[krbdev.mit.edu #8978] git commit
"Greg Hudson via RT" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
Thu Jan 28 12:47:00 2021: Request 8978 was acted upon. Transaction: Ticket created by [email protected] Queue: krb5 Subject: git commit Owner: [email protected] Requestors: Status: new Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8978 > Support host-based GSS initiator names When checking if we can get initial credentials in the GSS krb5 mech, use krb5_kt_have_match() to support fallback iteration. When scanning the ccache or getting initial credentials, rewrite cred->name->princ to the canonical client name. When a name check is necessary (such as when the caller specifies both a name and ccache), use a new internal API k5_sname_compare() to support fallback iteration. Add fallback iteration to krb5_cc_cache_match() to allow host-based names to be canonicalized against the cache collection. Create and store the matching principal for acceptor names in acquire_accept_cred() so that it isn't affected by changes in cred->name->princ during acquire_init_cred(). https://github.com/krb5/krb5/commit/c374ab40dd059a5938ffc0440d87457ac5da3a46 Author: Greg Hudson <[email protected]> Commit: c374ab40dd059a5938ffc0440d87457ac5da3a46 Branch: master src/include/k5-int.h | 9 +++ src/include/k5-trace.h | 3 + src/lib/gssapi/krb5/accept_sec_context.c | 15 +---- src/lib/gssapi/krb5/acquire_cred.c | 89 +++++++++++++++++------------ src/lib/gssapi/krb5/gssapiP_krb5.h | 1 + src/lib/gssapi/krb5/rel_cred.c | 1 + src/lib/krb5/ccache/cccursor.c | 57 +++++++++++++++---- src/lib/krb5/libkrb5.exports | 1 + src/lib/krb5/os/sn2princ.c | 23 +++++++- src/lib/krb5_32.def | 1 + src/tests/gssapi/t_client_keytab.py | 44 +++++++++++++++ src/tests/gssapi/t_credstore.py | 32 +++++++++++ 12 files changed, 214 insertions(+), 62 deletions(-)