summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Remove unneeded check in SPNEGO initiatorGreg Hudson2013-12-161-7/+0
| | | | | | | | In init_ctx_cont, if the response token contains no fields, we set a return value but don't actually quit out of the function. We do not need this check (we will fail later on if a piece of required information isn't present), so just remove it. Reported by simo@redhat.com.
* Fix SPNEGO one-hop interop against old IISGreg Hudson2013-12-121-0/+6
| | | | | | | | | | | | | | | | IIS 6.0 and similar return a zero length reponse buffer in the last SPNEGO packet when context initiation is performed without mutual authentication. In this case the underlying Kerberos mechanism has already completed successfully on the first invocation, and SPNEGO does not expect a mech response token in the answer. If we get an empty mech response token when the mech is complete during negotiation, ignore it. [ghudson@mit.edu: small code style and commit message changes] ticket: 7797 (new) target_version: 1.12.1 tags: pullup
* Fix up tests directory ignores, deps, cleanupGreg Hudson2013-12-123-2/+15
| | | | | A few test programs didn't make it into .gitignore, OBJS, or EXTRADEPSRCS.
* Add tests for krb5_sname_to_principalGreg Hudson2013-12-125-4/+197
|
* Allow ":port" suffixes in sn2princ hostnamesGreg Hudson2013-12-111-2/+37
| | | | | | | | | MSSQLSvc principal names can contain a ":port" or ":instance" trailer on the hostname part. If we see that in the hostname argument of krb5_sname_to_principal(), remove it before canonicalizing the hostname and put it back on afterwards. ticket: 7795 (new)
* Modernize sn2princ.cGreg Hudson2013-12-112-145/+115
| | | | | Refactor and edit sn2princ.c to match current coding style. No behavior changes, except to be less chatty in trace logs.
* Update man pagesTom Yu2013-12-1025-138/+323
|
* make dependTom Yu2013-12-1012-61/+100
|
* Better keysalt docsTom Yu2013-12-096-39/+62
| | | | | | | | | | Add a new section to kdc_conf.rst to describe keysalt lists, and update other documentation to better distinguish enctype lists from keysalt lists. ticket: 7608 target_version: 1.12 tags: pullup
* Avoid malloc(0) in SPNEGO get_input_tokenGreg Hudson2013-12-061-6/+9
| | | | | | | If we read a zero-length token in spnego_mech.c's get_input_token(), set the value pointer to NULL instead of calling malloc(0). ticket: 7794 (new)
* Fix S4U2Self against non-FAST KDCsGreg Hudson2013-12-061-5/+34
| | | | | | | | | | | When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs which don't support FAST, because the S4U2Self padata is only present within the FAST request. For now, duplicate that padata in the outer request so that both FAST and non-FAST KDCs can see it. ticket: 7791 target_version: 1.11.5 tags: pullup
* Fix error message quotations in install_kdc.rstTom Yu2013-12-031-6/+5
| | | | | | | | | | | Some error messages that kprop could print were quoted incorrectly in install_kdc.rst. Also fix minor typos. ticket: 7785 (new) target_version: 1.12 tags: pullup
* Edit README.asn1Greg Hudson2013-12-031-34/+51
| | | | | | Add another blank line before section headers. Avoid contractions. Change some whiches to thats where it seems appropriate. Fix some missing or extra words.
* Bump libgssrpc minor versionTom Yu2013-11-271-1/+1
| | | | | | Bump minor version for the new log_badauth2 interfaces. ticket: 7770
* Correctly log IPv6 addresses in kadmindGreg Hudson2013-11-255-58/+50
| | | | | | | | | | | | | | Define client_addr() in server_stubs.c and use it consistently in that file and ipropd_svc.c to get the client address from a transport handle. In it, call getpeername() on the client socket and use inet_ntop() on the result, instead of using inet_ntoa() on the IPv4 socket address. Provide a log_badauth2 callback to GSSRPC, so that we get a transport handle instead of an IPv4 socket address, and use client_addr() within it instead of inet_ntoa(). ticket: 7770 target_version: 1.12 tags: pullup
* Add new versions of log_badauth gssrpc callbacksGreg Hudson2013-11-255-11/+59
| | | | | | | | | | libgssrpc supports two callbacks for gss_accept_sec_context failures on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are IPv4-specific. Provide an alternate version which supplies the transport handle instead of the address, so that we can get the address via the file descriptor for TCP connections. ticket: 7770
* Remove inet_ntoa() prototype from getrpcent.cBen Kaduk2013-11-251-1/+0
| | | | | | | It is not needed. In general, we shouldn't be using inet_ntoa(), anyway, as it is IPv4-specific and we have IPv6 support almost everywhere.
* Update doc for current kdb5_util dump versionTom Yu2013-11-221-1/+1
| | | | | | | | | kdb5_util.rst incorrectly describes the current default dump format version as 6 when it should be 7. Reported by Jeff D'Angelo. ticket: 7777 target_version: 1.12 tags: pullup
* Edit ccache_def.rstGreg Hudson2013-11-221-79/+83
| | | | | | | Re-fill to 70 columns. Replace non-ascii apostrophes with ASCII ones. Edit wording slightly. ticket: 7776
* Added a new ccache doc to "Kerberos V5 concepts"Zhanna Tsitkov2013-11-222-0/+135
| | | | | | | | | This is to add a short introductory document on credential caches to the Concepts section of Kerberos documentation. ticket: 7776 (new) target_version: 1.12 tags: pullup
* Improve default ccache name API documentationGreg Hudson2013-11-221-6/+25
| | | | | | | | | | | | Document the lifetime and caching behavior of the krb5_cc_default_name() return value. Document that krb5_cc_set_default_name() may be called with NULL to purge the cached value. Correct a typo in the krb5_cc_default() summary and explicitly reference krb5_cc_default_name(). ticket: 7775 (new) target_version: 1.12 tags: pullup
* Correct kadm5.acl back-reference documentationGreg Hudson2013-11-211-3/+4
| | | | | | | | | In kadm5.acl, *N in the target principal name refers to the Nth wildcard in the acting principal pattern, not the Nth component. ticket: 7774 (new) target_version: 1.12 tags: pullup
* Add another kadmin ACL test for backreferencesGreg Hudson2013-11-211-0/+6
| | | | | | Add a test using backreferences which don't correspond directly to principal components, to verify that *N refers to the Nth wildcard and not the Nth component.
* Clarify lockout replication issues in docsGreg Hudson2013-11-181-7/+13
| | | | | | | | | | | | In the "KDC replication and account lockout" section of lockout.rst, specifically call out kprop and incremental propagation as the mechanisms which do not replicate account lockout state, and add a note that KDCs using LDAP may not be affected by that section's concerns. ticket: 7773 (new) target_version: 1.12 tags: pullup
* Remove dangling --with-kdc-kdb-update referencesGreg Hudson2013-11-172-19/+0
| | | | | | This configure option hasn't done anything since 1.8, so don't mention it in configure --help or the documentation. The disable_last_success and disable_lockout DB options are now used to turn it off.
* Remove a warning in AES string-to-keyGreg Hudson2013-11-151-7/+4
| | | | | | | On 32-bit platforms, the code to translate an iteration count of 0 to 2^32 can trigger a compiler warning. Since we will basically never accept an iteration count that high (right now we reject anything above 2^24), just reject it out of hand.
* Set expiration time on keys and keyringsSimo Sorce2013-11-151-5/+66
| | | | | | | | | | | By setting the timeout based on the credetial's timeout we let the system automatically cleanup expired credentials. [ghudson@mit.edu: simplified code slightly] ticket: 7769 (new) target_version: 1.12 tags: pullup
* Add support to store time offsets in cc_keyringSimo Sorce2013-11-151-2/+203
| | | | | | | | | | | | | | The code follows the same model used for the memory ccache type. Time offsets are stored in each credential cache in a special key just like the principal name. Legacy session caches do not store timestamps as legacy code would fail when iterating over the new offset key. [ghudson@mit.edu: minor formatting changes; note legacy session exception in commit message] ticket: 7768 (new) target_version: 1.12 tags: pullup
* Enforce minimum PBKDF2 iteration countTom Yu2013-11-153-65/+233
| | | | | | | | | Also add a testing interface to allow weak iteration counts. (Published test vectors use weak iteration counts.) ticket: 7465 target_version: 1.12 tags: pullup
* Catch more strtol() failures when using KEYRINGsNalin Dahyabhai2013-11-121-3/+3
| | | | | | | | | | | | | When parsing what should be a UID while resolving a KEYRING ccache name, don't just depend on strtol() to set errno when the residual that we pass to it can't be parsed as a number. In addition to checking errno, pass in and check the value of an "endptr". [ghudson@mit.edu: simplified slightly] ticket: 7764 (new) target_version: 1.12 tags: pullup
* Clarify realm and dbmodules configuration docsGreg Hudson2013-11-061-23/+34
| | | | | | | | | | | | | In kdc_conf.rst, add examples showing how to configure a realm parameter and a database parameter. Document that the default DB configuration section is the realm name, and use that in the example. Move the db_module_dir description to the end of the [dbmodules] documentation since it is rarely used and could confuse a reader about the usual structure of the section. ticket: 7759 (new) target_version: 1.12 tags: pullup
* Multi-realm KDC null deref [CVE-2013-1418]Tom Yu2013-11-041-0/+3
| | | | | | | | | | | | | | | If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C A related but more minor vulnerability requires authentication to exploit, and is only present if a third-party KDC database module can dereference a null pointer under certain conditions. ticket: 7755 (new) target_version: 1.12 tags: pullup
* Remove rtm_type_name()Ben Kaduk2013-11-041-37/+0
| | | | | It has been unused since 2009 when Ken decided that the routing log messages were too verbose (commit 91fc077c96926dd60).
* Clean up the code to eliminate some clang warningsBen Kaduk2013-11-048-11/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In ure.c, though k is a short, the literal 1 is of type 'int', and so the operation 'k + 1' is performed at the (32-bit) width of int, and therefore the "%d" format string is correct. In accept_sec_context.c, the 'length' field of krb5_data is an unsigned type, so checking for a negative value has no effect. In net-server.c, the helper routine rtm_type_name() is only used in code that is disabled with #if 0 conditionals; make the definition also disabled in the same way to avoid warnings of an unused function. In kdc_authdata.c, equality checks in double parentheses elicit a warning from clang. The double-parentheses idiom is normally used to indicate that an assignment is being performed, but the value of the assignment is also to be used as the value for the conditional. Since assignment and equality checking differ only by a single character, clang considers this worthy of a warning. Since the extra set of parentheses is redundant and against style, it is correct to remove them. In several places (sim_server.c, dump.c, kdb5_destroy.c, ovsec_kadmd.c), there are declarations of extern variables relating to getopt() functionality that are now unused in the code. Remove these unused variables.
* Make set_cloexec_fd return voidBen Kaduk2013-11-041-10/+7
| | | | | | | | | We never check its return value (causing clang to emit warnings), and its use is primarily in cases where we should continue processing in the event of failure. Just ignore errors from the underlying fcntl() call (if present) and treat this operation as best-effort. The #if 0 code should probably be removed.
* Avoid deprecated krb5_get_in_tkt_with_keytabBen Kaduk2013-11-043-46/+46
| | | | | | | | | | | | | | | | | | | | | The kprop code has been pretty unloved, and uses some routines that are marked as deprecated (which show up as warnings in the build log). Use the documented replacement for krb5_get_in_tkt_with_keytab, krb5_get_init_creds_keytab, instead. As a bonus, there is no longer a side effect of a credentials cache that needs to be destroyed. The also-deprecated function krb5_get_in_tkt_with_skey was backending to it when no keyblock was passed in; we can unroll the call to krb5_get_init_creds_keytab ourselves as the documented workaround. While here, improve style compliance with regards to cleanup. The setkey test just wants to know whether it can use the key it just put into a keytab to get credentials; as such the recommended krb5_get_init_creds_keytab is quite sufficient. While here, use that interface to request the particular enctype as well, reducing the scope of an XXX comment. ticket: 6366
* Remove last uses of "possibly-insecure" mktemp(3)Ben Kaduk2013-11-043-23/+39
| | | | | | | | | | | | | | | | | | | | Many libc implementations include notations to the linker to generate warnings upon references to mktemp(3), due to its potential for insecure operation. This has been the case for quite some time, as was noted in RT #6199. Our usage of the function has decreased with time, but has not yet disappeared entirely. This commit removes the last few instances from our tree. kprop's credentials never need to hit the disk, so a MEMORY ccache is sufficient (and does not need randomization). store_master_key_list is explicitly putting keys on disk so as to do an atomic rename of the stash file, but since the stash file should be in a root-only directory, we can just use a fixed name for the temporary file. When using this fixed name, we must detect (and error out) if the temporary file already exists; add a test to confirm that we do so. ticket: 1794
* Clean up stash file error handlingBen Kaduk2013-11-041-3/+2
| | | | | | | | | | | The comment previously failed to match the behavior. The intent was that if we failed to write out the entire stash file into the temporary location, we should remove the partial file. However, the code was actually checking whether the *real* stash file existed, not whether the temporary one existed. It is safe to always try to unlink the partial file, and not worry about whether it already exists.
* Use retval, not errno, when stashing master keysBen Kaduk2013-11-043-3/+3
| | | | | | The krb5_db_store_master_key{,_list} functions return a krb5_error_code, and do not necessarily set errno on failure. Use the correct variable while reporting errors with com_err().
* Clarify kpropd standalone mode documentationGreg Hudson2013-11-011-15/+12
| | | | | | | | | | | | The kpropd -S option is no longer needed to run kpropd in standalone mode, but its functionality is not deprecated; standalone mode is automatically activated when appropriate. Clarify the kpropd documentation on standalone mode to avoid giving the impression that the mode is deprecated. ticket: 7751 (new) target_version: 1.12 tags: pullup
* Document master key rolloverGreg Hudson2013-10-301-0/+51
| | | | | | | | | Add a new section to database.rst documenting the procedure for rolling the master key. ticket: 7732 (new) target_version: 1.12 tags: pullup
* Improve LDAP KDB initialization error messagesGreg Hudson2013-10-301-7/+7
| | | | | | | | | | | | | In krb5_ldap_initialize, don't just blat the LDAP error into the extended message; give an indication of which LDAP operation we were trying to do and show what parameters we gave to it. (Also, krb5_set_error_message can handle a null context argument, so don't bother to check before calling.) ticket: 7739 (new) target_version: 1.12 tags: pullup
* Add tests for anonymous kadminGreg Hudson2013-10-301-0/+13
|
* Use correct default principal for kadmin -nGreg Hudson2013-10-301-6/+14
| | | | | | | | | Use WELLKNOWN/ANONYMOUS@realm as the default principal for kadmin -n, just like we do for kinit -n. ticket: 7741 (new) target_version: 1.12 tags: pullup
* Accept anonymous GSS names in kadmindGreg Hudson2013-10-301-6/+19
| | | | | | | | | | | | | | | | The krb5 implementation of gss_display_name() reports the name type as GSS_C_NT_ANONYMOUS if the client uses an anonymous principal. Accept this name type in gss_name_to_string and gss_to_krb5_name so that anonymous kadmin can work. Also improve code hygiene: call gss_name_to_string from gss_to_krb5_name to reduce code repetition; use gss_oid_equal instead of pointer comparison for name types; and don't assume that the gss_display_name result buffer is zero-terminated. ticket: 7740 (new) target_version: 1.12 tags: pullup
* Fix decoding of mkey kvno in mkey_aux tl-dataGreg Hudson2013-10-291-2/+3
| | | | | | | | | | | krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an int, resulting in the wrong value on big-endian platforms. The consequences are mostly invisible because we ignore this field and try all mkey_aux nodes in krb5_def_fetch_mkey_list. ticket: 7738 (new) target_version: 1.12 tags: pullup
* Add tests for different salt combinationsBen Kaduk2013-10-252-0/+59
| | | | | | | | | | | | | Create a principal with a pair of enctypes using different salt types. Confirm that the non-default salt type appears only once in the principal's key list. Also verify that the afs3 salt type is rejected by non-DES enctypes The afs3 salt type is for compatibility with AFS-3 kaservers, which are roughly krb4. As such, it only makes sense for single-DES enctypes. The PBKDF2 and arcfour enctypes correctly reject the key-creation parameters from the afs3 salt, but triple-DES currently does not.
* Reset key-generation parameters for each enctypeBen Kaduk2013-10-251-1/+2
| | | | | | | | | | In add_key_pwd, initialize s2k_params to NULL inside the loop over enctypes instead of outside the loop, so that if the afs3 salt type is used it does not contaminate later enctype/salt pairs in the list. ticket: 7733 tags: pullup target_version: 1.12
* Simplify kdb5_list_mkeys actkvno list retrievalGreg Hudson2013-10-251-34/+12
| | | | | After recent changes, krb5_dbe_lookup_actkvno cannot yield an empty list and cannot return KRB5_KDB_NOACTMASTERKEY.
* Remove old master key testsGreg Hudson2013-10-2518-1992/+2
| | | | | | | | | | | | | | | Remove tests/mkeystash_compat and tests/mk_migr. These are superseded by t_mkey.py, with two exceptions: tests/mk_migr included tests for password history across master key rollovers. Historical keys are encrypted in the kadmin/history key (which is accessed like any other key), so there isn't a specific need to test this unless we implement #1221. tests/mk_migr had provisions for testing master key rollover with the LDAP KDB module. All master key logic used in the LDAP KDB module is shared with the DB2 module in lib/kdb, so there is no specific need to test this combination.
generated by cgit (git 2.34.1) at 2024-05-03 20:35:20 +0000