svn rev #24189: trunk/src/ include/ kdc/ lib/kdb/ plugins/kdb/db2/ plugins/kdb/ldap/ ...
ghudson@MIT.EDU
ghudson at MIT.EDU
Thu Jul 15 00:18:00 EDT 2010
http://src.mit.edu/fisheye/changelog/krb5/?cs=24189
Commit By: ghudson
Log Message:
ticket: 6749
Add check_allowed_to_delegate to the DAL with a corresponding libkdb5
API, replacing the last method (CHECK_ALLOWED_TO_DELEGATE) of
db_invoke. Remove db_invoke since it no longer has any methods.
Changed Files:
U trunk/src/include/kdb.h
U trunk/src/kdc/kdc_util.c
U trunk/src/lib/kdb/kdb5.c
U trunk/src/lib/kdb/libkdb5.exports
U trunk/src/plugins/kdb/db2/Makefile.in
U trunk/src/plugins/kdb/db2/db2_exp.c
U trunk/src/plugins/kdb/db2/kdb_db2.h
D trunk/src/plugins/kdb/db2/kdb_ext.c
U trunk/src/plugins/kdb/ldap/ldap_exp.c
U trunk/src/plugins/kdb/ldap/libkdb_ldap/Makefile.in
D trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c
U trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
U trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
U trunk/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports
Modified: trunk/src/include/kdb.h
===================================================================
--- trunk/src/include/kdb.h 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/include/kdb.h 2010-07-15 04:18:00 UTC (rev 24189)
@@ -322,16 +322,6 @@
#define KRB5_DB_LOCKMODE_DONTBLOCK 0x0004
#define KRB5_DB_LOCKMODE_PERMANENT 0x0008
-/* db_invoke methods */
-#define KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE 0x00000080
-
-typedef struct _kdb_check_allowed_to_delegate_req {
- krb5_magic magic;
- const krb5_db_entry *server;
- krb5_const_principal proxy;
- krb5_const_principal client;
-} kdb_check_allowed_to_delegate_req;
-
/* libkdb.spec */
krb5_error_code krb5_db_setup_lib_handle(krb5_context kcontext);
krb5_error_code krb5_db_open( krb5_context kcontext, char **db_args, int mode );
@@ -620,10 +610,10 @@
void krb5_db_refresh_config(krb5_context kcontext);
-krb5_error_code krb5_db_invoke ( krb5_context kcontext,
- unsigned int method,
- const krb5_data *req,
- krb5_data *rep );
+krb5_error_code krb5_db_check_allowed_to_delegate(krb5_context kcontext,
+ krb5_const_principal client,
+ const krb5_db_entry *server,
+ krb5_const_principal proxy);
/* default functions. Should not be directly called */
/*
@@ -1282,24 +1272,20 @@
void (*refresh_config)(krb5_context kcontext);
/*
- * Optional: Perform an operation on input data req with output stored in
- * rep. Return KRB5_PLUGIN_OP_NOTSUPP if the module does not implement the
- * method. Defined methods are:
- *
- * KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE: req contains a
- * kdb_check_allowed_to_delegate_req structure. Perform a policy check
- * on server being allowed to obtain tickets from client to proxy.
- * (Note that proxy is the target of the delegation, not the delegating
- * service; the term "proxy" is from the viewpoint of the delegating
- * service asking another service to perform some of its work in the
- * authentication context of the client. This terminology comes from
- * the Microsoft S4U protocol documentation.) Return 0 if policy
- * allows it, or an appropriate error (such as KRB5KDC_ERR_POLICY) if
- * not. If this method is not implemented, all S4U2Proxy delegation
- * requests will be rejected. Do not place any data in rep.
+ * Optional: Perform a policy check on server being allowed to obtain
+ * tickets from client to proxy. (Note that proxy is the target of the
+ * delegation, not the delegating service; the term "proxy" is from the
+ * viewpoint of the delegating service asking another service to perform
+ * some of its work in the authentication context of the client. This
+ * terminology comes from the Microsoft S4U protocol documentation.)
+ * Return 0 if policy allows it, or an appropriate error (such as
+ * KRB5KDC_ERR_POLICY) if not. If this method is not implemented, all
+ * S4U2Proxy delegation requests will be rejected.
*/
- krb5_error_code (*invoke)(krb5_context context, unsigned int method,
- const krb5_data *req, krb5_data *rep);
+ krb5_error_code (*check_allowed_to_delegate)(krb5_context context,
+ krb5_const_principal client,
+ const krb5_db_entry *server,
+ krb5_const_principal proxy);
} kdb_vftabl;
#endif /* !defined(_WIN32) */
Modified: trunk/src/kdc/kdc_util.c
===================================================================
--- trunk/src/kdc/kdc_util.c 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/kdc/kdc_util.c 2010-07-15 04:18:00 UTC (rev 24189)
@@ -2180,47 +2180,19 @@
}
static krb5_error_code
-check_allowed_to_delegate_to(krb5_context context,
- krb5_const_principal client,
+check_allowed_to_delegate_to(krb5_context context, krb5_const_principal client,
const krb5_db_entry *server,
krb5_const_principal proxy)
{
- kdb_check_allowed_to_delegate_req req;
- krb5_data req_data;
- krb5_data rep_data;
- krb5_error_code code;
-
/* Can't get a TGT (otherwise it would be unconstrained delegation) */
- if (krb5_is_tgs_principal(proxy)) {
+ if (krb5_is_tgs_principal(proxy))
return KRB5KDC_ERR_POLICY;
- }
/* Must be in same realm */
- if (!krb5_realm_compare(context, server->princ, proxy)) {
+ if (!krb5_realm_compare(context, server->princ, proxy))
return KRB5KDC_ERR_POLICY;
- }
- req.server = server;
- req.proxy = proxy;
- req.client = client;
-
- req_data.data = (void *)&req;
- req_data.length = sizeof(req);
-
- rep_data.data = NULL;
- rep_data.length = 0;
-
- code = krb5_db_invoke(context,
- KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE,
- &req_data,
- &rep_data);
- if (code == KRB5_PLUGIN_OP_NOTSUPP) {
- code = KRB5KDC_ERR_POLICY;
- }
-
- assert(rep_data.length == 0);
-
- return code;
+ return krb5_db_check_allowed_to_delegate(context, client, server, proxy);
}
krb5_error_code
@@ -2432,7 +2404,6 @@
/* OpenSolaris: audit_krb5kdc_tgs_req(...) or
audit_krb5kdc_tgs_req_2ndtktmm(...) */
- /* ... krb5_db_invoke ... */
}
void
Modified: trunk/src/lib/kdb/kdb5.c
===================================================================
--- trunk/src/lib/kdb/kdb5.c 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/lib/kdb/kdb5.c 2010-07-15 04:18:00 UTC (rev 24189)
@@ -2330,18 +2330,18 @@
}
krb5_error_code
-krb5_db_invoke(krb5_context kcontext,
- unsigned int method,
- const krb5_data *req,
- krb5_data *rep)
+krb5_db_check_allowed_to_delegate(krb5_context kcontext,
+ krb5_const_principal client,
+ const krb5_db_entry *server,
+ krb5_const_principal proxy)
{
- krb5_error_code status = 0;
+ krb5_error_code ret;
kdb_vftabl *v;
- status = get_vftabl(kcontext, &v);
- if (status)
- return status;
- if (v->invoke == NULL)
+ ret = get_vftabl(kcontext, &v);
+ if (ret)
+ return ret;
+ if (v->check_allowed_to_delegate == NULL)
return KRB5_PLUGIN_OP_NOTSUPP;
- return v->invoke(kcontext, method, req, rep);
+ return v->check_allowed_to_delegate(kcontext, client, server, proxy);
}
Modified: trunk/src/lib/kdb/libkdb5.exports
===================================================================
--- trunk/src/lib/kdb/libkdb5.exports 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/lib/kdb/libkdb5.exports 2010-07-15 04:18:00 UTC (rev 24189)
@@ -4,6 +4,7 @@
krb5_db_alloc
krb5_db_free
krb5_db_audit_as_req
+krb5_db_check_allowed_to_delegate
krb5_db_check_policy_as
krb5_db_check_policy_tgs
krb5_db_check_transited_realms
@@ -20,7 +21,6 @@
krb5_db_get_mkey_list
krb5_db_get_context
krb5_db_get_principal
-krb5_db_invoke
krb5_db_iterate
krb5_db_lock
krb5_db_put_principal
Modified: trunk/src/plugins/kdb/db2/Makefile.in
===================================================================
--- trunk/src/plugins/kdb/db2/Makefile.in 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/db2/Makefile.in 2010-07-15 04:18:00 UTC (rev 24189)
@@ -54,7 +54,6 @@
$(srcdir)/adb_openclose.c \
$(srcdir)/adb_policy.c \
$(srcdir)/kdb_db2.c \
- $(srcdir)/kdb_ext.c \
$(srcdir)/pol_xdr.c \
$(srcdir)/db2_exp.c \
$(srcdir)/lockout.c
@@ -65,7 +64,6 @@
adb_openclose.o \
adb_policy.o \
kdb_db2.o \
- kdb_ext.o \
pol_xdr.o \
db2_exp.o \
lockout.o
Modified: trunk/src/plugins/kdb/db2/db2_exp.c
===================================================================
--- trunk/src/plugins/kdb/db2/db2_exp.c 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/db2/db2_exp.c 2010-07-15 04:18:00 UTC (rev 24189)
@@ -192,13 +192,6 @@
krb5_timestamp authtime, krb5_error_code error_code),
(kcontext, request, client, server, authtime, error_code));
-WRAP_K (krb5_db2_invoke,
- (krb5_context kcontext,
- unsigned int method,
- const krb5_data *request,
- krb5_data *response),
- (kcontext, method, request, response));
-
static krb5_error_code
hack_init (int dal_version)
{
@@ -258,6 +251,5 @@
/* check_policy_as */ wrap_krb5_db2_check_policy_as,
0,
/* audit_as_req */ wrap_krb5_db2_audit_as_req,
- 0,
- /* invoke */ wrap_krb5_db2_invoke
+ 0, 0
};
Modified: trunk/src/plugins/kdb/db2/kdb_db2.h
===================================================================
--- trunk/src/plugins/kdb/db2/kdb_db2.h 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/db2/kdb_db2.h 2010-07-15 04:18:00 UTC (rev 24189)
@@ -157,11 +157,4 @@
krb5_db_entry *client, krb5_db_entry *server,
krb5_timestamp authtime, krb5_error_code error_code);
-/* methods */
-krb5_error_code
-krb5_db2_invoke(krb5_context context,
- unsigned int method,
- const krb5_data *req,
- krb5_data *rep);
-
#endif /* KRB5_KDB_DB2_H */
Modified: trunk/src/plugins/kdb/ldap/ldap_exp.c
===================================================================
--- trunk/src/plugins/kdb/ldap/ldap_exp.c 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/ldap/ldap_exp.c 2010-07-15 04:18:00 UTC (rev 24189)
@@ -88,6 +88,6 @@
/* check_policy_tgs */ NULL,
/* audit_as_req */ krb5_ldap_audit_as_req,
/* refresh_config */ NULL,
- /* invoke */ krb5_ldap_invoke,
+ /* check_allowed_to_delegate */ krb5_ldap_check_allowed_to_delegate
};
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/Makefile.in
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/Makefile.in 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/Makefile.in 2010-07-15 04:18:00 UTC (rev 24189)
@@ -52,7 +52,6 @@
$(srcdir)/princ_xdr.c \
$(srcdir)/ldap_fetch_mkey.c \
$(srcdir)/ldap_service_stash.c \
- $(srcdir)/kdb_ext.c \
$(srcdir)/kdb_xdr.c \
$(srcdir)/ldap_err.c \
$(srcdir)/lockout.c \
@@ -74,7 +73,6 @@
princ_xdr.o \
ldap_fetch_mkey.o \
ldap_service_stash.o \
- kdb_ext.o \
kdb_xdr.o \
ldap_err.o \
lockout.o
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c 2010-07-15 04:18:00 UTC (rev 24189)
@@ -549,3 +549,34 @@
{
(void) krb5_ldap_lockout_audit(kcontext, client, authtime, error_code);
}
+
+krb5_error_code
+krb5_ldap_check_allowed_to_delegate(krb5_context context,
+ krb5_const_principal client,
+ const krb5_db_entry *server,
+ krb5_const_principal proxy)
+{
+ krb5_error_code code;
+ krb5_tl_data *tlp;
+
+ code = KRB5KDC_ERR_POLICY;
+
+ for (tlp = server->tl_data; tlp != NULL; tlp = tlp->tl_data_next) {
+ krb5_principal acl;
+
+ if (tlp->tl_data_type != KRB5_TL_CONSTRAINED_DELEGATION_ACL)
+ continue;
+
+ if (krb5_parse_name(context, (char *)tlp->tl_data_contents, &acl) != 0)
+ continue;
+
+ if (krb5_principal_compare(context, proxy, acl)) {
+ code = 0;
+ krb5_free_principal(context, acl);
+ break;
+ }
+ krb5_free_principal(context, acl);
+ }
+
+ return code;
+}
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h 2010-07-15 04:18:00 UTC (rev 24189)
@@ -307,6 +307,12 @@
krb5_db_entry *client, krb5_db_entry *server,
krb5_timestamp authtime, krb5_error_code error_code);
+krb5_error_code
+krb5_ldap_check_allowed_to_delegate(krb5_context context,
+ krb5_const_principal client,
+ const krb5_db_entry *server,
+ krb5_const_principal proxy);
+
/* DAL functions */
@@ -337,11 +343,4 @@
krb5_timestamp stamp,
krb5_error_code status);
-/* kdb_ext.c */
-krb5_error_code
-krb5_ldap_invoke(krb5_context context,
- unsigned int method,
- const krb5_data *req,
- krb5_data *rep);
-
#endif
Modified: trunk/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports
===================================================================
--- trunk/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports 2010-07-15 03:17:08 UTC (rev 24188)
+++ trunk/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports 2010-07-15 04:18:00 UTC (rev 24189)
@@ -46,4 +46,4 @@
krb5_ldap_get_mkey_list
krb5_ldap_check_policy_as
krb5_ldap_audit_as_req
-krb5_ldap_invoke
+krb5_ldap_check_allowed_to_delegate
More information about the cvs-krb5
mailing list