[krbdev.mit.edu #8971] git commit

[Greg Hudson via RT]

<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8971 >


Implement fallback for GSS acceptor names

Commit 3fcc365a6f049730b3f47168f7112c03997c5c0b added fallback support
to krb5_rd_req(), but acquiring acceptor creds for a host-based name
could still fail within check_keytab() in the krb5 mech.

Add an internal libkrb5 API k5_kt_have_match() to check for a matching
keytab entry with canonicalization, and use it in check_keytab().  Add
a library-internal function k5_sname_wildcard_host() to share logic
between rd_req and k5_kt_have_match().

(cherry picked from commit 7e0a2a7a3a76205ebd7192f06a99f23bad8dc5bd)

https://github.com/krb5/krb5/commit/196be3c474881dcaf76332375c1dffbd3a9140f6
Author: Greg Hudson <ghudson at mit.edu>
Commit: 196be3c474881dcaf76332375c1dffbd3a9140f6
Branch: krb5-1.19
 src/include/k5-int.h               |    3 ++
 src/lib/gssapi/krb5/acquire_cred.c |   18 +-----------
 src/lib/krb5/keytab/ktfns.c        |   49 ++++++++++++++++++++++++++++++++++++
 src/lib/krb5/krb/int-proto.h       |    5 +++
 src/lib/krb5/krb/rd_req_dec.c      |    6 +---
 src/lib/krb5/krb/sname_match.c     |   13 +++++++++
 src/lib/krb5/libkrb5.exports       |    1 +
 src/lib/krb5_32.def                |    1 +
 src/tests/gssapi/t_gssapi.py       |   24 +++++++++++++++++-
 9 files changed, 99 insertions(+), 21 deletions(-)