Add GssapiRequiredNameAttributes option #140

mrogers950 · 2017-05-22T15:52:56Z

Allow setting the required name attributes for a session, using a flex and
bison based parser to process the attributes specified.

frozencemetery

Alright, code with tests! I promise all the stuff I've marked is minor.

frozencemetery · 2017-05-22T17:39:15Z

Makefile.am

 	cd $(srcdir) && ./tests/magtests.py --path $(TESTSDIR) --so-dir=$(abs_builddir)/src/.libs

+check-na:


Maybe just fold this into the main check target, rather than putting it on its own?

I can, that was just for me to be able to run the shell tests separately.

frozencemetery · 2017-05-22T17:39:22Z

configure.ac

@@ -83,14 +86,14 @@ AC_CHECK_FUNCS(gss_krb5_ccache_name)
 AC_SUBST([GSSAPI_CFLAGS])
 AC_SUBST([GSSAPI_LIBS])

-MAG_CFLAGS="`${APXS} -q CFLAGS` `${APXS} -q EXTRA_CPPFLAGS` `${APR} --cflags` ${GSSAPI_CFLAGS} ${OPENSSL_CFLAGS} -I`${APXS} -q INCLUDEDIR` `${APR} --includes`"
+MAG_CFLAGS="`${APXS} -q CFLAGS` `${APXS} -q EXTRA_CPPFLAGS` `${APR} --cflags` ${GSSAPI_CFLAGS} ${OPENSSL_CFLAGS} -I`${APXS} -q INCLUDEDIR` `${APR} --includes` -fPIC"


Adding PIE/PIC support is a fine thing to do, but not in scope for this PR.

I forgot to comment that building fails without adding -fPIC here;
/usr/bin/ld: lex/libparser.a(libparser_a-lex.o): relocation R_X86_64_PC32 against undefined symbol `stderr@@GLIBC_2.2.5' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Bad value

I can add it to a separate commit before the main one (and submit a separate PR if you want)

Ah, that makes sense. Maybe just drop a comment above it.

frozencemetery · 2017-05-22T17:39:31Z

src/lex/parser.y

+                        continue;
+                    }
+                    if (($3[0] == '[') && ($3[strlen($3) - 1] == ']')) {
+                        if (hex2bincmp($3 + 1, strlen($3) - 2, (unsigned char *)vals[i], strlen(vals[i]))) {


Wrap at <80 characters, please.

frozencemetery · 2017-05-22T17:40:07Z

src/lex/parser.y

+
+/* Convert hex_len of hex characters into binary and memcmp against bin. Return
+ * 1 if the hex string is valid and matches, else 0. */
+int hex2bincmp(const char *hex, size_t hex_len, unsigned char *bin, size_t bin_len)


<80 here too.

frozencemetery · 2017-05-22T17:41:24Z

src/lex/parser.y

+    r = memcmp(b, bin, b_len);
+    free(b);
+
+    return r == 0 ? 1 : 0;


Can be simplified to just return r == 0.

frozencemetery · 2017-05-22T17:43:42Z

src/mod_auth_gssapi.c

+     * expected_name_attr_verify(). */
+    names = apr_pcalloc(req->pool, (mc->na_count + 1) * sizeof(*names));
+    vals = apr_pcalloc(req->pool, (mc->na_count + 1) * sizeof(*names));
+    for (i = 0; i < mc->na_count; i++) {


Please use C99 for-loop syntax.

frozencemetery · 2017-05-22T17:44:57Z

src/mod_auth_gssapi.h

@@ -138,3 +139,6 @@ struct mag_conn {
 struct mag_conn *mag_new_conn_ctx(apr_pool_t *pool);
 const char *mag_str_auth_type(int auth_type);
 char *mag_error(apr_pool_t *pool, const char *msg, uint32_t maj, uint32_t min);
+extern int expected_name_attr_verify(const char *expr, const char **attrs,
+			      const char **vals);


const char **vals should line up with const char *expr.

frozencemetery · 2017-05-22T17:45:48Z

tests/natest.c

+        exit(1);
+    }
+
+    for (i = 2; i < argc; i++) {


C99 for-loops please.

frozencemetery · 2017-05-22T17:49:06Z

tests/natest.sh

+#!/bin/bash -xe
+cmd=./natest
+
+  # Single match and wildcard.


Could these be echoed instead of just being comments? Might make the logs easier to read through.

frozencemetery · 2017-05-22T17:49:59Z

src/environ.c

+            mc_add_name_attribute(mc, apr_pstrndup(req->pool,
+                                                   attr.name.value,
+                                                   attr.name.length),
+                                  apr_pstrndup(req->pool,


This is kind of gross looking. Can you pull out the apr_pstrndup calls into variables?

simo5 · 2017-05-22T19:12:07Z

src/mod_auth_gssapi.c

@@ -1795,6 +1845,8 @@ static const command_rec mag_commands[] = {
                    "Don't resend negotiate header on negotiate failure"),
    AP_INIT_RAW_ARGS("GssapiNameAttributes", mag_name_attrs, NULL, OR_AUTHCFG,
                     "Name Attributes to be exported as environ variables"),
+    AP_INIT_RAW_ARGS("GssapiExpectedNameAttributes", expect_name_attrs, NULL,


nitpick: if they are Required ... then the name should be GssapiRequiredNameAttributes ?

I think that might actually be the better name now that you mention it.

iboukris · 2017-05-22T19:40:15Z

README

+#### Example
+    GssapiExpectedNameAttributes "auth-indicators=high"
+    GssapiExpectedNameAttributes "auth-indicators=high or other-attr=foo"
+    GssapiExpectedNameAttributes "((auth-indicators=low and auth-indicators=med) or auth-indicators=high)"


Can auth-indicators be both?

Yes, you can have multiple authentication indicators (although that may not be clear with the given example), and the parser will use the list of them when checking for the match on each attribute in the statement.

Hmm, how are we handling multiple values? from the code it looks like we add _N to the name, is that right? does it parse ok?

Oh, I now see that you added a copy of each value.

iboukris · 2017-05-22T20:12:28Z

src/mod_auth_gssapi.c

+    if (!expected_name_attr_expr_check(w)) {
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, parms->server,
+                     "Invalid Name Attribute filter [%s].", w);
+        return NULL;


I think we should return no null here, so it won get silently ignored.

mrogers950 · 2017-05-22T20:42:23Z

I've turned "Expected" to "Required", revised the README text, and now return an error string from expect_name_attrs() (now required_name_attrs()) on a syntax error.

frozencemetery

Missed a couple places the first time.

frozencemetery · 2017-05-23T16:11:03Z

src/lex/parser.y

+extern int yyparse(const char **keys, const char **vals, int *status);
+extern YY_BUFFER_STATE yy_scan_string(char * str);
+extern void yy_delete_buffer(YY_BUFFER_STATE buffer);
+int hex2bincmp(const char *hex, size_t hex_len, unsigned char *bin,


bin and bin_len on their own line; line up with hex

frozencemetery · 2017-05-23T16:11:14Z

src/lex/parser.y

+requiredkv: STRING EQUAL STRING {
+            int i, ret = 0;
+            if (keys != NULL && vals != NULL) {
+                for (i = 0; keys[i] != NULL && vals[i] != NULL; i++) {


frozencemetery · 2017-05-23T16:11:36Z

src/lex/parser.y

+          | STRING EQUAL AST {
+            int i, ret = 0;
+            if (keys != NULL && vals != NULL) {
+                for (i = 0; keys[i] != NULL && vals[i] != NULL; i++) {


frozencemetery · 2017-05-23T16:11:56Z

src/lex/parser.y

+
+static int hexchar(unsigned int c)
+{
+    if ((c >= '0') && (c <= '9'))


Parens not needed; also applies to rest of function

iboukris · 2017-05-23T19:44:17Z

Do attributes specified in GssapiRequiredNameAttributes need to be specified in GssapiNameAttributes too? from the code it looks like yes, so maybe we need to clarify it, or address it in code.

simo5 · 2017-05-23T20:13:02Z

Uhmm good point @Frenche I wonder if we should error out if the required is not a subset or if we should automaticaly add the ones in the required parser (do we have a simple way to get a list of them) to the set of items we retrieve, or if we should "shadow" retrieve them.
We may not want to expose named attributes we use for authorization to the application necessarily.

simo5

I think we need some changes, but the core is ok.
Any chance we have a way to expose some name attributes in the functional testsuite so we can have a (smoke) test that the whole thing works correctly ?

simo5 · 2017-05-22T19:15:24Z

src/environ.c

+                           struct mag_conn *mc)
+{
+    apr_table_set(mc->env, "GSS_NAME", mc->gss_name);
+    apr_table_set(mc->env, "GSS_NAME_ATTR_ERROR", "name attribute mismatch");


maybe: "required name attributes check unsatisfied"

simo5 · 2017-05-24T12:32:40Z

src/environ.c

+            v = apr_pstrndup(req->pool, attr.value.value, attr.value.length);
+
+            mc_add_name_attribute(mc, n, v);
+


so I have been thinking about this.

Why are you forcibly re-adding the name attribute here ? This will break the semantics of the Name Attribute interface I think.

do not use 1 letter vars

in a case like this I think it makes more sense to declare these var in the do{} block, not across the whole function

I think we need separate lists for required_name_attributes

This last point is the main one, I think we should have a separate list for required attributes because some people may want to use specific name attribute (say auth indicators) without being forced to expose them as env vars to the application.
So I guess we need a required_nameattr variable on mc where we set attributes use to check required attributes.

Sure, I see how this is problematic. I'll separate the required attributes from the env exposed ones. As for the smoke test, against a 1.16 krb5 KDC we could enable the encrypted challenge indicator (does not require as much config as PKINIT/OTP) and test against that, otherwise I'm not sure what other name attribute we could enable in the test suite and test against.

Any name attribute will work, pick the simplest to expose

+1 on the above.
One way to go about it could be to store raw attributes on the MC struct (if we need it for either env or authz), and defer the parsing to a later point.

simo5 · 2017-05-24T12:34:20Z

src/mod_auth_gssapi.c

@@ -1151,6 +1151,30 @@ static int mag_auth(request_rec *req)
    return ret;
 }

+/* Return 1 if the received name attributes are allowed by the
+ * GssapiRequiredNameAttributes option, or else 0. */
+static int verify_name_attributes(struct mag_config *cfg, request_rec *req,


-> verify_required_name_attributes()

simo5 · 2017-05-24T12:35:02Z

src/lex/parser.y

+
+void yyerror(const char **keys, const char **vals, int *status, const char *s)
+{
+    return;


please prepend functions that are not static with a mag_ prefix

simo5 · 2017-05-24T12:42:37Z

src/mod_auth_gssapi.c

+    /* Use NULL terminated string arrays to pass name attributes and values to
+     * required_name_attr_verify(). */
+    names = apr_pcalloc(req->pool, (mc->na_count + 1) * sizeof(*names));
+    vals = apr_pcalloc(req->pool, (mc->na_count + 1) * sizeof(*names));


As you change this code to store attributes into a separate required_nameattr structure, store them there already zero terminated. Please also check that the values do not contain embedded zeros by verifying with strlen() that the length match what you expect and fire a debug log if they don't. (Or perhaps auto-base64 the value in this case ?)

I guess if you do the above this function can go away entirely ...

simo5 · 2017-05-24T12:47:48Z

src/mod_auth_gssapi.c

@@ -1795,6 +1845,8 @@ static const command_rec mag_commands[] = {
                    "Don't resend negotiate header on negotiate failure"),
    AP_INIT_RAW_ARGS("GssapiNameAttributes", mag_name_attrs, NULL, OR_AUTHCFG,
                     "Name Attributes to be exported as environ variables"),
+    AP_INIT_RAW_ARGS("GssapiRequiredNameAttributes", required_name_attrs, NULL,
+                     OR_AUTHCFG, "Name Attributes required to be present"),


If we support != expressions then this description is not correct.
We should say something like: Required checks for Name Attributes

and perhaps the option should actually be called GssapiCheckNameAttributes ? Or GssapiVerifyNameAttributes now that I think of it ? Sorry for not realizing this sooner.

Seems we do not support !=, is this a conscious decision to avoid "deny" accerss control cases ?
If not what is the reasoning ?
I am perfectly fine not supporting !=, but I think we should add to the README explicitly that we match only on '=' and we do not support '!='

No particular reason, though we certainly can support deny rules if you think there will be demand for it.

I guess someone will ask, but in general I tend to be against the concept of "deny ACL" because they do not fail safe.

simo5 · 2017-05-24T12:52:58Z

src/mod_auth_gssapi.h

@@ -138,3 +139,6 @@ struct mag_conn {
 struct mag_conn *mag_new_conn_ctx(apr_pool_t *pool);
 const char *mag_str_auth_type(int auth_type);
 char *mag_error(apr_pool_t *pool, const char *msg, uint32_t maj, uint32_t min);
+extern int required_name_attr_verify(const char *expr, const char **attrs,
+                                     const char **vals);
+extern int required_name_attr_expr_check(const char *expr);


Is there a reason why these are not being pulled in with a dedicated include file ?

I'll make a dedicated include for these.

mrogers950 · 2017-05-24T21:34:27Z

I've pushed my current changes, that should be mostly everything except for the smoke test which I am working on, and will push later.

simo5 · 2017-05-25T13:31:46Z

src/environ.c

+            if (!mag_get_name_attr(req, name, &attr)) {
+                break;
+            }
+            mc_add_req_name_attribute(req, mc, attr.name, attr.value);


In the oriignal name attribute code we pull in display_value and fall back to value only if that is not available.

simo5 · 2017-05-25T13:33:24Z

src/environ.c

+                                                  name.length);
+    mc->required_name_attrs[count + 1] = NULL;
+
+    mc->required_name_vals[count] = apr_pstrndup(mc->pool, value.value,


There is no check that value is in fact a string, this code will not handle binary values with embedded zeros well if such are passed in.
Or are we sure name attributes are always guaranteed to be printable strings ?

simo5 · 2017-05-25T13:39:51Z

src/environ.c

+
+    ap_set_module_config(req->request_config, &auth_gssapi_module, mc->env);
+    mag_export_req_env(req, mc->env);
+}


Should we just set the error env var here and then call mag_set_req_data() to complete ?
It seem like maiing env vars and ccaches available to the error handler may be valuable given yiou are calling mag_export_req_env() here but not mag_set_name_attributes() which is somewhat required to fill the proper tables.

simo5 · 2017-05-25T13:40:09Z

src/environ.c

+                           struct mag_conn *mc)
+{
+    apr_table_set(mc->env, "GSS_NAME", mc->gss_name);
+    apr_table_set(mc->env, "GSS_NAME_ATTR_ERROR",


Should this be GSS_REQUIRED_NAME_ATTR_ERROR ?

simo5 · 2017-05-25T13:43:53Z

src/mod_auth_gssapi.c

@@ -1176,6 +1177,20 @@ static int mag_complete(struct mag_req_cfg *req_cfg, struct mag_conn *mc,
    mc->expiration = time(NULL) + vtime;

    mag_get_name_attributes(req, cfg, client, mc);
+    mag_get_required_name_attributes(req, cfg, client, mc);


I understand why you spoon this out in a new function, however, this means we call gss_get_name_attribute twice for each attribute, and it may be an expensive call.
Can we rather restructure mag_get_name_attributes() so it calls gss_get_name_attribute() *once but then internally calls two subfunctions to fill the two arrays ?

EDIT: added *once

simo5 · 2017-05-25T13:45:23Z

src/mod_auth_gssapi.c

@@ -1795,6 +1845,8 @@ static const command_rec mag_commands[] = {
                    "Don't resend negotiate header on negotiate failure"),
    AP_INIT_RAW_ARGS("GssapiNameAttributes", mag_name_attrs, NULL, OR_AUTHCFG,
                     "Name Attributes to be exported as environ variables"),
+    AP_INIT_RAW_ARGS("GssapiRequiredNameAttributes", required_name_attrs, NULL,
+                     OR_AUTHCFG, "Name Attributes required to be present"),


I guess someone will ask, but in general I tend to be against the concept of "deny ACL" because they do not fail safe.

mrogers950 · 2017-06-09T19:51:10Z

Sorry about the delay on this update. Here's an overview of the changes:

Build bison and flex code as source files for the mod_auth_gssapi library instead of its own object. This removes some portability warnings about linking to mod_auth_gssapi. Use a separate header.
Change the binary value specifier to ':=' (as in name:=value).
Add the base64 value case to the parser where the incoming name attribute values are converted to base64 before comparing to the expected value.
Store the environment name attributes and the to-be-verified name attributes separately in mag_conn, and prefer the display value.
For testing generate x509 certificates and enable PKINIT with multiple PKINIT indicators, and add required attribute test locations. In order to avoid PKINIT messing with the other tests, add a new user (maguser3) and perform PKINIT only before running the required attribute tests.

One issue is that autotools seems to have some problem during libtool linking the standalone parser test program tests/natest.c, where it cannot resolve the apr_base64* functions used by the parser. I've tried quite a few different Makefile.am configurations for it with no luck, so some suggestions would be helpful. For the moment I've left those build statements commented out.

simo5 · 2017-06-12T12:21:54Z

README

+This option allows specifying one or more Name Attributes that the client must
+possess in order to be authorized to access the location. The required Name
+Attributes are specified by name=value pairs (name being the ATTRIBUTE_NAME as
+mentioned above, and value being an ASCII string. Alternately, if a Name


ASCII -> Can we say UTF8? Or do we have no guarntees in which case we should just use a "Null terminated string" ?

Now that I think of it, are spaces allowed in bare strings ?

I don't think there is a guarantee for UTF-8 here as I specified just character values in the lex rules (but it might be possible to specify UTF-8 code points instead). And spaces are not allowed in bare strings as that would be considered a token separation, so if there is a space expected in the value then the base64 option should be used. I can update the README with this clarification.

Yes, please, it will help nuderstanding when you must use bse64

simo5 · 2017-06-12T12:24:59Z

src/environ.c

+    for (count = 0; mc->required_name_attrs != NULL &&
+                    mc->required_name_attrs[count] != NULL &&
+                    mc->required_name_vals != NULL &&
+                    mc->required_name_vals[count] != NULL; count++);


Is it legal to have names w/o corresponding value ?

simo5 · 2017-06-12T12:28:40Z

src/mod_auth_gssapi.h

@@ -128,6 +129,8 @@ struct mag_conn {
    struct databuf basic_hash;
    bool is_preserved;
    int na_count;
+    const char **required_name_attrs;
+    const char **required_name_vals;


Looking at the code it seem like these two arrays are always allocated and handled in pairs.
Maybe we should have instead a:
struct mag_required_name_attr {
const char *name;
const char *value;
};

And just allocate an array of these ?
Given we often count them, we could also add a size_t req_name_attr_count, and keep their number around.

Right, they are a pair. Turning it into a struct with a counter for clarity is OK with me.

Actually, I opted to store them in this way to make it simple to pass to the parser. Storing them in a mag_attr struct would need a conversion later on (or a change in the parser). So I'd prefer to keep them this way and add in a comment for clarification.

simo5

I have only nits, but I am not requiring them, just wondering if they'd made code more clear.
Otherwise I think we are good to go.
@frozencemetery or @Frenche could you give another quick look ?

frozencemetery · 2017-06-12T20:11:55Z

I have no non-nit objections

iboukris · 2017-06-14T19:15:36Z

Great stuff, I plan to review some more over the weekend, (no need to hold the merge however).

iboukris · 2017-06-16T18:07:10Z

src/environ.c

+        if (!mc->required_name_attrs || !mc->required_name_vals) {
+            apr_pool_abort_get(mc->pool)(ENOMEM);
+        }
+        apr_pool_userdata_setn(mc, GSS_NAME_ATTR_USERDATA,


Maybe better to be called once at mc constructor.

Please ignore this comment, I now see it was modeled after the other directive, so let's leave it for now.

iboukris · 2017-06-16T18:11:31Z

src/environ.c

+        val = apr_pstrndup(mc->pool, attr->display_value.value, len);
+    } else if (attr->value.length != 0) {
+        len = attr->value.length;
+        val = apr_pcalloc(mc->pool, len + 1);


If raw value may embed null, then the length must be kept along or it should be encoded here, otherwise it will get cut at the first null occurrence when accessed.

iboukris · 2017-06-16T18:13:17Z

src/environ.c

+        len = attr->value.length;
+        val = apr_pcalloc(mc->pool, len + 1);
+        memcpy(val, attr->value.value, len);
+    }


Maybe else {error_out}, and perhaps move this block upper.

mrogers950 · 2017-06-19T18:02:21Z

Updated, now we prepend the value length to the saved value. In the parser we read in the length prefix and use it for the value comparison. I moved the value checks in mag_set_required_name_attr() with an else return as suggested, and also stuck in an ap_log_rdata() call to print out the raw value data.

simo5 · 2017-06-20T15:00:01Z

@mrogers950 github claims there are merge conflicts, can you check ?

mrogers950 · 2017-06-20T15:40:42Z

Rebased to latest master.

simo5 · 2017-06-21T09:37:52Z

@Frenche can you confirm your remarks have been addressed ?

iboukris

Looks good to me.
I can't build right now but I think I noticed some warnings last time, if there are it would be nice to silence them.

mrogers950 · 2017-06-27T16:54:54Z

I added in the flex options to silence the remaining warnings.

simo5 · 2017-07-13T09:04:23Z

make test fails for me:
{{{
cd . && ./tests/magtests.py --path /home/simo/devel/git/mod_auth_gssapi/testsdir --so-dir=/home/simo/devel/git/mod_auth_gssapi/src/.libs
/home/simo/devel/git/mod_auth_gssapi/testsdir/key.pem
SPNEGO: SUCCESS
SPNEGO Proxy Auth: SUCCESS
SPNEGO No Auth: SUCCESS
SPNEGO Rewrite: SUCCESS
SPNEGO Negotiate Once: SUCCESS
HOSTNAME ACCEPTOR: SUCCESS
BAD ACCEPTOR: SUCCESS
Traceback (most recent call last):
File "./tests/magtests.py", line 722, in
testenv = kinit_certuser(testdir, testenv)
File "./tests/magtests.py", line 477, in kinit_certuser
raise ValueError('kinit failed')
ValueError: kinit failed
Makefile:821: recipe for target 'check' failed
make: *** [check] Error 1
}}}

Do we require some specific version of some dependency ?
If so can you add a check in configure ?

make test fails still

simo5

Please fix make test or fix configure to require the right stuff

Allow setting the required name attributes for a session, using a flex and bison based parser to process the attributes specified.

mrogers950 · 2017-07-24T21:09:41Z

That happens when krb5-pkinit isn't installed, so I added a dirty check for the pkinit module and skip the name attribute tests with a warning if it's not found, and README.md mentions the krb5-pkinit dependency for the tests.

frozencemetery reviewed May 22, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch 2 times, most recently from 0833a43 to 09cf378 Compare May 22, 2017 19:03

simo5 reviewed May 22, 2017

View reviewed changes

iboukris reviewed May 22, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch from 09cf378 to 8be6da1 Compare May 22, 2017 20:38

mrogers950 changed the title ~~Add GssapiExpectedNameAttributes option~~ Add GssapiRequiredNameAttributes option May 22, 2017

frozencemetery reviewed May 23, 2017

View reviewed changes

simo5 requested changes May 24, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch 2 times, most recently from d007451 to cb823ab Compare May 24, 2017 21:28

simo5 requested changes May 25, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch from cb823ab to c6d3e73 Compare June 9, 2017 19:11

simo5 reviewed Jun 12, 2017

View reviewed changes

simo5 previously approved these changes Jun 12, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch from c6d3e73 to b4c0e7d Compare June 12, 2017 14:45

iboukris reviewed Jun 16, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch from b4c0e7d to 5ff54df Compare June 19, 2017 17:49

Add -fPIC to MAG_CFLAGS

4c86cdd

mrogers950 force-pushed the expected_name_attr branch from 5ff54df to 5668f9b Compare June 20, 2017 15:40

iboukris approved these changes Jun 23, 2017

View reviewed changes

mrogers950 force-pushed the expected_name_attr branch from 5668f9b to c427b0e Compare June 27, 2017 16:54

simo5 requested changes Jul 13, 2017

View reviewed changes

Add GssapiRequiredNameAttributes option

802498c

Allow setting the required name attributes for a session, using a flex and bison based parser to process the attributes specified.

mrogers950 force-pushed the expected_name_attr branch from c427b0e to 802498c Compare July 24, 2017 21:05

simo5 closed this in fe50dfe Jul 25, 2017

simo5 mentioned this pull request Oct 3, 2017

GssapiExpectedNameAttribute option #137

Closed

		cd $(srcdir) && ./tests/magtests.py --path $(TESTSDIR) --so-dir=$(abs_builddir)/src/.libs

		check-na:

		v = apr_pstrndup(req->pool, attr.value.value, attr.value.length);

		mc_add_name_attribute(mc, n, v);

Add GssapiRequiredNameAttributes option #140

Add GssapiRequiredNameAttributes option #140

Uh oh!

Conversation

mrogers950 commented May 22, 2017

Uh oh!

frozencemetery left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrogers950 commented May 22, 2017

Uh oh!

frozencemetery left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iboukris commented May 23, 2017

Uh oh!

simo5 commented May 23, 2017

Uh oh!

simo5 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment