Issue #160: interpose gss_set_cred_option() for GSS_KRB5_CRED_NO_CI_FLAGS_X - gssproxy

gssproxy

#160 interpose gss_set_cred_option() for GSS_KRB5_CRED_NO_CI_FLAGS_X

Closed: Fixed May 12, 2017 Opened Feb 24, 2017 by abbra.

gss_set_cred_option() is not interposed so any operation on creds handled by gssproxy fails with 'invalid argument' error.

This is what happens in FreeIPA framework (git master) when trying to run Samba Python bindings where gss_set_cred_option() is used within cli credentials code:

Starting GENSEC mechanism spnego
Starting GENSEC submechanism gssapi_krb5
Ticket in credentials cache for admin@XS.IPA.COOL will expire in 0 secs
Cannot obtain client GSS credentials we need to contact cifs/nyx.xs.ipa.cool@ : gss_set_cred_option failed: Invalid argument
SPNEGO(gssapi_krb5) NEG_TOKEN_INIT failed: NT_STATUS_INVALID_PARAMETER
SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT

The code in question is this: https://git.samba.org/?p=samba.git;a=blob;f=auth/credentials/credentials_krb5.c;h=d2a655e9b6d1f7e30c90024d29f09ffddcef1444;hb=refs/heads/master#l789

Metadata Update from @abbra:
- Issue assigned to simo
- Issue set to the milestone: 0.0 NEEDS TRIAGE

Feb 28, 2017

simo commented Mar 3, 2017

Turns out we do interpose gss_set_cred_option(0 already, but we have to actively filter what is allowed because some of the calls allow a client to escape privilege separation and copy out data.

Metadata Update from @simo:
- Issue close_status updated to: None
- Issue priority set to: None (was: 3)

Mar 3, 2017

simo commented Mar 3, 2017

I updated the title to reflect the specific option we want to implement

rharwood commented May 12, 2017

This was done in 7150e488e0f7b2a3bbc55f24a8ebd8e0dce4796a

Metadata Update from @rharwood:
- Issue status updated to: Closed (was: Open)

May 12, 2017

simo commented Nov 15, 2017

Commit 7a0fa44e fixes this issue

simo commented Nov 15, 2017

Commit 7150e488 fixes this issue