summaryrefslogtreecommitdiffstats
path: root/src/lib/gssapi
Commit message (Collapse)AuthorAgeFilesLines
* Properly reflect MS krb5 mech in SPNEGO acceptorGreg Hudson2014-02-051-4/+4
| | | | | | | | | | | | | | | r25590 changed negotiate_mech() to return an alias into the acceptor's mech set, with the unfortunate side effect of transforming the erroneous Microsoft krb5 mech OID into the correct krb5 mech OID, meaning that we answer with a different OID than the requested one. Return an alias into the initiator's mech set instead, and store that in mech_set field the SPNEGO context. The acceptor code only uses mech_set to hold the allocated storage pointed into by internal_mech, so this change is safe. ticket: 7858 target_version: 1.12.2 tags: pullup
* Fix gss_pseudo_random leak on zero length outputGreg Hudson2014-01-181-0/+3
| | | | | | | | | Nobody is likely to ever ask for zero bytes of output from gss_pseudo_random, but if they do, just return an empty buffer without allocating. Otherwise we leak memory because gss_release_buffer doesn't do anything to buffers with length 0. ticket: 7838 (new)
* Allow empty store in gss_acquire_cred_fromGreg Hudson2014-01-171-12/+0
| | | | | | | | | There is no reason to deny a zero-length cred store, so don't check for it in val_acq_cred_args or val_add_cred_args. ticket: 7836 (new) target_version: 1.12.2 tags: pullup
* Add rcache feature to gss_acquire_cred_fromSimo Sorce2014-01-172-13/+36
| | | | | | | | | | The "rcache" cred store entry can specify a replay cache type and name to be used with the credentials being acquired. [ghudson@mit.edu: split up, simplified, and altered to fit preparatory commits] ticket: 7819 (new)
* Clean up rcache if GSS krb5 acquire_cred failsGreg Hudson2014-01-171-0/+2
| | | | | | | | | The error handler in acquire_cred_context didn't release the rcache, which would cause it to leak if we failed after acquire_accept_cred. ticket: 7818 (new) target_version: 1.12.2 tags: pullup
* Clean up GSS krb5 acquire_accept_credGreg Hudson2014-01-171-22/+30
| | | | | | Use a cleanup handler instead of releasing kt in multiple error clauses. Wrap a long line and fix a comment with a missing word. Rewrap the function arguments to use fewer lines.
* Don't produce context deletion token in krb5 mechGreg Hudson2014-01-131-15/+0
| | | | | | | | | RFCs 2743 and 4121 recommend that implementations produce empty tokens from gss_delete_sec_context, and trying to produce one can cause gss_delete_sec_context to fail on a partially established context. Patch from Tomas Kuthan. ticket: 7816 (new)
* Let SPNEGO display mechanism errorsSimo Sorce2013-12-181-8/+34
| | | | | | | | | | | | | | | To avoid potential recursion we use a thread local variable that tells us whether the ancestor was called via spnego_gss_display_name(). If we detect recursion, we assume that we returned a com_err code like ENOMEM and call error_message(); in the worst case that will result in an "Unknown error" message. [ghudson@mit.edu: Edited comments and commit message; removed an unneeded line of code.] ticket: 7045 target_version: 1.12.1 tags: pullup
* Fix GSS krb5 acceptor acquire_cred error handlingGreg Hudson2013-12-161-1/+3
| | | | | | | | | | | | When acquiring acceptor creds with a specified name, if we fail to open a replay cache, we leak the keytab handle. If there is no specified name and we discover that there is no content in the keytab, we leak the keytab handle and return the wrong major code. Memory leak reported by Andrea Campi. ticket: 7805 target_version: 1.12.1 tags: pullup
* Fix memory leak in SPNEGO initiatorSimo Sorce2013-12-161-0/+1
| | | | | | | | | | | | If we eliminate a mechanism from the initiator list because gss_init_sec_context fails, free the memory for that mech OID before removing it from the list. [ghudson@mit.edu: clarified commit message] ticket: 7803 (new) target_version: 1.12.1 tags: pullup
* Remove unneeded check in SPNEGO initiatorGreg Hudson2013-12-161-7/+0
| | | | | | | | In init_ctx_cont, if the response token contains no fields, we set a return value but don't actually quit out of the function. We do not need this check (we will fail later on if a piece of required information isn't present), so just remove it. Reported by simo@redhat.com.
* Fix SPNEGO one-hop interop against old IISGreg Hudson2013-12-121-0/+6
| | | | | | | | | | | | | | | | IIS 6.0 and similar return a zero length reponse buffer in the last SPNEGO packet when context initiation is performed without mutual authentication. In this case the underlying Kerberos mechanism has already completed successfully on the first invocation, and SPNEGO does not expect a mech response token in the answer. If we get an empty mech response token when the mech is complete during negotiation, ignore it. [ghudson@mit.edu: small code style and commit message changes] ticket: 7797 (new) target_version: 1.12.1 tags: pullup
* Avoid malloc(0) in SPNEGO get_input_tokenGreg Hudson2013-12-061-6/+9
| | | | | | | If we read a zero-length token in spnego_mech.c's get_input_token(), set the value pointer to NULL instead of calling malloc(0). ticket: 7794 (new)
* Clean up the code to eliminate some clang warningsBen Kaduk2013-11-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In ure.c, though k is a short, the literal 1 is of type 'int', and so the operation 'k + 1' is performed at the (32-bit) width of int, and therefore the "%d" format string is correct. In accept_sec_context.c, the 'length' field of krb5_data is an unsigned type, so checking for a negative value has no effect. In net-server.c, the helper routine rtm_type_name() is only used in code that is disabled with #if 0 conditionals; make the definition also disabled in the same way to avoid warnings of an unused function. In kdc_authdata.c, equality checks in double parentheses elicit a warning from clang. The double-parentheses idiom is normally used to indicate that an assignment is being performed, but the value of the assignment is also to be used as the value for the conditional. Since assignment and equality checking differ only by a single character, clang considers this worthy of a warning. Since the extra set of parentheses is redundant and against style, it is correct to remove them. In several places (sim_server.c, dump.c, kdb5_destroy.c, ovsec_kadmd.c), there are declarations of extern variables relating to getopt() functionality that are now unused in the code. Remove these unused variables.
* Fix gss_accept_sec_context error tokensGreg Hudson2013-10-142-29/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A GSS krb5 error response contains a KRB-ERROR message, which is required to have a server principal name, although few recipients actually use it. Starting in 1.3, accept_sec_context would fail to encode the error in the GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL case (introduced by #1370) because cred->princ (which became cred->name->princ in 1.8) is unset. This problem got worse in 1.10 because we stopped setting the server field in all cases due to the changes for #6855. In 1.11 the problem got worse again when a misguided change to the mechglue started discarding output tokens when the mechanism returns an error; the mechglue should only do so when it itself causes the error. Fix krb5 gss_accept_sec_context by unconditionally decoding the AP-REQ and using krb5_rd_req_decoded, and then using the requested ticket server in the KRB-ERROR message. Fix the mechglue gss_accept_sec_context by reverting that part of commit 56feee187579905c9101b0cdbdd8c6a850adcfc9. Add a test program which artificially induces a replay cache failure (the easiest failure we can produce which has an associated RFC 4120 error code) and checks that this can be communicated back to the initiator via an error token. ticket: 1445 target_version: 1.12 tags: pullup
* Fix GSSAPI krb5 cred ccache importGreg Hudson2013-10-141-1/+1
| | | | | | | | | | | | | | json_to_ccache was incorrectly indexing the JSON array when restoring a memory ccache. Fix it. Add test coverage for a multi-cred ccache by exporting/importing the synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move export_import_cred from t_export_cred.c to common.c to facilitate this. Make a note in t_export_cred.py that this case is covered in t_s4u.py. ticket: 7706 target_version: 1.11.4
* Use constant-time comparisons for checksumsGreg Hudson2013-10-032-5/+5
|
* Err codes in KRB_ERROR protocol messages are < 128Zhanna Tsitkov2013-09-231-1/+1
| | | | | | If the error code is out of [0,127] range, assign it to KRB_ERR_GENERIC. This fix is to correct the previous behavior with [0,128] range. For more information see krb5_err.et
* Add GSSAPI IOV MIC functionsGreg Hudson2013-09-1814-50/+306
| | | | | | | | | | | | | Add gss_get_mic_iov, gss_get_mic_iov_length, and gss_verify_mic_iov functions, which work similarly to the corresponding IOV wrap functions. Add a new buffer type GSS_IOV_BUFFER_TYPE_MIC_TOKEN for the destination buffer. Most of the internal code for this was already present, and just needed to be fixed up and adjusted to use the new buffer type for the MIC token. ticket: 7705 (new)
* Get rid of G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZEGreg Hudson2013-09-083-7/+1
| | | | | | | | | | This flag was introduced in the mskrb-integ merge but is not actually used after r21742--while kg_unseal_iov_token sets it in vfyflags for DCE-style contexts, it doesn't actually pass vfyflags to g_verify_token_header or otherwise use it. Moreover, the flag is not necessary there; we correctly set input_length to the header length (without data, padding, or trailer) for v1 tokens in a DCE-style context.
* Fix gss_krb5_set_allowable_enctypes for acceptorGreg Hudson2013-08-121-2/+2
| | | | | | | | | | | | | | | | | | | The acceptor implementation of gss_krb5_set_allowable_enctypes (added in 1.9.1) is intended to restrict the acceptor subkey negotiated by krb5_rd_req(). It uses the same approach as the initiator, calling krb5_set_default_tgs_enctypes on the context. This has the unwanted side effect of restricting the encryption key of the ticket, because krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the ticket encryption key since 1.8. Instead, use krb5_auth_con_setpermetypes on the auth context. This list is only used for session key enctype negotiation. Also add automated tests to verify that gss_krb5_set_allowable_enctypes works as desired. ticket: 7688 (new) target_version: 1.11.4 tags: pullup
* Load import/export cred functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the import/export credential feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom import/export credential extensions if they wish. ticket: 7682
* Load cred store functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the credential store feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom credential store extensions if they wish. ticket: 7682
* Fix various warningsGreg Hudson2013-06-073-13/+2
|
* Reduce boilerplate in makefilesGreg Hudson2013-05-165-12/+4
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Assume mutex locking cannot failGreg Hudson2013-05-149-138/+45
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Fix mismatched spnego_mech.c declarationsGreg Hudson2013-05-031-3/+4
| | | | | The mechglue definitions of gssint_get_der_length and friends use unsigned int for the buffer length, not OM_uint32.
* Avoid passing null pointers to memcpy/memcmpGreg Hudson2013-04-081-1/+2
| | | | | | | | | | | | | | | By a strict reading of the C standard, memcpy and memcmp have undefined behavior if their pointer arguments aren't valid object pointers, even if the length argument is 0. Compilers are becoming more aggressive about breaking code with undefined behavior, so we should try to avoid it when possible. In a krb5_data object, we frequently use NULL as the data value when the length is 0. Accordingly, we should avoid copying from or comparing the data field of a length-0 krb5_data object. Add checks to our wrapper functions (like data_eq and k5_memdup) and to code which works with possibly-empty krb5_data objects. In a few places, use wrapper functions to simplify the code rather than adding checks.
* Add krb5_kt_dup API and use it in two placesGreg Hudson2013-04-011-25/+6
| | | | | | | Add an API to duplicate keytab handles, mirroring krb5_cc_dup. Use it to simplify the krb5 GSS acquire_cred code. ticket: 7599 (new)
* Add support for client keytab from cred storeSimo Sorce2013-04-012-10/+44
| | | | | | | | | | | | | | | | The new credential store extensions added support for specifying a specific ccache name and also a specific keytab to be used for accepting security contexts, but did not add a way to specify a client keytab to be used in conjunction with the Keytab initiation support added also in 1.11 This patch introduces a new URN named client_keytab through which a specific client_keytab can be set when calling gss_acquire_cred_from() and Keytab Initiation will use that keytab to initialize credentials. [ghudson@mit.edu: minor C style fix] ticket: 7598 (new)
* Using k5-int.h data helpers for some functionsGreg Hudson2013-03-291-10/+7
| | | | | | Use empty_data(), alloc_data(), and make_data() in some appropriate places. This has the side effect of initializing the krb5_data magic field, which can placate debugging tools.
* Fix unused assignment in mechglue loadConfigFileGreg Hudson2013-03-281-1/+1
|
* Fix import_sec_context with interposersSimo Sorce2013-03-241-21/+14
| | | | | | | | | | | | | | | | | | The code was correctly selecting the mechanism to execute, but it was improperly setting the mechanism type of the internal context when the selected mechanism was that of an interposer and vice versa. When an interposer is involved the internal context is that of the interposer, so the mechanism type of the context needs to be the interposer oid. Conversely, when an interposer re-enters gssapi and presents a token with a special oid, the mechanism called is the real mechanism, and the context returned is a real mechanism context. In this case the mechanism type of the context needs to be that of the real mechanism. ticket: 7592 target_version: 1.11.2 tags: pullup
* make dependGreg Hudson2013-03-243-213/+205
|
* Eliminate unused variablesGreg Hudson2013-03-151-1/+0
|
* Fix argument type in kg_unseal_v1Greg Hudson2013-03-151-1/+1
| | | | | | The caller of kg_unseal_v1 passes a gss_qop_t * for the qop_state parameter, so make it use that type instead of an int *. Noted by David Benjamin <davidben@mit.edu>.
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-271-2/+2
| | | | ticket: 7585
* Modernize k5bufGreg Hudson2013-02-143-16/+16
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Add k5_json_array_fmt and use it in export_cred.cGreg Hudson2013-02-131-261/+273
| | | | | | Add a template-based array constructor for convenient marshalling of structured values as JSON array values. Use it to simplify export_cred.c.
* Make internal JSON functions return error codesGreg Hudson2013-02-132-75/+97
| | | | | | | | | Return error codes (0, ENOMEM, or EINVAL) from JSON support functions instead of returning results directly. This makes error handling simpler for functions which assemble JSON objects and then return a krb5_error_code values. Adjust all callers. Use shims in export_cred.c to minimize changes there; it will be redesigned internally in a subsequent commit.
* Fix RFC 5587 const pointer typedefsGreg Hudson2013-02-111-3/+3
| | | | | | | | | | | | gss_const_ctx_id_t, gss_const_cred_id_t, and gss_const_name_t are supposed to be const pointers to the appropriate structures, not the structures themselves. These are not used by any prototypes yet, and no application would have any reason to use them as they are, so it should be safe to change them within the public header. ticket: 7567 (new) target_version: 1.11.1 tags: pullup
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-094-15/+6
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* make dependGreg Hudson2013-01-104-4/+4
| | | | | Mostly this gets rid of the trailing space on line 2 after bb76891f5386526bdf91bc790c614fc9296cb5fa.
* Rename ccache configuration macrosZhanna Tsitkov2013-01-092-6/+6
| | | | | KRB5_CONF_ prefix should be used for the krb5/kdc.conf parameters. Use KRB5_CC_CONF_ prefix for cache configuration variables.
* Fix void pointer arithmetic in oid_ops.cGreg Hudson2013-01-091-1/+1
| | | | | | | | When asserting that out has advanced the expected number of bytes in generic_gss_str_to_oid, avoid adding to oid->elements, which is a void pointer. Instead subtract from out and compare. ticket: 7524
* Fix gss_str_to_oid and gss_oid_to_str edge casesGreg Hudson2013-01-011-125/+121
| | | | | | | | | | | | | Neither function correctly handled OIDs whose second arc exceeds 47 (theoretically possible if the first arc is 2). gss_str_to_oid had additional problems: it used scanf, it didn't consistently protect against read overrun if the input buffer wasn't null-terminated, and it could get confused by + or - characters in the first two arcs. Fix gss_oid_to_str and rewrite gss_str_to_oid. Also add a test program. ticket: 7524 (new)
* Fix a small memory leak in util_errmapGreg Hudson2013-01-011-12/+9
| | | | | | | | | | | Calls to gssint_mecherrmap_map_errcode would result in calling mecherror_copy with a zero-length mech OID, which would result in an OID with 0 for length and malloc(0) for elements. On platforms which return non-null from malloc(0), gssint_mecherrmap_destroy() wouldn't free the elements pointer. Avoid calling malloc(0) and don't use the length field to decide whether to free an elements pointer.
* Fix gss_str_to_oid for OIDs with zero-valued arcsLuke Howard2013-01-011-6/+6
| | | | | | | | | | | gss_str_to_oid wasn't outputting any bytes for a zero-valued arc. It should output one byte with value 0. [ghudson@mit.edu: commit message] ticket: 7523 (new) target_version: 1.11.1 tags: pullup
* Separate clpreauth and kdcpreauth interfacesGreg Hudson2012-12-193-102/+102
| | | | | | | Since there is no overlap between the clpreauth and kdcpreauth interface declarations, there's no particular reason to combine them into one header. For backward compatibility and convenience, leave behind a preauth_plugin.h which includes both.
* Style cleanup for internal error handlingGreg Hudson2012-12-191-1/+1
| | | | | | | Fix style issues in kerrs.c and errors.c. Rename error handling functions to use shorter k5_ prefix. Eliminate an inoperable krb5int_set_error() call in gic_opte_alloc and convert the other call to use krb5_set_error_message().
generated by cgit (git 2.34.1) at 2024-05-29 01:03:58 +0000