negotiate_kerberos_auth: fix krb5.conf backward compatibility

Older versions of the helper would use krb5.conf settings via the
library support. This was lot recently, now restored.

Also add some variable checks in the helper.

diff --git a/helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.cc b/helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.cc
index 270d9ca9e49e9149eb7c88419efc7113c64fa5aa..6799ae3db404d112e6a3de25557442ca974c6199 100644 (file)
--- a/helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.cc
+++ b/helpers/negotiate_auth/kerberos/negotiate_kerberos_auth.cc
@@ -105,7 +105,7 @@ gethost_name(void)
         return NULL;
     }
     rc = getaddrinfo(hostname, NULL, NULL, &hres);
-    if (rc != 0) {
+    if (rc != 0 || hres == NULL ) {
         debug((char *) "%s| %s: ERROR: resolving hostname with getaddrinfo: %s failed\n",
               LogTime(), PROGRAM, gai_strerror(rc));
         fprintf(stderr,
@@ -339,10 +339,8 @@ main(int argc, char *const argv[])
     gss_buffer_desc type_id = GSS_C_EMPTY_BUFFER;
 #endif
 #endif
-#if HAVE_PAC_SUPPORT || HAVE_KRB5_MEMORY_KEYTAB
     krb5_context context = NULL;
     krb5_error_code ret;
-#endif
     long length = 0;
     static int err = 0;
     int opt, log = 0, norealm = 0;
@@ -352,6 +350,7 @@ main(int argc, char *const argv[])
     char *service_principal = NULL;
     char *keytab_name = NULL;
     char *keytab_name_env = NULL;
+    char default_keytab[MAXPATHLEN];
 #if HAVE_KRB5_MEMORY_KEYTAB
     char *memory_keytab_name = NULL;
 #endif
@@ -536,9 +535,14 @@ main(int argc, char *const argv[])
         putenv(keytab_name_env);
     } else {
         keytab_name_env = getenv("KRB5_KTNAME");
-        if (!keytab_name_env)
-            keytab_name = xstrdup("/etc/krb5.keytab");
-        else
+        if (!keytab_name_env) {
+            ret = krb5_init_context(&context);
+            if (!check_k5_err(context, "krb5_init_context", ret)) {
+                krb5_kt_default_name(context, default_keytab, MAXPATHLEN);
+            }
+            keytab_name = default_keytab;
+            krb5_free_context(context);
+        } else
             keytab_name = xstrdup(keytab_name_env);
     }
     debug((char *) "%s| %s: INFO: Setting keytab to %s\n", LogTime(), PROGRAM, keytab_name);

diff --git a/helpers/negotiate_auth/kerberos/negotiate_kerberos_pac.cc b/helpers/negotiate_auth/kerberos/negotiate_kerberos_pac.cc
index c229c4c6fc178a5c0501fa701d0c8aaa9ef8a89c..f9e216fa7ac8fdc50931d1e7e3fddef4fd454f84 100644 (file)
--- a/helpers/negotiate_auth/kerberos/negotiate_kerberos_pac.cc
+++ b/helpers/negotiate_auth/kerberos/negotiate_kerberos_pac.cc
@@ -141,9 +141,9 @@ pstrcat( char *src, const char *dst)
 int
 checkustr(RPC_UNICODE_STRING *string)
 {
-    uint32_t size,off,len;
 
     if (string->pointer != 0) {
+        uint32_t size,off,len;
         align(4);
         size = (uint32_t)((p[bpos]<<0) | (p[bpos+1]<<8) | (p[bpos+2]<<16) | (p[bpos+3]<<24));
         bpos = bpos+4;
@@ -168,7 +168,6 @@ getgids(char **Rids, uint32_t GroupIds, uint32_t  GroupCount)
 {
     if (GroupIds!= 0) {
         uint32_t ngroup;
-        uint32_t sauth;
         int l;
 
         align(4);
@@ -182,6 +181,7 @@ getgids(char **Rids, uint32_t GroupIds, uint32_t  GroupCount)
 
         Rids=(char **)xcalloc(GroupCount*sizeof(char*),1);
         for ( l=0; l<(int)GroupCount; l++) {
+            uint32_t sauth;
             Rids[l]=(char *)xcalloc(4*sizeof(char),1);
             memcpy((void *)Rids[l],(void *)&p[bpos],4);
             sauth = get4byt();
@@ -196,11 +196,16 @@ getgids(char **Rids, uint32_t GroupIds, uint32_t  GroupCount)
 char *
 getdomaingids(char *ad_groups, uint32_t DomainLogonId, char **Rids, uint32_t GroupCount)
 {
+    if (!ad_groups) {
+        debug((char *) "%s| %s: ERR: No space to store groups\n",
+              LogTime(), PROGRAM);
+        return NULL;
+    }
+
     if (DomainLogonId!= 0) {
         uint32_t nauth;
         uint8_t rev;
         uint64_t idauth;
-        uint32_t sauth;
         char dli[256];
         char *ag;
         size_t length;
@@ -251,6 +256,7 @@ getdomaingids(char *ad_groups, uint32_t DomainLogonId, char **Rids, uint32_t Gro
 
         snprintf(dli,sizeof(dli),"S-%d-%lu",rev,(long unsigned int)idauth);
         for ( l=0; l<(int)nauth; l++ ) {
+            uint32_t sauth;
             sauth = get4byt();
             snprintf((char *)&dli[strlen(dli)],sizeof(dli)-strlen(dli),"-%u",sauth);
         }
@@ -286,23 +292,23 @@ getextrasids(char *ad_groups, uint32_t ExtraSids, uint32_t SidCount)
 
         for ( l=0; l<(int)SidCount; l++ ) {
             char es[256];
-            uint32_t nauth;
-            uint8_t rev;
-            uint64_t idauth;
-            uint32_t sauth;
-            int k;
 
             if (pa[l] != 0) {
+                uint32_t nauth;
+                uint8_t rev;
+                uint64_t idauth;
+
                 nauth = get4byt();
 
                 length = 1+1+6+nauth*4;
                 ag = (char *)xcalloc((length)*sizeof(char),1);
                 memcpy((void *)ag,(const void*)&p[bpos],length);
                 if (!ad_groups) {
-                    if (!pstrcpy(ad_groups,"group=")) {
-                        debug((char *) "%s| %s: WARN: Too many groups ! size > %d : %s\n",
-                              LogTime(), PROGRAM, MAX_PAC_GROUP_SIZE, ad_groups);
-                    }
+                    debug((char *) "%s| %s: ERR: No space to store groups\n",
+                          LogTime(), PROGRAM);
+                    xfree(pa);
+                    xfree(ag);
+                    return NULL;
                 } else {
                     if (!pstrcat(ad_groups," group=")) {
                         debug((char *) "%s| %s: WARN: Too many groups ! size > %d : %s\n",
@@ -328,7 +334,8 @@ getextrasids(char *ad_groups, uint32_t ExtraSids, uint32_t SidCount)
                 idauth = get6byt_be();
 
                 snprintf(es,sizeof(es),"S-%d-%lu",rev,(long unsigned int)idauth);
-                for ( k=0; k<(int)nauth; k++ ) {
+                for (int k=0; k<(int)nauth; k++ ) {
+                    uint32_t sauth;
                     sauth = get4byt();
                     snprintf((char *)&es[strlen(es)],sizeof(es)-strlen(es),"-%u",sauth);
                 }
@@ -365,6 +372,12 @@ get_ad_groups(char *ad_groups, krb5_context context, krb5_pac pac)
     char **Rids=NULL;
     int l=0;
 
+    if (!ad_groups) {
+        debug((char *) "%s| %s: ERR: No space to store groups\n",
+            LogTime(), PROGRAM);
+        return NULL;
+    }
+
     ad_data = (krb5_data *)xcalloc(1,sizeof(krb5_data));
 
 #define KERB_LOGON_INFO 1