summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
* Add ccache marshalling testsGreg Hudson2014-05-173-2/+413
| | | | | | | Add a new ccache test program t_marshal.c which verifies the new marshalling functions and also the FILE ccache type against the expected representations of the ccache header, default principal, and credentials.
* Add cred marshalling functionsGreg Hudson2014-05-173-0/+495
| | | | | | | Add a new file ccmarshal.c containing functions to marshal and unmarshal credentials in file formats version 1-4. These will replace the functions in cc_file.c and cc_keyring.c, and can be used for KCM in the future.
* Modernize rd_cred.cGreg Hudson2014-05-171-188/+138
| | | | | | | | Adjust the internal abstractions so that decrypt_encpart is responsible for the fallback from receiving subkey to session key, and krb5_rd_cred is responsible for decoding and calling decrypt_encpart. Rename krb5_rd_cred_basic to make_cred_list since it is now only responsible for constructing the list.
* Allow GSS mechs to force mechlistMIC in SPNEGOSimo Sorce2014-05-081-0/+37
| | | | | | | | | | | | | | | | | | | During a SPNEGO negotiation, if the NTLMSSP mechanism is used and a MIC is produced within the final initiator mechanism token, Microsoft servers require a mechlistMIC even if NTLMSSP was the most preferred mechanism. In spnego_mech.c, add a helper function mech_requires_mechlistMIC which queries the mechanism to determine whether we might need to produce a mechlistMIC for interoperability. Call it after each call to the mechanism's gss_init_sec_context and set sc->mic_reqd if it returns true. Although only the second call to NTLMSSP will actually ever return true, the first call makes the mechanism aware that the SPNEGO implementation supports this feature. [ghudson@mit.edu: clarified commit message and code] ticket: 7907 (new)
* Fix unlikely memory error in krb5_rd_credNeng Xue2014-05-081-1/+3
| | | | | | | | | If an error occurs in the for loop in krb5_rd_cred_basic (which should only happen on an ENOMEM), do not leave the caller with a dangling reference to the freed credential array. ticket: 7908 (new) target_version: 1.12.2
* Fix unlikely memory leak exporting lucid contextNeng Xue2014-05-071-0/+1
| | | | | | | If the GSSAPI context has an unrecognized proto field (which should never happen), free the context we allocated before returning EINVAL. [ghudson@mit.edu: clarify commit message]
* Don't remove ccache creds before storing themGreg Hudson2014-05-071-3/+0
| | | | | | | | | | | | | Revert #6291, which attempts to suppress duplicate credentials by calling krb5_cc_remove in krb5_cc_store_cred. Most of our ccache types don't implement remove_cred, and avoiding duplicate credentials is a responsibility better suited to the ccache implementation for atomicity reasons. Removing this call gets rid of the misleading "Removing ... from ..." messages in trace logs. ticket: 7906 (new)
* Improve krb5_rd_req decryption failure errorsGreg Hudson2014-05-073-49/+271
| | | | | | | | | | | | | | When krb5_rd_req cannot decrypt a ticket, try to produce the most helpful diagnostic we can, and return an error code which corresponds to the most applicable Kerberos protocol error. Add a trace log containing the error message for ticket decryption failures, in case the application server does not log it. Add new tests to cover krb5_rd_req error messages and adjust existing tests to match the new messages. Also adjust svc_auth_gssapi.c to look for KRB5KRB_AP_ERR_NOT_US instead of KRB5KRB_AP_WRONG_PRINC. ticket: 7232
* Use k5_change_error_message_code in krb5 GSS mechGreg Hudson2014-05-071-4/+1
| | | | Simplify acquire_accept_cred using the new helper function.
* Add helper to change extended error message codeGreg Hudson2014-05-073-0/+14
| | | | | k5_change_error_message_code allows an extended error message to be used when an error code is remapped.
* Update sample configs to include master_kdcGreg Hudson2014-04-151-0/+1
| | | | | | | | | | | | Where we have ATHENA.MIT.EDU stanzas in sample or test krb5.conf files which define kdc entries, also define a master_kdc entry. Remove default_domain and v4_instance_convert entries in examples as they are only needed for krb5/krb4 principal conversions. In the krb5_conf.rst example, remove enctype specifications as we don't want to encourage their use when they aren't necessary, and remove a redundant domain_realm entry. ticket: 7901 (new)
* Fix sendto_kdc.c on OS X after cm refactoringGreg Hudson2014-04-051-0/+9
| | | | | | Treat POLLHUP without POLLIN or POLLOUT as an exception in the poll version of cm_get_ssflags, to correctly handle TCP connection errors on OS X.
* Remove adb_policy_init and adb_policy_closeTomas Kuthan2014-04-044-26/+1
| | | | | | | | | | | Since f72c3ffa the policy is initialized as part of database. adb_policy_close is now a no-op, and adb_policy_init just makes sure the database is initialized. adb_policy_init is only called from kadm5_flush, and only if database initialization was successful beforehand, rendering this call redundant. Remove adb_policy_init and adb_policy_close and all their references in the code and documentation.
* Fix leak in kadm5_flush with LDAP KDBTomas Kuthan2014-04-041-1/+1
| | | | | | | | | | | | | Due to an inverted test in adb_policy_init, kadm5_flush calls krb5_db_open twice. With the DB2 KDB module, the second open is a no-op, but with the LDAP module, a new DB handle is allocated and the old one is leaked. [ghudson@mit.edu: rewrote commit message] ticket: 7897 (new) target_version: 1.12.2 tags: pullup
* Refactor cm functions in sendto_kdc.cGreg Hudson2014-04-021-161/+187
| | | | | | | | | | | | | | | | Move get_curtime_ms and the cm functions near the top of the file right after structure definitions. Except for cm_select_or_poll, define each cm function separately for poll and for select, since the implementations don't share much in common. Instead of cm_unset_write, define cm_read and cm_write functions to put an fd in read-only or write-only state. Remove the ssflags argument from cm_add_fd and just expect the caller to make a subsequent call to cm_read or cm_write. Always select for exceptions when using select. (Polling for exceptions is implicit with poll). With these changes, we no longer select/poll for reading on a TCP connection until we are done writing to it. So in service_tcp_fd, remove the check for unexpected read events.
* Get getopt from unistd.h (not getopt.h) in testsGreg Hudson2014-03-282-2/+0
| | | | | | | | | | | POSIX defines getopt to be declared in unistd.h, and HP-UX (as of version 11.31) does not appear to have getopt.h. In test programs which currently include getopt.h and aren't currently built on Windows, include unistd.h or just assume we will get it via k5-int.h. ticket: 7894 (new) target_version: 1.12.2 tags: pullup
* Fix t_seqstate build with Solaris compilerGreg Hudson2014-03-281-2/+3
| | | | | | | | | The Solaris native compiler (as of version 5.9) outputs code for static inline functions even if they are not used. So the k5buf_to_gss helper in gssapiP_generic.h causes t_seqstate to have a dependency on libkrb5support. ticket: 7872
* Don't free cred handle used in kadm5 server handleTomas Kuthan2014-03-272-7/+7
| | | | | | | | | | | | | | | | At the end of setup_gss(), gss_client_creds is released, but an alias to the credential handle is saved in kadm5_server_handle_t in handle->clnt->cl_auth->(struct rpc_gss_data *)ah_private->sec.cred. Accessing these credentials (by authgss_refresh) can result in use after free. This fix stores credential reference in server handle and releases the credentials in kadm5_destroy. [ghudson@mit.edu: initialize handle->cred to correct constant; get rid of gss_client_creds variable; clarify commit message slightly] ticket: 7891 (new)
* Improve salt type display in kadmin getprincGreg Hudson2014-03-261-13/+10
| | | | | | | | | | | | | | In krb5_salttype_to_string, output the salt type name we would recognize as input. In the output of getprinc, display the enctype and salt type in a form we would accept--either enctype:salttype if the salt type is not the default, or just the enctype if it is. Update t_mkey.py and t_salt.py to expect the new output format. Update documentation examples to show the new format. ticket: 5958
* Modernize default_state.cGreg Hudson2014-03-252-18/+11
| | | | | | | Use alloc_data() and empty_data() where appropriate. Keep mainline logic to the left where possible. Name the output parameter of krb5int_des_init_state with an _out suffix. Use a professional tone in comments. Partly based on a patch from Alok Menghrajani.
* Fix a harmless DNS glue macro bugWill Fiveash2014-03-211-3/+3
| | | | | | | | | | | The definition of SAFE_GETUINT16 mistakenly uses "p" instead its ptr parameter in three places, which happens to work because all current invocations of the macro use "p" as the ptr argument. Fix it to correctly use the ptr parameter. [ghudson@mit.edu: commit message] ticket: 6845
* Make use of strtoul() unconditional in locate_kdcNalin Dahyabhai2014-03-201-4/+0
| | | | | | | | When parsing port numbers, we previously attempted to conditionalize use of strtoul() on whether or not it was available, falling back to atoi() instead, but we did so in a way that would always fall back to using atoi(). We also call strtoul() from elsewhere without that condition, so we don't gain anything by trying to be careful about it here.
* Don't check kpasswd reply addressNalin Dahyabhai2014-03-201-21/+0
| | | | | | | | | | | | Don't check the address of the kpasswd server when parsing the reply we received from it. If the server's address was modified by a proxy or other network element, the user will be incorrectly warned that the password change failed when it succeeded. The check is unnecessary as the kpasswd protocol is not subject to a reflection attack. [ghudson@mit.edu: edit commit message] ticket: 7886 (new)
* Try compatible keys in rd_req_dec "any" pathNalin Dahyabhai2014-03-191-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | When we go to decrypt a ticket using a keytab, we have two code paths. In the first (traditional) one, we try to read an entry that exactly matches the principal name, enctype, and kvno from the ticket, and then attempt to decrypt the ticket using the entry's key. The keytab routines helpfully return an entry so long as it's of a key type that's compatible with the ticket being decrypted, fixing up the enctype in the entry structure while doing so, allowing us to decrypt a DES-CBC-CRC ticket with a DES-CBC-MD5 key. In the second code path, we try the key of every entry which loosely matches the principal name from the ticket and which exactly matches its enctype, meaning that the ticket/keytab pair above won't work if the principal name is one which suggests we shouldn't be matching entries exactly. This change modifies the "any" path to also try to decrypt the ticket with compatible keys. [ghudson@mit.edu: avoid stuffing too much logic in one conditional] ticket: 7883 (new)
* Rewrite GSS sequence state tracking codeGreg Hudson2014-03-185-271/+184
| | | | | | | | | | | | | Replace util_ordering.c with a new file util_seqstate.c, implemented using a bitmap of previously received sequence numbers instead of a 20-element circular queue. This approach has slightly different limitations--it can check for replays for values within 64 of the expected next number, where the old code could check within the range of the last 20 received numbers regardless of how far apart they are. The new approach should work as well or better for any realistic packet reordering scenario. ticket: 7879 (new)
* Improve internal API for GSS sequence numbersGreg Hudson2014-03-1812-93/+101
| | | | | | | | | | Use an opaque structure type instead of a void pointer for the sequence number state. Rename all functions to use a g_seqstate prefix rather than a mix of g_order and g_queue. Remove the unneccessary indirection from the state object parameter in g_seqstate_check and g_seqstate_free. Return OM_uint32 where we return a GSS major code, long where we return an errno value, and void where we can't fail.
* Add tests for GSSAPI sequence number processingGreg Hudson2014-03-183-0/+204
| | | | ticket: 7872
* Fix GSS krb5 initial sequence number gap handlingTomas Kuthan2014-03-181-0/+15
| | | | | | | | | | | | | | Since #2040, the dummy queue element inserted by g_order_init no longer compares less than the initial sequence number, so we fail when the first few sequence numbers are received out of order. Properly detect when a sequence number fits between the dummy element and the first real queue element. [ghudson@mit.edu: rewrote commit message] ticket: 7872 target_version: 1.12.2 tags: pullup
* Don't leak the per-request preauth contextNalin Dahyabhai2014-03-131-0/+1
| | | | | | | | | | | | Currently, per-request preauth module data is only cleared when we successfully obtain initial credentials. Make sure to clear it at the end of the operation even if we failed to get creds. [ghudson@mit.edu: expanded commit message] ticket: 7793 target_version: 1.12.2 tags: pullup
* Fix memory leak in krb5_verify_init_credsNalin Dahyabhai2014-03-131-3/+3
| | | | | | | | | | | | | When copying most of the credentials from one cache to another in copy_creds_except (called from get_vfy_cred, from krb5_verify_init_creds), we need to free all of the credentials that we read, not just the ones we copied. [ghudson@mit.edu: edited commit message] ticket: 7875 (new) target_version: 1.12.2 tags: pullup
* Initialize err variable in krb5_sendto_kdcNalin Dahyabhai2014-03-131-0/+1
| | | | | | | | | | | | | | | | When we get an KRB5_KDC_UNREACH error back from k5_sendto, we check if the err variable we passed for use by our message handler has been set to KDC_ERR_SVC_UNAVAILABLE. If k5_sendto doesn't receive any response, though, the handler isn't called, so we're reading an uninitialized variable. Initialize it to a value other than KDC_ERR_SVC_UNAVAILABLE to be sure. [ghudson@mit.edu: initialize err just before calling k5_sendto; edit commit message] ticket: 7874 (new) target_version: 1.12.2 tags: pullup
* Fix clean-unix rule for gssapi_krb5.hTomas Kuthan2014-03-081-2/+2
| | | | | | | Don't delete gssapi_krb5.h now that it is not generated. [ghudson@mit.edu: also remove from generate-files-mac rule and from .gitignore]
* Modernize gic options code styleGreg Hudson2014-03-051-48/+33
|
* Improve extended gic option supportGreg Hudson2014-03-0511-551/+316
| | | | | | | | | | | | | | | | | | | | The current extended gic option facility violates strict aliasing, is not nestable (gic_opt_to_opte cannot be used on an extended options structure casted back to krb5_get_init_creds_options), and requires callers to use error-prone conversion functions. Rewrite this code to use a new structure private to gic_opt.c, which contains a krb5_get_init_creds_opt structure as its first member. We can cast between the extended structure and its first element without violating strict aliasing (C99 6.7.2.1 paragraph 13 and the aggregate type clause of 6.5 paragraph 7). Define internal accessor functions for the extended option fields. Replace all uses of krb5_gic_opt_ext in callers with krb5_get_init_creds_opt and the new accessors. Bring krb5_get_init_creds_opt_set_pa back into gic_opt.c (reverting faa810c5b59fa33d9f7db837c5bb88df5436bb30) so that all of the code which accesses the extended options structure can be in one file. ticket: 6034
* Use preauth options when changing passwordGreg Hudson2014-03-031-12/+51
| | | | | | | | | | | If we try to change the password in rb5_get_init_creds_password, we must use all application-specified gic options which affect preauthentication when getting the kadmin/changepw ticket. Create a helper function make_chpw_options which copies the application's options, unsets the options we don't want, and sets options appropriate for a temporary ticket. ticket: 7868
* Fix install rule for gssapi_krb5.hGreg Hudson2014-02-281-1/+1
| | | | Revert r16428 now that gssapi_krb5.h is in the source tree.
* Fix two omissions in stdint.h changesGreg Hudson2014-02-261-0/+2
| | | | | | | | Since we no longer prefix an "#include <stdint.h>" in the gssapi.h preamble at build time, include it in gssapi.hin. Update util/gss/kernel-lib/Makefile.in to account for gssapi_krb5.h being in the source tree.
* Eliminate internal fixed-width type wrappersGreg Hudson2014-02-2622-96/+87
| | | | | Directly use stdint.h names for integer types in preference to the various internal names we have made up for them.
* Stop generating gssapi_krb5.hGreg Hudson2014-02-264-24/+18
| | | | | | | We started generating gssapi_krb5.h from gssapi_krb5.hin when we needed to use a 64-bit type for lucid contexts. Since we can now assume a standard name for 64-bit types, we can stop generating the header.
* Get rid of builtin AES uitypes.hGreg Hudson2014-02-2611-749/+612
| | | | | Remove uitypes.h and just include stdint.h; all we need from it is uint{8,16,32}_t.
* Assume <stdint.h> and fixed-width typesGreg Hudson2014-02-263-28/+4
| | | | | | | Make unconditional use of <stdint.h> and fixed-width types such as uint32_t. k5-plugin.h doesn't use any special integer types, so remove the conditional include block there. Nothing uses INT64_FMT/UINT64_FMT, so leave those out of k5-platform.h for now.
* Maintain complete ulog on iprop slavesGreg Hudson2014-02-201-75/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | Factor out most of ulog_add_update into a helper function named store_update, and make ulog_add_update just responsible for assigning a serial number and timestamp to the update before storing it. In ulog_replay, use store_update and ulog_finish_update to add each update to the ulog in addition to replaying it to the database. Don't use incr_ret->lastentry to set kdb_last_sno/kdb_last_time, since it will have been set properly by adding the individual updates; instead, just reinitialize the ulog on error. Slave ulogs use serial numbers provided from upstream, and thus do not always begin at serial number 1 after a header reset. As a result, we must: (A) in store_update, detect the first update (for which we must assign kdb_first_sno/kdb_first_time) by comparing kdb_num to 0, instead of by comparing the serial number to 1; (B) in store_update, detect that we are overwriting the first update by comparing kdb_num to ulogentries, instead of comparing the serial number to ulogentries; and (C) in ulog_map, detect that ulogentries changed by verifying the first and last serial number and timestamp against the actual ulog entries, rather than simply comparing kdb_last_sno to kdb_num. Based on code submitted by Richard Basch. ticket: 7855
* Simplify ulog_mapGreg Hudson2014-02-203-85/+19
| | | | | | | | | | | | | | | | | | | | Get rid of the caller parameter. The kproplog semantics (without -R) for mapping the ulog are simple and almost completely different from other users of the ulog, so implement them as a static helper in kproplog. With hierarchical iprop, kpropd will need the same semantics as FKCOMMAND and FKADMIND, which were already identical. Get rid of the db_args parameter, since ulog_map no longer opens the database after #7552. Remove an inoperative lseek() call when creating a new ulog file. Rename ulog_filesize to filesize and compute it from scratch each time we use it, for easier analysis. If kdb_hmagic is zero, init the ulog header but don't skip the rest of the function; it's possible that we need to expand the ulog file. Remove an unneeded conditional before calling extend_file_to for an existing ulog. ticket: 7855
* Lock around more ulog operationsGreg Hudson2014-02-203-44/+101
| | | | | | | | | | | | | | | Always lock the ulog when accessing it. We can currently get away with some laxness on iprop slaves because they are mostly synchronous, but hierarchical iprop will allow master and slave operations to take place concurrently, requiring more strict locking. Add new functions ulog_get_last and ulog_set_last, which access the ulog header with locking, and use them in kdb5_util and kpropd. Add locking to ulog_replay and ulog_init_header. ulog_lock and ulog_sync_header are no longer used outside of kdb_log.c after these changes, so make them static functions and remove the ulog_ prefix. Add an unlock_ulog function for clarity.
* Factor out ulog serial number status checkGreg Hudson2014-02-202-25/+58
| | | | | | | | | | | | | | | Add a new function ulog_get_sno_status, which checks a serial number and timestamp against the ulog for currency. Use it in kdb5_util dump and in ulog_get_entries. Adjust parse_iprop_header's contract in dump.c to better match the ulog_get_sno_status contract. This change causes some minor behavior differences. kadmind will check for an empty ulog unless the last serial number matches exactly, and will never set lastentry when returning UPDATE_FULL_RESYNC_NEEDED (which was pointless). kdb5_util dump will recognize a dump file as current if it exactly matches the last serial number, even if the ulog is empty; it will be more robust in the presence of non-monotonic clocks; and it will properly lock around the ulog access.
* Simplify iprop update locking and avoid deadlockGreg Hudson2014-02-202-138/+37
| | | | | | | | | | | | | Since we are no longer treating the update log like a journal (#7552), we don't need two-stage update logging. In kdb5.c, add an update log entry after each DB change in one step, without getting an explicit lock. In kdb_log.c, combine ulog_add_update with ulog_finish_update, and make ulog_add_update lock the ulog internally. This change avoids deadlock by removing the only cases where the ulog is locked before the DB. ticket: 7861
* Support referrals from Windows Server 2003Nate Rosenblum2014-02-181-3/+32
| | | | | | | | | | | | | | | | | Although RFC 6806 Section 7 requires servers to indicate a client referral in a WRONG_REALM message, Microsoft Windows Server 2003 returns this information in a message with error code PRINCIPAL_UNKNOWN. Failure to follow the referral in these messages prevents referral chasing in Windows Server 2003 forests. Detect referral messages of this type by checking for a non-empty client.realm field in the response, and activate the referral logic in these cases. [tlyu@mit.edu: style, comments, and commit message] ticket: 7856 (new) target_version: 1.12.2 tags: pullup
* Generate dependencies for t_stringattrGreg Hudson2014-02-122-1/+12
| | | | | When t_stringattr.c was introduced, it wasn't added to EXTRADEPSRCS, so no dependencies were created for it. Fix that now.
* Fix SAM-2 preauth when password argument is usedGreg Hudson2014-02-111-2/+3
| | | | | | | | | | | | | | | | sam2_process accesses gak_data to get the password, so that it can do string-to-key with the etype in the SAM-2 challenge. When #7642 changed gic_pwd.c to use struct gak_password instead of krb5_data, sam2_process wasn't altered to match. We don't see a problem when the password is read through the prompter (as with kinit), because the password winds up in the storage field at the beginning of the gak_password structure. But when a password is supplied as a parameter (as with ksu), the storage field is empty and we get the wrong answer from sam2_process. ticket: 7862 target_version: 1.12.2 tags: pullup
* Correctly get default realm in kdb5.cGreg Hudson2014-02-111-10/+13
| | | | | | | Call krb5_get_default_realm instead of directly accessing context->default_realm, to remove the requirement that krb5_get_default_realm or krb5_set_default_realm be used before krb5_db_open.
generated by cgit (git 2.34.1) at 2025-02-23 21:32:44 +0000