summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-024-2/+201
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* HTTPS transport (Microsoft KKDCPP implementation)Nalin Dahyabhai2014-06-026-28/+471
| | | | | | | | | | | | | | | | | | | | Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy server using HTTPS to communicate with a KDC. The KDC's name should take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy"). An HTTPS connection's encryption layer can be reading and writing when the application layer is expecting to write and read, so the HTTPS callbacks have to handle being called multiple times. [nalin@redhat.com: use cleanup labels, make sure we always send the realm name, keep a copy of the URI on-hand, move most of the conditionally-compiled sections into their own conditionally-built functions, break out HTTPS request formatting into a helper function, handle the MS-KKDCP length bytes, update comments to mention specific versions of the MS-KKDCP spec, differentiate TCP and HTTP trace messages, trace unparseable responses] ticket: 7929
* Dispatch-style protocol switching for transportRobbie Harwood (frozencemetery)2014-06-023-133/+171
| | | | | | | | | | | | | Switch to using per-transport-type functions when a socket that we're using to communicate with a server becomes readable or writable, and add them as pointers to the connection state. The functions are passed the name of the realm of the server being contacted, as we expect to need this in the near future. [nalin@redhat.com: replace macros with typedefs] [nalin@redhat.com: compare transports with TCP_OR_UDP rather than with 0] ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-0212-0/+147
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Build support for TLS used by HTTPS proxy supportRobbie Harwood (frozencemetery)2014-06-028-2/+66
| | | | | | | | | Add a --with-proxy-tls-impl option to configure, taking 'openssl', 'auto', or invocation as --without-proxy-tls-impl. Use related CFLAGS when building lib/krb5/os, and LIBS when linking libkrb5. Call the OpenSSL library startup functions during library initialization. ticket: 7929
* Use k5_transport(_strategy) enums for k5_sendtoRobbie Harwood (frozencemetery)2014-06-0210-122/+178
| | | | | | | | | | | | | | | | | | In k5_sendto and k5_locate_server, replace "socktype" parameters with a new enumerator k5_transport, so that we can add new transports which are not in the socket type namespace. Control the order in which we make connections of different types using a new k5_transport_strategy enumerator, to simplify the logic for adding new transports later. Control the result of k5_locate_server with a no_udp boolean rather than a socket type. [ghudson@mit.edu: renamed type to k5_transport; k5_locate_server no_udp change; clarified commit message; fix for Solaris getaddrinfo] [kaduk@mit.edu: name variables of type k5_transport 'transport'] [nalin@redhat.com: use transport rather than sock_type in more places, add and use k5_transport_strategy, update the test program] ticket: 7929
* Add helper to determine if a KDC is the masterGreg Hudson2014-06-023-64/+80
| | | | | | Add a new function k5_kdc_is_master in locate_kdc.c to determine whether a KDC matches one of the masters, and use it in krb5_sendto_kdc.
* Simplify sendto_kdc.cGreg Hudson2014-06-021-80/+79
| | | | | | | | | | | | | | | | | | * Get rid of the "x" member of conn_state, which used to be a union but hasn't been since r14742. * Define a structure type for the "out" member of conn_state. * Rename incoming_krb5_message to incoming_message for brevity. * Make the "pos" member of incoming_message an offset instead of a pointer, simplifying several present and future computations. * Use "in" and "out" aliases to the conn_state in and out members where it improves brevity. * Rename set_conn_state_msg_length to set_transport_message and give it a descriptive comment. * Call set_transport_message from start_connection only, instead of once in add_connection and perhaps again in start_connection. To make this possible, pass the original message argument to maybe_send and start_connection. * Use make_data and empty_data helpers where appropriate.
* Make x-deltat.y work with bison 3Greg Hudson2014-06-012-762/+629
| | | | | | | | | | | | | | | | | Bison 3 removed support for YYPARSE_PARAM and YYLEX_PARAM, breaking x-deltat.y. Use %parse-param and %lex-param instead. (In Bison 3 we could use just %param, but that doesn't work in 2.x.) The parameter added by %parse-param is also passed to yyerror, so adjust the macro we use to suppress yyerror accordingly. Also use "%define api.pure" instead of "%pure_parser", which was deprecated in bison 2.3b. (The correct spelling was actually "%pure-parser", and bison 3 generates a warning about the underscore spelling.) Regenerate deltat.c using the new x-deltat.y and bison 3.0.2. ticket: 7923
* Change example module name in host_config.rstGreg Hudson2014-06-011-3/+3
| | | | | | | | | | Don't use "otp" as the example clpreauth module name in host_config.rst, since we now ship an effectively built-in otp clpreauth module. Instead use "mypreauth". ticket: 7920 (new) target_version: 1.12.2 tags: pullup
* Correct documentation of 'x' in kadm5.aclBen Kaduk2014-05-291-1/+1
| | | | | It really is all privileges, including setting keys and disallowing the propagation of the principal database.
* Make tcl_kadm5.c work with Tcl 8.6Greg Hudson2014-05-281-27/+15
| | | | | | | | | | Directly accessing the result field of Tcl_Interp has been deprecated for a long time, requires a special define in Tcl 8.6, and will be impossible in Tcl 9. Use Tcl_SetResult instead. The new error messages are less helpful than the old ones, but this is just support infrastructure for old tests, so it isn't important. ticket: 7924
* Fix uninitialized variable bug in KEYRING ccacheGreg Hudson2014-05-281-1/+1
| | | | | | | Commit 5f4a4d7d357fedac5feadc65c09ecf487ff98db8 removed the only unconditional assignment of ret in get_time_offsets, causing the function to return an uninitialized value if nothing goes wrong. Initialize ret at declaration time to fix this.
* Properly handle PKCS11 label in PKINITGreg Hudson2014-05-241-10/+18
| | | | | | | | | | | The CK_TOKEN_INFO label field is defined to be zero-filled, but it may not be zero-terminated if all bytes of the field are used. Use only length-counted operations to process it. Also avoid underrunning the buffer pointer if the label is empty or contains only whitespace. ticket: 7917 target_version: 1.12.2 tags: pullup
* Don't blindly use PKCS11 slot IDs in PKINITGreg Hudson2014-05-241-14/+13
| | | | | | | | | | | Passing invalid slot IDs to C_OpenSession can cause some PKCS #11 implementations (such as the Solaris one) to crash. If a PKINIT identity specifies a slotid, use it to filter the result of C_GetSlotList, but don't try it if it does not appear in the list. ticket: 7916 target_version: 1.12.2 tags: pullup
* Improve pointer hygiene around gss_display_nameGreg Hudson2014-05-242-3/+7
| | | | | | | | | | | | | | | | | | | | GSSAPI functions are responsible for setting their output parameters on failure. Take greater care to do so in krb5_gss_display_name. The mechglue is generally defensive about initializing variables used as outputs, and not assuming that mechs will set them on failure. Make gssint_convert_name_to_union_name initialize union_name->external_name before calling mech->gss_display_name, so that if the mech's gss_display_name doesn't touch it, we don't free an uninitialized pointer. Either one of these changes prevents an unlikely memory bug which could occur if krb5_gss_init_context fails within krb5_gss_display_name when called from gssint_convert_name_to_union_name. ticket: 7915 (new) target_version: 1.12.2
* Fix fencepost error in krad timeout handlerGreg Hudson2014-05-241-1/+1
| | | | | | ticket: 7911 target_version: 1.12.2 tags: pullup
* Document /etc/gss/mech.d/*.confGünther Deschner2014-05-222-8/+11
| | | | [ghudson@mit.edu: editorial changes]
* Load mechglue config files from /etc/gss/mech.dGünther Deschner2014-05-221-11/+54
| | | | | | | | | | | | | In addition to loading /etc/gss/mech, glob for *.conf files in /etc/gss/mech.d. Load only config files which have changed since the highest mtime we saw in the previous scan. Scan at most once per second to avoid excessive numbers of filesystem syscalls for busy GSSAPI applications. [ghudson@mit.edu: rewrote commit message; style changes; added once-per-second throttle on glob/stat calls] ticket: 7882 (new)
* Remove dead code from the mechglue initializationGünther Deschner2014-05-221-27/+0
| | | | | | | | The stat check in gss_indicate_mechs had no consequent and would have been redundant with logic in updateMechList if it did. [ghudson@mit.edu: elaborated commit message; removed unused g_mechSetTime and now-irrelevant comment]
* Test that kinit -k -i picks the intended principalBen Kaduk2014-05-221-0/+3
| | | | | | | Prior to ticket 7892 it would use the default host/ principal when no principal was given on the command line. ticket: 7892
* Do not default to host/ for client keytabsBen Kaduk2014-05-221-0/+17
| | | | | | | | | | | | | | | When the normal (acceptor) keytab is being used to obtain initial credentials, it is reasonable to use the default hostbased service principal (host/fully.qualified.localhost.domain) when no client principal is given. This behavior is not very reasonable when the default client keytab is being used, as host/ credentials are not normally client credentials. Make kinit -i match up with the GSS-API behavior when client keytabs are in use, using the name of the first entry in the keytab when no name is explicitly given. ticket: 7892
* Add tests for krb5int_c_combine_keysGreg Hudson2014-05-214-3/+99
| | | | | | | | | | | | krb5int_c_combine_keys is used only by SAM-2 preauth with neither the send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by any automated function tests. Add some unit tests to make sure that it works and returns the expected results for two randomly generated test vectors. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix krb5int_c_combine_keysKen Hornstein2014-05-211-0/+1
| | | | | | | | | | | | When krb5int_c_combine_keys was updated to use the new crypto interface, a small bug was introduced. It turns out the temporary keyblock created needs to have its enctype set; otherwise, when krb5int_derive_keyblock() is called later, it will fail with KRB5_BAD_ENCTYPE. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix typo in k5test.pyBen Kaduk2014-05-191-1/+1
| | | | The principal/principle confusion strikes again.
* Use case insensitive DNS SAN matching in PKINITTomas Kuthan2014-05-191-1/+1
| | | | | | | Matching Subject Alternative Name from certificate with pkinit_kdc_hostname value from krb5.conf should disregard case. ticket: 7913 (new)
* Fix invalid JSON handling in KDC OTP moduleGreg Hudson2014-05-191-0/+2
| | | | | | | | | | | If the OTP configuration for a principal contains invalid JSON, the KDC OTP module calls k5_json_get_tid on a null pointer, causing the KDC process to crash. Fix this bug by checking the return value of k5_json_decode in decode_config_json. ticket: 7912 (new) target_version: 1.12.2 tags: pullup
* Fix t_marshal on big-endian platformsGreg Hudson2014-05-191-6/+12
| | | | | | | t_marshal.c attempts to skip the version 1 and 2 tests on big-endian platforms, but didn't do so correctly. Correctly start at version 3 on big-endian platforms, and change the way we do it to avoid preprocessor conditionals inside a function body.
* Use cred marshalling functions in cc_keyring.cGreg Hudson2014-05-171-1039/+56
| | | | | | | Replace the cc_keyring.c credential and principal marshalling functions with calls to the ccmarshal.c functions. Simplify the remaining parsing functions (for the index and time offsets) and fold the resulting code into the calling functions where appropriate.
* Use cred marshalling functions in cc_file.cGreg Hudson2014-05-171-653/+170
| | | | | | | | | | | Replace the cc_file.c credential and principal marshalling and unmarshalling functions with calls to the ccmarshal.c functions. For unmarshalling, we still need code to read the appropriate amount of data into a memory buffer. Because there is no outer length header for principals and credentials, this code needs to understand the credential and principal representations, but is much simpler than the old code as it only needs to store the data it reads, not assemble a data structure.
* Modernize cc_file.c and cc_keyring.cGreg Hudson2014-05-172-2348/+1665
| | | | | | | | | | | | | | | | | | | Rename functions not to use the krb5_ prefix, and to use the fcc_ or krcc_ prefixes only for ccache method implementations. Use shorter function comments and add missing comments in some cases. Remove forward declarations where they aren't needed. Use native types (uint16_t, void *, etc.) in preference to Kerberos type wrappers. Use "ret" as the variable name for krb5_error_code return values. Use 0 instead of KRB5_OK. Make whitespace conform to current practice. Remove old #if 0 blocks. Don't cast to and from void * or between integer types when C guarantees an implicit cast. Use literal 2 and 4 for the size of fixed-width 16-bit and 32-bit types. In cc_file.c, rewrite the header comment to specify the header format as updated by version 4 and refer to ccmarshal.c for the principal and credential format. Also add a helper function to return the cache version as an integer from 1 to 4, allowing more concise version checks.
* Add ccache marshalling testsGreg Hudson2014-05-174-2/+415
| | | | | | | Add a new ccache test program t_marshal.c which verifies the new marshalling functions and also the FILE ccache type against the expected representations of the ccache header, default principal, and credentials.
* Add cred marshalling functionsGreg Hudson2014-05-173-0/+495
| | | | | | | Add a new file ccmarshal.c containing functions to marshal and unmarshal credentials in file formats version 1-4. These will replace the functions in cc_file.c and cc_keyring.c, and can be used for KCM in the future.
* Add k5-input.hGreg Hudson2014-05-171-0/+143
| | | | | | | | | Add a header containing a declaration for struct k5input and static inline functions to use it. A k5input structure can be used to safely extract bytes and integers from a fixed-sized input buffer without overrunning the buffer. It supports deferred error checking (similar to k5buf) by returning dummy values and storing a status value in the input structure.
* Add k5_buf_get_spaceGreg Hudson2014-05-173-0/+15
| | | | | Add a new k5_buf method to make room in the buffer for the caller to fill in.
* Modernize rd_cred.cGreg Hudson2014-05-171-188/+138
| | | | | | | | Adjust the internal abstractions so that decrypt_encpart is responsible for the fallback from receiving subkey to session key, and krb5_rd_cred is responsible for decoding and calling decrypt_encpart. Rename krb5_rd_cred_basic to make_cred_list since it is now only responsible for constructing the list.
* Allow GSS mechs to force mechlistMIC in SPNEGOSimo Sorce2014-05-081-0/+37
| | | | | | | | | | | | | | | | | | | During a SPNEGO negotiation, if the NTLMSSP mechanism is used and a MIC is produced within the final initiator mechanism token, Microsoft servers require a mechlistMIC even if NTLMSSP was the most preferred mechanism. In spnego_mech.c, add a helper function mech_requires_mechlistMIC which queries the mechanism to determine whether we might need to produce a mechlistMIC for interoperability. Call it after each call to the mechanism's gss_init_sec_context and set sc->mic_reqd if it returns true. Although only the second call to NTLMSSP will actually ever return true, the first call makes the mechanism aware that the SPNEGO implementation supports this feature. [ghudson@mit.edu: clarified commit message and code] ticket: 7907 (new)
* Fix unlikely memory error in krb5_rd_credNeng Xue2014-05-081-1/+3
| | | | | | | | | If an error occurs in the for loop in krb5_rd_cred_basic (which should only happen on an ENOMEM), do not leave the caller with a dangling reference to the freed credential array. ticket: 7908 (new) target_version: 1.12.2
* Fix unlikely memory leak exporting lucid contextNeng Xue2014-05-071-0/+1
| | | | | | | If the GSSAPI context has an unrecognized proto field (which should never happen), free the context we allocated before returning EINVAL. [ghudson@mit.edu: clarify commit message]
* Don't remove ccache creds before storing themGreg Hudson2014-05-071-3/+0
| | | | | | | | | | | | | Revert #6291, which attempts to suppress duplicate credentials by calling krb5_cc_remove in krb5_cc_store_cred. Most of our ccache types don't implement remove_cred, and avoiding duplicate credentials is a responsibility better suited to the ccache implementation for atomicity reasons. Removing this call gets rid of the misleading "Removing ... from ..." messages in trace logs. ticket: 7906 (new)
* Improve krb5_rd_req decryption failure errorsGreg Hudson2014-05-079-58/+529
| | | | | | | | | | | | | | When krb5_rd_req cannot decrypt a ticket, try to produce the most helpful diagnostic we can, and return an error code which corresponds to the most applicable Kerberos protocol error. Add a trace log containing the error message for ticket decryption failures, in case the application server does not log it. Add new tests to cover krb5_rd_req error messages and adjust existing tests to match the new messages. Also adjust svc_auth_gssapi.c to look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC. ticket: 7232
* Use k5_change_error_message_code in krb5 GSS mechGreg Hudson2014-05-071-4/+1
| | | | Simplify acquire_accept_cred using the new helper function.
* Add helper to change extended error message codeGreg Hudson2014-05-074-0/+17
| | | | | k5_change_error_message_code allows an extended error message to be used when an error code is remapped.
* Remove compile_et.cGreg Hudson2014-04-307-790/+6
| | | | | | We have used awk scripts in preference to the C version of compile_et since 1994 (r4426). Get rid of the sources for the C version and all of the Makefile.in references to them.
* Refactor KDC option/flag processingTom Yu2014-04-283-50/+82
| | | | | | | | | A lot of KDC code was spent copying options to flags, and copying header_ticket flags to the output ticket. Behavior change: previous code didn't copy PROXY from the header_ticket, but this seems to have been a minor bug rather than intentional. This also seems to have been an omission from RFC 4120.
* Check for asprintf failure in kdb5_util createTomas Kuthan2014-04-151-26/+4
| | | | | | | | | | | | In add_admin_princ, remove build_name_with_realm and call asprintf directly instead. Check for asprintf failure to avoid passing an undefined pointer to krb5_parse_name. [ghudson@mit.edu: rewrite commit message] ticket: 7902 (new) target_version: 1.12.2 tags: pullup
* In PKINIT, use library initializer for OpenSSLTomas Kuthan2014-04-151-15/+10
| | | | | | | | | | | | | Use a library initializer to prevent multiple threads using PKINIT from concurently initializing OpenSSL functions. For cases where MT-safety is not assured by registering OpenSSL locking callbacks, this significantly lowers the odds of crashes caused by races in OpenSSL initialization. (If OpenSSL initialization functions are called by some other thread directly, crashes are still possible.) [ghudson@mit.edu: simplify code changes and commit message] ticket: 6413
* Update sample configs to include master_kdcGreg Hudson2014-04-155-19/+12
| | | | | | | | | | | | Where we have ATHENA.MIT.EDU stanzas in sample or test krb5.conf files which define kdc entries, also define a master_kdc entry. Remove default_domain and v4_instance_convert entries in examples as they are only needed for krb5/krb4 principal conversions. In the krb5_conf.rst example, remove enctype specifications as we don't want to encourage their use when they aren't necessary, and remove a redundant domain_realm entry. ticket: 7901 (new)
* Fix sendto_kdc.c on OS X after cm refactoringGreg Hudson2014-04-051-0/+9
| | | | | | Treat POLLHUP without POLLIN or POLLOUT as an exception in the poll version of cm_get_ssflags, to correctly handle TCP connection errors on OS X.
* Remove adb_policy_init and adb_policy_closeTomas Kuthan2014-04-045-29/+3
| | | | | | | | | | | Since f72c3ffa the policy is initialized as part of database. adb_policy_close is now a no-op, and adb_policy_init just makes sure the database is initialized. adb_policy_init is only called from kadm5_flush, and only if database initialization was successful beforehand, rendering this call redundant. Remove adb_policy_init and adb_policy_close and all their references in the code and documentation.
generated by cgit (git 2.34.1) at 2026-01-06 01:44:58 +0000