[krbdev.mit.edu #8978] git commit

[Greg Hudson via RT]

Thu Jan 28 12:47:00 2021: Request 8978 was acted upon.
 Transaction: Ticket created by ghudson at mit.edu
       Queue: krb5
     Subject: git commit
       Owner: ghudson at mit.edu
  Requestors: 
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8978 >



Support host-based GSS initiator names

When checking if we can get initial credentials in the GSS krb5 mech,
use krb5_kt_have_match() to support fallback iteration.  When scanning
the ccache or getting initial credentials, rewrite cred->name->princ
to the canonical client name.  When a name check is necessary (such as
when the caller specifies both a name and ccache), use a new internal
API k5_sname_compare() to support fallback iteration.  Add fallback
iteration to krb5_cc_cache_match() to allow host-based names to be
canonicalized against the cache collection.

Create and store the matching principal for acceptor names in
acquire_accept_cred() so that it isn't affected by changes in
cred->name->princ during acquire_init_cred().

https://github.com/krb5/krb5/commit/c374ab40dd059a5938ffc0440d87457ac5da3a46
Author: Greg Hudson <ghudson at mit.edu>
Commit: c374ab40dd059a5938ffc0440d87457ac5da3a46
Branch: master
 src/include/k5-int.h                     |    9 +++
 src/include/k5-trace.h                   |    3 +
 src/lib/gssapi/krb5/accept_sec_context.c |   15 +----
 src/lib/gssapi/krb5/acquire_cred.c       |   89 +++++++++++++++++------------
 src/lib/gssapi/krb5/gssapiP_krb5.h       |    1 +
 src/lib/gssapi/krb5/rel_cred.c           |    1 +
 src/lib/krb5/ccache/cccursor.c           |   57 +++++++++++++++----
 src/lib/krb5/libkrb5.exports             |    1 +
 src/lib/krb5/os/sn2princ.c               |   23 +++++++-
 src/lib/krb5_32.def                      |    1 +
 src/tests/gssapi/t_client_keytab.py      |   44 +++++++++++++++
 src/tests/gssapi/t_credstore.py          |   32 +++++++++++
 12 files changed, 214 insertions(+), 62 deletions(-)