kcm: replace old credentials when storing a new one

[pbrezina]

Currently, when KCM stores a new credential it just blindly appends it to the existing credential cache. This make the ccache grow overtime when it stores a credential that already is in the ccache - such as refresh_time control credential which is stored when GSSAPI tries to refresh a particular ticket.

Instead of appending, we should replace the old credential. Even though we have improved KCM performance dramatically, this will help further as the ccache will stay as small as needed.

[pbrezina]

You can use this code to test. Each call will add a new test control credential.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <krb5.h>

int main(int argc, const char **argv)
{
    krb5_data data = {0, strlen("hello"), strdup("hello")};
    krb5_context context;
    krb5_error_code ret;
    krb5_ccache cc;

    ret = krb5_init_context(&context);
    if (ret != 0) {
        printf("krb5_init_context Error %d\n", ret);
        return 1;
    }

    ret = krb5_cc_default(context, &cc);
    if (ret != 0) {
        printf("krb5_cc_default Error %d\n", ret);
        return 1;
    }

    ret = krb5_cc_set_config(context, cc, NULL, "test", &data);
    if (ret != 0) {
        printf("krb5_cc_set_config Error %d\n", ret);
        return 1;
    }

    return 0;
}

$ gcc -ggdb3 -o main src/main.c -lkrb5

[pbrezina]

Pushed PR: #5776

• master
  • 55c5de2 - kcm: replace existing credentials to avoid unnecessary ccache growth
  • aca2e08 - krb5: remove unused mem_ctx from get_krb5_data_from_cred()