summaryrefslogtreecommitdiffstats
path: root/src/lib/krb5/krb
Commit message (Collapse)AuthorAgeFilesLines
* Use preauth options when changing passwordGreg Hudson2014-03-031-12/+51
| | | | | | | | | | | If we try to change the password in rb5_get_init_creds_password, we must use all application-specified gic options which affect preauthentication when getting the kadmin/changepw ticket. Create a helper function make_chpw_options which copies the application's options, unsets the options we don't want, and sets options appropriate for a temporary ticket. ticket: 7868
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-265-19/+16
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Support referrals from Windows Server 2003Nate Rosenblum2014-02-181-3/+32
| | | | | | | | | | | | | | | | | Although RFC 6806 Section 7 requires servers to indicate a client referral in a WRONG_REALM message, Microsoft Windows Server 2003 returns this information in a message with error code PRINCIPAL_UNKNOWN. Failure to follow the referral in these messages prevents referral chasing in Windows Server 2003 forests. Detect referral messages of this type by checking for a non-empty client.realm field in the response, and activate the referral logic in these cases. [tlyu@mit.edu: style, comments, and commit message] ticket: 7856 (new) target_version: 1.12.2 tags: pullup
* Fix SAM-2 preauth when password argument is usedGreg Hudson2014-02-111-2/+3
| | | | | | | | | | | | | | | | sam2_process accesses gak_data to get the password, so that it can do string-to-key with the etype in the SAM-2 challenge. When #7642 changed gic_pwd.c to use struct gak_password instead of krb5_data, sam2_process wasn't altered to match. We don't see a problem when the password is read through the prompter (as with kinit), because the password winds up in the storage field at the beginning of the gak_password structure. But when a password is supplied as a parameter (as with ksu), the storage field is empty and we get the wrong answer from sam2_process. ticket: 7862 target_version: 1.12.2 tags: pullup
* make dependGreg Hudson2013-12-201-0/+11
|
* Fix typo that broke 'make clean'Zhanna Tsitkov2013-12-201-1/+1
| | | | Missing $
* Add a test program for krb5_copy_contextGreg Hudson2013-12-182-1/+174
| | | | | | | | This test program isn't completely proof against the kind of mistakes we've made with krb5_copy_context in the past, but it at least exercises krb5_copy_context and can detect some kinds of bugs. ticket: 7807
* Fix krb5_copy_contextGreg Hudson2013-12-182-1/+16
| | | | | | | | | | | | | krb5_copy_context has been broken since 1.8 (it broke in r22456) because k5_copy_etypes crashes on null enctype lists. Subsequent additions to the context structure were not reflected in krb5_copy_context, creating double-free bugs. Make k5_copy_etypes handle null input and account for all new fields in krb5_copy_context. Reported by Arran Cudbard-Bell. ticket: 7807 (new) target_version: 1.12.1 tags: pullup
* Remove unused krb5_context fieldsGreg Hudson2013-12-181-2/+0
| | | | | The vtbl and locate_fptrs fields were ostensibly related to the locate pluggable interface, but weren't actually used.
* make dependTom Yu2013-12-101-0/+11
|
* Fix S4U2Self against non-FAST KDCsGreg Hudson2013-12-061-5/+34
| | | | | | | | | | | When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs which don't support FAST, because the S4U2Self padata is only present within the FAST request. For now, duplicate that padata in the outer request so that both FAST and non-FAST KDCs can see it. ticket: 7791 target_version: 1.11.5 tags: pullup
* Avoid deprecated krb5_get_in_tkt_with_keytabBen Kaduk2013-11-041-16/+20
| | | | | | | | | | | | | | | | | | | | | The kprop code has been pretty unloved, and uses some routines that are marked as deprecated (which show up as warnings in the build log). Use the documented replacement for krb5_get_in_tkt_with_keytab, krb5_get_init_creds_keytab, instead. As a bonus, there is no longer a side effect of a credentials cache that needs to be destroyed. The also-deprecated function krb5_get_in_tkt_with_skey was backending to it when no keyblock was passed in; we can unroll the call to krb5_get_init_creds_keytab ourselves as the documented workaround. While here, improve style compliance with regards to cleanup. The setkey test just wants to know whether it can use the key it just put into a keytab to get credentials; as such the recommended krb5_get_init_creds_keytab is quite sufficient. While here, use that interface to request the particular enctype as well, reducing the scope of an XXX comment. ticket: 6366
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Factor out krb5int_random_string() routineZhanna Tsitkov2013-09-242-0/+71
| | | | | Make krb5int_random_string() function available outside ccache code. Move it into a separate file under lib/krb5/krb hierarchy.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-061-0/+5
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Use hostrealm interface for realm mappingGreg Hudson2013-08-151-0/+1
| | | | | | | | | Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and krb5_get_default_realm in terms of the hostrealm interface. Three built-in modules (dns, domain, and profile) implement the current behavior. ticket: 7687
* Add hostrealm pluggable interface definitionGreg Hudson2013-08-151-1/+2
| | | | ticket: 7687 (new)
* Fix localauth memory leakGreg Hudson2013-08-121-0/+1
| | | | | localauth modules were not freed by krb5_free_context(), causing a memory leak.
* Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai2013-07-173-0/+219
| | | | | | | | | | | | | | | | | Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-113-6/+6
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Fix uninitialized variable bugsGreg Hudson2013-06-271-1/+1
| | | | | The previous few commits introduced a couple of bugs where variables could be used without being initialized. Fix them.
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-188/+265
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Fix various warningsGreg Hudson2013-06-072-5/+5
|
* Use KDC clock skew for AS-REQ timestampsGreg Hudson2013-06-051-5/+12
| | | | | | | | | | | | | | | | Calculate request timestamps each time we encode a request, and use the adjusted current time when calculating them, including adjustments resulting from preauth-required errors early in the AS exchange. As a side effect, this reverts one of the changes in commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063); we will once again use the time adjustment from any ccache we read before the AS exchange, if we don't have a more specific adjustment from a preauth-required error. Based on a patch from Stef Walter. ticket: 7657 (new)
* Refactor AS-REQ nonce and timestamp handlingGreg Hudson2013-06-053-67/+78
| | | | | | | | | | | | Create helper functions to set the request nonce and to set the request timestamp. Don't bother picking a nonce in restart_init_creds_loop since we will just pick a new one in init_creds_step_request. Create a library-internal function to get the current time with possible adjustment from a preauth-required error. Only set ctx->request_time in one place (just before encoding each request). Remove unused parameters from stash_as_reply. Partially based on a patch from Stef Walter.
* Fix spurious clock skew caused by preauth delayGreg Hudson2013-06-021-0/+3
| | | | | | | | | | Commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063) prevented clock skew caused by preauth delay by recording the time of the initial request. However, it failed to take into account delay between requests due to prompting during preauthentication. Fix this by recording the request time for each request. ticket: 7656 (new)
* Properly handle use_master in k5_init_creds_getGreg Hudson2013-05-311-2/+4
| | | | | | | | | | | If we make multiple requests in an initial creds exchange, the krb5_sendto_kdc call in k5_init_creds_get may flip the use_master value from 0 to 1 if it detects that the response was from a master KDC. Don't turn this into a requirement for future requests during the same exchange, or we may have trouble following AS referrals. Reported by Sumit Bose. ticket: 7650
* Make empty passwords work via init_creds APIsGreg Hudson2013-05-273-59/+60
| | | | | | | | | | | | | | In the gak_data value used by krb5_get_as_key_password, separate the already-known password from the storage we might have allocated to put it in, so that we no longer use an empty data buffer to determine whether we know the password. This allows empty passwords to work via the API. Remove the kadm5 test which explicitly uses an empty password. Based on a patch from Stef Walter. ticket: 7642
* Fix transited handling for GSSAPI acceptorsGreg Hudson2013-05-211-3/+5
| | | | | | | | | | | | | | | | | | The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. ticket: 7639 target_version: 1.11.3 tags: pullup
* Reduce boilerplate in makefilesGreg Hudson2013-05-161-4/+1
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Better fix for not using expired TGTs in TGS-REQsGreg Hudson2013-04-291-53/+91
| | | | | | | | | | | | We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is expired, like we would if we tried the TGT against the KCD. To make this work, separate the helpers for getting local and crossrealm cached TGTs. For a crossrealm TGT, match against the endtime, as there could be multiple entries. For a local TGT, find any match, but check if it's expired. The cache_code field is no longer needed after this change, so get rid of it. ticket: 6948
* Don't use expired TGTs in TGS-REQsNicolas Williams2013-04-261-8/+10
| | | | ticket: 6948
* Avoid passing null pointers to memcpy/memcmpGreg Hudson2013-04-089-21/+26
| | | | | | | | | | | | | | | By a strict reading of the C standard, memcpy and memcmp have undefined behavior if their pointer arguments aren't valid object pointers, even if the length argument is 0. Compilers are becoming more aggressive about breaking code with undefined behavior, so we should try to avoid it when possible. In a krb5_data object, we frequently use NULL as the data value when the length is 0. Accordingly, we should avoid copying from or comparing the data field of a length-0 krb5_data object. Add checks to our wrapper functions (like data_eq and k5_memdup) and to code which works with possibly-empty krb5_data objects. In a few places, use wrapper functions to simplify the code rather than adding checks.
* Simplify principal access within libkrb5Greg Hudson2013-04-0821-142/+103
| | | | | For conciseness, directly use fields of krb5_principal objects instead of using the accessor macros.
* Using k5-int.h data helpers for some functionsGreg Hudson2013-03-291-6/+3
| | | | | | Use empty_data(), alloc_data(), and make_data() in some appropriate places. This has the side effect of initializing the krb5_data magic field, which can placate debugging tools.
* Fix an error case in krb5_sendauthGreg Hudson2013-03-281-3/+1
| | | | | If we fail to get the client principal when constructing the stack-allocated creds structure, don't double-free creds.server.
* make dependGreg Hudson2013-03-241-388/+364
|
* Move a bunch of stuff out of k5-int.hGreg Hudson2013-03-2426-181/+274
| | | | | | | | | Move internal declarations from k5-int.h to more localized headers (like int-proto.h) where appropriate. Rename many symbols whose prototypes were moved to use the k5_ prefix instead of krb5int_. Remove some unused declarations or move them to the single source file they were needed in. Remove krb5_creds_compare since it isn't used any more.
* Fix use-before-init in two test programsGreg Hudson2013-03-152-2/+2
| | | | | | If krb5_init_context fails, use a null context for getting the error message, not a context we haven't yet initialized. Observed by David Benjamin <davidben@mit.edu> using clang.
* Add localauth pluggable interfaceGreg Hudson2013-03-091-1/+2
| | | | | | | | Add a new pluggable interface for local authorization, and replace the existing krb5_aname_to_localname and krb5_kuserok implementations with implementations based on the pluggable interface. ticket: 7583 (new)
* Simplify and clarify lookup_etypes_for_keytabGreg Hudson2013-03-011-27/+21
|
* Fix a memory leak in krb5_get_init_creds_keytabGreg Hudson2013-02-281-3/+11
| | | | | | | | | lookup_etypes_for_keytab was not freeing the keytab entries it iterated over. Reported by nalin@redhat.com. ticket: 7586 target_version: 1.11.2 tags: pullup
* Add krb5_free_enctypes APIGreg Hudson2013-02-271-2/+2
| | | | | | | Rename krb5_free_ktypes to krb5_free_enctypes and add it to the public API. ticket: 7584
* Add missing .gitignore entries and clean rulesGreg Hudson2013-02-271-0/+3
| | | | ticket: 7585
* Allow multi-hop SAM-2 exchangesGreg Hudson2013-02-191-0/+5
| | | | | | | | | | | | Prior to 1.11, it was possible to do SAM-2 preauth exchanges with multiple hops by sending repeated preauth-required errors with different challenges (which is not the way multi-hop exchanges are described in RFC 6113, but it can still work). This stopped working when SAM-2 was converted to a built-in module. Make it work again. ticket: 7571 (new) target_version: 1.11.1 tags: pullup
* Convert success in krb5_chpw_result_code_stringJonathan Reams2013-02-151-0/+3
| | | | | | | | | | | | | | | Result code 0 used to be converted properly by krb5_set_password, though not krb5_change_password; this changed in 1.10 when krb5int_setpw_result_code_string was folded into krb5_chpw_result_code_string. Restore the old behavior, and make it apply to krb5_change_password as well, by making krb5_chpw_result_code_string convert result code 0. [ghudson@mit.edu: commit message] ticket: 7569 (new) target_version: 1.11.1 tags: pullup
* Modernize k5bufGreg Hudson2013-02-143-42/+38
| | | | | | Rename the krb5int_buf_ family of functions to use the k5_ prefix for brevity. Reformat some k5buf implementation code to match current practices.
* Make internal JSON functions return error codesGreg Hudson2013-02-134-99/+84
| | | | | | | | | Return error codes (0, ENOMEM, or EINVAL) from JSON support functions instead of returning results directly. This makes error handling simpler for functions which assemble JSON objects and then return a krb5_error_code values. Adjust all callers. Use shims in export_cred.c to minimize changes there; it will be redesigned internally in a subsequent commit.
* Add and use k5memdup, k5memdup0 helpersGreg Hudson2013-02-098-49/+27
| | | | | | Add k5-int.h static functions to duplicate byte ranges, optionally with a trailing zero byte, and set an error code like k5alloc does. Use them where they would shorten existing code.
* Simplify TGS request constructionGreg Hudson2013-02-084-171/+60
| | | | | | | Move krb5int_make_tgs_request from gc_via_tkt.c into send_tgs.c, combine it with krb5int_make_tgs_request_ext (which nothing else called), and rename the combined function to k5_make_tgs_req. Also use a typedef for the pacb callback.
generated by cgit (git 2.34.1) at 2025-07-03 14:52:03 +0000