HEIMDAL:lib/gssapi/krb5: add GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X

This allows KRB5_VERIFY_AP_REQ_SKIP_TRANSITED_CHECK (on the acceptor)
to be controlled via the gssapi layer.

Members of Active Directory domains should just rely on there
KDCs (domain controllers) to do SID-Filtering (and name checking)
on trust boundaries, I have verified this with a modified Samba KDC
and a Windows 2012R2 DC. The Windows DC rejects invalid cross-realm tickets
with KRB5KDC_ERR_POLICY, before generating a new (service or referral)
ticket. So any service ticket is already policy checked by the KDC
even if this does not result in setting the transited_policy_checked in the ticket.

This means an accepting service can tell gss_accept_sec_context()
to skip any transited checking, as the trust topoligy is only
fully known to the KDC anyway.

The detailed background for this can be found in the bug report
and the mailing list:
https://lists.samba.org/archive/samba-technical/2019-September/thread.html#134285
https://lists.samba.org/archive/samba-technical/2019-November/thread.html#134553
http://mailman.mit.edu/pipermail/krbdev/ should also have references.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12907

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h b/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
index fabd090fd8355d535546f94abe977cb4344a855b..eb19bba4bfba97fff46bd066bef4e5812590abaf 100644 (file)
--- a/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
+++ b/third_party/heimdal/lib/gssapi/gssapi/gssapi_oid.h
@@ -169,6 +169,12 @@ extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_negoex_mechanism_oid_desc;
 extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_sanon_x25519_mechanism_oid_desc;
 #define GSS_SANON_X25519_MECHANISM (&__gss_sanon_x25519_mechanism_oid_desc)
 
+/*
+ * From Samba
+ */
+extern GSSAPI_LIB_VARIABLE gss_OID_desc __gss_krb5_cred_skip_transit_check_x_oid_desc;
+#define GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X (&__gss_krb5_cred_skip_transit_check_x_oid_desc)
+
 /*
  * OID mappings with name and short description and and slightly longer description
  */

diff --git a/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c b/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
index 3f8e2740e2127615e4ddd29bdda47a8e95f5952b..9dd250fd7fcd700b2bbff07d7b56668bf2fbadf6 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
+++ b/third_party/heimdal/lib/gssapi/krb5/accept_sec_context.c
@@ -431,13 +431,22 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
        krb5_rd_req_in_ctx in = NULL;
        krb5_rd_req_out_ctx out = NULL;
        krb5_principal server = NULL;
+       krb5_flags verify_ap_req_flags = 0;
 
-       if (acceptor_cred)
+       if (acceptor_cred) {
            server = acceptor_cred->principal;
 
+           if (acceptor_cred->cred_flags & GSS_CF_SKIP_TRANSIT_CHECK) {
+               verify_ap_req_flags |= KRB5_VERIFY_AP_REQ_SKIP_TRANSITED_CHECK;
+           }
+       }
+
        kret = krb5_rd_req_in_ctx_alloc(context, &in);
        if (kret == 0)
            kret = krb5_rd_req_in_set_keytab(context, in, keytab);
+       if (kret == 0)
+           kret = krb5_rd_req_in_set_verify_ap_req_flags(context, in,
+                                                         verify_ap_req_flags);
        if (kret) {
            if (in)
                krb5_rd_req_in_ctx_free(context, in);

diff --git a/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h b/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
index fbbb168c6b11fe333589bbc79117c747aa57704b..8173e39a51263419f817b5e8c585a6573a33cdbe 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
+++ b/third_party/heimdal/lib/gssapi/krb5/gsskrb5_locl.h
@@ -101,6 +101,7 @@ typedef struct {
   int cred_flags;
 #define GSS_CF_DESTROY_CRED_ON_RELEASE 1
 #define GSS_CF_NO_CI_FLAGS             2
+#define GSS_CF_SKIP_TRANSIT_CHECK      4
   struct krb5_keytab_data *keytab;
   time_t endtime;
   gss_cred_usage_t usage;

diff --git a/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c b/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
index ef177a0ef473155ebc100f52a1ac9cc658d88eaa..77cb6de8a65224af1774fc16835dcaccf991c506 100644 (file)
--- a/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
+++ b/third_party/heimdal/lib/gssapi/krb5/set_cred_option.c
@@ -217,6 +217,26 @@ no_ci_flags(OM_uint32 *minor_status,
 }
 
 
+static OM_uint32
+skip_transit_check(OM_uint32 *minor_status,
+                  krb5_context context,
+                  gss_cred_id_t *cred_handle,
+                  const gss_buffer_t value)
+{
+    gsskrb5_cred cred;
+
+    if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL) {
+       *minor_status = 0;
+       return GSS_S_FAILURE;
+    }
+
+    cred = (gsskrb5_cred)*cred_handle;
+    cred->cred_flags |= GSS_CF_SKIP_TRANSIT_CHECK;
+
+    *minor_status = 0;
+    return GSS_S_COMPLETE;
+}
+
 OM_uint32 GSSAPI_CALLCONV
 _gsskrb5_set_cred_option
            (OM_uint32 *minor_status,
@@ -243,6 +263,9 @@ _gsskrb5_set_cred_option
        return no_ci_flags(minor_status, context, cred_handle, value);
     }
 
+    if (gss_oid_equal(desired_object, GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X)) {
+       return skip_transit_check(minor_status, context, cred_handle, value);
+    }
 
     *minor_status = EINVAL;
     return GSS_S_FAILURE;

diff --git a/third_party/heimdal/lib/gssapi/mech/gss_oid.c b/third_party/heimdal/lib/gssapi/mech/gss_oid.c
index 10ec22dbeffa365114d7f33b7068973cb001930f..8309e687d01aeb6a666849d7ceb19ac8e4140add 100644 (file)
--- a/third_party/heimdal/lib/gssapi/mech/gss_oid.c
+++ b/third_party/heimdal/lib/gssapi/mech/gss_oid.c
@@ -157,6 +157,9 @@ gss_OID_desc GSSAPI_LIB_VARIABLE __gss_negoex_mechanism_oid_desc = { 10, rk_UNCO
 /* GSS_SANON_X25519_MECHANISM - 1.3.6.1.4.1.5322.26.1.110 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_sanon_x25519_mechanism_oid_desc = { 10, rk_UNCONST("\x2b\x06\x01\x04\x01\xa9\x4a\x1a\x01\x6e") };
 
+/* GSS_KRB5_CRED_SKIP_TRANSIT_CHECK_X - 1.3.6.1.4.1.7165.4.7.1 */
+gss_OID_desc GSSAPI_LIB_VARIABLE __gss_krb5_cred_skip_transit_check_x_oid_desc = { 10, rk_UNCONST("\x2b\x06\x01\x04\x01\xb7\x7d\x04\x07\x01") };
+
 /* GSS_C_MA_MECH_CONCRETE - 1.3.6.1.5.5.13.1 */
 gss_OID_desc GSSAPI_LIB_VARIABLE __gss_c_ma_mech_concrete_oid_desc = { 7, rk_UNCONST("\x2b\x06\x01\x05\x05\x0d\x01") };
 

diff --git a/third_party/heimdal/lib/gssapi/version-script.map b/third_party/heimdal/lib/gssapi/version-script.map
index 7f482b53624066788f4f206bf5883808f4633481..1b3dfed06d2657c2ed69560f25d6c8b0ea04a707 100644 (file)
--- a/third_party/heimdal/lib/gssapi/version-script.map
+++ b/third_party/heimdal/lib/gssapi/version-script.map
@@ -165,6 +165,7 @@ HEIMDAL_GSS_2.0 {
                __gss_c_ntlm_session_key_oid_desc;
                __gss_c_ntlm_force_v1_oid_desc;
                __gss_krb5_cred_no_ci_flags_x_oid_desc;
+               __gss_krb5_cred_skip_transit_check_x_oid_desc;
                __gss_krb5_import_cred_x_oid_desc;
                __gss_c_ma_sasl_mech_name_oid_desc;
                __gss_c_ma_mech_name_oid_desc;