summaryrefslogtreecommitdiffstats
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
* Avoid memory leaks on errorHEADmasterSimo Sorce2014-07-101-1/+3
| | | | | | | In some cases, on error errinfo->err may hold an alocated error message. Free it on an error condition. Signed-off-by: Simo Sorce <simo@redhat.com>
* make dependGreg Hudson2014-07-083-24/+68
|
* Include autoconf.h before system headersGreg Hudson2014-07-0847-129/+38
| | | | | | | | | Include autoconf.h (either directly or via proxy) before system headers, so that feature test macros defined there can affect the system namespace. Where include order was changed, eliminate some redundant or unnecessary includes. ticket: 7961
* Simplify usage of strerror_rGreg Hudson2014-07-081-7/+2
| | | | | | | | Take advantage of the strerror_r portability wrapper to simplify code using it. Remove unused macros related to strerror_r in ldap_service_stash.c and plugins.c. ticket: 7961
* Avoid using length fields in socket addressesGreg Hudson2014-07-047-45/+0
| | | | | | | | | | | | Remove code to set or reference the length fields of socket addresses (sa_len/sin_len/sin6_len), since they aren't portable and setting them is not required. Remove autoconf tests for those fields which are no longer used or which were never used. There is one exception: in localaddr.c, we still neeed to reference sa_len for the definition of ifreq_size on platforms which have sa_len. Leave that behind, along with the autoconf test which defines SA_LEN.
* Don't depend on sa_len sockaddr fieldGreg Hudson2014-07-045-8/+8
| | | | | | | In socket-utils.h, replace the socklen macro with an inline function sa_socklen which always uses the address family, even on platforms with the sa_len sockaddr field. This removes the need to set sa_len in socket addresses we construct.
* Simplify net-server.c UDP listener setupGreg Hudson2014-07-041-61/+22
| | | | | | | | | In setup_udp_port_1, remove the haddrbuf parameter and use paddr like we already do for one of the log messages. In setup_udp_port, remove the long switch statement and just look for AF_INET/AF_INET6 addresses. Split up udp_flags into two booleans for clarity. Update the comment in loop_setup_network since we did the "To do" item a long time ago.
* Fix build on systems without RTM_OLD*Ben Kaduk2014-07-031-0/+4
| | | | | | | | | | | | For example, FreeBSD has removed RTM_OLDADD and RTM_OLDDEL from its API in March 2014, with the message: Garbage collect long time obsoleted (or never used) stuff from routing API Only attempt to define behavior for these cases if they are defined. ticket: 7955 (new) tags: pullup target_version: 1.12.2
* Fix bugs in bindresvport_sa() changesTom Yu2014-07-022-2/+8
| | | | | | | | | | | In svctcp_create() and svcudp_bufcreate(), set sa->sa_len on platforms where that field exists, so that a subsequent call to socklen() will return the correct result. To make the code more self-evidently correct, zero the entire struct sockaddr_storage object, using the memset(&ss, 0, sizeof(ss)) idiom. ticket: 7935
* Fix unlikely null dereference in TGS client codeNeng Xue2014-06-301-1/+3
| | | | | | | | | | | | If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an error re-reading the profile), k5_make_tgs_req will dereference a null pointer. Check the return value before dereferencing defenctypes. [ghudson@mit.edu: clarified commit message] ticket: 7952 (new) target_version: 1.12.2 tags: pullup
* Use binresvport_sa when creating RPC handlesAndreas Schneider2014-06-274-27/+39
| | | | | | | | | | | | | Make clnttcp_create, clntudp_bufcreate, svctcp_create, and svcudp_bufcreate work with unbound IPv6 sockets using bindresvport_sa and other socket helpers. For caller-supplied sockets, call getsockname to determine the address family we should attempt to bind. [ghudson@mit.edu: clarified commit message, minimized code changes, used socket-utils.h helpers, fixed fallback find on bindresvport failure, restored getsockaddr call to get port after binding] ticket: 7935
* Add a family-independent bindresvport_sa functionAndreas Schneider2014-06-271-11/+23
| | | | | | | | | | | | This functions allows you to pass IPv4 and IPv6 addresses. If no address is given, t will determine the family by checking the socket with getsockname. [ghudson@mit.edu: clarified commit message, split out setport helper, squashed with next commit, minimized code changes from old bindresvport, used socket-utils.h helpers] ticket: 7935 (new)
* Use sa_setport and sa_getport where appropriateGreg Hudson2014-06-272-33/+7
| | | | | | Use sa_setport and sa_getport in place of existing static helpers or open-coded switch statements in net-server.c, fake-addrinfo.c, and svc_tcp.c.
* Add tests for invalid GSSAPI per-message tokensGreg Hudson2014-06-261-0/+1
| | | | ticket: 7949
* Handle invalid RFC 1964 tokens [CVE-2014-4341...]Greg Hudson2014-06-262-9/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Detect the following cases which would otherwise cause invalid memory accesses and/or integer underflow: * An RFC 1964 token being processed by an RFC 4121-only context [CVE-2014-4342] * A header with fewer than 22 bytes after the token ID or an incomplete checksum [CVE-2014-4341 CVE-2014-4342] * A ciphertext shorter than the confounder [CVE-2014-4341] * A declared padding length longer than the plaintext [CVE-2014-4341] If we detect a bad pad byte, continue on to compute the checksum to avoid creating a padding oracle, but treat the checksum as invalid even if it compares equal. CVE-2014-4341: In MIT krb5, an unauthenticated remote attacker with the ability to inject packets into a legitimately established GSSAPI application session can cause a program crash due to invalid memory references when attempting to read beyond the end of a buffer. CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C CVE-2014-4342: In MIT krb5 releases krb5-1.7 and later, an unauthenticated remote attacker with the ability to inject packets into a legitimately established GSSAPI application session can cause a program crash due to invalid memory references when reading beyond the end of a buffer or by causing a null pointer dereference. CVSSv2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C [tlyu@mit.edu: CVE summaries, CVSS] ticket: 7949 (new) subject: Handle invalid RFC 1964 tokens [CVE-2014-4341 CVE-2014-4342] taget_version: 1.12.2 tags: pullup
* Fix unlikely null dereference in mk_cred()Nalin Dahyabhai2014-06-251-7/+0
| | | | | | | | | | | | | If krb5_encrypt_keyhelper() returns an error, the ciphertext structure may contain a non-zero length, but it will already have freed the pointer to its data, making encrypt_credencpart()'s subsequent attempt to clear and free the memory fail. Remove that logic. Based on a patch from Jatin Nansi. ticket: 7948 (new) target_version: 1.12.2 tags: pullup
* Simplify and fix k5_check_cert_addressGreg Hudson2014-06-121-19/+12
| | | | | | | | | | | Get rid of the address union. Store the result of get_cert_cn in a signed variable so we can meaningfully check for negative results. Make get_cert_cn return int for consistency with X509_NAME_get_text_by_NID and its two callers. Also add an emacs mode line to the top of the file. ticket: 7929
* Add missing profile functions to libkrb5 exportsGreg Hudson2014-06-111-0/+5
| | | | | | | | | | | | | | | profile_flush_to_buffer, profile_flush_to_file, profile_free_buffer, profile_init_flags, and profile_init_vtable are all public profile functions, but are inaccessible to libkrb5 applications on some platforms because they were never added to the export list. Add them now. (libprofile functions have never been part of the Windows DLL export list, so do not change krb5_32.def at this time.) ticket: 7930 (new) target_version: 1.12.2 tags: pullup
* Simplify ticket retrieval from AP-REQsGreg Hudson2014-06-102-5/+9
| | | | | | | | | After krb5_rd_req_decoded or krb5_rd_req_decoded_anyflag, the ticket (with enc_part2 if we could decrypt it) is accessible via request->ticket; there is no need to copy it. Stop using the ticket parameter of those functions. Where we need to save the ticket beyond the lifetime of the krb5_ap_req, steal the pointer before freeing the request.
* In KDC, log client principal in bad header ticketrbasch2014-06-101-7/+0
| | | | | | | | | | | | | | | | | | | | Fix KDC logging to include client principal in TGS_REQ logging even during error conditions such as "Ticket expired". As long as the TGS_REQ can be decrypted and the client principal is available, it should be included in the log, regardless of other errors which might be detected. krb5_rd_req_decoded and krb5_rd_req_decoded_anyflag (not public interfaces) now leave the decrypted ticket in req->ticket->enc_part2 on success or failure, if the ticket was successfully decrypted. This does not affect the behavior of krb5_rd_req. [ghudson@mit.edu: removed extraneous change, added commit message summary and description of internal API change, fixed possible memory leak, removed comment and #if 0 code block of purely historical interest] ticket: 7910
* Do not loop on add_cred_from and other new methodsSam Hartman2014-06-051-4/+4
| | | | | | | | | | | | | Several new GSS-API methods were added but GSSAPI_ADD_METHOD was called to add them rather than GSSAPI_ADD_METHOD_NOLOOP. This means that the implementation from the GSS-API mechglue would be used if the mechanism had no implementation. As a result, the mechglue will call into itself exhausting the call stack in an endless loop when one of these methods is called. ticket: 7926 target_version: 1.12.2 tags: pullup
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-051-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Use k5_setmsgGreg Hudson2014-06-0530-286/+235
| | | | | | Replace most calls to krb5_set_error_message with k5_setmsg for brevity. Leave alone plugin sources where we don't include k5-int.h (mostly PKINIT).
* Remove DEBUG_ERROR_LOCATIONS supportGreg Hudson2014-06-052-26/+0
| | | | | It wasn't being used and it added too much complexity to the error-handling functions.
* Read /etc/gss/mech if no mech.d/*.conf foundGreg Hudson2014-06-041-17/+24
| | | | | | | | | | Always read /etc/gss/mech, even if globbing /etc/gss/mech.d/*.conf doesn't work. Doing this using GLOB_DOOFFS proved error-prone, so use a simpler approach: factor out the per-pathname handling into a helper function load_if_changed, call it with MECH_CONF before the glob, then pass each glob result through the helper. ticket: 7925
* Check names in the server's cert when using KKDCPNalin Dahyabhai2014-06-025-10/+350
| | | | | | | | When we connect to a KDC using an HTTPS proxy, check that the naming information in the certificate matches the name or address which we extracted from the server URL in the configuration. ticket: 7929
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-021-2/+167
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* HTTPS transport (Microsoft KKDCPP implementation)Nalin Dahyabhai2014-06-025-28/+458
| | | | | | | | | | | | | | | | | | | | Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy server using HTTPS to communicate with a KDC. The KDC's name should take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy"). An HTTPS connection's encryption layer can be reading and writing when the application layer is expecting to write and read, so the HTTPS callbacks have to handle being called multiple times. [nalin@redhat.com: use cleanup labels, make sure we always send the realm name, keep a copy of the URI on-hand, move most of the conditionally-compiled sections into their own conditionally-built functions, break out HTTPS request formatting into a helper function, handle the MS-KKDCP length bytes, update comments to mention specific versions of the MS-KKDCP spec, differentiate TCP and HTTP trace messages, trace unparseable responses] ticket: 7929
* Dispatch-style protocol switching for transportRobbie Harwood (frozencemetery)2014-06-023-133/+171
| | | | | | | | | | | | | Switch to using per-transport-type functions when a socket that we're using to communicate with a server becomes readable or writable, and add them as pointers to the connection state. The functions are passed the name of the realm of the server being contacted, as we expect to need this in the near future. [nalin@redhat.com: replace macros with typedefs] [nalin@redhat.com: compare transports with TCP_OR_UDP rather than with 0] ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-023-0/+27
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Build support for TLS used by HTTPS proxy supportRobbie Harwood (frozencemetery)2014-06-025-2/+20
| | | | | | | | | Add a --with-proxy-tls-impl option to configure, taking 'openssl', 'auto', or invocation as --without-proxy-tls-impl. Use related CFLAGS when building lib/krb5/os, and LIBS when linking libkrb5. Call the OpenSSL library startup functions during library initialization. ticket: 7929
* Use k5_transport(_strategy) enums for k5_sendtoRobbie Harwood (frozencemetery)2014-06-0210-122/+178
| | | | | | | | | | | | | | | | | | In k5_sendto and k5_locate_server, replace "socktype" parameters with a new enumerator k5_transport, so that we can add new transports which are not in the socket type namespace. Control the order in which we make connections of different types using a new k5_transport_strategy enumerator, to simplify the logic for adding new transports later. Control the result of k5_locate_server with a no_udp boolean rather than a socket type. [ghudson@mit.edu: renamed type to k5_transport; k5_locate_server no_udp change; clarified commit message; fix for Solaris getaddrinfo] [kaduk@mit.edu: name variables of type k5_transport 'transport'] [nalin@redhat.com: use transport rather than sock_type in more places, add and use k5_transport_strategy, update the test program] ticket: 7929
* Add helper to determine if a KDC is the masterGreg Hudson2014-06-023-64/+80
| | | | | | Add a new function k5_kdc_is_master in locate_kdc.c to determine whether a KDC matches one of the masters, and use it in krb5_sendto_kdc.
* Simplify sendto_kdc.cGreg Hudson2014-06-021-80/+79
| | | | | | | | | | | | | | | | | | * Get rid of the "x" member of conn_state, which used to be a union but hasn't been since r14742. * Define a structure type for the "out" member of conn_state. * Rename incoming_krb5_message to incoming_message for brevity. * Make the "pos" member of incoming_message an offset instead of a pointer, simplifying several present and future computations. * Use "in" and "out" aliases to the conn_state in and out members where it improves brevity. * Rename set_conn_state_msg_length to set_transport_message and give it a descriptive comment. * Call set_transport_message from start_connection only, instead of once in add_connection and perhaps again in start_connection. To make this possible, pass the original message argument to maybe_send and start_connection. * Use make_data and empty_data helpers where appropriate.
* Make x-deltat.y work with bison 3Greg Hudson2014-06-012-762/+629
| | | | | | | | | | | | | | | | | Bison 3 removed support for YYPARSE_PARAM and YYLEX_PARAM, breaking x-deltat.y. Use %parse-param and %lex-param instead. (In Bison 3 we could use just %param, but that doesn't work in 2.x.) The parameter added by %parse-param is also passed to yyerror, so adjust the macro we use to suppress yyerror accordingly. Also use "%define api.pure" instead of "%pure_parser", which was deprecated in bison 2.3b. (The correct spelling was actually "%pure-parser", and bison 3 generates a warning about the underscore spelling.) Regenerate deltat.c using the new x-deltat.y and bison 3.0.2. ticket: 7923
* Fix uninitialized variable bug in KEYRING ccacheGreg Hudson2014-05-281-1/+1
| | | | | | | Commit 5f4a4d7d357fedac5feadc65c09ecf487ff98db8 removed the only unconditional assignment of ret in get_time_offsets, causing the function to return an uninitialized value if nothing goes wrong. Initialize ret at declaration time to fix this.
* Improve pointer hygiene around gss_display_nameGreg Hudson2014-05-242-3/+7
| | | | | | | | | | | | | | | | | | | | GSSAPI functions are responsible for setting their output parameters on failure. Take greater care to do so in krb5_gss_display_name. The mechglue is generally defensive about initializing variables used as outputs, and not assuming that mechs will set them on failure. Make gssint_convert_name_to_union_name initialize union_name->external_name before calling mech->gss_display_name, so that if the mech's gss_display_name doesn't touch it, we don't free an uninitialized pointer. Either one of these changes prevents an unlikely memory bug which could occur if krb5_gss_init_context fails within krb5_gss_display_name when called from gssint_convert_name_to_union_name. ticket: 7915 (new) target_version: 1.12.2
* Fix fencepost error in krad timeout handlerGreg Hudson2014-05-241-1/+1
| | | | | | ticket: 7911 target_version: 1.12.2 tags: pullup
* Load mechglue config files from /etc/gss/mech.dGünther Deschner2014-05-221-11/+54
| | | | | | | | | | | | | In addition to loading /etc/gss/mech, glob for *.conf files in /etc/gss/mech.d. Load only config files which have changed since the highest mtime we saw in the previous scan. Scan at most once per second to avoid excessive numbers of filesystem syscalls for busy GSSAPI applications. [ghudson@mit.edu: rewrote commit message; style changes; added once-per-second throttle on glob/stat calls] ticket: 7882 (new)
* Remove dead code from the mechglue initializationGünther Deschner2014-05-221-27/+0
| | | | | | | | The stat check in gss_indicate_mechs had no consequent and would have been redundant with logic in updateMechList if it did. [ghudson@mit.edu: elaborated commit message; removed unused g_mechSetTime and now-irrelevant comment]
* Add tests for krb5int_c_combine_keysGreg Hudson2014-05-213-3/+98
| | | | | | | | | | | | krb5int_c_combine_keys is used only by SAM-2 preauth with neither the send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by any automated function tests. Add some unit tests to make sure that it works and returns the expected results for two randomly generated test vectors. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix krb5int_c_combine_keysKen Hornstein2014-05-211-0/+1
| | | | | | | | | | | | When krb5int_c_combine_keys was updated to use the new crypto interface, a small bug was introduced. It turns out the temporary keyblock created needs to have its enctype set; otherwise, when krb5int_derive_keyblock() is called later, it will fail with KRB5_BAD_ENCTYPE. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix t_marshal on big-endian platformsGreg Hudson2014-05-191-6/+12
| | | | | | | t_marshal.c attempts to skip the version 1 and 2 tests on big-endian platforms, but didn't do so correctly. Correctly start at version 3 on big-endian platforms, and change the way we do it to avoid preprocessor conditionals inside a function body.
* Use cred marshalling functions in cc_keyring.cGreg Hudson2014-05-171-1039/+56
| | | | | | | Replace the cc_keyring.c credential and principal marshalling functions with calls to the ccmarshal.c functions. Simplify the remaining parsing functions (for the index and time offsets) and fold the resulting code into the calling functions where appropriate.
* Use cred marshalling functions in cc_file.cGreg Hudson2014-05-171-653/+170
| | | | | | | | | | | Replace the cc_file.c credential and principal marshalling and unmarshalling functions with calls to the ccmarshal.c functions. For unmarshalling, we still need code to read the appropriate amount of data into a memory buffer. Because there is no outer length header for principals and credentials, this code needs to understand the credential and principal representations, but is much simpler than the old code as it only needs to store the data it reads, not assemble a data structure.
* Modernize cc_file.c and cc_keyring.cGreg Hudson2014-05-172-2348/+1665
| | | | | | | | | | | | | | | | | | | Rename functions not to use the krb5_ prefix, and to use the fcc_ or krcc_ prefixes only for ccache method implementations. Use shorter function comments and add missing comments in some cases. Remove forward declarations where they aren't needed. Use native types (uint16_t, void *, etc.) in preference to Kerberos type wrappers. Use "ret" as the variable name for krb5_error_code return values. Use 0 instead of KRB5_OK. Make whitespace conform to current practice. Remove old #if 0 blocks. Don't cast to and from void * or between integer types when C guarantees an implicit cast. Use literal 2 and 4 for the size of fixed-width 16-bit and 32-bit types. In cc_file.c, rewrite the header comment to specify the header format as updated by version 4 and refer to ccmarshal.c for the principal and credential format. Also add a helper function to return the cache version as an integer from 1 to 4, allowing more concise version checks.
* Add ccache marshalling testsGreg Hudson2014-05-173-2/+413
| | | | | | | Add a new ccache test program t_marshal.c which verifies the new marshalling functions and also the FILE ccache type against the expected representations of the ccache header, default principal, and credentials.
* Add cred marshalling functionsGreg Hudson2014-05-173-0/+495
| | | | | | | Add a new file ccmarshal.c containing functions to marshal and unmarshal credentials in file formats version 1-4. These will replace the functions in cc_file.c and cc_keyring.c, and can be used for KCM in the future.
* Modernize rd_cred.cGreg Hudson2014-05-171-188/+138
| | | | | | | | Adjust the internal abstractions so that decrypt_encpart is responsible for the fallback from receiving subkey to session key, and krb5_rd_cred is responsible for decoding and calling decrypt_encpart. Rename krb5_rd_cred_basic to make_cred_list since it is now only responsible for constructing the list.
* Allow GSS mechs to force mechlistMIC in SPNEGOSimo Sorce2014-05-081-0/+37
| | | | | | | | | | | | | | | | | | | During a SPNEGO negotiation, if the NTLMSSP mechanism is used and a MIC is produced within the final initiator mechanism token, Microsoft servers require a mechlistMIC even if NTLMSSP was the most preferred mechanism. In spnego_mech.c, add a helper function mech_requires_mechlistMIC which queries the mechanism to determine whether we might need to produce a mechlistMIC for interoperability. Call it after each call to the mechanism's gss_init_sec_context and set sc->mic_reqd if it returns true. Although only the second call to NTLMSSP will actually ever return true, the first call makes the mechanism aware that the SPNEGO implementation supports this feature. [ghudson@mit.edu: clarified commit message and code] ticket: 7907 (new)
generated by cgit (git 2.34.1) at 2025-06-15 12:11:08 +0000