Infer name type when creating principals

In the krb5_parse_name() and krb5_build_principal() families, infer
the name type if the principal is a TGS name or has first component
WELLKNOWN.

Revert commit 0d5df56ea6d4a05c31b7e513ee9ec1542a4b5dce and part of
commit 5994d8928b8ff88751b14bc60c7d7bfce8b30e57 since that
responsibility now lies with krb5_build_principal_ext().

[ghudson@mit.edu: made editorial changes; added removal of
no-longer-needed code; added documentation; rewrote commit message]

ticket: 8983 (new)

diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
index 6a01ed10a9df6f2a85df7ca9610735ff490066d7..4af545fc0e069fc9aeb84da88625f074b524ffb7 100644 (file)
--- a/src/include/krb5/krb5.hin
+++ b/src/include/krb5/krb5.hin
@@ -3450,6 +3450,10 @@ krb5_rd_priv(krb5_context context, krb5_auth_context auth_context,
  * @note The realm in a Kerberos @a name cannot contain slash, colon,
  * or NULL characters.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * Use krb5_free_principal() to free @a principal_out when it is no longer
  * needed.
  *
@@ -4013,6 +4017,10 @@ krb5_get_server_rcache(krb5_context context, const krb5_data *piece,
  * empty component with this function).  Call krb5_free_principal() to free
  * allocated memory for principal when it is no longer needed.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * @code
  * Example of how to build principal WELLKNOWN/ANONYMOUS@R
  *     krb5_build_principal_ext(context, &principal, strlen("R"), "R",
@@ -4042,6 +4050,10 @@ krb5_build_principal_ext(krb5_context context,  krb5_principal * princ,
  *
  * Call krb5_free_principal() to free @a princ when it is no longer needed.
  *
+ * Beginning with release 1.20, the name type of the principal will be inferred
+ * as @c KRB5_NT_SRV_INST or @c KRB5_NT_WELLKNOWN based on the principal name.
+ * The type will be @c KRB5_NT_PRINCIPAL if a type cannot be inferred.
+ *
  * @note krb5_build_principal() and krb5_build_principal_alloc_va() perform the
  * same task.  krb5_build_principal() takes variadic arguments.
  * krb5_build_principal_alloc_va() takes a pre-computed @a varargs pointer.

diff --git a/src/lib/krb5/krb/Makefile.in b/src/lib/krb5/krb/Makefile.in
index f63de8ab83358e46c00fbe38f8cfdbbfbca768db..5a163ab6220e8b7f1cf25ca7ce094a5cc07e92a7 100644 (file)
--- a/src/lib/krb5/krb/Makefile.in
+++ b/src/lib/krb5/krb/Makefile.in
@@ -390,8 +390,7 @@ clean-unix:: clean-libobjs
 
 COMERRLIB=$(TOPLIBD)/libcom_err.a
 
-T_WALK_RTREE_OBJS= t_walk_rtree.o walk_rtree.o tgtname.o unparse.o \
-       bld_pr_ext.o copy_data.o
+T_WALK_RTREE_OBJS= t_walk_rtree.o
 
 T_KERB_OBJS= t_kerb.o conv_princ.o unparse.o set_realm.o str_conv.o
 
@@ -403,7 +402,7 @@ T_DELTAT_OBJS= t_deltat.o deltat.o
 
 T_PAC_OBJS= t_pac.o pac.o pac_sign.o copy_data.o
 
-T_PRINC_OBJS= t_princ.o parse.o unparse.o
+T_PRINC_OBJS= t_princ.o
 
 T_ETYPES_OBJS= t_etypes.o init_ctx.o etype_list.o plugin.o
 
@@ -486,6 +485,10 @@ check-unix: $(TEST_PROGS) runenv.sh
                parse_name tytso\\\\0/\\0@B\\n\\t\\\\GAG \
                parse_name tytso/\\n/\\b\\t@B\\0hacky-test \
                parse_name \\/slash/\\@atsign/octa\\/thorpe@\\/slash\\@at\\/sign \
+               name_type host/www.krb5.test@KRB5.TEST \
+               name_type krbtg/KRB5.TEST@KRB5.TEST \
+               name_type krbtgt/KRB5.TEST@KRB5.TEST \
+               name_type WELLKNOWN/ANONYMOUS@KRB5.TEST \
                425_conv_principal rcmd e40-po ATHENA.MIT.EDU \
                425_conv_principal rcmd mit ATHENA.MIT.EDU \
                425_conv_principal rcmd lithium ATHENA.MIT.EDU \

diff --git a/src/lib/krb5/krb/bld_pr_ext.c b/src/lib/krb5/krb/bld_pr_ext.c
index 10268a0ff0380b203eef851474a1d1240fa20f7c..4da6f9fb5b9e435112cb4ca00a072d011cc28ae3 100644 (file)
--- a/src/lib/krb5/krb/bld_pr_ext.c
+++ b/src/lib/krb5/krb/bld_pr_ext.c
@@ -30,6 +30,7 @@
  */
 
 #include "k5-int.h"
+#include "int-proto.h"
 
 #include <stdarg.h>
 
@@ -83,7 +84,7 @@ krb5_build_principal_ext(krb5_context context,  krb5_principal * princ,
     }
     va_end(ap);
     *princ = princ_ret;
-    princ_ret->type = KRB5_NT_UNKNOWN;
+    princ_ret->type = k5_infer_principal_type(princ_ret);
     return 0;
 
 free_out:

diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c
index 8604268ceb883d4c0b2a1499b24ddb32bc59424a..ff8265acf14ccf10abd8b9a74fb614a5a498e11d 100644 (file)
--- a/src/lib/krb5/krb/bld_princ.c
+++ b/src/lib/krb5/krb/bld_princ.c
@@ -25,6 +25,22 @@
  */
 
 #include "k5-int.h"
+#include "int-proto.h"
+
+krb5_int32
+k5_infer_principal_type(krb5_principal princ)
+{
+    /* RFC 4120 section 7.3 */
+    if (princ->length == 2 && data_eq_string(princ->data[0], KRB5_TGS_NAME))
+        return KRB5_NT_SRV_INST;
+
+    /* RFC 6111 section 3.1 */
+    if (princ->length >= 2 &&
+        data_eq_string(princ->data[0], KRB5_WELLKNOWN_NAMESTR))
+        return KRB5_NT_WELLKNOWN;
+
+    return KRB5_NT_PRINCIPAL;
+}
 
 static krb5_error_code
 build_principal_va(krb5_context context, krb5_principal princ,
@@ -65,11 +81,11 @@ build_principal_va(krb5_context context, krb5_principal princ,
     }
 
     if (!retval) {
-        princ->type = KRB5_NT_UNKNOWN;
         princ->magic = KV5M_PRINCIPAL;
         princ->realm = make_data(r, rlen);
         princ->data = data;
         princ->length = count;
+        princ->type = k5_infer_principal_type(princ);
         r = NULL;    /* take ownership */
         data = NULL; /* take ownership */
     }

diff --git a/src/lib/krb5/krb/deps b/src/lib/krb5/krb/deps
index ab3cc3e5a49c5825e3a01ec97b154d9c6feb6c07..6197a9839e022e6f03514fda858c4348b27f5bbf 100644 (file)
--- a/src/lib/krb5/krb/deps
+++ b/src/lib/krb5/krb/deps
@@ -136,7 +136,7 @@ bld_pr_ext.so bld_pr_ext.po $(OUTPRE)bld_pr_ext.$(OBJEXT): \
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  bld_pr_ext.c
+  bld_pr_ext.c int-proto.h
 bld_princ.so bld_princ.po $(OUTPRE)bld_princ.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
@@ -147,7 +147,7 @@ bld_princ.so bld_princ.po $(OUTPRE)bld_princ.$(OBJEXT): \
   $(top_srcdir)/include/k5-trace.h $(top_srcdir)/include/krb5.h \
   $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/plugin.h \
   $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \
-  bld_princ.c
+  bld_princ.c int-proto.h
 brand.so brand.po $(OUTPRE)brand.$(OBJEXT): $(top_srcdir)/patchlevel.h \
   brand.c
 chk_trans.so chk_trans.po $(OUTPRE)chk_trans.$(OBJEXT): \
@@ -741,7 +741,7 @@ parse.so parse.po $(OUTPRE)parse.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \
   $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/k5-trace.h \
   $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \
   $(top_srcdir)/include/krb5/plugin.h $(top_srcdir)/include/port-sockets.h \
-  $(top_srcdir)/include/socket-utils.h parse.c
+  $(top_srcdir)/include/socket-utils.h int-proto.h parse.c
 parse_host_string.so parse_host_string.po $(OUTPRE)parse_host_string.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 569518722dd9b85780c1f9b1a2382c989be8401c..b28b38a1592d93d42e289cfad36bd313e674eb7d 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -506,12 +506,7 @@ build_in_tkt_name(krb5_context context,
         if (ret)
             return ret;
     }
-    /*
-     * Windows Server 2008 R2 RODC insists on TGS principal names having the
-     * right name type.
-     */
-    if (server->length == 2 && data_eq_string(server->data[0], KRB5_TGS_NAME))
-        server->type = KRB5_NT_SRV_INST;
+
     *server_out = server;
     return 0;
 }

diff --git a/src/lib/krb5/krb/int-proto.h b/src/lib/krb5/krb/int-proto.h
index 2fde08d1ae91d11f689fb2dd70e93cd913b04a6a..15f4adf28541e7ed9c3425053fd0b139ea94dfad 100644 (file)
--- a/src/lib/krb5/krb/int-proto.h
+++ b/src/lib/krb5/krb/int-proto.h
@@ -391,4 +391,8 @@ k5_get_proxy_cred_from_kdc(krb5_context context, krb5_flags options,
 krb5_boolean
 k5_sname_wildcard_host(krb5_context context, krb5_const_principal mprinc);
 
+/* Guess the appropriate name-type for a principal based on the name. */
+krb5_int32
+k5_infer_principal_type(krb5_principal princ);
+
 #endif /* KRB5_INT_FUNC_PROTO__ */

diff --git a/src/lib/krb5/krb/parse.c b/src/lib/krb5/krb/parse.c
index 00c0ec1b179d336c7651b5d4e446194271437eeb..953389b69d8b2bad5e3b203f7d56769cac415265 100644 (file)
--- a/src/lib/krb5/krb/parse.c
+++ b/src/lib/krb5/krb/parse.c
@@ -25,6 +25,7 @@
  */
 
 #include "k5-int.h"
+#include "int-proto.h"
 
 /*
  * Scan name and allocate a shell principal with enough space in each field.
@@ -218,7 +219,8 @@ krb5_parse_name_flags(krb5_context context, const char *name,
     }
 
     princ->type = (enterprise) ? KRB5_NT_ENTERPRISE_PRINCIPAL :
-        KRB5_NT_PRINCIPAL;
+        k5_infer_principal_type(princ);
+
     princ->magic = KV5M_PRINCIPAL;
     *principal_out = princ;
     princ = NULL;

diff --git a/src/lib/krb5/krb/t_kerb.c b/src/lib/krb5/krb/t_kerb.c
index 74ac14d9ab64595a98b01c3b3016bf82c4899d2f..e8c42ab5d3677b528a0d3be561199bd22f9d8518 100644 (file)
--- a/src/lib/krb5/krb/t_kerb.c
+++ b/src/lib/krb5/krb/t_kerb.c
@@ -14,6 +14,7 @@ void test_string_to_timestamp (krb5_context, char *);
 void test_425_conv_principal (krb5_context, char *, char*, char *);
 void test_524_conv_principal (krb5_context, char *);
 void test_parse_name (krb5_context, const char *);
+void test_name_type (krb5_context, const char *);
 void test_set_realm (krb5_context, const char *, const char *);
 void usage (char *);
 
@@ -120,6 +121,21 @@ fail:
         krb5_free_principal(ctx, princ2);
 }
 
+void
+test_name_type(krb5_context ctx, const char *name)
+{
+    krb5_error_code retval;
+    krb5_principal  princ = 0;
+
+    retval = krb5_parse_name(ctx, name, &princ);
+    if (retval) {
+        com_err("krb5_parse_name", retval, 0);
+        return;
+    }
+    printf("name_type principal(%s): %d\n", name, krb5_princ_type(ctx, princ));
+    krb5_free_principal(ctx, princ);
+}
+
 void
 test_set_realm(krb5_context ctx, const char *name, const char *realm)
 {
@@ -154,10 +170,11 @@ fail:
 void
 usage(char *progname)
 {
-    fprintf(stderr, "%s: Usage: %s 425_conv_principal <name> <inst> <realm\n",
+    fprintf(stderr, "%s: Usage: %s 425_conv_principal <name> <inst> <realm>\n",
             progname, progname);
     fprintf(stderr, "\t%s 524_conv_principal <name>\n", progname);
     fprintf(stderr, "\t%s parse_name <name>\n", progname);
+    fprintf(stderr, "\t%s name_type <name>\n", progname);
     fprintf(stderr, "\t%s set_realm <name> <realm>\n", progname);
     fprintf(stderr, "\t%s string_to_timestamp <time>\n", progname);
     exit(1);
@@ -198,6 +215,11 @@ main(int argc, char **argv)
             if (!argc) usage(progname);
             name = *argv;
             test_parse_name(ctx, name);
+        } else if (strcmp(*argv, "name_type") == 0) {
+            argc--; argv++;
+            if (!argc) usage(progname);
+            name = *argv;
+            test_name_type(ctx, name);
         } else if (strcmp(*argv, "set_realm") == 0) {
             argc--; argv++;
             if (!argc) usage(progname);

diff --git a/src/lib/krb5/krb/t_ref_kerb.out b/src/lib/krb5/krb/t_ref_kerb.out
index 08a53343fcb6b88fb6a010a3c3eee354ae7d8aca..8daff9ef0cb2c546692370a83575e50c2ebcaa18 100644 (file)
--- a/src/lib/krb5/krb/t_ref_kerb.out
+++ b/src/lib/krb5/krb/t_ref_kerb.out
@@ -7,6 +7,10 @@ parsed (and unparsed) principal(tytso/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t@FO
 parsed (and unparsed) principal(tytso\\0/\0@B\n\t\\GAG): MATCH
 parsed (and unparsed) principal(tytso/\n/\b\t@B\0hacky-test): MATCH
 parsed (and unparsed) principal(\/slash/\@atsign/octa\/thorpe@\/slash\@at\/sign): MATCH
+name_type principal(host/www.krb5.test@KRB5.TEST): 1
+name_type principal(krbtg/KRB5.TEST@KRB5.TEST): 1
+name_type principal(krbtgt/KRB5.TEST@KRB5.TEST): 2
+name_type principal(WELLKNOWN/ANONYMOUS@KRB5.TEST): 11
 425_converted principal(rcmd, e40-po, ATHENA.MIT.EDU): 'host/e40-po.mit.edu@ATHENA.MIT.EDU'
 425_converted principal(rcmd, mit, ATHENA.MIT.EDU): 'host/mit.edu@ATHENA.MIT.EDU'
 425_converted principal(rcmd, lithium, ATHENA.MIT.EDU): 'host/lithium.lcs.mit.edu@ATHENA.MIT.EDU'

diff --git a/src/lib/krb5/krb/tgtname.c b/src/lib/krb5/krb/tgtname.c
index 0ffeb17df4e3d54f37b739758c41330c9e7a9a58..6fc2fae9ffcba84ee8428353316b5f58a7359e57 100644 (file)
--- a/src/lib/krb5/krb/tgtname.c
+++ b/src/lib/krb5/krb/tgtname.c
@@ -30,19 +30,8 @@
 krb5_error_code
 krb5int_tgtname(krb5_context context, const krb5_data *server, const krb5_data *client, krb5_principal *tgtprinc)
 {
-    krb5_error_code ret;
-
-    ret = krb5_build_principal_ext(context, tgtprinc, client->length, client->data,
-                                   KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME,
-                                   server->length, server->data,
-                                   0);
-    if (ret)
-        return ret;
-    /*
-     * Windows Server 2008 R2 RODC insists on TGS principal names having the
-     * right name type.
-     */
-    (*tgtprinc)->type = KRB5_NT_SRV_INST;
-
-    return ret;
+    return krb5_build_principal_ext(context, tgtprinc,
+                                    client->length, client->data,
+                                    KRB5_TGS_NAME_SIZE, KRB5_TGS_NAME,
+                                    server->length, server->data, 0);
 }

diff --git a/src/plugins/preauth/pkinit/pkinit_kdf_test.c b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
index 7acbd0d2875fac46e7a8579848f76253c00b72b9..5f60de9e4b7eb90e10ed0d57996c5e80de401fe7 100644 (file)
--- a/src/plugins/preauth/pkinit/pkinit_kdf_test.c
+++ b/src/plugins/preauth/pkinit/pkinit_kdf_test.c
@@ -112,6 +112,10 @@ main(int argc, char **argv)
         goto cleanup;
     }
 
+    /* The test vectors in RFC 8636 implicitly use NT-PRINCIPAL names. */
+    u_principal->type = KRB5_NT_PRINCIPAL;
+    v_principal->type = KRB5_NT_PRINCIPAL;
+
     /* set-up the as_req and and pk_as_rep data */
     memset(twenty_as, 0xaa, sizeof(twenty_as));
     memset(eighteen_bs, 0xbb, sizeof(eighteen_bs));