FreeTDS Development Group

["Peter C. Norton" <spacey-freetds.org AT ssr.com>]

On Wed, Sep 15, 2010 at 10:17:10PM -0400, James K. Lowden wrote:
> Peter C. Norton wrote:
> > 
> > I've hacked in some simple support for this with very minor edits to
> > gssapi.c, tds.h, and config.c.  The support adds a new config option
> > to freetds.conf that adds a boolean config option of "enable gssapi
> > delegation = <true|false>" by adding a couple of defines in tds.h and an
> > additional value to the TDSCONNECTION struct.
> > 
> > So my first question is: Would this minor addition be accepted into
> > the mainline freetds by the maintainers?
> 
> Hello Peter, 
> 
> Absolutely.  I don't understand the fine points of Kerberos, but I don't
> see any downside to the changes you propose.  

OK, I've attached the patch.  

NOTES: 

(1) At my site, we are using the mutual and replay flags.  Mutual has
the client verify the server as well as the server verifying the
client.  Replay includes replay protection.  Both of these are
generally "more secure" but reasonable people could prefer that site
policy govern this.  If this would make a difference, I can break
these other flags into other options in the conf file.

(2) I've commenetd out <gssapi/gssapi_generic.h> because my reading is
that it is only a backwards-compatability sop.  It has a handful of
declarations, beginning with this:

/* Deprecated MIT krb5 oid names provided for compatibility.
 * The correct oids (GSS_C_NT_USER_NAME, etc) from rfc 2744 
 * are defined in gssapi.h. */

You can google it to confirm that it's generally un-needed for new
software (e.g. at
http://www.koders.com/c/fid860F9C0434703D7BE8578A8A53877A56E70F8133.aspx?s=crc)

Thanks,

-Peter
diff -r e92c274ae9fd include/tds.h
--- a/include/tds.h	Thu Sep 02 15:21:35 2010 -0400
+++ b/include/tds.h	Thu Sep 16 00:42:56 2010 -0400
@@ -808,6 +808,9 @@
 #define TDS_STR_ENCRYPTION_OFF	 "off"
 #define TDS_STR_ENCRYPTION_REQUEST "request"
 #define TDS_STR_ENCRYPTION_REQUIRE "require"
+/* Defines to enable optional GSSAPI delegation */
+#define TDS_GSSAPI_DELEGATION "enable gssapi delegation"
+#define TDS_GSSAPI_DELEGATION_OFF "off" 
 
 
 /* TODO do a better check for alignment than this */
@@ -877,6 +880,7 @@
 	unsigned int emul_little_endian:1;
 	unsigned int bulk_copy:1;
 	unsigned int suppress_language:1;
+        unsigned int gssapi_use_delegation:1;     
 } TDSCONNECTION;
 
 typedef struct tds_locale
diff -r e92c274ae9fd src/tds/config.c
--- a/src/tds/config.c	Thu Sep 02 15:21:35 2010 -0400
+++ b/src/tds/config.c	Thu Sep 16 00:42:56 2010 -0400
@@ -564,6 +564,9 @@
 			connection->block_size = val;
 	} else if (!strcmp(option, TDS_STR_SWAPDT)) {
 		connection->broken_dates = tds_config_boolean(value);
+	} else if (!strcmp(option, TDS_GSSAPI_DELEGATION)) { 
+		/* gssapi flag addition */
+		connection->gssapi_use_delegation = tds_config_boolean(value);
 	} else if (!strcmp(option, TDS_STR_DUMPFILE)) {
 		tds_dstr_copy(&connection->dump_file, value);
 	} else if (!strcmp(option, TDS_STR_DEBUGFLAGS)) {
diff -r e92c274ae9fd src/tds/gssapi.c
--- a/src/tds/gssapi.c	Thu Sep 02 15:21:35 2010 -0400
+++ b/src/tds/gssapi.c	Thu Sep 16 00:42:56 2010 -0400
@@ -57,7 +57,7 @@
 
 #ifdef ENABLE_KRB5
 
-#include <gssapi/gssapi_generic.h>
+// #include <gssapi/gssapi_generic.h> // Obsoleted interface file, fails to build with heimdal
 #include <gssapi/gssapi_krb5.h>
 
 #include "tds.h"
@@ -146,6 +146,7 @@
 	const char *server_name;
 	/* Storage for reentrant getaddrby* calls */
 	char buffer[4096];
+	int gssapi_flags = 0;
 
 	struct tds_gss_auth *auth = (struct tds_gss_auth *) calloc(1, sizeof(struct tds_gss_auth));
 
@@ -205,9 +206,19 @@
 	token_ptr = GSS_C_NO_BUFFER;
 	auth->gss_context = GSS_C_NO_CONTEXT;
 
+	/* We may ask for delegation based on config in the tds.conf and other conf files */
+	/* We always want to ask for the mutual, replay, and integ flags */
+	if (tds->connection->gssapi_use_delegation) {
+	    gssapi_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
+	} else {
+	    gssapi_flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_INTEG_FLAG;
+	}
+
 	maj_stat = gss_init_sec_context(&min_stat, GSS_C_NO_CREDENTIAL, &auth->gss_context, auth->target_name, 
 					/* GSS_C_DELEG_FLAG GSS_C_MUTUAL_FLAG ?? */
-					GSS_C_NULL_OID, GSS_C_REPLAY_FLAG, 0, NULL,	/* no channel bindings */
+					GSS_C_NULL_OID, 
+					gssapi_flags,
+					0, NULL,	/* no channel bindings */
 					token_ptr, NULL,	/* ignore mech type */
 					&send_tok, &ret_flags, NULL);	/* ignore time_rec */