summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Use active master key in update_princ_encryptionGreg Hudson2013-10-252-12/+7
| | | | | | | | | kdb5_util update_princ_encryption should update to the active master key version, not the most recent. ticket: 6507 target_version: 1.12 tags: pullup
* Fix typos in kdb5_util master key command outputsGreg Hudson2013-10-251-5/+5
| | | | | | | | | | kdb5_util list_mkeys was beginning lines with "KNVO" instead of "KVNO". kdb5_util purge_mkeys was displaying "follwing" instead of "following" for both dry-run and normal cases. ticket: 7730 (new) target_version: 1.12 tags: pullup
* Fix race in util/profile/Makefile.inGreg Hudson2013-10-211-7/+1
| | | | | | $(BUILDTOP)/include/profile.h was being updated by two different rules, which could collide with make -j. Use a dependency from includes instead of a redundant rule.
* Discuss cert expiry, no-key princs in PKINIT docsGreg Hudson2013-10-172-6/+46
| | | | | | | | | | | | In pkinit.rst, add "-days" options to the example commands for creating certificate and briefly discuss the issue of expiration dates so that the administrator thinks about it. In troubleshoot.rst, add an entry for the "certificate has expired" error which results from PKINIT (when linked with OpenSSL) when a certificate has expired. ticket: 7719 (new) target_version: 1.12 tags: pullup
* Use protocol error for PKINIT cert expiryGreg Hudson2013-10-171-1/+1
| | | | | | | | | | | If we fail to create a cert chain in cms_signeddata_create(), return KRB5KDC_ERR_PREAUTH_FAILED, which corresponds to a protocol code, rather than KRB5_PREAUTH_FAILED, which doesn't. This is also more consistent with other error clauses in the same function. ticket: 7718 (new) target_version: 1.12 tags: pullup
* Fix gss_accept_sec_context error tokensGreg Hudson2013-10-146-37/+157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | A GSS krb5 error response contains a KRB-ERROR message, which is required to have a server principal name, although few recipients actually use it. Starting in 1.3, accept_sec_context would fail to encode the error in the GSS_C_NO_NAME/GSS_C_NO_CREDENTIAL case (introduced by #1370) because cred->princ (which became cred->name->princ in 1.8) is unset. This problem got worse in 1.10 because we stopped setting the server field in all cases due to the changes for #6855. In 1.11 the problem got worse again when a misguided change to the mechglue started discarding output tokens when the mechanism returns an error; the mechglue should only do so when it itself causes the error. Fix krb5 gss_accept_sec_context by unconditionally decoding the AP-REQ and using krb5_rd_req_decoded, and then using the requested ticket server in the KRB-ERROR message. Fix the mechglue gss_accept_sec_context by reverting that part of commit 56feee187579905c9101b0cdbdd8c6a850adcfc9. Add a test program which artificially induces a replay cache failure (the easiest failure we can produce which has an associated RFC 4120 error code) and checks that this can be communicated back to the initiator via an error token. ticket: 1445 target_version: 1.12 tags: pullup
* Add missing entries to tests/gssapi Makefile.inGreg Hudson2013-10-142-17/+59
| | | | | | Some test sources files, objects, or programs were missing from SRCS, OBJS, all, check-pytests, or clean. t_oid was also out of order in a couple of places.
* Change KRB5KDC_ERR_NO_ACCEPTABLE_KDF to 100Greg Hudson2013-10-141-2/+2
| | | | | | | | | | | | | | | draft-ietf-krb-wg-pkinit-alg-agility-07 specifies KDC_ERR_NO_ACCEPTABLE_KDF as 82, but this value conflicts with KRB_AP_ERR_PRINCIPAL_UNKNOWN from RFC 6111. The former value has been reassigned to 100 to fix the conflict. Use the correct value. We believe that this error won't crop up in practice for a long time (when SHA-2 has been superceded by other hash algorithms and people are desupporting it), by which time implementations will mostly have been upgraded to use the new value. ticket: 7715 (new) target_version: 1.12
* Fix GSSAPI krb5 cred ccache importGreg Hudson2013-10-146-18/+27
| | | | | | | | | | | | | | json_to_ccache was incorrectly indexing the JSON array when restoring a memory ccache. Fix it. Add test coverage for a multi-cred ccache by exporting/importing the synthesized S4U2Proxy delegated cred in t_s4u2proxy_krb5.c; move export_import_cred from t_export_cred.c to common.c to facilitate this. Make a note in t_export_cred.py that this case is covered in t_s4u.py. ticket: 7706 target_version: 1.11.4
* Perform complete referrals in t_referral.pyGreg Hudson2013-10-091-31/+44
| | | | | | | | | | | | | | t_referral.py was written to exercise KDC host referral logic, and did not actually create the target realm, instead just looking at the error message from gcred to determine whether the KDC returned a referral or not. It's only a small amount of additional work to actually set up the target realm and check that the client code successfully retrieves the referral, so do that instead. Since the referral and non-referral outcomes aren't all that similar any more, split test() into testref() and testfail(). Get rid of the message argument, since it wouldn't be output in most cases where we get an unexpected result.
* Update for krb5-1.13-prereleaseTom Yu2013-10-072-4/+4
|
* Fix audit test module initializationGreg Hudson2013-10-051-2/+1
| | | | | | | | Check if the fopen result is NULL, not whether it's less than zero. ticket: 7713 (new) target_version: 1.12 tags: pullups
* KDC Audit infrastructure and plugin implementationZhanna Tsitkov2013-10-0429-7/+2770
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per project http://k5wiki.kerberos.org/wiki/Projects/Audit The purpose of this project is to create an Audit infrastructure to monitor security related events on the KDC. The following events are targeted in the initial version: - startup and shutdown of the KDC; - AS_REQ and TGS_REQ exchanges. This includes client address and port, KDC request and request ID, KDC reply, primary and derived ticket and their ticket IDs, second ticket ID, cross-realm referral, was ticket renewed and validated, local policy violation and protocol constraints, and KDC status message. Ticket ID is introduced to allow to link tickets to their initial TGT at any stage of the Kerberos exchange. For the purpose of this project it is a private to KDC ticket ID: each successfully created ticket is hashed and recorded into audit log. The administrators can correlate the primary and derived ticket IDs after the fact. Request ID is a randomly generated alpha-numeric string. Using this ID an administrator can easily correlate multiple audit events related to a single request. It should be informative both in cases when the request is sent to multiple KDCs, or to the same KDC multiple times. For the purpose of testing and demo of the Audit, the JSON based modules are implemented: "test" and "simple" audit modules respectively. The file plugins/audit/j_dict.h is a dictionary used in this implememtations. The new Audit system is build-time enabled and run-time pluggable. [kaduk@mit.edu: remove potential KDC crashes, minor reordering] ticket: 7712 target_version: 1.12
* Be smarter about installing debug symbolsBen Kaduk2013-10-042-19/+25
| | | | | | | | | | | | We know when we're going to generate debug symbols, so only attempt to install them when we know they should be present. This eliminates the need to tell make to ignore errors from the shell on these steps. ticket: 7317 tags: pullup target_version: 1.11.4
* Use better URL for kerberos documentationBen Kaduk2013-10-042-2/+2
| | | | | | | | | | | | We have added a krb5-latest symlink for the latest stable release, which is preferred to the krb5-current link (which points to a nightly build of master). ticket: 7673 (new) ticket: 7493 queue: kfw tags: pullup target_version: 1.11.4
* Remove OldCC/rpc.cxxBen Kaduk2013-10-042-80/+0
| | | | | | | | It is only linked on one place, which does not use any of the exported routines, since an alternate implementation is linked first. Remove the dead code and reduce the number of warnings omitted by the build process.
* Use new-style variable expansion for light.exeBen Kaduk2013-10-044-34/+34
| | | | | | | | | | | | With WiX 3.x, the preprocessor candle.exe expands variables using $(); the linker light.exe expands localization and similar variables using !(), though it accepts the $() form and prints a warning. Switch to using the expected form to silence the warnings. ticket: 7390 tags: pullup target_version 1.11.4
* Remove unneeded variable enc_tkt_transitedBen Kaduk2013-10-041-7/+2
| | | | | | | | | There's no need to use an intermediate variable to initialize the contents of enc_tkt_reply.transited. Instead of setting each field to zero individually (and misspelling NULL), use memset and set the one field which is being initialized to a nonzero value explicitly.
* Zero out stack variables in process_tgs_req()Ben Kaduk2013-10-041-4/+5
| | | | | | | | It is general good hygeine, preventing stack garbage from accidentally leaking out into other consumers. Don't bother with variables that are only used in a single place, but do initialize the 'magic' field of nolrentry before it is used.
* Use constant-time comparisons for checksumsGreg Hudson2013-10-0310-17/+17
|
* Add an internal constant-time comparison functionGreg Hudson2013-10-034-1/+57
| | | | | | | k5_bcmp acts similarly to the deprecated Unix bcmp() function, returning zero if two memory regions are equal and nonzero if they are not. It is implemented such that it should take the same amount of time regardless of how many bytes are equal within the memory regions.
* Conditionally test KEYRING ccache typeGreg Hudson2013-10-024-44/+156
| | | | | | | | | | | | | | | | | | | If the keyctl command is found and klist recognizes the KEYRING credential cache type, then run several tests against keyring ccaches: the collection test program in lib/krb5/ccache, the command-line collection tests in tests/t_ccache.py, and some new tests to verify legacy session cache behavior. Much of the Python code in t_ccache.py is moved into a new function named "collection_test" so we can run it once against a DIR collection and once against a KEYRING collection. Also: fix a memory leak in the collection test program; add a test for iteration when the default cache name is a subsidiary name; use a process keyring ccache in t_cc.c to avoid leaving behind empty collections in the session keyring after each test run. Adapted from a patch by simo@redhat.com. ticket: 7711
* Support new KEYRING anchor names and big_key keysGreg Hudson2013-10-023-27/+148
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for the new anchor names persistent, user, and session. The persistent anchor attempts to use a persistent keyring for a specified uid, and falls back to the user keyring if it cannot; the collection is stored at a fixed name within the persistent or user keyring. The session anchor uses the session keyring without legacy semantics. For all keyring types except legacy, attempt to use the "big_key" key type on systems which have keyctl_get_persistent. (They are essentially unrelated features, but were added at the same time.) This key type is stored in a kernel tmpfs and can store larger tickets. Since kernel commit 96b5c8fea6c0861621051290d705ec2e971963f1, new keys created by add_key() only have VIEW permission for the user, and the rest of the permissions require "possession," which means there is a path from the thread, process, or session keyring to the key. For the user and persistent anchor types, we link the collection into the process keyring to ensure that we have a possession rights on the collection. Adapted from a patch by simo@redhat.com. ticket: 7711
* Add collection support for KEYRING ccache typeGreg Hudson2013-10-022-149/+792
| | | | | | | | | | | | | Augment the KEYRING ccache type to support collection semantics similar to those of the DIR type. For keyrings with no anchor prefix, maintain compatibility with old code by linking the initial primary cache directly from the session keyring and naming it after the collection. See http://k5wiki.kerberos.org/wiki/Projects/Keyring_collection_cache for more information. Adapted from a patch by simo@redhat.com. ticket: 7711 (new)
* Clarify variable names in cc_keyring.cGreg Hudson2013-09-281-56/+55
| | | | | | | | | | Consistently use "cache_name" and "cache_id" to talk about the name and ID of the keyring containing the cache. In krb5_krcc_resolve, use "residual" for the residual string as we are no longer using it for the cache keyring name, and use "anchor_id" for the keyring identified by the prefix to make it clear that it is not the cache keyring. Adapted from a patch by simo@redhat.com.
* Defer KEYRING key creation until initializeGreg Hudson2013-09-281-22/+58
| | | | | | | | | | If we resolve a KEYRING cache and the key does not exist, wait until initialize time to create it, to avoid wasting precious kernel memory on a cache which might not ever be created. Properly error out if store_cred or start_seq_get is called on an uninitialized cache, as we would for a FILE cache. Adapted from a patch by simo@redhat.com.
* Add "which" function to k5testGreg Hudson2013-09-282-9/+13
| | | | | Add a utility function in k5test.py to look for a command in the executable path, and remove it from t_kdb.py.
* Improve kinit output credential cache selectionGreg Hudson2013-09-261-104/+131
| | | | | | | | | | If kinit chooses a client principal based on anything other than the current default ccache's principal name, apply collection rules if possible. When applying collection rules, if we don't find an existing cache for the client principal, use the default cache if it is uninitialized, instead of creating a new one. ticket: 7689
* Support authoritative KDB check_transited methodsGreg Hudson2013-09-252-10/+9
| | | | | | | | | In kdc_check_transited_list, consult the KDB module first. If it succeeds, treat this as authoritative and do not use the core transited mechanisms. Modules can return KRB5_PLUGIN_NO_HANDLE to fall back to core mechanisms. ticket: 7709
* Add ccache collection tests using APIGreg Hudson2013-09-243-2/+366
| | | | | | Create a new test program in lib/krb5/ccache named t_cccol.c which verifies collection semantics using the API. Run it with an empty DIR collection in t_cccol.py.
* Factor out krb5int_random_string() routineZhanna Tsitkov2013-09-246-40/+76
| | | | | Make krb5int_random_string() function available outside ccache code. Move it into a separate file under lib/krb5/krb hierarchy.
* Re-factoring of service processing code in AS-REQZhanna Tsitkov2013-09-231-12/+12
| | | | | | | | | | | | | | | | | | | | Take one step toward re-factoring of the KDC code: keep the service principal related code in one place. The code pattern was changed from: - unparse client - - unparse service - - db_get_ client - - client referrals - - db_get_ service - - validate policies etc into: - unparse client - - db_get_ client - - client referrals - - unparse service - - db_get_ service - - validate policies etc
* Err codes in KRB_ERROR protocol messages are < 128Zhanna Tsitkov2013-09-235-4/+5
| | | | | | If the error code is out of [0,127] range, assign it to KRB_ERR_GENERIC. This fix is to correct the previous behavior with [0,128] range. For more information see krb5_err.et
* Fix literal blocks in gssapi.rstTom Yu2013-09-201-2/+2
| | | | | | Some literal blocks in the new AEAD and IOV documentation in gssapi.rst started with ":" instead of "::", causing documentation build errors.
* Use macros instead of magic numbers in json.cZhanna Tsitkov2013-09-191-6/+7
| | | | Avoid using "magic numbers" for better maintainability.
* Release krb5-1.9 is not supported anymoreZhanna Tsitkov2013-09-191-1/+1
| | | | Release 1.9.5 was the last planned release for the krb5-1.9 series.
* Document AEAD and IOV GSSAPI extensionsGreg Hudson2013-09-181-0/+295
|
* Add GSSAPI IOV MIC functionsGreg Hudson2013-09-1816-50/+399
| | | | | | | | | | | | | Add gss_get_mic_iov, gss_get_mic_iov_length, and gss_verify_mic_iov functions, which work similarly to the corresponding IOV wrap functions. Add a new buffer type GSS_IOV_BUFFER_TYPE_MIC_TOKEN for the destination buffer. Most of the internal code for this was already present, and just needed to be fixed up and adjusted to use the new buffer type for the MIC token. ticket: 7705 (new)
* Correct comments in ccselect_plugin.hZhanna Tsitkov2013-09-181-3/+3
| | | | Some text mistakenly referred to password quality plugin.
* Get rid of G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZEGreg Hudson2013-09-083-7/+1
| | | | | | | | | | This flag was introduced in the mskrb-integ merge but is not actually used after r21742--while kg_unseal_iov_token sets it in vfyflags for DCE-style contexts, it doesn't actually pass vfyflags to g_verify_token_header or otherwise use it. Moreover, the flag is not necessary there; we correctly set input_length to the header length (without data, padding, or trailer) for v1 tokens in a DCE-style context.
* Use gss_release_iov_buffer in t_iov.cGreg Hudson2013-09-061-20/+7
|
* Add tests for GSS IOV and AEAD interfacesGreg Hudson2013-09-064-6/+486
| | | | | | Add a new test program t_iov.c which tests various combinations of wrapping and unwrapping using the IOV and AEAD interfaces. Run it with and without SPNEGO in each enctype configuration.
* Factor out context establishment in GSS testsGreg Hudson2013-09-0612-271/+134
| | | | | | Add a new helper to common.c which runs gss_init_sec_context and gss_accept_sec_context in a loop, and use it in test programs instead of the open-coded one-token or two-token exchanges.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-064-2/+17
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Stop modifying TGS requests for referralsGreg Hudson2013-09-031-17/+0
| | | | | | | | | | | | | | | | | | | | | | | | It is no longer necessary to modify request->server when we receive a referral. The uses of request->server break down as follows: * Matching against previously issued tickets (e.g. for renewals). We now explicitly disallow referrals for requests where we need to do that. * Using only the realm (e.g. for transited checking). Referrals are cross-realm TGS entries within the same realm as the requested server principal, so this does not change. * Comparing to a local TGS principal (for restrict_anonymous_to_tgt enforcement). Local TGS principals are not treated as referrals, so the sense of this comparison will not change if we use the original request. * Setting the sname and realm fields of a KRB-ERROR response. RFC 4120 and 6806 do not specify what we should put here for referrals or aliases and we are not aware of any uses of this field by clients, so putting the requested server principal here should be okay.
* Explicitly prevent referrals for certain requestsGreg Hudson2013-09-032-2/+21
| | | | | | | | | | | | | | | | For ticket modification requests (such as renewals), u2u requests, and S4U2Self requests, the requested server principal is expected to match a previously issued ticket. If that principal no longer exists, we must fail the request; we cannot issue a referral. We are currently doing that by rewriting request->server to the referral principal, which causes the match against the ticket to fail. Since we would like to stop modifying the request, we must explicitly prevent referrals in these cases. We don't find out whether a request is S4U2Self until after we've looked up the server principal, so for now we have to make a retroactive check for a referral after calling kdc_process_s4u2self_req.
* Tighten up referral recognition in KDC TGS codeGreg Hudson2013-09-031-2/+6
| | | | | | | | | | | | In do_tgs_req(), treat the search_sprinc() result as a referral only if it is a cross-TGS principal and it doesn't match the requested server principal. This change fixes two corner cases: (1) when a client requests a cross-realm TGT, we won't squash the name type in the response; and (2) if we are serving multiple realms out of the same KDB, we will properly handle aliases to any local-realm TGT, not just the one for the configured realm name. ticket: 7555
* Fix FAST critical option bit checkingGreg Hudson2013-09-031-2/+2
| | | | | | | | | The FAST option bits 0-15 are intended to be critical--if they are present and a KDC does not support them, the KDC is supposed to fail the request. Because of an incorrect constant, we were erroneously recognizing bits 24-31 as critical. Fix the constant. ticket: 7701 (new)
* Support FAST hide-client-names optionGreg Hudson2013-09-035-1/+19
| | | | | | | | In the KDC, if we see the hide-client-names option, identify the client as the anonymous principal in KDC-REP and KRB-ERROR responses. The actual client name is present in encrypted FAST elements. ticket: 7700 (new)
* Make it possible to renew aliased service ticketsGreg Hudson2013-08-292-3/+11
| | | | | | | | | We always allow aliases in the service principal when processing AS-REQs and TGS-REQs. If the ticket we issued is presented back to us in a TGS-REQ as a header ticket for renewal or similar, we should allow aliases when looking up its key to decode the AP-REQ. ticket: 7699 (new)
generated by cgit (git 2.34.1) at 2024-11-11 20:50:27 +0000