From 66587fcd6380eac2c53674df4f64a827d337aee5 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Mon, 7 Feb 2011 18:40:00 +0000 Subject: Improve acceptor name flexibility Be more flexible about the principal names we will accept for a given GSS acceptor name. Also add support for a new libdefaults profile variable ignore_acceptor_hostname, which causes the hostnames of host-based service principals to be ignored when passed by server applications as acceptor names. Note that we still always invoke krb5_sname_to_principal() when importing a gss-krb5 mechanism name, even though we won't always use the result. This is an unfortunate waste of getaddrinfo/getnameinfo queries in some situations, but the code surgery necessary to defer it appears too risky at this time. The project proposal for this change is at: http://k5wiki.kerberos.org/wiki/Projects/Acceptor_Names ticket: 6855 git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24616 dc483132-0cff-0310-8789-dd5450dbe970 --- src/include/k5-int.h | 2 ++ src/include/krb5/krb5.hin | 16 ++++++++++++++++ 2 files changed, 18 insertions(+) (limited to 'src/include') diff --git a/src/include/k5-int.h b/src/include/k5-int.h index d188f8e9d..92ff1f043 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -217,6 +217,7 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" +#define KRB5_CONF_IGNORE_ACCEPTOR_HOSTNAME "ignore_acceptor_hostname" #define KRB5_CONF_IPROP_ENABLE "iprop_enable" #define KRB5_CONF_IPROP_MASTER_ULOGSIZE "iprop_master_ulogsize" #define KRB5_CONF_IPROP_PORT "iprop_port" @@ -1600,6 +1601,7 @@ struct _krb5_context { struct _kdb_log_context *kdblog_context; krb5_boolean allow_weak_crypto; + krb5_boolean ignore_acceptor_hostname; krb5_trace_callback trace_callback; void *trace_callback_data; diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index adf670082..14c4a9e41 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -4284,6 +4284,22 @@ krb5_error_code KRB5_CALLCONV krb5_sname_to_principal(krb5_context context, const char *hostname, const char *sname, krb5_int32 type, krb5_principal *ret_princ); +/** Return true if @a princ matches @a matching, false otherwise. + * + * A matching principal is a host-based principal with an empty realm and/or + * second data component (hostname). Profile configuration may cause the + * hostname to be ignored even if it is present. A principal matches a + * matching principal if the principal has the same non-empty (and non-ignored) + * components of the matching principal. + * + * If @a matching is NULL, return true. If @a matching is not a matching + * principal, return the value of krb5_principal_compare(context, matching, + * princ). + */ +krb5_boolean KRB5_CALLCONV +krb5_sname_match(krb5_context context, krb5_const_principal matching, + krb5_const_principal princ); + /** * @brief Change the password for an existing Kerberos account. * -- cgit