Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upImplement remaining GGF extensions #151
Conversation
|
If |
| Creds: The output credential. | ||
| Raises: | ||
| GSS_ERROR |
DirectXMan12
Mar 23, 2018
Member
This should be the python type (GSSError)
This should be the python type (GSSError)
DirectXMan12
Mar 23, 2018
Member
(can you fix that up in the rest of these functions, too? Don't know how that snuck by last time).
(can you fix that up in the rest of these functions, too? Don't know how that snuck by last time).
jborean93
Mar 23, 2018
Author
Contributor
Sure, don't know why I wrote them this way.
Sure, don't know why I wrote them this way.
| An example of how this can be used would be to reset the NTLM crypto engine | ||
| used in gss-ntlmssp. The OID that controls this value is | ||
| '1.3.6.1.4.1.7165.655.1.3' and it takes it a byte value that represents | ||
| an int32 where 1 reset's the verifier handle and any other int resets the |
DirectXMan12
Mar 23, 2018
Member
s/reset's/resets/
s/reset's/resets/
| # nothing much we can test here apart from it doesn't fail and the | ||
| # id of the return cred is the same as the input one | ||
| output_cred = gb.set_cred_option(no_ci_flags_x, creds=orig_cred) | ||
| id(orig_cred).should_be(id(output_cred)) |
DirectXMan12
Mar 23, 2018
Member
oof, I don't like testing the id like that. Just drop that line. It's probably fine to just test that it doesn't error out.
oof, I don't like testing the id like that. Just drop that line. It's probably fine to just test that it doesn't error out.
jborean93
Mar 23, 2018
Author
Contributor
Will do.
Will do.
| b"\x00") | ||
|
|
||
| # TODO: get these tests to detect gss-ntlmssp once it is installed | ||
| """ |
DirectXMan12
Mar 23, 2018
Member
gss-ntlmssp will be installed as part of #150, so we just need to figure out how to detect it, and get that merged into k5test.
gss-ntlmssp will be installed as part of #150, so we just need to figure out how to detect it, and get that merged into k5test.
jborean93
Mar 23, 2018
Author
Contributor
Sounds good.
Sounds good.
| # because MIT krb5 doesn't implement any OID's for | ||
| # gss_set_sec_context_option, we just need to query any OID and it will | ||
| # raise an exception | ||
| gb.set_sec_context_option.should_raise(gb.GSSError, |
DirectXMan12
Mar 23, 2018
Member
this test feels fragile. Is there anything else we can do?
this test feels fragile. Is there anything else we can do?
jborean93
Mar 23, 2018
Author
Contributor
Once the NTLMSSP stuff works in the tests we can call that with an invalid value instead.
Once the NTLMSSP stuff works in the tests we can call that with an invalid value instead.
|
Thanks for the review @DirectXMan12, let me know what you would like me to do about the |
|
It's there on master now. |
|
Must have done something wrong the first time, have updated the tests to use ntlmssp. |
a7489c1
to
726366d
|
new revisions look good at a glance. Feel free to merge @frozencemetery. |
These parts of th GGF extensions provide extended support for managing security contexts and credentials. In particular, with NTLM, they can be used to reset the crypto handles using the GSS_NTLMSSP_RESET_CRYPTO_OID_LENGTH OID. Draft IETF document for the gss_set_sec_context_option(): https://tools.ietf.org/html/draft-engert-ggf-gss-extensions-00 Draft IETF document for the gss_set_cred_option(): https://tools.ietf.org/html/draft-ietf-kitten-channel-bound-flag-02 Fixes: #51 [rharwood@redhat.com edited commit message]
13467fb
into
pythongssapi:master
This PR implements the remaining GGF extensions #51, excluding the
gss_{import,export}_credvariants as they are not implemented as per the GGF spec in both MIT krb5 and Heimdal. This PR adds in thegss_set_cred_optionandgss_set_sec_context_optionfunctions.While
gss_set_cred_optiondoesn't seem to be a function that was part of the GGF draft, most implementations bundle it together with the GGFgss_set_sec_context_optionand so I decided to keep it inext_ggf, please let me know if you want to split them up further.I also have a commented out test for
gss_set_sec_context_option, it requiresgss-ntlmsspand unfortunately I was unable to get that working in the docker container tests. Not sure if I needed to do anything extra (apart from installing it from apt/dnf) as it was unable to find the mech when i supplied it as part of the test. For now it is commented out until someone smarter can figure it out.