summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix S4U2Self against non-FAST KDCsGreg Hudson2013-12-061-5/+34
| | | | | | | | | | | When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs which don't support FAST, because the S4U2Self padata is only present within the FAST request. For now, duplicate that padata in the outer request so that both FAST and non-FAST KDCs can see it. ticket: 7791 target_version: 1.11.5 tags: pullup
* Edit README.asn1Greg Hudson2013-12-031-34/+51
| | | | | | Add another blank line before section headers. Avoid contractions. Change some whiches to thats where it seems appropriate. Fix some missing or extra words.
* Bump libgssrpc minor versionTom Yu2013-11-271-1/+1
| | | | | | Bump minor version for the new log_badauth2 interfaces. ticket: 7770
* Correctly log IPv6 addresses in kadmindGreg Hudson2013-11-255-58/+50
| | | | | | | | | | | | | | Define client_addr() in server_stubs.c and use it consistently in that file and ipropd_svc.c to get the client address from a transport handle. In it, call getpeername() on the client socket and use inet_ntop() on the result, instead of using inet_ntoa() on the IPv4 socket address. Provide a log_badauth2 callback to GSSRPC, so that we get a transport handle instead of an IPv4 socket address, and use client_addr() within it instead of inet_ntoa(). ticket: 7770 target_version: 1.12 tags: pullup
* Add new versions of log_badauth gssrpc callbacksGreg Hudson2013-11-255-11/+59
| | | | | | | | | | libgssrpc supports two callbacks for gss_accept_sec_context failures on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are IPv4-specific. Provide an alternate version which supplies the transport handle instead of the address, so that we can get the address via the file descriptor for TCP connections. ticket: 7770
* Remove inet_ntoa() prototype from getrpcent.cBen Kaduk2013-11-251-1/+0
| | | | | | | It is not needed. In general, we shouldn't be using inet_ntoa(), anyway, as it is IPv4-specific and we have IPv6 support almost everywhere.
* Improve default ccache name API documentationGreg Hudson2013-11-221-6/+25
| | | | | | | | | | | | Document the lifetime and caching behavior of the krb5_cc_default_name() return value. Document that krb5_cc_set_default_name() may be called with NULL to purge the cached value. Correct a typo in the krb5_cc_default() summary and explicitly reference krb5_cc_default_name(). ticket: 7775 (new) target_version: 1.12 tags: pullup
* Add another kadmin ACL test for backreferencesGreg Hudson2013-11-211-0/+6
| | | | | | Add a test using backreferences which don't correspond directly to principal components, to verify that *N refers to the Nth wildcard and not the Nth component.
* Remove dangling --with-kdc-kdb-update referencesGreg Hudson2013-11-171-10/+0
| | | | | | This configure option hasn't done anything since 1.8, so don't mention it in configure --help or the documentation. The disable_last_success and disable_lockout DB options are now used to turn it off.
* Remove a warning in AES string-to-keyGreg Hudson2013-11-151-7/+4
| | | | | | | On 32-bit platforms, the code to translate an iteration count of 0 to 2^32 can trigger a compiler warning. Since we will basically never accept an iteration count that high (right now we reject anything above 2^24), just reject it out of hand.
* Set expiration time on keys and keyringsSimo Sorce2013-11-151-5/+66
| | | | | | | | | | | By setting the timeout based on the credetial's timeout we let the system automatically cleanup expired credentials. [ghudson@mit.edu: simplified code slightly] ticket: 7769 (new) target_version: 1.12 tags: pullup
* Add support to store time offsets in cc_keyringSimo Sorce2013-11-151-2/+203
| | | | | | | | | | | | | | The code follows the same model used for the memory ccache type. Time offsets are stored in each credential cache in a special key just like the principal name. Legacy session caches do not store timestamps as legacy code would fail when iterating over the new offset key. [ghudson@mit.edu: minor formatting changes; note legacy session exception in commit message] ticket: 7768 (new) target_version: 1.12 tags: pullup
* Enforce minimum PBKDF2 iteration countTom Yu2013-11-153-65/+233
| | | | | | | | | Also add a testing interface to allow weak iteration counts. (Published test vectors use weak iteration counts.) ticket: 7465 target_version: 1.12 tags: pullup
* Catch more strtol() failures when using KEYRINGsNalin Dahyabhai2013-11-121-3/+3
| | | | | | | | | | | | | When parsing what should be a UID while resolving a KEYRING ccache name, don't just depend on strtol() to set errno when the residual that we pass to it can't be parsed as a number. In addition to checking errno, pass in and check the value of an "endptr". [ghudson@mit.edu: simplified slightly] ticket: 7764 (new) target_version: 1.12 tags: pullup
* Multi-realm KDC null deref [CVE-2013-1418]Tom Yu2013-11-041-0/+3
| | | | | | | | | | | | | | | If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C A related but more minor vulnerability requires authentication to exploit, and is only present if a third-party KDC database module can dereference a null pointer under certain conditions. ticket: 7755 (new) target_version: 1.12 tags: pullup
* Remove rtm_type_name()Ben Kaduk2013-11-041-37/+0
| | | | | It has been unused since 2009 when Ken decided that the routing log messages were too verbose (commit 91fc077c96926dd60).
* Clean up the code to eliminate some clang warningsBen Kaduk2013-11-048-11/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In ure.c, though k is a short, the literal 1 is of type 'int', and so the operation 'k + 1' is performed at the (32-bit) width of int, and therefore the "%d" format string is correct. In accept_sec_context.c, the 'length' field of krb5_data is an unsigned type, so checking for a negative value has no effect. In net-server.c, the helper routine rtm_type_name() is only used in code that is disabled with #if 0 conditionals; make the definition also disabled in the same way to avoid warnings of an unused function. In kdc_authdata.c, equality checks in double parentheses elicit a warning from clang. The double-parentheses idiom is normally used to indicate that an assignment is being performed, but the value of the assignment is also to be used as the value for the conditional. Since assignment and equality checking differ only by a single character, clang considers this worthy of a warning. Since the extra set of parentheses is redundant and against style, it is correct to remove them. In several places (sim_server.c, dump.c, kdb5_destroy.c, ovsec_kadmd.c), there are declarations of extern variables relating to getopt() functionality that are now unused in the code. Remove these unused variables.
* Make set_cloexec_fd return voidBen Kaduk2013-11-041-10/+7
| | | | | | | | | We never check its return value (causing clang to emit warnings), and its use is primarily in cases where we should continue processing in the event of failure. Just ignore errors from the underlying fcntl() call (if present) and treat this operation as best-effort. The #if 0 code should probably be removed.
* Avoid deprecated krb5_get_in_tkt_with_keytabBen Kaduk2013-11-043-46/+46
| | | | | | | | | | | | | | | | | | | | | The kprop code has been pretty unloved, and uses some routines that are marked as deprecated (which show up as warnings in the build log). Use the documented replacement for krb5_get_in_tkt_with_keytab, krb5_get_init_creds_keytab, instead. As a bonus, there is no longer a side effect of a credentials cache that needs to be destroyed. The also-deprecated function krb5_get_in_tkt_with_skey was backending to it when no keyblock was passed in; we can unroll the call to krb5_get_init_creds_keytab ourselves as the documented workaround. While here, improve style compliance with regards to cleanup. The setkey test just wants to know whether it can use the key it just put into a keytab to get credentials; as such the recommended krb5_get_init_creds_keytab is quite sufficient. While here, use that interface to request the particular enctype as well, reducing the scope of an XXX comment. ticket: 6366
* Remove last uses of "possibly-insecure" mktemp(3)Ben Kaduk2013-11-043-23/+39
| | | | | | | | | | | | | | | | | | | | Many libc implementations include notations to the linker to generate warnings upon references to mktemp(3), due to its potential for insecure operation. This has been the case for quite some time, as was noted in RT #6199. Our usage of the function has decreased with time, but has not yet disappeared entirely. This commit removes the last few instances from our tree. kprop's credentials never need to hit the disk, so a MEMORY ccache is sufficient (and does not need randomization). store_master_key_list is explicitly putting keys on disk so as to do an atomic rename of the stash file, but since the stash file should be in a root-only directory, we can just use a fixed name for the temporary file. When using this fixed name, we must detect (and error out) if the temporary file already exists; add a test to confirm that we do so. ticket: 1794
* Clean up stash file error handlingBen Kaduk2013-11-041-3/+2
| | | | | | | | | | | The comment previously failed to match the behavior. The intent was that if we failed to write out the entire stash file into the temporary location, we should remove the partial file. However, the code was actually checking whether the *real* stash file existed, not whether the temporary one existed. It is safe to always try to unlink the partial file, and not worry about whether it already exists.
* Use retval, not errno, when stashing master keysBen Kaduk2013-11-043-3/+3
| | | | | | The krb5_db_store_master_key{,_list} functions return a krb5_error_code, and do not necessarily set errno on failure. Use the correct variable while reporting errors with com_err().
* Improve LDAP KDB initialization error messagesGreg Hudson2013-10-301-7/+7
| | | | | | | | | | | | | In krb5_ldap_initialize, don't just blat the LDAP error into the extended message; give an indication of which LDAP operation we were trying to do and show what parameters we gave to it. (Also, krb5_set_error_message can handle a null context argument, so don't bother to check before calling.) ticket: 7739 (new) target_version: 1.12 tags: pullup
* Add tests for anonymous kadminGreg Hudson2013-10-301-0/+13
|
* Use correct default principal for kadmin -nGreg Hudson2013-10-301-6/+14
| | | | | | | | | Use WELLKNOWN/ANONYMOUS@realm as the default principal for kadmin -n, just like we do for kinit -n. ticket: 7741 (new) target_version: 1.12 tags: pullup
* Accept anonymous GSS names in kadmindGreg Hudson2013-10-301-6/+19
| | | | | | | | | | | | | | | | The krb5 implementation of gss_display_name() reports the name type as GSS_C_NT_ANONYMOUS if the client uses an anonymous principal. Accept this name type in gss_name_to_string and gss_to_krb5_name so that anonymous kadmin can work. Also improve code hygiene: call gss_name_to_string from gss_to_krb5_name to reduce code repetition; use gss_oid_equal instead of pointer comparison for name types; and don't assume that the gss_display_name result buffer is zero-terminated. ticket: 7740 (new) target_version: 1.12 tags: pullup
* Fix decoding of mkey kvno in mkey_aux tl-dataGreg Hudson2013-10-291-2/+3
| | | | | | | | | | | krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an int, resulting in the wrong value on big-endian platforms. The consequences are mostly invisible because we ignore this field and try all mkey_aux nodes in krb5_def_fetch_mkey_list. ticket: 7738 (new) target_version: 1.12 tags: pullup
* Add tests for different salt combinationsBen Kaduk2013-10-252-0/+59
| | | | | | | | | | | | | Create a principal with a pair of enctypes using different salt types. Confirm that the non-default salt type appears only once in the principal's key list. Also verify that the afs3 salt type is rejected by non-DES enctypes The afs3 salt type is for compatibility with AFS-3 kaservers, which are roughly krb4. As such, it only makes sense for single-DES enctypes. The PBKDF2 and arcfour enctypes correctly reject the key-creation parameters from the afs3 salt, but triple-DES currently does not.
* Reset key-generation parameters for each enctypeBen Kaduk2013-10-251-1/+2
| | | | | | | | | | In add_key_pwd, initialize s2k_params to NULL inside the loop over enctypes instead of outside the loop, so that if the afs3 salt type is used it does not contaminate later enctype/salt pairs in the list. ticket: 7733 tags: pullup target_version: 1.12
* Simplify kdb5_list_mkeys actkvno list retrievalGreg Hudson2013-10-251-34/+12
| | | | | After recent changes, krb5_dbe_lookup_actkvno cannot yield an empty list and cannot return KRB5_KDB_NOACTMASTERKEY.
* Remove old master key testsGreg Hudson2013-10-2518-1992/+2
| | | | | | | | | | | | | | | Remove tests/mkeystash_compat and tests/mk_migr. These are superseded by t_mkey.py, with two exceptions: tests/mk_migr included tests for password history across master key rollovers. Historical keys are encrypted in the kadmin/history key (which is accessed like any other key), so there isn't a specific need to test this unless we implement #1221. tests/mk_migr had provisions for testing master key rollover with the LDAP KDB module. All master key logic used in the LDAP KDB module is shared with the DB2 module in lib/kdb, so there is no specific need to test this combination.
* Add master key rollover tests in k5test frameworkGreg Hudson2013-10-253-0/+315
| | | | | | | | | | | Add a new script t_mkey.py using the k5test framework. Test the fixes for #6507, #7685, and #7686 as well as basic functionality and old-stashfile compatibility. dump.16 was created by running "kdb5_util create -s -P footes" and "kdb5_util dump dumpfile" with krb5 1.6. The key from the resulting stash file was extracted and placed in the struct.pack() call in the new test script.
* Correctly activate master keys in pre-1.7 KDBsGreg Hudson2013-10-251-22/+19
| | | | | | | | | | | | | | | | | | Starting with 1.7, databases are created with actkvno tl-data in the K/M entry which gives the initial master key version an activation time of 0. A database created before 1.7 will not have this tl-data, but we should behave in the same way as we do for a more recent database. Move the actkvno list synthesis code from krb5_dbe_fetch_act_key_list to krb5_dbe_lookup_actkvno so it applies to kdb5_util commands as well as libkadm5. Synthesize the same list as we would have initialized the KDB with, with an activation time of 0 for the earliest master key. ticket: 7686 target_version: 1.12 tags: pullup
* Don't cache active master key list in kadmindGreg Hudson2013-10-253-18/+26
| | | | | | | | | | | "kdb5_util use_mkey" should not require a kadmind restart to take effect. At the cost of fetching the K/M principal once for each key change operation, make kadmind use the current active master key list for each operation. ticket: 7685 target_version: 1.12 tags: pullup
* Reload master keys to find active mkey if neededGreg Hudson2013-10-251-61/+52
| | | | | | | Refactor krb5_dbe_find_act_mkey and make it reload the master key list if it doesn't find a master key matching the active mkvno. ticket: 7685
* Use active master key in update_princ_encryptionGreg Hudson2013-10-251-10/+5
| | | | | | | | | kdb5_util update_princ_encryption should update to the active master key version, not the most recent. ticket: 6507 target_version: 1.12 tags: pullup
* Fix typos in kdb5_util master key command outputsGreg Hudson2013-10-251-5/+5
| | | | | | | | | | kdb5_util list_mkeys was beginning lines with "KNVO" instead of "KVNO". kdb5_util purge_mkeys was displaying "follwing" instead of "following" for both dry-run and normal cases. ticket: 7730 (new) target_version: 1.12 tags: pullup
* Fix race in util/profile/Makefile.inGreg Hudson2013-10-211-7/+1
| | | | | | $(BUILDTOP)/include/profile.h was being updated by two different rules, which could collide with make -j. Use a dependency from includes instead of a redundant rule.
* Use protocol error for PKINIT cert expiryGreg Hudson2013-10-171-1/+1
| | | | | | | | | | | If we fail to create a cert chain in cms_signeddata_create(), return KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code, rather than KRB5_PREAUTH_FAILED, which doesn't. This is also more consistent with other error clauses in the same function. ticket: 7718 (new) target_version: 1.12 tags: pullup
* Fix gss_accept_sec_context error tokensGreg Hudson2013-10-146-37/+157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A GSS krb5 error response contains a KRB-ERROR message, which is required to have a server principal name, although few recipients actually use it. Starting in 1.3, accept_sec_context would fail to encode the error in the GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL case (introduced by #1370) because cred->princ (which became cred->name->princ in 1.8) is unset. This problem got worse in 1.10 because we stopped setting the server field in all cases due to the changes for #6855. In 1.11 the problem got worse again when a misguided change to the mechglue started discarding output tokens when the mechanism returns an error; the mechglue should only do so when it itself causes the error. Fix krb5 gss_accept_sec_context by unconditionally decoding the AP-REQ and using krb5_rd_req_decoded, and then using the requested ticket server in the KRB-ERROR message. Fix the mechglue gss_accept_sec_context by reverting that part of commit 56feee187579905c9101b0cdbdd8c6a850adcfc9. Add a test program which artificially induces a replay cache failure (the easiest failure we can produce which has an associated RFC 4120 error code) and checks that this can be communicated back to the initiator via an error token. ticket: 1445 target_version: 1.12 tags: pullup
* Add missing entries to tests/gssapi Makefile.inGreg Hudson2013-10-142-17/+59
| | | | | | Some test sources files, objects, or programs were missing from SRCS, OBJS, all, check-pytests, or clean. t_oid was also out of order in a couple of places.
* Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100Greg Hudson2013-10-141-2/+2
| | | | | | | | | | | | | | | draft-ietf-krb-wg-pkinit-alg-agility-07 specifies KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111. The former value has been reassigned to 100 to fix the conflict. Use the correct value. We believe that this error won't crop up in practice for a long time (when SHA-2 has been superceded by other hash algorithms and people are desupporting it), by which time implementations will mostly have been upgraded to use the new value. ticket: 7715 (new) target_version: 1.12
* Fix GSSAPI krb5 cred ccache importGreg Hudson2013-10-146-18/+27
| | | | | | | | | | | | | | json_to_ccache was incorrectly indexing the JSON array when restoring a memory ccache. Fix it. Add test coverage for a multi-cred ccache by exporting/importing the synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move export_import_cred from t_export_cred.c to common.c to facilitate this. Make a note in t_export_cred.py that this case is covered in t_s4u.py. ticket: 7706 target_version: 1.11.4
* Perform complete referrals in t_referral.pyGreg Hudson2013-10-091-31/+44
| | | | | | | | | | | | | | t_referral.py was written to exercise KDC host referral logic, and did not actually create the target realm, instead just looking at the error message from gcred to determine whether the KDC returned a referral or not. It's only a small amount of additional work to actually set up the target realm and check that the client code successfully retrieves the referral, so do that instead. Since the referral and non-referral outcomes aren't all that similar any more, split test() into testref() and testfail(). Get rid of the message argument, since it wouldn't be output in most cases where we get an unexpected result.
* Update for krb5-1.13-prereleaseTom Yu2013-10-071-1/+1
|
* Fix audit test module initializationGreg Hudson2013-10-051-2/+1
| | | | | | | | Check if the fopen result is NULL, not whether it's less than zero. ticket: 7713 (new) target_version: 1.12 tags: pullups
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-0429-7/+2770
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Be smarter about installing debug symbolsBen Kaduk2013-10-042-19/+25
| | | | | | | | | | | | We know when we're going to generate debug symbols, so only attempt to install them when we know they should be present. This eliminates the need to tell make to ignore errors from the shell on these steps. ticket: 7317 tags: pullup target_version: 1.11.4
* Use better URL for kerberos documentationBen Kaduk2013-10-042-2/+2
| | | | | | | | | | | | We have added a krb5-latest symlink for the latest stable release, which is preferred to the krb5-current link (which points to a nightly build of master). ticket: 7673 (new) ticket: 7493 queue: kfw tags: pullup target_version: 1.11.4
* Remove OldCC/rpc.cxxBen Kaduk2013-10-042-80/+0
| | | | | | | | It is only linked on one place, which does not use any of the exported routines, since an alternate implementation is linked first. Remove the dead code and reduce the number of warnings omitted by the build process.
generated by cgit (git 2.34.1) at 2024-05-21 09:08:16 +0000