Skip to content

Implement Kerberos in Rust NASL using existing C code #2133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kraemii wants to merge 10 commits into
base: main
Choose a base branch
from
Open

Implement Kerberos in Rust NASL using existing C code #2133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
cd805cc
Clean up build scripts
Kraemii Feb 12, 2026
3617ee3
Add: static krb5 lib and openvas implementation
Kraemii Feb 13, 2026
9a94a75
Add: Nasl builtin functions for Kerberos support
Kraemii Feb 16, 2026
edf5533
Add test script for Kerberos authentication
Kraemii Feb 27, 2026
69e1e24
Satisfy clippy
Kraemii Mar 2, 2026
e8732d9
Fix: issue with freeing static krb5 OID
Kraemii Mar 4, 2026
75af02b
Resolve conflicts
Kraemii Mar 5, 2026
b52e352
Use c_char instead of i8
Kraemii Mar 6, 2026
05755ae
Create temporary krb5 config per target as default
Kraemii Mar 10, 2026
c563c9a
Cleanup
Kraemii Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 15 additions & 8 deletions misc/openvas-krb5.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,18 +469,28 @@ o_krb5_gss_prepare_context (const OKrb5Credential *creds,
target->host_name.len + target->domain.len
+ target->service.len + creds->realm.len + 4,
result);
sprintf (target_principal_str, "%s/%s/%s@%s",
(char *) target->service.data, (char *) target->host_name.data,
(char *) target->domain.data, (char *) creds->realm.data);
snprintf (target_principal_str,
target->host_name.len + target->domain.len + target->service.len
+ creds->realm.len + 4,
"%.*s/%.*s/%.*s@%.*s", (int) target->service.len,
(char *) target->service.data, (int) target->host_name.len,
(char *) target->host_name.data, (int) target->domain.len,
(char *) target->domain.data, (int) creds->realm.len,
(char *) creds->realm.data);
}
else
{
ALLOCATE_AND_CHECK (target_principal_str, char,
target->host_name.len + target->service.len
+ creds->realm.len + 3,
result);
sprintf (target_principal_str, "%s/%s@%s", (char *) target->service.data,
(char *) target->host_name.data, (char *) creds->realm.data);
snprintf (target_principal_str,
target->host_name.len + target->service.len + creds->realm.len
+ 3,
"%.*s/%.*s@%.*s", (int) target->service.len,
(char *) target->service.data, (int) target->host_name.len,
(char *) target->host_name.data, (int) creds->realm.len,
(char *) creds->realm.data);
}

targetbuf = (gss_buffer_desc) {
Expand All @@ -499,9 +509,6 @@ o_krb5_gss_prepare_context (const OKrb5Credential *creds,
}

gss_context->gss_target = gss_target;
// gss_set_neg_mechs() already specified that we want gss_mech_krb5
// and/or gss_mech_iakerb
// so we use spnego to do the negotiation
gss_context->gss_mech = gss_mech_spnego;
gss_context->gss_want_flags = GSS_C_MUTUAL_FLAG | GSS_C_DELEG_POLICY_FLAG
| GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG
Expand Down
Loading
Loading