>From 1bb1ec210685acb6a3dd0bba1763e6466a000cf6 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Sat, 11 Oct 2014 17:39:21 +0200 Subject: [PATCH 2/6] LDAP: Move sss_krb5_verify_keytab_ex to ldap_child The function was called from one place only, so it makes no sense to keep it in a shared module. Moreover, the function should only be called from code that runs as root. --- src/providers/ldap/ldap_child.c | 80 ++++++++++++++++++++++++++++++++++++++++- src/util/sss_krb5.c | 76 --------------------------------------- src/util/sss_krb5.h | 3 -- 3 files changed, 79 insertions(+), 80 deletions(-) diff --git a/src/providers/ldap/ldap_child.c b/src/providers/ldap/ldap_child.c index e5779b70906d90ab855677f04a154e179f2163c6..faa6f027ba52f55985c63e8055292e616b5bb6bf 100644 --- a/src/providers/ldap/ldap_child.c +++ b/src/providers/ldap/ldap_child.c @@ -160,6 +160,84 @@ set_child_debugging(krb5_context ctx) return EOK; } +static int lc_verify_keytab_ex(const char *principal, + const char *keytab_name, + krb5_context context, + krb5_keytab keytab) +{ + bool found; + char *kt_principal; + krb5_error_code krberr; + krb5_kt_cursor cursor; + krb5_keytab_entry entry; + + krberr = krb5_kt_start_seq_get(context, keytab, &cursor); + if (krberr) { + DEBUG(SSSDBG_FATAL_FAILURE, + "Cannot read keytab [%s].\n", KEYTAB_CLEAN_NAME); + + sss_log(SSS_LOG_ERR, "Error reading keytab file [%s]: [%d][%s]. " + "Unable to create GSSAPI-encrypted LDAP " + "connection.", + KEYTAB_CLEAN_NAME, krberr, + sss_krb5_get_error_message(context, krberr)); + + return EIO; + } + + found = false; + while((krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){ + krberr = krb5_unparse_name(context, entry.principal, &kt_principal); + if (krberr) { + DEBUG(SSSDBG_FATAL_FAILURE, + "Could not parse keytab entry\n"); + sss_log(SSS_LOG_ERR, "Could not parse keytab entry\n"); + return EIO; + } + + if (strcmp(principal, kt_principal) == 0) { + found = true; + } + free(kt_principal); + krberr = sss_krb5_free_keytab_entry_contents(context, &entry); + if (krberr) { + /* This should never happen. The API docs for this function + * specify only success for this function + */ + DEBUG(SSSDBG_CRIT_FAILURE,"Could not free keytab entry contents\n"); + /* This is non-fatal, so we'll continue here */ + } + + if (found) { + break; + } + } + + krberr = krb5_kt_end_seq_get(context, keytab, &cursor); + if (krberr) { + DEBUG(SSSDBG_FATAL_FAILURE, "Could not close keytab.\n"); + sss_log(SSS_LOG_ERR, "Could not close keytab file [%s].", + KEYTAB_CLEAN_NAME); + return EIO; + } + + if (!found) { + DEBUG(SSSDBG_FATAL_FAILURE, + "Principal [%s] not found in keytab [%s]\n", + principal, + KEYTAB_CLEAN_NAME); + sss_log(SSS_LOG_ERR, "Error processing keytab file [%s]: " + "Principal [%s] was not found. " + "Unable to create GSSAPI-encrypted LDAP connection.", + KEYTAB_CLEAN_NAME, principal); + + return EFAULT; + } + + return EOK; +} + + static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx, const char *realm_str, const char *princ_str, @@ -287,7 +365,7 @@ static krb5_error_code ldap_child_get_tgt_sync(TALLOC_CTX *memctx, } /* Verify the keytab */ - ret = sss_krb5_verify_keytab_ex(full_princ, keytab_name, context, keytab); + ret = lc_verify_keytab_ex(full_princ, keytab_name, context, keytab); if (ret) { DEBUG(SSSDBG_OP_FAILURE, "Unable to verify principal is present in the keytab\n"); diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c index d9b076ebeccbcd571f14e1b642cade86b21fd5d7..377d61e47254133a6c1b6ed2f20dc0ef1a572aa3 100644 --- a/src/util/sss_krb5.c +++ b/src/util/sss_krb5.c @@ -249,82 +249,6 @@ done: return ret; } -int sss_krb5_verify_keytab_ex(const char *principal, const char *keytab_name, - krb5_context context, krb5_keytab keytab) -{ - bool found; - char *kt_principal; - krb5_error_code krberr; - krb5_kt_cursor cursor; - krb5_keytab_entry entry; - - krberr = krb5_kt_start_seq_get(context, keytab, &cursor); - if (krberr) { - DEBUG(SSSDBG_FATAL_FAILURE, - "Cannot read keytab [%s].\n", KEYTAB_CLEAN_NAME); - - sss_log(SSS_LOG_ERR, "Error reading keytab file [%s]: [%d][%s]. " - "Unable to create GSSAPI-encrypted LDAP " - "connection.", - KEYTAB_CLEAN_NAME, krberr, - sss_krb5_get_error_message(context, krberr)); - - return EIO; - } - - found = false; - while((krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){ - krberr = krb5_unparse_name(context, entry.principal, &kt_principal); - if (krberr) { - DEBUG(SSSDBG_FATAL_FAILURE, - "Could not parse keytab entry\n"); - sss_log(SSS_LOG_ERR, "Could not parse keytab entry\n"); - return EIO; - } - - if (strcmp(principal, kt_principal) == 0) { - found = true; - } - free(kt_principal); - krberr = sss_krb5_free_keytab_entry_contents(context, &entry); - if (krberr) { - /* This should never happen. The API docs for this function - * specify only success for this function - */ - DEBUG(SSSDBG_CRIT_FAILURE,"Could not free keytab entry contents\n"); - /* This is non-fatal, so we'll continue here */ - } - - if (found) { - break; - } - } - - krberr = krb5_kt_end_seq_get(context, keytab, &cursor); - if (krberr) { - DEBUG(SSSDBG_FATAL_FAILURE, "Could not close keytab.\n"); - sss_log(SSS_LOG_ERR, "Could not close keytab file [%s].", - KEYTAB_CLEAN_NAME); - return EIO; - } - - if (!found) { - DEBUG(SSSDBG_FATAL_FAILURE, - "Principal [%s] not found in keytab [%s]\n", - principal, - KEYTAB_CLEAN_NAME); - sss_log(SSS_LOG_ERR, "Error processing keytab file [%s]: " - "Principal [%s] was not found. " - "Unable to create GSSAPI-encrypted LDAP connection.", - KEYTAB_CLEAN_NAME, principal); - - return EFAULT; - } - - return EOK; -} - - enum matching_mode {MODE_NORMAL, MODE_PREFIX, MODE_POSTFIX}; /** * We only have primary and instances stored separately, we need to diff --git a/src/util/sss_krb5.h b/src/util/sss_krb5.h index 83c72097594dc24de1f8ac93d5394b6766a449f4..afa0d1943d8a23ae1543ae3874b5abbfbb4b3372 100644 --- a/src/util/sss_krb5.h +++ b/src/util/sss_krb5.h @@ -70,9 +70,6 @@ void KRB5_CALLCONV sss_krb5_get_init_creds_opt_free (krb5_context context, void KRB5_CALLCONV sss_krb5_free_unparsed_name(krb5_context context, char *name); -int sss_krb5_verify_keytab_ex(const char *principal, const char *keytab_name, - krb5_context context, krb5_keytab keytab); - krb5_error_code find_principal_in_keytab(krb5_context ctx, krb5_keytab keytab, const char *pattern_primary, -- 1.9.3