summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Move kdc log routines into a separate fileZhanna Tsitkov2013-12-203-198/+229
| | | | | Their previous location - kdc_util.c - seems to be overloaded with various helper functions. No code changes.
* Fix typo that broke 'make clean'Zhanna Tsitkov2013-12-201-1/+1
| | | | Missing $
* Move kprop error explanation into TroubleshootingZhanna Tsitkov2013-12-192-48/+77
| | | | | | | The plan is to make Troubleshooting section of the documentation a one-stop-shop place for all error diagnostics, explanations and possible solutions. The relocation of kprop error messages descriptions is part of this consolidation effort.
* Add a test program for krb5_copy_contextGreg Hudson2013-12-183-1/+175
| | | | | | | | This test program isn't completely proof against the kind of mistakes we've made with krb5_copy_context in the past, but it at least exercises krb5_copy_context and can detect some kinds of bugs. ticket: 7807
* Fix krb5_copy_contextGreg Hudson2013-12-182-1/+16
| | | | | | | | | | | | | krb5_copy_context has been broken since 1.8 (it broke in r22456) because k5_copy_etypes crashes on null enctype lists. Subsequent additions to the context structure were not reflected in krb5_copy_context, creating double-free bugs. Make k5_copy_etypes handle null input and account for all new fields in krb5_copy_context. Reported by Arran Cudbard-Bell. ticket: 7807 (new) target_version: 1.12.1 tags: pullup
* Test SPNEGO error message in t_s4u.pyGreg Hudson2013-12-181-6/+5
| | | | | | | Now that #7045 is fixed, we can check for the correct error message from t_s4u2proxy_krb5 with --spnego. ticket: 7045
* Let SPNEGO display mechanism errorsSimo Sorce2013-12-182-8/+35
| | | | | | | | | | | | | | | To avoid potential recursion we use a thread local variable that tells us whether the ancestor was called via spnego_gss_display_name(). If we detect recursion, we assume that we returned a com_err code like ENOMEM and call error_message(); in the worst case that will result in an "Unknown error" message. [ghudson@mit.edu: Edited comments and commit message; removed an unneeded line of code.] ticket: 7045 target_version: 1.12.1 tags: pullup
* Remove unused krb5_context fieldsGreg Hudson2013-12-183-5/+0
| | | | | The vtbl and locate_fptrs fields were ostensibly related to the locate pluggable interface, but weren't actually used.
* Clarify klist -s documentationGreg Hudson2013-12-171-4/+3
| | | | | | | | | | | | The documentation for klist -s erroneously suggests that it doesn't affect the exit status behavior and that it merely checks for the existence of the ccache (only mentioning the expired ticket check at the end). Make it clearer and simpler, but avoid going into a lot of detail about the nature of the expiration check. ticket: 7806 (new) target_version: 1.12.1 tags: pullup
* Remove BADSYMSGreg Hudson2013-12-161-281/+0
| | | | | We haven't been using it or keeping it up to date, and there's no need to keep it checked in.
* Don't require krb5.conf without KRB5_DNS_LOOKUPGreg Hudson2013-12-162-15/+2
| | | | | | | | | | | | For a long time we have allowed krb5 contexts to be initialized in the absence of krb5.conf--but only if KRB5_DNS_LOOKUP is defined, presumably on the theory that no KDCs could be contacted without either DNS support or profile configuration. But locate plugins could provide the ability to find KDCs, and some libkrb5 operations (such as IAKERB initiation) could succeed without needing to locate KDCs. Also get rid of the profile_in_memory context flag, since we don't use it any more.
* Fix GSS krb5 acceptor acquire_cred error handlingGreg Hudson2013-12-161-1/+3
| | | | | | | | | | | | When acquiring acceptor creds with a specified name, if we fail to open a replay cache, we leak the keytab handle. If there is no specified name and we discover that there is no content in the keytab, we leak the keytab handle and return the wrong major code. Memory leak reported by Andrea Campi. ticket: 7805 target_version: 1.12.1 tags: pullup
* Fix memory leak in SPNEGO initiatorSimo Sorce2013-12-161-0/+1
| | | | | | | | | | | | If we eliminate a mechanism from the initiator list because gss_init_sec_context fails, free the memory for that mech OID before removing it from the list. [ghudson@mit.edu: clarified commit message] ticket: 7803 (new) target_version: 1.12.1 tags: pullup
* Remove unneeded check in SPNEGO initiatorGreg Hudson2013-12-161-7/+0
| | | | | | | | In init_ctx_cont, if the response token contains no fields, we set a return value but don't actually quit out of the function. We do not need this check (we will fail later on if a piece of required information isn't present), so just remove it. Reported by simo@redhat.com.
* Fix SPNEGO one-hop interop against old IISGreg Hudson2013-12-121-0/+6
| | | | | | | | | | | | | | | | IIS 6.0 and similar return a zero length reponse buffer in the last SPNEGO packet when context initiation is performed without mutual authentication. In this case the underlying Kerberos mechanism has already completed successfully on the first invocation, and SPNEGO does not expect a mech response token in the answer. If we get an empty mech response token when the mech is complete during negotiation, ignore it. [ghudson@mit.edu: small code style and commit message changes] ticket: 7797 (new) target_version: 1.12.1 tags: pullup
* Fix up tests directory ignores, deps, cleanupGreg Hudson2013-12-123-2/+15
| | | | | A few test programs didn't make it into .gitignore, OBJS, or EXTRADEPSRCS.
* Add tests for krb5_sname_to_principalGreg Hudson2013-12-125-4/+197
|
* Allow ":port" suffixes in sn2princ hostnamesGreg Hudson2013-12-111-2/+37
| | | | | | | | | MSSQLSvc principal names can contain a ":port" or ":instance" trailer on the hostname part. If we see that in the hostname argument of krb5_sname_to_principal(), remove it before canonicalizing the hostname and put it back on afterwards. ticket: 7795 (new)
* Modernize sn2princ.cGreg Hudson2013-12-112-145/+115
| | | | | Refactor and edit sn2princ.c to match current coding style. No behavior changes, except to be less chatty in trace logs.
* Update man pagesTom Yu2013-12-1025-138/+323
|
* make dependTom Yu2013-12-1012-61/+100
|
* Better keysalt docsTom Yu2013-12-096-39/+62
| | | | | | | | | | Add a new section to kdc_conf.rst to describe keysalt lists, and update other documentation to better distinguish enctype lists from keysalt lists. ticket: 7608 target_version: 1.12 tags: pullup
* Avoid malloc(0) in SPNEGO get_input_tokenGreg Hudson2013-12-061-6/+9
| | | | | | | If we read a zero-length token in spnego_mech.c's get_input_token(), set the value pointer to NULL instead of calling malloc(0). ticket: 7794 (new)
* Fix S4U2Self against non-FAST KDCsGreg Hudson2013-12-061-5/+34
| | | | | | | | | | | When we added FAST TGS support in 1.11, we broke S4U2Self against KDCs which don't support FAST, because the S4U2Self padata is only present within the FAST request. For now, duplicate that padata in the outer request so that both FAST and non-FAST KDCs can see it. ticket: 7791 target_version: 1.11.5 tags: pullup
* Fix error message quotations in install_kdc.rstTom Yu2013-12-031-6/+5
| | | | | | | | | | | Some error messages that kprop could print were quoted incorrectly in install_kdc.rst. Also fix minor typos. ticket: 7785 (new) target_version: 1.12 tags: pullup
* Edit README.asn1Greg Hudson2013-12-031-34/+51
| | | | | | Add another blank line before section headers. Avoid contractions. Change some whiches to thats where it seems appropriate. Fix some missing or extra words.
* Bump libgssrpc minor versionTom Yu2013-11-271-1/+1
| | | | | | Bump minor version for the new log_badauth2 interfaces. ticket: 7770
* Correctly log IPv6 addresses in kadmindGreg Hudson2013-11-255-58/+50
| | | | | | | | | | | | | | Define client_addr() in server_stubs.c and use it consistently in that file and ipropd_svc.c to get the client address from a transport handle. In it, call getpeername() on the client socket and use inet_ntop() on the result, instead of using inet_ntoa() on the IPv4 socket address. Provide a log_badauth2 callback to GSSRPC, so that we get a transport handle instead of an IPv4 socket address, and use client_addr() within it instead of inet_ntoa(). ticket: 7770 target_version: 1.12 tags: pullup
* Add new versions of log_badauth gssrpc callbacksGreg Hudson2013-11-255-11/+59
| | | | | | | | | | libgssrpc supports two callbacks for gss_accept_sec_context failures on servers (one for AUTH_GSS and one for AUTH_GSSAPI), which are IPv4-specific. Provide an alternate version which supplies the transport handle instead of the address, so that we can get the address via the file descriptor for TCP connections. ticket: 7770
* Remove inet_ntoa() prototype from getrpcent.cBen Kaduk2013-11-251-1/+0
| | | | | | | It is not needed. In general, we shouldn't be using inet_ntoa(), anyway, as it is IPv4-specific and we have IPv6 support almost everywhere.
* Update doc for current kdb5_util dump versionTom Yu2013-11-221-1/+1
| | | | | | | | | kdb5_util.rst incorrectly describes the current default dump format version as 6 when it should be 7. Reported by Jeff D'Angelo. ticket: 7777 target_version: 1.12 tags: pullup
* Edit ccache_def.rstGreg Hudson2013-11-221-79/+83
| | | | | | | Re-fill to 70 columns. Replace non-ascii apostrophes with ASCII ones. Edit wording slightly. ticket: 7776
* Added a new ccache doc to "Kerberos V5 concepts"Zhanna Tsitkov2013-11-222-0/+135
| | | | | | | | | This is to add a short introductory document on credential caches to the Concepts section of Kerberos documentation. ticket: 7776 (new) target_version: 1.12 tags: pullup
* Improve default ccache name API documentationGreg Hudson2013-11-221-6/+25
| | | | | | | | | | | | Document the lifetime and caching behavior of the krb5_cc_default_name() return value. Document that krb5_cc_set_default_name() may be called with NULL to purge the cached value. Correct a typo in the krb5_cc_default() summary and explicitly reference krb5_cc_default_name(). ticket: 7775 (new) target_version: 1.12 tags: pullup
* Correct kadm5.acl back-reference documentationGreg Hudson2013-11-211-3/+4
| | | | | | | | | In kadm5.acl, *N in the target principal name refers to the Nth wildcard in the acting principal pattern, not the Nth component. ticket: 7774 (new) target_version: 1.12 tags: pullup
* Add another kadmin ACL test for backreferencesGreg Hudson2013-11-211-0/+6
| | | | | | Add a test using backreferences which don't correspond directly to principal components, to verify that *N refers to the Nth wildcard and not the Nth component.
* Clarify lockout replication issues in docsGreg Hudson2013-11-181-7/+13
| | | | | | | | | | | | In the "KDC replication and account lockout" section of lockout.rst, specifically call out kprop and incremental propagation as the mechanisms which do not replicate account lockout state, and add a note that KDCs using LDAP may not be affected by that section's concerns. ticket: 7773 (new) target_version: 1.12 tags: pullup
* Remove dangling --with-kdc-kdb-update referencesGreg Hudson2013-11-172-19/+0
| | | | | | This configure option hasn't done anything since 1.8, so don't mention it in configure --help or the documentation. The disable_last_success and disable_lockout DB options are now used to turn it off.
* Remove a warning in AES string-to-keyGreg Hudson2013-11-151-7/+4
| | | | | | | On 32-bit platforms, the code to translate an iteration count of 0 to 2^32 can trigger a compiler warning. Since we will basically never accept an iteration count that high (right now we reject anything above 2^24), just reject it out of hand.
* Set expiration time on keys and keyringsSimo Sorce2013-11-151-5/+66
| | | | | | | | | | | By setting the timeout based on the credetial's timeout we let the system automatically cleanup expired credentials. [ghudson@mit.edu: simplified code slightly] ticket: 7769 (new) target_version: 1.12 tags: pullup
* Add support to store time offsets in cc_keyringSimo Sorce2013-11-151-2/+203
| | | | | | | | | | | | | | The code follows the same model used for the memory ccache type. Time offsets are stored in each credential cache in a special key just like the principal name. Legacy session caches do not store timestamps as legacy code would fail when iterating over the new offset key. [ghudson@mit.edu: minor formatting changes; note legacy session exception in commit message] ticket: 7768 (new) target_version: 1.12 tags: pullup
* Enforce minimum PBKDF2 iteration countTom Yu2013-11-153-65/+233
| | | | | | | | | Also add a testing interface to allow weak iteration counts. (Published test vectors use weak iteration counts.) ticket: 7465 target_version: 1.12 tags: pullup
* Catch more strtol() failures when using KEYRINGsNalin Dahyabhai2013-11-121-3/+3
| | | | | | | | | | | | | When parsing what should be a UID while resolving a KEYRING ccache name, don't just depend on strtol() to set errno when the residual that we pass to it can't be parsed as a number. In addition to checking errno, pass in and check the value of an "endptr". [ghudson@mit.edu: simplified slightly] ticket: 7764 (new) target_version: 1.12 tags: pullup
* Clarify realm and dbmodules configuration docsGreg Hudson2013-11-061-23/+34
| | | | | | | | | | | | | In kdc_conf.rst, add examples showing how to configure a realm parameter and a database parameter. Document that the default DB configuration section is the realm name, and use that in the example. Move the db_module_dir description to the end of the [dbmodules] documentation since it is rarely used and could confuse a reader about the usual structure of the section. ticket: 7759 (new) target_version: 1.12 tags: pullup
* Multi-realm KDC null deref [CVE-2013-1418]Tom Yu2013-11-041-0/+3
| | | | | | | | | | | | | | | If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C A related but more minor vulnerability requires authentication to exploit, and is only present if a third-party KDC database module can dereference a null pointer under certain conditions. ticket: 7755 (new) target_version: 1.12 tags: pullup
* Remove rtm_type_name()Ben Kaduk2013-11-041-37/+0
| | | | | It has been unused since 2009 when Ken decided that the routing log messages were too verbose (commit 91fc077c96926dd60).
* Clean up the code to eliminate some clang warningsBen Kaduk2013-11-048-11/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In ure.c, though k is a short, the literal 1 is of type 'int', and so the operation 'k + 1' is performed at the (32-bit) width of int, and therefore the "%d" format string is correct. In accept_sec_context.c, the 'length' field of krb5_data is an unsigned type, so checking for a negative value has no effect. In net-server.c, the helper routine rtm_type_name() is only used in code that is disabled with #if 0 conditionals; make the definition also disabled in the same way to avoid warnings of an unused function. In kdc_authdata.c, equality checks in double parentheses elicit a warning from clang. The double-parentheses idiom is normally used to indicate that an assignment is being performed, but the value of the assignment is also to be used as the value for the conditional. Since assignment and equality checking differ only by a single character, clang considers this worthy of a warning. Since the extra set of parentheses is redundant and against style, it is correct to remove them. In several places (sim_server.c, dump.c, kdb5_destroy.c, ovsec_kadmd.c), there are declarations of extern variables relating to getopt() functionality that are now unused in the code. Remove these unused variables.
* Make set_cloexec_fd return voidBen Kaduk2013-11-041-10/+7
| | | | | | | | | We never check its return value (causing clang to emit warnings), and its use is primarily in cases where we should continue processing in the event of failure. Just ignore errors from the underlying fcntl() call (if present) and treat this operation as best-effort. The #if 0 code should probably be removed.
* Avoid deprecated krb5_get_in_tkt_with_keytabBen Kaduk2013-11-043-46/+46
| | | | | | | | | | | | | | | | | | | | | The kprop code has been pretty unloved, and uses some routines that are marked as deprecated (which show up as warnings in the build log). Use the documented replacement for krb5_get_in_tkt_with_keytab, krb5_get_init_creds_keytab, instead. As a bonus, there is no longer a side effect of a credentials cache that needs to be destroyed. The also-deprecated function krb5_get_in_tkt_with_skey was backending to it when no keyblock was passed in; we can unroll the call to krb5_get_init_creds_keytab ourselves as the documented workaround. While here, improve style compliance with regards to cleanup. The setkey test just wants to know whether it can use the key it just put into a keytab to get credentials; as such the recommended krb5_get_init_creds_keytab is quite sufficient. While here, use that interface to request the particular enctype as well, reducing the scope of an XXX comment. ticket: 6366
* Remove last uses of "possibly-insecure" mktemp(3)Ben Kaduk2013-11-043-23/+39
| | | | | | | | | | | | | | | | | | | | Many libc implementations include notations to the linker to generate warnings upon references to mktemp(3), due to its potential for insecure operation. This has been the case for quite some time, as was noted in RT #6199. Our usage of the function has decreased with time, but has not yet disappeared entirely. This commit removes the last few instances from our tree. kprop's credentials never need to hit the disk, so a MEMORY ccache is sufficient (and does not need randomization). store_master_key_list is explicitly putting keys on disk so as to do an atomic rename of the stash file, but since the stash file should be in a root-only directory, we can just use a fixed name for the temporary file. When using this fixed name, we must detect (and error out) if the temporary file already exists; add a test to confirm that we do so. ticket: 1794
generated by cgit (git 2.34.1) at 2025-09-27 08:57:23 +0000