYXZ5Lm1pbDAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
KwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAG3pY2ZSLujikcJO3KuQuzk/BUtswBr4kCXeiZV3
2yWD4iTy8vt+Dlra8nZS/H6QNb5AK0rBAfPKMHo8gblNO6YYVstJPvQDLl9m9+npUzBTbejGV0Ls
DJWNUHDRpoLfgQuP87Xh4G2HjxvzBm/fvd7UyrmDoZ81uK4RDHs2B/ecNK/qJGf5T2rplTLMOwWw
/lIBiss4FEPQtTFucP7drmgSvhO5QSPab/ymRw03hghS5aqlKZFBgBKGlrdj+7Yjx5z6MW42xmWU
G2/hpQItx9HIv1bR3amkKADLST4NahWB4iNzZrHDZMPHGpEPulYM9JxT39d/w5W6hTA6fVQUIUAx
ggHqMIIB5gIBATBkMF0xCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAK
BgNVBAsTA0RvRDEMMAoGA1UECxMDUEtJMRgwFgYDVQQDEw9ET0QgSUQgU1cgQ0EtMzgCAwGY/jAJ
BgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcw
ODI0MTMzOTIyWjAjBgkqhkiG9w0BCQQxFgQUEI6VvWm1pGDTGakDvwF89bmbwV8wDQYJKoZIhvcN
AQEBBQAEggEAotbWfElJZPFezNTOxG4dySx8P39mNBXh94Mymgx16JErHZNnwSR2pUiB6Jmu6JeS
IzVSi7m58XFUdJpzZyqkRkevfjxKHkUx8J1pt7PQEfcmqs1EOUMwr88gcPKvDnUtka+hF74GHNSo
37QKFSX4z83sqtlkmI7cTOOTh/RwtjQfYeXdAOT5HFnequ3HBbIASmzqRE4qv+MrLRjl0YXF65lU
nJJRULDXSyDVT5cUZps1ik474rAKhWl3KUib+LCt06gAXWyHGoFCiAqonHYjIr+snUrhyoTECU6B
dd7GUiPld2LX01XHcTOClYj5Ggj6juhGU27KAOxE11o4+Gwn4wAAAAAAAA==
--Apple-Mail=_E68246D8-58B1-4012-B68B-C868FE6F0424--
--===============3548341745157244431==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--===============3548341745157244431==--
