[krbdev.mit.edu #8971] git commit
"Greg Hudson via RT" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8971 > Implement fallback for GSS acceptor names Commit 3fcc365a6f049730b3f47168f7112c03997c5c0b added fallback support to krb5_rd_req(), but acquiring acceptor creds for a host-based name could still fail within check_keytab() in the krb5 mech. Add an internal libkrb5 API k5_kt_have_match() to check for a matching keytab entry with canonicalization, and use it in check_keytab(). Add a library-internal function k5_sname_wildcard_host() to share logic between rd_req and k5_kt_have_match(). (cherry picked from commit 7e0a2a7a3a76205ebd7192f06a99f23bad8dc5bd) https://github.com/krb5/krb5/commit/196be3c474881dcaf76332375c1dffbd3a9140f6 Author: Greg Hudson <[email protected]> Commit: 196be3c474881dcaf76332375c1dffbd3a9140f6 Branch: krb5-1.19 src/include/k5-int.h | 3 ++ src/lib/gssapi/krb5/acquire_cred.c | 18 +----------- src/lib/krb5/keytab/ktfns.c | 49 ++++++++++++++++++++++++++++++++++++ src/lib/krb5/krb/int-proto.h | 5 +++ src/lib/krb5/krb/rd_req_dec.c | 6 +--- src/lib/krb5/krb/sname_match.c | 13 +++++++++ src/lib/krb5/libkrb5.exports | 1 + src/lib/krb5_32.def | 1 + src/tests/gssapi/t_gssapi.py | 24 +++++++++++++++++- 9 files changed, 99 insertions(+), 21 deletions(-)