krb5_child couldn't parse pkcs11 objects if token label contains semicolon

[lo1ol]

Hi!

I think it could be dangerous too. If token label contains a semicolon, then krb5_child stop read token objects properly. I think it could be a backdoor, because we can pass any pkcs11 lib in this name. Also, I'm not sure what could happen if semicolon will be another object id parts. For example, in object label

Example:

Token name: Token label: Rutoken ECP <no label> pkcs11:mo

Got this in log:
krb5_child.log

(2024-12-05 13:32:53): [krb5_child[302]] [get_pkinit_identity] (0x4000): [RID#5] Got [Rutoken ECP <no label> pkcs11:mo][/opt/aktivco/rtlogon/lib/librtpkcs11ecp.so].
(2024-12-05 13:32:53): [krb5_child[302]] [get_pkinit_identity] (0x4000): [RID#5] Using pkinit identity [PKCS11:module_name=/opt/aktivco/rtlogon/lib/librtpkcs11ecp.so:token=Rutoken ECP <no label> pkcs11:mo:certid=E3E9990F108258E7:certlabel=e3e9990f108258e7].
...

(2024-12-05 13:32:53): [krb5_child[302]] [sss_child_krb5_trace_cb] (0x4000): [RID#5] [302] 1733405573.318464: PKINIT loading identity PKCS11:module_name=/opt/aktivco/rtlogon/lib/librtpkcs11ecp.so:token=Rutoken ECP <no label> pkcs11:mo:certid=E3E9990F108258E7:certlabel=e3e9990f108258e7

(2024-12-05 13:32:53): [krb5_child[302]] [sss_child_krb5_trace_cb] (0x4000): [RID#5] [302] 1733405573.318465: PKINIT opening PKCS#11 module "mo"

(2024-12-05 13:32:53): [krb5_child[302]] [sss_child_krb5_trace_cb] (0x4000): [RID#5] [302] 1733405573.318466: PKINIT PKCS#11 module open failed: unable to load plugin [mo]: mo: cannot open shared object file: No such file or directory

[lo1ol]

may be it's a problem of krb5 or p11-kit. I'm not so dived in your code

[sumit-bose]

Hi,

thank you for your report. It looks like libkrb5 does not support escaping the : character, so I will add a patch to error out of any of the inputs contains a :.

bye,
Sumit

[lo1ol]

Do I need to report a bug in krb5 repo, or will you do that?

[sumit-bose]

Do I need to report a bug in krb5 repo, or will you do that?

Hi,

I opened a ticket asking to at least document this limitation.

bye,
Sumit