Skip to content

Commit

Permalink
KRB5_CHILD: 'fast-ccache-uid/gid' args aren't used anymore
Browse files Browse the repository at this point in the history
  • Loading branch information
@alexey-tikhonov
alexey-tikhonov committed Nov 18, 2024
1 parent a1f39be commit c15f589
Show file tree
Hide file tree
Showing 4 changed files with 29 additions and 83 deletions.
2 changes: 0 additions & 2 deletions src/providers/krb5/krb5_auth.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,6 @@

#define ILLEGAL_PATH_PATTERN "//|/\\./|/\\.\\./"

#define CHILD_OPT_FAST_CCACHE_UID "fast-ccache-uid"
#define CHILD_OPT_FAST_CCACHE_GID "fast-ccache-gid"
#define CHILD_OPT_FAST_USE_ANONYMOUS_PKINIT "fast-use-anonymous-pkinit"
#define CHILD_OPT_REALM "realm"
#define CHILD_OPT_LIFETIME "lifetime"
Expand Down
15 changes: 1 addition & 14 deletions src/providers/krb5/krb5_child.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -115,8 +115,6 @@ struct krb5_req {
bool old_cc_active;
enum k5c_fast_opt fast_val;

uid_t fast_uid;
gid_t fast_gid;
struct sss_creds *pcsc_saved_creds;

struct cli_opts *cli_opts;
Expand Down Expand Up @@ -3420,8 +3418,6 @@ static krb5_error_code get_fast_ccache_with_keytab(krb5_context ctx,

static krb5_error_code check_fast_ccache(TALLOC_CTX *mem_ctx,
krb5_context ctx,
uid_t fast_uid,
gid_t fast_gid,
bool posix_domain,
struct cli_opts *cli_opts,
const char *primary,
Expand Down Expand Up @@ -3654,8 +3650,7 @@ static int k5c_setup_fast(struct krb5_req *kr, bool demand)
fast_principal = NULL;
}

kerr = check_fast_ccache(kr, kr->ctx, kr->fast_uid, kr->fast_gid,
kr->posix_domain, kr->cli_opts,
kerr = check_fast_ccache(kr, kr->ctx, kr->posix_domain, kr->cli_opts,
fast_principal, fast_principal_realm,
kr->keytab, &kr->fast_ccname);
if (kerr != 0) {
Expand Down Expand Up @@ -4100,8 +4095,6 @@ int main(int argc, const char *argv[])
const char *opt_logger = NULL;
errno_t ret;
krb5_error_code kerr;
uid_t fast_uid = 0;
gid_t fast_gid = 0;
long chain_id = 0;
struct cli_opts cli_opts = { 0 };
int sss_creds_password = 0;
Expand All @@ -4118,10 +4111,6 @@ int main(int argc, const char *argv[])
{"debug-fd", 0, POPT_ARG_INT, &debug_fd, 0,
_("An open file descriptor for the debug logs"), NULL},
SSSD_LOGGER_OPTS
{CHILD_OPT_FAST_CCACHE_UID, 0, POPT_ARG_INT, &fast_uid, 0,
_("The user to create FAST ccache as"), NULL},
{CHILD_OPT_FAST_CCACHE_GID, 0, POPT_ARG_INT, &fast_gid, 0,
_("The group to create FAST ccache as"), NULL},
{CHILD_OPT_FAST_USE_ANONYMOUS_PKINIT, 0, POPT_ARG_NONE, NULL, 'A',
_("Use anonymous PKINIT to request FAST armor ticket"), NULL},
{CHILD_OPT_REALM, 0, POPT_ARG_STRING, &cli_opts.realm, 0,
Expand Down Expand Up @@ -4228,8 +4217,6 @@ int main(int argc, const char *argv[])
}
talloc_steal(kr, debug_prg_name);

kr->fast_uid = fast_uid;
kr->fast_gid = fast_gid;
kr->cli_opts = &cli_opts;
if (sss_creds_password != 0) {
kr->krb5_get_init_creds_password = sss_krb5_get_init_creds_password;
Expand Down
22 changes: 1 addition & 21 deletions src/providers/krb5/krb5_child_handler.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -328,32 +328,12 @@ errno_t set_extra_args(TALLOC_CTX *mem_ctx, struct krb5_ctx *krb5_ctx,
return EINVAL;
}

extra_args = talloc_zero_array(mem_ctx, const char *, 12);
extra_args = talloc_zero_array(mem_ctx, const char *, 10);
if (extra_args == NULL) {
DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_array failed.\n");
return ENOMEM;
}

extra_args[c] = talloc_asprintf(extra_args,
"--"CHILD_OPT_FAST_CCACHE_UID"=%"SPRIuid,
getuid());
if (extra_args[c] == NULL) {
DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
ret = ENOMEM;
goto done;
}
c++;

extra_args[c] = talloc_asprintf(extra_args,
"--"CHILD_OPT_FAST_CCACHE_GID"=%"SPRIgid,
getgid());
if (extra_args[c] == NULL) {
DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
ret = ENOMEM;
goto done;
}
c++;

krb5_realm = krb5_ctx->realm;
if (domain != NULL && IS_SUBDOMAIN(domain) && dp_opt_get_bool(krb5_ctx->opts, KRB5_USE_SUBDOMAIN_REALM)) {
DEBUG(SSSDBG_CONF_SETTINGS, "Use subdomain realm %s.\n", domain->realm);
Expand Down
73 changes: 27 additions & 46 deletions src/tests/cmocka/test_krb5_common.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,98 +83,79 @@ void test_set_extra_args(void **state)
{
int ret;
struct krb5_ctx *krb5_ctx;
char *uid_opt;
char *gid_opt;
const char **krb5_child_extra_args;

ret = set_extra_args(NULL, NULL, NULL, NULL);
assert_int_equal(ret, EINVAL);

krb5_ctx = talloc_zero(global_talloc_context, struct krb5_ctx);
assert_non_null(krb5_ctx);
uid_opt = talloc_asprintf(krb5_ctx, "--fast-ccache-uid=%"SPRIuid, getuid());
assert_non_null(uid_opt);

gid_opt = talloc_asprintf(krb5_ctx, "--fast-ccache-gid=%"SPRIgid, getgid());
assert_non_null(gid_opt);

ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
assert_null(krb5_child_extra_args[3]);
assert_string_equal(krb5_child_extra_args[0], "--chain-id=0");
assert_null(krb5_child_extra_args[1]);
talloc_free(krb5_child_extra_args);

krb5_ctx->canonicalize = true;
ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--canonicalize");
assert_string_equal(krb5_child_extra_args[3], "--chain-id=0");
assert_null(krb5_child_extra_args[4]);
assert_string_equal(krb5_child_extra_args[0], "--canonicalize");
assert_string_equal(krb5_child_extra_args[1], "--chain-id=0");
assert_null(krb5_child_extra_args[2]);
talloc_free(krb5_child_extra_args);

krb5_ctx->realm = discard_const(TEST_REALM);
ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
assert_null(krb5_child_extra_args[5]);
assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[1], "--canonicalize");
assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
assert_null(krb5_child_extra_args[3]);
talloc_free(krb5_child_extra_args);

/* --fast-principal will be only set if FAST is used */
krb5_ctx->fast_principal = discard_const(TEST_FAST_PRINC);
ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
assert_null(krb5_child_extra_args[5]);
assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[1], "--canonicalize");
assert_string_equal(krb5_child_extra_args[2], "--chain-id=0");
assert_null(krb5_child_extra_args[3]);
talloc_free(krb5_child_extra_args);

krb5_ctx->use_fast_str = discard_const(TEST_FAST_STR);
ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[3], "--use-fast=" TEST_FAST_STR);
assert_string_equal(krb5_child_extra_args[4],
assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[1], "--use-fast=" TEST_FAST_STR);
assert_string_equal(krb5_child_extra_args[2],
"--fast-principal=" TEST_FAST_PRINC);
assert_string_equal(krb5_child_extra_args[5], "--canonicalize");
assert_string_equal(krb5_child_extra_args[6], "--chain-id=0");
assert_null(krb5_child_extra_args[7]);
assert_string_equal(krb5_child_extra_args[3], "--canonicalize");
assert_string_equal(krb5_child_extra_args[4], "--chain-id=0");
assert_null(krb5_child_extra_args[5]);
talloc_free(krb5_child_extra_args);

krb5_ctx->lifetime_str = discard_const(TEST_LIFE_STR);
krb5_ctx->rlife_str = discard_const(TEST_RLIFE_STR);
ret = set_extra_args(global_talloc_context, krb5_ctx, NULL,
&krb5_child_extra_args);
assert_int_equal(ret, EOK);
assert_string_equal(krb5_child_extra_args[0], uid_opt);
assert_string_equal(krb5_child_extra_args[1], gid_opt);
assert_string_equal(krb5_child_extra_args[2], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[3], "--lifetime=" TEST_LIFE_STR);
assert_string_equal(krb5_child_extra_args[4],
assert_string_equal(krb5_child_extra_args[0], "--realm=" TEST_REALM);
assert_string_equal(krb5_child_extra_args[1], "--lifetime=" TEST_LIFE_STR);
assert_string_equal(krb5_child_extra_args[2],
"--renewable-lifetime=" TEST_RLIFE_STR);
assert_string_equal(krb5_child_extra_args[5], "--use-fast=" TEST_FAST_STR);
assert_string_equal(krb5_child_extra_args[6],
assert_string_equal(krb5_child_extra_args[3], "--use-fast=" TEST_FAST_STR);
assert_string_equal(krb5_child_extra_args[4],
"--fast-principal=" TEST_FAST_PRINC);
assert_string_equal(krb5_child_extra_args[7], "--canonicalize");
assert_string_equal(krb5_child_extra_args[8], "--chain-id=0");
assert_null(krb5_child_extra_args[9]);
assert_string_equal(krb5_child_extra_args[5], "--canonicalize");
assert_string_equal(krb5_child_extra_args[6], "--chain-id=0");
assert_null(krb5_child_extra_args[7]);
talloc_free(krb5_child_extra_args);

talloc_free(krb5_ctx);
Expand Down

0 comments on commit c15f589

Please sign in to comment.