[19638] in Kerberos_V5_Development
Re: pkinit plugin logic in pkinit_srv.c
daemon@ATHENA.MIT.EDU (Robbie Harwood)
Thu Aug 24 11:12:35 2017
From: Robbie Harwood <rharwood@redhat.com>
To: Craig Huckabee <craig.huckabee@spawar.navy.mil>, krbdev@mit.edu
In-Reply-To: <3B62B9BA-C297-4753-907D-D7CEF67F21F8@spawar.navy.mil>
Date: Thu, 24 Aug 2017 11:12:56 -0400
Message-ID: <jlg1so1j8xz.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============5295978317691691852=="
Errors-To: krbdev-bounces@mit.edu
--===============5295978317691691852==
Content-Type: multipart/signed; boundary="=-=-=";
micalg=pgp-sha256; protocol="application/pgp-signature"
--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Craig Huckabee <craig.huckabee@spawar.navy.mil> writes:
> While running some tests with the latest development builds, I noticed
> that the plugin test logic in pkinit_srv.c might be flawed. The
> comment in the plugin check codes says:
>
> /*
> * Check the certificate against each certauth module. For the certi=
ficate
> * to be authorized at least one module must return 0, and no module =
can an
> * error code other than KRB5_PLUGIN_NO_HANDLE (pass). Add indicator=
s from
> * modules that return 0 or pass.
> */
>
> but that=E2=80=99s not really true as each plugin returns
> KRB5KDC_ERR_CLIENT_NAME_MISMATCH when a match is not found. This
> means the first plugin that fails kicks out of that loop and no other
> checks are performed. I noticed this specifically because we were
> testing with certs that need the dbmatch module to work but it was
> never being called.
>
> Attached is a small patch that allows KRB5KDC_ERR_CLIENT_NAME_MISMATCH
> to be ignored and that will jump out of the loop on the first accepted
> match.
Hi, I'm not seeing a patch attached. Also, if you prefer, we do accept
PRs on github: https://github.com/krb5/krb5/
Thanks,
=2D-Robbie
--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEA5qc6hnelQjDaHWqJTL5F2qVpEIFAlme7PgACgkQJTL5F2qV
pEJHeg//U3ZZR5eKvwWJfBYVaWdH8kFTGoBQ5jDuDJxdlzLNVn5ehKO/iryku+IG
CZqYv/KUSWPwKkb6oB8GuuoZ9zhLfLb+AeOBBh68bMd3OrIzWiqupq+YvDWgkWR5
Ctzv7AgeZbt97Uw+mLuwaXDHxUaA4SzaZ2qWXBq5RRDBVe249KM4wEsm+7oKw10+
Blov0F4rlMlbIoMa74o7BbXxlQRN41A6v0FOGsJRtSalTL7v4LjaQ7A/IUpgzFAu
eWtjZNQ8JgcueDMonTY56+YOQgiGw8JT898bMw7B+k+uJa0C+QhcVatrdBkMy1Hr
6s1mplRaN+GOlvayCxmV7n8qd9+r7U2dIILoNxLfZTLe4SerE6Emj2wbYcO6/Ffi
/QqcoUjZPRkbhaeqhSXi7PKUCq5Bx/06YHAC7QoGy+wAARm/tgeS4XxIvJVoBvZA
92NR8bzZG0upHOdM0Ba96CkBdpUuaZHLfCeLUd2GTb8mPMGOF1Yhtn8f1HYrK5tQ
pps+3wDVHCT9U+FGH+YpWHXnd+zi2hYCsrMT9NHwPcdu1wmgoUw1fCVYjaoDeocC
ug22FOvDwYxCd/yDa0qLK4G6Oi/WsvXFqzyRTyOVeCR64m1v1Lodauu0BlY0kEIz
BQPbwTVOHKx5hIn1Moena3F8ra8waVcuatoIA4+L4UvxDIqKWrs=
=SBfd
-----END PGP SIGNATURE-----
--=-=-=--
--===============5295978317691691852==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--===============5295978317691691852==--
