Skip to content

Commit 5324297

Browse files
author
Yashwant Sahu
committed
Bug #31862170 : SASL PLUGIN DOES NOT HONOUR KERBEROS STANDARD OF PORTS IN HOSTNAME
KDC host information from Kerberos configuration is used by LDAP SASL client API while initialization. For example: kdchost.example.com or also kdchost.example.com:88 Previously plugin was not parsing port number and this was resulting into error. Now plug-in is parsing for port number and retrieving correct KDC host. RB : 26987
1 parent bdd97f6 commit 5324297

File tree

1 file changed

+45
-3
lines changed

1 file changed

+45
-3
lines changed

libmysql/authentication_ldap/auth_ldap_kerberos.cc

+45-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Copyright (c) 2020, 2021, Oracle and/or its affiliates.
1+
/* Copyright (c) 2020, 2022, Oracle and/or its affiliates.
22
33
This program is free software; you can redistribute it and/or modify
44
it under the terms of the GNU General Public License, version 2.0,
@@ -284,6 +284,23 @@ bool Kerberos::obtain_store_credentials() {
284284
ldap_server_host = ldap_host.oracle.com
285285
ldap_destroy_tgt = true
286286
}
287+
288+
kdc:
289+
The name or address of a host running a KDC for that realm.
290+
An optional port number, separated from the hostname by a colon, may
291+
be included. If the name or address contains colons (for example, if it is
292+
an IPv6 address), enclose it in square brackets to distinguish the colon
293+
from a port separator.
294+
295+
For example:
296+
kdchost.example.com:88
297+
[2001:db8:3333:4444:5555:6666:7777:8888]:88
298+
299+
Details from:
300+
https://web.mit.edu/kerberos/krb5-latest/doc/admin/conf_files/krb5_conf.html
301+
302+
Host information is used by LDAP SASL client API while initialization.
303+
LDAP SASL API doesn't need port information and port is not used any where.
287304
*/
288305
bool Kerberos::get_kerberos_config() {
289306
log_dbg("Getting kerberos configuration.");
@@ -343,8 +360,33 @@ bool Kerberos::get_kerberos_config() {
343360
goto EXIT;
344361
}
345362
}
346-
m_ldap_server_host = host_value;
347-
log_info(host_value);
363+
if (host_value) {
364+
std::stringstream log_stream;
365+
m_ldap_server_host = host_value;
366+
log_stream << "Kerberos configuration KDC : " << m_ldap_server_host;
367+
log_info(log_stream.str());
368+
log_stream.str("");
369+
size_t pos = m_ldap_server_host.npos;
370+
/* IPV6 */
371+
if (m_ldap_server_host[0] == '[') {
372+
pos = m_ldap_server_host.find("]");
373+
if (pos != m_ldap_server_host.npos &&
374+
(m_ldap_server_host.length() > (pos + 1)) &&
375+
(m_ldap_server_host[pos + 1] == ':')) {
376+
m_ldap_server_host = m_ldap_server_host.substr(1, pos - 1);
377+
}
378+
}
379+
/* IPV4 */
380+
else {
381+
pos = m_ldap_server_host.find(":");
382+
if (pos != m_ldap_server_host.npos) {
383+
m_ldap_server_host.erase(pos);
384+
}
385+
}
386+
log_stream << "Processed Kerberos KDC: " << m_ldap_server_host;
387+
log_info(log_stream.str());
388+
log_stream.str("");
389+
}
348390

349391
/*
350392
Get the LDAP destroy TGT from MySQL app section.

0 commit comments

Comments
 (0)