summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Avoid memory leaks on errorHEADmasterSimo Sorce2014-07-101-1/+3
| | | | | | | In some cases, on error errinfo->err may hold an alocated error message. Free it on an error condition. Signed-off-by: Simo Sorce <simo@redhat.com>
* make dependGreg Hudson2014-07-087-36/+112
|
* Define _GNU_SOURCE for glibc extensionsGreg Hudson2014-07-081-0/+3
| | | | | | | | | | | | glibc does not declare a number of common, useful extensions such as asprintf unless _GNU_SOURCE is defined. Define it early in the configure process so that it is available for autoconf tests. Defining _GNU_SOURCE unfortunately causes glibc to use the non-POSIX version of strerror_r, which we now handle using the k5-platform.h wrapper. ticket: 7961
* Include autoconf.h before system headersGreg Hudson2014-07-08127-429/+145
| | | | | | | | | Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
* Simplify usage of strerror_rGreg Hudson2014-07-085-40/+4
| | | | | | | | Take advantage of the strerror_r portability wrapper to simplify code using it. Remove unused macros related to strerror_r in ldap_service_stash.c and plugins.c. ticket: 7961
* Define k5-platform.h wrapper for strerror_rGreg Hudson2014-07-086-3/+110
| | | | | | | | On systems where strerror_r is not the POSIX version, define it to k5_strerror_r. Implement k5_strerror_r in libkrb5support using strerror_s, strerror, or the GNU strerror_r as appropriate. ticket: 7961
* Avoid using length fields in socket addressesGreg Hudson2014-07-0411-78/+0
| | | | | | | | | | | | Remove code to set or reference the length fields of socket addresses (sa_len/sin_len/sin6_len), since they aren't portable and setting them is not required. Remove autoconf tests for those fields which are no longer used or which were never used. There is one exception: in localaddr.c, we still neeed to reference sa_len for the definition of ifreq_size on platforms which have sa_len. Leave that behind, along with the autoconf test which defines SA_LEN.
* Don't depend on sa_len sockaddr fieldGreg Hudson2014-07-047-17/+21
| | | | | | | In socket-utils.h, replace the socklen macro with an inline function sa_socklen which always uses the address family, even on platforms with the sa_len sockaddr field. This removes the need to set sa_len in socket addresses we construct.
* Simplify net-server.c UDP listener setupGreg Hudson2014-07-041-61/+22
| | | | | | | | | In setup_udp_port_1, remove the haddrbuf parameter and use paddr like we already do for one of the log messages. In setup_udp_port, remove the long switch statement and just look for AF_INET/AF_INET6 addresses. Split up udp_flags into two booleans for clarity. Update the comment in loop_setup_network since we did the "To do" item a long time ago.
* Fix build on systems without RTM_OLD*Ben Kaduk2014-07-031-0/+4
| | | | | | | | | | | | For example, FreeBSD has removed RTM_OLDADD and RTM_OLDDEL from its API in March 2014, with the message: Garbage collect long time obsoleted (or never used) stuff from routing API Only attempt to define behavior for these cases if they are defined. ticket: 7955 (new) tags: pullup target_version: 1.12.2
* Fix bugs in bindresvport_sa() changesTom Yu2014-07-022-2/+8
| | | | | | | | | | | In svctcp_create() and svcudp_bufcreate(), set sa->sa_len on platforms where that field exists, so that a subsequent call to socklen() will return the correct result. To make the code more self-evidently correct, zero the entire struct sockaddr_storage object, using the memset(&ss, 0, sizeof(ss)) idiom. ticket: 7935
* Remove indent workaround in man page RST sourcesGreg Hudson2014-07-0218-230/+84
| | | | | | | | | | docutils 0.10 properly adds indentation to example blocks in man pages, so we do not need to force an extra indentation level. Get rid of the workaround wherever we use it. ticket: 7954 (new) target_version: 1.12.2 tags: pullup
* Fix unlikely null dereference in TGS client codeNeng Xue2014-06-301-1/+3
| | | | | | | | | | | | If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an error re-reading the profile), k5_make_tgs_req will dereference a null pointer. Check the return value before dereferencing defenctypes. [ghudson@mit.edu: clarified commit message] ticket: 7952 (new) target_version: 1.12.2 tags: pullup
* Use binresvport_sa when creating RPC handlesAndreas Schneider2014-06-274-27/+39
| | | | | | | | | | | | | Make clnttcp_create, clntudp_bufcreate, svctcp_create, and svcudp_bufcreate work with unbound IPv6 sockets using bindresvport_sa and other socket helpers. For caller-supplied sockets, call getsockname to determine the address family we should attempt to bind. [ghudson@mit.edu: clarified commit message, minimized code changes, used socket-utils.h helpers, fixed fallback find on bindresvport failure, restored getsockaddr call to get port after binding] ticket: 7935
* Add a family-independent bindresvport_sa functionAndreas Schneider2014-06-273-11/+25
| | | | | | | | | | | | This functions allows you to pass IPv4 and IPv6 addresses. If no address is given, t will determine the family by checking the socket with getsockname. [ghudson@mit.edu: clarified commit message, split out setport helper, squashed with next commit, minimized code changes from old bindresvport, used socket-utils.h helpers] ticket: 7935 (new)
* Use sa_setport and sa_getport where appropriateGreg Hudson2014-06-273-42/+9
| | | | | | Use sa_setport and sa_getport in place of existing static helpers or open-coded switch statements in net-server.c, fake-addrinfo.c, and svc_tcp.c.
* Add socket-utils.h helpers for portsGreg Hudson2014-06-271-0/+30
| | | | | Add sa_setport, sa_getport, and sa_is_inet helpers for conveniently manipulating port numbers on IPv4 and IPv6 socket addresses.
* Fix KDC worker process argument parsingGreg Hudson2014-06-271-2/+4
| | | | | | | | | | | | | To create worker processes, the KDC shuts down realms, forks off the worker processes, then reinitializes realms in each child. Reinitializing realms requires making a second pass over the command-line arguments. To do this with getopt, optind must be reinitialized to 1 for each pass; otherwise, no options will be seen the second time around. ticket: 7945 target_version: 1.12.2 tags: pullup
* Add tests for invalid GSSAPI per-message tokensGreg Hudson2014-06-265-7/+459
| | | | ticket: 7949
* Handle invalid RFC 1964 tokens [CVE-2014-4341...]Greg Hudson2014-06-262-9/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Detect the following cases which would otherwise cause invalid memory accesses and/or integer underflow: * An RFC 1964 token being processed by an RFC 4121-only context [CVE-2014-4342] * A header with fewer than 22 bytes after the token ID or an incomplete checksum [CVE-2014-4341 CVE-2014-4342] * A ciphertext shorter than the confounder [CVE-2014-4341] * A declared padding length longer than the plaintext [CVE-2014-4341] If we detect a bad pad byte, continue on to compute the checksum to avoid creating a padding oracle, but treat the checksum as invalid even if it compares equal. CVE-2014-4341: In MIT krb5, an unauthenticated remote attacker with the ability to inject packets into a legitimately established GSSAPI application session can cause a program crash due to invalid memory references when attempting to read beyond the end of a buffer. CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C CVE-2014-4342: In MIT krb5 releases krb5-1.7 and later, an unauthenticated remote attacker with the ability to inject packets into a legitimately established GSSAPI application session can cause a program crash due to invalid memory references when reading beyond the end of a buffer or by causing a null pointer dereference. CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C [tlyu@mit.edu: CVE summaries, CVSS] ticket: 7949 (new) subject: Handle invalid RFC 1964 tokens [CVE-2014-4341 CVE-2014-4342] taget_version: 1.12.2 tags: pullup
* Load plugins with RTLD_NODELETE if possibleGreg Hudson2014-06-261-5/+14
| | | | | | | | | | | | | | | | | | On platforms which support RTLD_NODELETE, use it to load plugin modules. While using this flag makes plugins stay in the process map after libkrb5/libgssapi_krb5 are unloaded, it solves several problems: 1. It prevents plugin modules which link against OpenSSL (PKINIT and k5tls) from repeatedly initializing instances of libssl or libcrypto, leaking heap memory each time. This is only an issue because we cannot safely uninitialize OpenSSL. 2. It prevents finalization ordering issues from causing a process crash when unloading libgssapi_krb5 (issue #7135). 3. It makes memory leak tracing with valgrind easier. ticket: 7947 (new)
* Fix unlikely null dereference in mk_cred()Nalin Dahyabhai2014-06-251-7/+0
| | | | | | | | | | | | | If krb5_encrypt_keyhelper() returns an error, the ciphertext structure may contain a non-zero length, but it will already have freed the pointer to its data, making encrypt_credencpart()'s subsequent attempt to clear and free the memory fail. Remove that logic. Based on a patch from Jatin Nansi. ticket: 7948 (new) target_version: 1.12.2 tags: pullup
* Fix error checking in PKINIT authdata creationGreg Hudson2014-06-201-20/+15
| | | | | | | | | | | | | | | | | In create_identifiers_from_stack: check for allocation errors from PKCS7_ISSUER_AND_SERIAL_new and M_ASN1_INTEGER_dup. Use PKCS7_ISSUER_AND_SERIAL_free to more concisely clean up the OpenSSL issuer variable, and make sure that any partially processed value is cleaned up on error. Use calloc to allocate krb5_cas so that all of its pointers are initially nulled, so that free_krb5_external_principal_identifier can operate on it safely in case of error. Eliminate the retval variable as it was not used safely. Rename the error label from "cleanup" to "oom" and separate it from the successful return path (which has nothing to clean up). ticket: 7943 (new) target_version: 1.12.2 tags: pullup
* Consolidate DB option documentationGreg Hudson2014-06-183-68/+24
| | | | | | | | | | | Document DB options in the kadmin/kadmin.local man page, in their own section. Refer to that section from the documentation of the -x parameter of each other command which supports DB options. Add documentation for the "dbname" DB2 option. ticket: 7946 (new) target_version: 1.12.2 tags: pullup
* Tidy up k5-int.h variable name constantsGreg Hudson2014-06-163-101/+102
| | | | | Fix three mismatched constant names, and properly alphabetize and columnize the lists of definitions. No functional changes.
* Update the kadm5.acl exampleBen Kaduk2014-06-161-16/+18
| | | | | | | | | | | | | | | | | | | | | | Make the example and documentation a closer match to reality. In particular, the list permission is all-or-nothing; it is not restricted in scope by the target_principal field. Change the table entry to try and indicate this fact, and do not put list permissions on any example line that is scoped by a target_principal pattern. While here, remove the nonsensical granting of global inquire permissions to */* (inaccurately described as "all principals"), and the granting of privileges to foreign-realm principals. It is not possible to obtain an initial ticket (as required by the kadmin service) for a principal in a different realm, and the current kadmind implementation can serve only a single realm at a time -- this permission literally has no effect. Replace it with a (presumably automated) "Service Management System" example, where it might make sense to limit the principals which are automatically created. ticket: 7939
* Remove pkinit_win2k_require_binding optionGreg Hudson2014-06-134-42/+4
| | | | | | | | | | | | When constructing a draft9 PKINIT request, always include KRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack. Do not accept a draft9 ReplyKeyPack in the KDC response. For now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC support for generating a draft9 ReplyKeyPack when a draft9 PKINIT request does not contain KRB5_PADATA_AS_CHECKSUM. ticket: 7933
* Remove PKINIT longhorn compatibility optionGreg Hudson2014-06-124-242/+45
| | | | | | | | Remove the PKINIT Windows Server 2008 beta compatibility code conditionalized under the "longhorn" variable. It is not required to interoperate with any released version of Windows. ticket: 7934 (new)
* Improve PKINIT certificate documentationGreg Hudson2014-06-122-34/+86
| | | | | | | | | | | | | | Describe how to use a commercially-issued server certificate for anonymous PKINIT. Separate the KDC and client configuration instructions so that the steps necessary for anonymous PKINIT are not combined with the additional steps necessary for regular PKINIT. Describe kpServerAuth as the EKU used in commercially issued server certificates, not as the value used by Microsoft (which does not appear to be true according to [MS-PKCA]). ticket: 7931 (new) target_version: 1.12.2 tags: pullup
* Simplify and fix k5_check_cert_addressGreg Hudson2014-06-121-19/+12
| | | | | | | | | | | Get rid of the address union. Store the result of get_cert_cn in a signed variable so we can meaningfully check for negative results. Make get_cert_cn return int for consistency with X509_NAME_get_text_by_NID and its two callers. Also add an emacs mode line to the top of the file. ticket: 7929
* Do not document pkinit_win2kGreg Hudson2014-06-111-5/+0
| | | | | | | | | This variable was never used in the PKINIT code as it was contributed; there was only code to read its value. ticket: 7932 (new) target_version: 1.12.2 tags: pullup
* Remove stub pkinit_win2k codeGreg Hudson2014-06-113-7/+0
| | | | | | As contributed, the PKINIT module contained code to read the pkinit_win2k variable, but never used it. Get rid of the structure field and the code to populate it.
* Add missing profile functions to libkrb5 exportsGreg Hudson2014-06-111-0/+5
| | | | | | | | | | | | | | | profile_flush_to_buffer, profile_flush_to_file, profile_free_buffer, profile_init_flags, and profile_init_vtable are all public profile functions, but are inaccessible to libkrb5 applications on some platforms because they were never added to the export list. Add them now. (libprofile functions have never been part of the Windows DLL export list, so do not change krb5_32.def at this time.) ticket: 7930 (new) target_version: 1.12.2 tags: pullup
* Simplify ticket retrieval from AP-REQsGreg Hudson2014-06-103-31/+31
| | | | | | | | | After krb5_rd_req_decoded or krb5_rd_req_decoded_anyflag, the ticket (with enc_part2 if we could decrypt it) is accessible via request->ticket; there is no need to copy it. Stop using the ticket parameter of those functions. Where we need to save the ticket beyond the lifetime of the krb5_ap_req, steal the pointer before freeing the request.
* Add test for KDC client loggingGreg Hudson2014-06-102-0/+24
| | | | | | | Add a test case which performed a TGS request with an expired ticket and checks that the client principal is logged. ticket: 7910
* In KDC, log client principal in bad header ticketrbasch2014-06-102-9/+18
| | | | | | | | | | | | | | | | | | | | Fix KDC logging to include client principal in TGS_REQ logging even during error conditions such as "Ticket expired". As long as the TGS_REQ can be decrypted and the client principal is available, it should be included in the log, regardless of other errors which might be detected. krb5_rd_req_decoded and krb5_rd_req_decoded_anyflag (not public interfaces) now leave the decrypted ticket in req->ticket->enc_part2 on success or failure, if the ticket was successfully decrypted. This does not affect the behavior of krb5_rd_req. [ghudson@mit.edu: removed extraneous change, added commit message summary and description of internal API change, fixed possible memory leak, removed comment and #if 0 code block of purely historical interest] ticket: 7910
* Do not loop on add_cred_from and other new methodsSam Hartman2014-06-051-4/+4
| | | | | | | | | | | | | Several new GSS-API methods were added but GSSAPI_ADD_METHOD was called to add them rather than GSSAPI_ADD_METHOD_NOLOOP. This means that the implementation from the GSS-API mechglue would be used if the mechanism had no implementation. As a result, the mechglue will call into itself exhausting the call stack in an endless loop when one of these methods is called. ticket: 7926 target_version: 1.12.2 tags: pullup
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-053-6/+21
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Always include salt in LDAP KrbKey encodingGreg Hudson2014-06-052-1/+21
| | | | | | | | | | | | | | | | | | | In the LDAP KDB module, ensure that every krb5_key_data we pass to asn1_encode_sequence_of_keys includes a salt type, for compatibility with the decoder in unpatched krb5 1.11 and 1.12. This is not a behavior change by itself; since 1.7 the encoder has always included a KrbKey salt field because it erroneously treats that field as non-optional. (Luckily, the encoded salt always happens to have salt type 0 because krb5_key_data constructors start with zeroed memory.) The next commit will fix the encoder and decoder to properly treat the KrbKey salt field as optional, so we need this change to ensure that our encodings remain compatible. Also fix the ASN.1 tests to set key_data_ver correctly for the sample test key data. ticket: 7919
* Use k5_setmsgGreg Hudson2014-06-0546-445/+360
| | | | | | Replace most calls to krb5_set_error_message with k5_setmsg for brevity. Leave alone plugin sources where we don't include k5-int.h (mostly PKINIT).
* Define k5_setmsg internal aliasGreg Hudson2014-06-051-0/+3
| | | | | | This is just a shorter internal name for krb5_set_error_message. The full name is so long that we have to wrap error messages more than we'd like.
* Remove DEBUG_ERROR_LOCATIONS supportGreg Hudson2014-06-056-90/+1
| | | | | It wasn't being used and it added too much complexity to the error-handling functions.
* Read /etc/gss/mech if no mech.d/*.conf foundGreg Hudson2014-06-041-17/+24
| | | | | | | | | | Always read /etc/gss/mech, even if globbing /etc/gss/mech.d/*.conf doesn't work. Doing this using GLOB_DOOFFS proved error-prone, so use a simpler approach: factor out the per-pathname handling into a helper function load_if_changed, call it with MECH_CONF before the glob, then pass each glob result through the helper. ticket: 7925
* Do not document pkinit_mapping_fileGreg Hudson2014-06-031-4/+0
| | | | | | | | | This feature was never implemented in the PKINIT code as it was contributed; there was only stub support for reading the filename. ticket: 7928 (new) target_version: 1.12.2 tags: pullup
* Remove stub pkinit_mapping_file codeGreg Hudson2014-06-033-7/+0
| | | | | | As contributed, the PKINIT code contained code to read a mapping filename, but never used the resulting structure variable. Get rid of the structure field and the code to populate it.
* Add tests for MS-KKDCP client supportNalin Dahyabhai2014-06-022-0/+220
| | | | | | | | Exercise the MS-KKDCP client support using the test proxy server, for AS, TGS, and kpasswd requests while also checking the certificate verification and name checks. ticket: 7929
* Add a simple KDC proxy test serverNalin Dahyabhai2014-06-028-0/+446
| | | | | | | | This proxy server uses python-paste to run the kdcproxy from https://pypi.python.org/pypi/kdcproxy. It should be used along with the proxy.pem certificate in ../tests/dejagnu/proxy-certs. ticket: 7929
* Have k5test.py provide 'runenv' to python testsNalin Dahyabhai2014-06-021-5/+10
| | | | | | | Expose the formerly-internal _runenv module as k5test.runenv, so that settings we store in the top-level runenv.py will be available to them. ticket: 7929
* Add some longer-form docs for HTTPSNalin Dahyabhai2014-06-022-0/+49
| | | | | | | | | Add some longer-form documentation for the new HTTPS support, walking a prospective administrator through generating a bare minimal signing setup, deploying a WSGI-based proxy server onto an Apache httpd server using mod_ssl and mod_wsgi, and configuring clients to use it. ticket: 7929
* Check names in the server's cert when using KKDCPNalin Dahyabhai2014-06-026-10/+355
| | | | | | | | When we connect to a KDC using an HTTPS proxy, check that the naming information in the certificate matches the name or address which we extracted from the server URL in the configuration. ticket: 7929
generated by cgit (git 2.34.1) at 2024-04-24 00:57:47 +0000