gss-proxy.git/proxy/src/mechglue, branch wip

Add helpers to store and retrieve encrypted creds

2015-12-01T22:45:56+00:00

This will allow to (ab)use the krb5 ccache to store encrypted
credentials in the user's ccache for later reuse.

Signed-off-by: Simo Sorce 
Reviewed-by: Robbie Harwoood

Add gss_acquire_cred_impersonate_name support

2015-12-01T22:45:53+00:00

This is used by a client that wants to peform a s4u2self operation
using its server credentials.

Signed-off-by: Simo Sorce 
Reviewed-by: Robbie Harwoood

Fix formatting on noncompliant copyright lines

2015-09-04T20:34:42+00:00

Signed-off-by: Robbie Harwood 
Reviewed-by: Simo Sorce

Fix handling of context initialization

2015-03-30T13:16:37+00:00

If a previous call has decided to use only local (to the process)
credentials, then we need to override all the way to the end.

A previous patch also swapped the order in which credential handler
and context handler are initialized, make sure also to swap the
fallback checks.
Set the behavior to the process default only if it wasn't forced to
local.

Signed-off-by: Simo Sorce 
Reviewed-by: Lukas Slebodnik

Properly handle security contexts on error

2015-03-24T15:49:25+00:00

On error we need to make sure we do not return a pointer to a
security context that may have been already freed.
So make sure to always unconditionally return the context that we've
been returned by our callees.
Also reorganize the code so we do not accidently wipe the context
and leak memoy on error.

This fixed a double-free bug found by NFS folks @ Red Hat

Fixes: https://fedorahosted.org/gss-proxy/ticket/137

Signed-off-by: Simo Sorce 
Reviewed-by: Nathaniel McCallum

Zero out the outputs of display_name

2015-01-22T19:54:05+00:00

The mechglue expects the mechanism function to zero them in all cases.
Otherwise on error it will later try to free the output buffer value
which can be an arbitrary pointer. This will cause a segfault or
worse in glibc's free().

Signed-off-by: Simo Sorce 
Reviewed-by: Roland Mainz

Fix potential segfault in gssi_inquire_context().

2014-02-05T14:08:53+00:00

Signed-off-by: Günther Deschner 
Reviewed-by: Simo Sorce

Use secure_getenv in client and mechglue module

2013-11-21T12:48:25+00:00

proxymehc.so may be used in setuid binaries so follow best security
practices and use secure_getenv() if available.
Fallback to poorman emulation when secure_getenv() is not available.

Resolves: https://fedorahosted.org/gss-proxy/ticket/110

Reviewed-by: Günther Deschner

Fix calling gpm_inquire_cred_by_mech

2013-11-19T13:04:09+00:00

We need to pass the real mechanism oid here, not the spcial oid.
special oids are used exclusively by the interposer and gssapi
machinery that calls the interposer, they must never be propagated
to clients or servers.

https://fedorahosted.org/gss-proxy/ticket/107

Reviewed-by: Günther Deschner

Add way to return regular oid from special

2013-11-19T13:04:03+00:00

In some cases we need to pass on the corresponding real oid, after we
are given a special oid.
Add helper functions to do that.

https://fedorahosted.org/gss-proxy/ticket/107

Reviewed-by: Günther Deschner