[19641] in Kerberos_V5_Development
Re: pkinit plugin logic in pkinit_srv.c
daemon@ATHENA.MIT.EDU (Craig Huckabee)
Thu Aug 24 14:48:28 2017
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Craig Huckabee <craig.huckabee@spawar.navy.mil>
In-Reply-To: <7cd7e913-4eb0-48d7-19a1-af174ede6246@mit.edu>
Date: Thu, 24 Aug 2017 13:42:56 -0400
Message-Id: <8FE1E244-9820-4071-9807-8CA72E308EB3@spawar.navy.mil>
To: Greg Hudson <ghudson@mit.edu>
Cc: krbdev@mit.edu
Content-Type: multipart/mixed; boundary="===============8882326807780454730=="
Errors-To: krbdev-bounces@mit.edu
--===============8882326807780454730==
Content-Type: multipart/signed;
boundary="Apple-Mail=_E5A76AF7-B424-4909-9275-322A4FDE65F1";
protocol="application/pkcs7-signature"; micalg=sha1
--Apple-Mail=_E5A76AF7-B424-4909-9275-322A4FDE65F1
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=windows-1252
> On Aug 24, 2017, at 11:02 AM, Greg Hudson <ghudson@mit.edu> wrote:
>=20
> On 08/24/2017 09:39 AM, Craig Huckabee wrote:
>> While running some tests with the latest development builds, I =
noticed that the plugin test logic in pkinit_srv.c might be flawed. The =
comment in the plugin check codes says:
>>=20
>> /*
>> * Check the certificate against each certauth module. For the =
certificate
>> * to be authorized at least one module must return 0, and no =
module can an
>> * error code other than KRB5_PLUGIN_NO_HANDLE (pass). Add =
indicators from
>> * modules that return 0 or pass.
>> */
>>=20
>> but that=92s not really true as each plugin returns =
KRB5KDC_ERR_CLIENT_NAME_MISMATCH when a match is not found. This means =
the first plugin that fails kicks out of that loop and no other checks =
are performed. I noticed this specifically because we were testing with =
certs that need the dbmatch module to work but it was never being =
called.
>=20
> Can you elaborate on "each plugin returns
> KRB5KDC_ERR_CLIENT_NAME_MISMATCH when a match is not found"? Of the
> built-in modules, I think only the san module would ever return that
> code, and should only return it when it finds PKINIT or UPN SANs in =
the
> certificate and they don't match. It should return
> KRB5_PLUGIN_NO_HANDLE if the cert doesn't have either of those SAN =
types.
>=20
Right - the san module returns it, but the dbmatch module also returns =
it, and the eku check returns KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE.
In my use case, I=92m working with a DoD CAC so I have a SAN that looks =
like this "1234567890@mil=94 - so to work around that I wanted to use =
the dbmatch feature to add the relation between that SAN and my actual =
principal. =20
But when the san module fails out with KRB5KDC_ERR_CLIENT_NAME_MISMATCH, =
the rest of the possible plugins are not called so I=92ll never reach =
that dbmatch.
Anything other than KRB5_PLUGIN_NO_HANDLE kicks it out of the loop. I =
assume the intent is to process all possible plugins until a match is =
found so that check needs to be adjusted or maybe just removed.
Attempting to attach the patch a second time - this probably isn=92t the =
=93right=94 fix but helps illustrate what makes it work.
=97Craig
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c =
b/src/plugins/preauth/pkinit/pkinit_srv.c
index 5da8892..303b49d 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -370,7 +370,7 @@ authorize_cert(krb5_context context, certauth_handle =
*certauth_modules,
&opts, db_ent, &ais);
if (ret =3D=3D 0)
accepted =3D TRUE;
- else if (ret !=3D KRB5_PLUGIN_NO_HANDLE)
+ else if (ret !=3D KRB5_PLUGIN_NO_HANDLE && ret !=3D =
KRB5KDC_ERR_CLIENT_NAME_MISMATCH)
goto cleanup;
=20
if (ais !=3D NULL) {
@@ -383,6 +383,9 @@ authorize_cert(krb5_context context, certauth_handle =
*certauth_modules,
h->vt.free_ind(context, h->moddata, ais);
ais =3D NULL;
}
+ if (accepted) {
+ break;
+ } =09
}
=20
ret =3D accepted ? 0 : KRB5KDC_ERR_CLIENT_NAME_MISMATCH;
--Apple-Mail=_E5A76AF7-B424-4909-9275-322A4FDE65F1
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIEsTCCBK0w
ggOVoAMCAQICAwGY/jANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJVUzEYMBYGA1UEChMPVS5T
LiBHb3Zlcm5tZW50MQwwCgYDVQQLEwNEb0QxDDAKBgNVBAsTA1BLSTEYMBYGA1UEAxMPRE9EIElE
IFNXIENBLTM4MB4XDTE3MDQxODEyMDQ1M1oXDTIwMDQxODEyMDQ1M1owdzELMAkGA1UEBhMCVVMx
GDAWBgNVBAoTD1UuUy4gR292ZXJubWVudDEMMAoGA1UECxMDRG9EMQwwCgYDVQQLEwNQS0kxDDAK
BgNVBAsTA1VTTjEkMCIGA1UEAxMbSFVDS0FCRUUuREFSWUwuQy4xMjQ5MzUzNTYyMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqyUPtaILBJCZufwFTQScISrbcIUQyJx9kK4vKyTCxujo
IkLHe/hnrPgZBrZIxx1mhy0+g1vGGIpJV2PHjVTBAY8ultmi/7+O6JT0mCM/zxVZP4yXqJXuzeGb
vQUEJUROJlYSkleORTmidKmZlk3fSIsXJ7+eQmOv71fkm1kNwonwzBxO3m/BnL7IteWbalQ3hSSp
/QAT3yn0UjMYfDHszTZBR6KgJU3FqXiqWABm00086QOTdKeWpxCQgWg1t4tPGv4p77+uH9GJOPx1
ZgGGwxZxKjuZYMIrmqo02A8wy8XjW6GSx9xf3SQJ98ebNvKHQ/kPd6OipxLEkL559vyjPQIDAQAB
o4IBWjCCAVYwHwYDVR0jBBgwFoAUjsW5zPzOjlO0Ks7oESrPmylsZ8owOQYDVR0fBDIwMDAuoCyg
KoYoaHR0cDovL2NybC5kaXNhLm1pbC9jcmwvRE9ESURTV0NBXzM4LmNybDAOBgNVHQ8BAf8EBAMC
B4AwFgYDVR0gBA8wDTALBglghkgBZQIBCycwHQYDVR0OBBYEFPVBl8LA3XVPDh3jVnP/Gfq+Dgv4
MGcGCCsGAQUFBwEBBFswWTA1BggrBgEFBQcwAoYpaHR0cDovL2NybC5kaXNhLm1pbC9zaWduL0RP
RElEU1dDQV8zOC5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3NwLmRpc2EubWlsMCkGA1UdEQQi
MCCBHmNyYWlnLmh1Y2thYmVlQHNwYXdhci5uYXZ5Lm1pbDAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
KwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAG3pY2ZSLujikcJO3KuQuzk/BUtswBr4kCXeiZV3
2yWD4iTy8vt+Dlra8nZS/H6QNb5AK0rBAfPKMHo8gblNO6YYVstJPvQDLl9m9+npUzBTbejGV0Ls
DJWNUHDRpoLfgQuP87Xh4G2HjxvzBm/fvd7UyrmDoZ81uK4RDHs2B/ecNK/qJGf5T2rplTLMOwWw
/lIBiss4FEPQtTFucP7drmgSvhO5QSPab/ymRw03hghS5aqlKZFBgBKGlrdj+7Yjx5z6MW42xmWU
G2/hpQItx9HIv1bR3amkKADLST4NahWB4iNzZrHDZMPHGpEPulYM9JxT39d/w5W6hTA6fVQUIUAx
ggHqMIIB5gIBATBkMF0xCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAK
BgNVBAsTA0RvRDEMMAoGA1UECxMDUEtJMRgwFgYDVQQDEw9ET0QgSUQgU1cgQ0EtMzgCAwGY/jAJ
BgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcw
ODI0MTc0MjU2WjAjBgkqhkiG9w0BCQQxFgQUTA349k+0Dg1ZgfQyKavzHecCj5wwDQYJKoZIhvcN
AQEBBQAEggEAQX+B7CxH+mRHw1YxyooK+Tp9NONzmEm9DDHAaZKMj7nrAIDj/IX3wcQ8KE6Tn0MO
Y+FHoC4+GRqYFQtNqV80NXiTch+RXOWxmu1y9PvbC0P22xTg8w3YwI+OEzmaV5EKwTZbw4yuRUZm
dm9v/3k1VOz40CEByou4g6A72gBZv34mcWTLD+kp5/5QAePzX2lj/zcN4mGSLkbeD8WFPWoiPaXy
L9UgiVX1d5EbFvq8UVDuabo65t4YWh+WUicsJ+W+X1SlNEYBPRlXYDy7Ku1NNIrVRHvJwuNCAsMU
kdvNHiJh0iT57R5I7iTsefoBUTkZbDqj6VtAVOKxTWhxT5K9TwAAAAAAAA==
--Apple-Mail=_E5A76AF7-B424-4909-9275-322A4FDE65F1--
--===============8882326807780454730==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--===============8882326807780454730==--
