Setup and cleanup for Kerberos: check colletion support on credential caches

diff --git a/etc/tlspool.conf b/etc/tlspool.conf
index 09d0226..b411cf6 100644 (file)
--- a/etc/tlspool.conf
+++ b/etc/tlspool.conf
@@ -60,6 +60,7 @@ daemon_group tlspool
 # Recognised values include:
 #  - TLS for TLS-level error messages
 #  - PKCS11 for errors in PKCS #11 connections
+#  - KERBEROS for errors in Kerberos operations
 #  - DB for errors related to management database handling
 #  - FILES for errors related to the file system
 #  - CRYPTO for cryptographic information

diff --git a/include/tlspool/internal.h b/include/tlspool/internal.h
index fbce95c..576b853 100644 (file)
--- a/include/tlspool/internal.h
+++ b/include/tlspool/internal.h
@@ -241,6 +241,7 @@ void tlog (unsigned int logmask, int priority, char *format, ...);
 #define TLOG_COPYCAT   0x00002000
 #define TLOG_UNIXSOCK  0x00004000
 #define TLOG_DAEMON    0x00008000
+#define TLOG_KERBEROS  0x00010000
 
 
 /* The security_layer defines a value for each of the possible secure protocols.

diff --git a/src/config.c b/src/config.c
index c3fd922..c53a472 100644 (file)
--- a/src/config.c
+++ b/src/config.c
@@ -138,10 +138,10 @@ struct cfgopt config_options [] = {
        "deny_facilities",      cfg_setvar,     CFGVAR_FACILITIES_DENY,
        "allow_facilities",     cfg_setvar,     CFGVAR_FACILITIES_ALLOW,
        "dnssec_rootkey",       cfg_setvar,     CFGVAR_DNSSEC_ROOTKEY,
-       //NOTYET// "kerberos_client_keytab",    cfg_setvar,     CFGVAR_KRB_CLIENT_KEYTAB,
-       "kerberos_server_keytab",       cfg_setvar,     CFGVAR_KRB_SERVER_KEYTAB,
-       "kerberos_client_credcache",    cfg_setvar,     CFGVAR_KRB_CLIENT_CREDCACHE,
-       "kerberos_server_credcache",    cfg_setvar,     CFGVAR_KRB_SERVER_CREDCACHE,
+       "kerberos_client_keytab",   cfg_setvar, CFGVAR_KRB_CLIENT_KEYTAB,
+       "kerberos_server_keytab",   cfg_setvar, CFGVAR_KRB_SERVER_KEYTAB,
+       "kerberos_client_credcache",cfg_setvar, CFGVAR_KRB_CLIENT_CREDCACHE,
+       "kerberos_server_credcache",cfg_setvar, CFGVAR_KRB_SERVER_CREDCACHE,
        //
        NULL,                   NULL,           CFGVAR_NONE
 };

diff --git a/src/starttls.c b/src/starttls.c
index 6102160..c1753c4 100644 (file)
--- a/src/starttls.c
+++ b/src/starttls.c
@@ -1629,20 +1629,30 @@ static int setup_starttls_kerberos (void) {
        //
        // Check for consistency and log helpful messages for the sysop
        if (k5err != 0) {
-               tlog (TLOG_DAEMON, LOG_ERR, "Error during STARTTLS setup: %s (acting on %s)",
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_ERR, "Error during STARTTLS setup: %s (acting on %s)",
                                krb5_get_error_message (krb_ctx, k5err),
                                cfg);
                retval = GNUTLS_E_UNWANTED_ALGORITHM;
        }
        if (krb_kt_cli != NULL) {
-               tlog (TLOG_DAEMON, LOG_WARNING, "Ignoring the configured kerberos_client_keytab -- it is not implemented yet");
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_WARNING, "Ignoring the configured kerberos_client_keytab -- it is not implemented yet");
        }
        if (krb_cc_cli == NULL) {
-               tlog (TLOG_DAEMON, LOG_ERR, "No kerberos_client_credcache configured, so Kerberos cannot work at all");
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_ERR, "No kerberos_client_credcache configured, so Kerberos cannot work at all");
+               retval = GNUTLS_E_UNWANTED_ALGORITHM;
+       } else if (!krb5_cc_support_switch (
+                       krb_ctx, krb5_cc_get_type (
+                               krb_ctx, krb_cc_cli))) {
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_ERR, "Your kerberos_client_credcache does not support multilpe identities");
                retval = GNUTLS_E_UNWANTED_ALGORITHM;
        }
        if (krb_cc_srv == NULL) {
-               tlog (TLOG_DAEMON, LOG_WARNING, "No kerberos_server_credcache configured, so user-to-user Kerberos will not work");
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_WARNING, "No kerberos_server_credcache configured, so user-to-user Kerberos will not work");
+       } else if (!krb5_cc_support_switch (
+                       krb_ctx, krb5_cc_get_type (
+                               krb_ctx, krb_cc_srv))) {
+               tlog (TLOG_DAEMON | TLOG_KERBEROS, LOG_ERR, "Your kerberos_server_credcache does not support multilpe identities");
+               retval = GNUTLS_E_UNWANTED_ALGORITHM;
        }
        if (retval != GNUTLS_E_SUCCESS) {
                cleanup_starttls_kerberos ();
@@ -1651,7 +1661,7 @@ static int setup_starttls_kerberos (void) {
 }
 #endif
 
-/* Cleanup Kerberks resources.  This must be an idempotent function, because
+/* Cleanup Kerberos resources.  This must be an idempotent function, because
  * it is called when Kerberos panics as well as when 
  */
 #ifdef HAVE_TLS_KDH