summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Get rid of G_VFY_TOKEN_HDR_IGNORE_SEQ_SIZEGreg Hudson2013-09-083-7/+1
| | | | | | | | | | This flag was introduced in the mskrb-integ merge but is not actually used after r21742--while kg_unseal_iov_token sets it in vfyflags for DCE-style contexts, it doesn't actually pass vfyflags to g_verify_token_header or otherwise use it. Moreover, the flag is not necessary there; we correctly set input_length to the header length (without data, padding, or trailer) for v1 tokens in a DCE-style context.
* Use gss_release_iov_buffer in t_iov.cGreg Hudson2013-09-061-20/+7
|
* Add tests for GSS IOV and AEAD interfacesGreg Hudson2013-09-064-6/+486
| | | | | | Add a new test program t_iov.c which tests various combinations of wrapping and unwrapping using the IOV and AEAD interfaces. Run it with and without SPNEGO in each enctype configuration.
* Factor out context establishment in GSS testsGreg Hudson2013-09-0612-271/+134
| | | | | | Add a new helper to common.c which runs gss_init_sec_context and gss_accept_sec_context in a loop, and use it in test programs instead of the open-coded one-token or two-token exchanges.
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-063-1/+8
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Stop modifying TGS requests for referralsGreg Hudson2013-09-031-17/+0
| | | | | | | | | | | | | | | | | | | | | | | | It is no longer necessary to modify request->server when we receive a referral. The uses of request->server break down as follows: * Matching against previously issued tickets (e.g. for renewals). We now explicitly disallow referrals for requests where we need to do that. * Using only the realm (e.g. for transited checking). Referrals are cross-realm TGS entries within the same realm as the requested server principal, so this does not change. * Comparing to a local TGS principal (for restrict_anonymous_to_tgt enforcement). Local TGS principals are not treated as referrals, so the sense of this comparison will not change if we use the original request. * Setting the sname and realm fields of a KRB-ERROR response. RFC 4120 and 6806 do not specify what we should put here for referrals or aliases and we are not aware of any uses of this field by clients, so putting the requested server principal here should be okay.
* Explicitly prevent referrals for certain requestsGreg Hudson2013-09-032-2/+21
| | | | | | | | | | | | | | | | For ticket modification requests (such as renewals), u2u requests, and S4U2Self requests, the requested server principal is expected to match a previously issued ticket. If that principal no longer exists, we must fail the request; we cannot issue a referral. We are currently doing that by rewriting request->server to the referral principal, which causes the match against the ticket to fail. Since we would like to stop modifying the request, we must explicitly prevent referrals in these cases. We don't find out whether a request is S4U2Self until after we've looked up the server principal, so for now we have to make a retroactive check for a referral after calling kdc_process_s4u2self_req.
* Tighten up referral recognition in KDC TGS codeGreg Hudson2013-09-031-2/+6
| | | | | | | | | | | | In do_tgs_req(), treat the search_sprinc() result as a referral only if it is a cross-TGS principal and it doesn't match the requested server principal. This change fixes two corner cases: (1) when a client requests a cross-realm TGT, we won't squash the name type in the response; and (2) if we are serving multiple realms out of the same KDB, we will properly handle aliases to any local-realm TGT, not just the one for the configured realm name. ticket: 7555
* Fix FAST critical option bit checkingGreg Hudson2013-09-031-2/+2
| | | | | | | | | The FAST option bits 0-15 are intended to be critical--if they are present and a KDC does not support them, the KDC is supposed to fail the request. Because of an incorrect constant, we were erroneously recognizing bits 24-31 as critical. Fix the constant. ticket: 7701 (new)
* Support FAST hide-client-names optionGreg Hudson2013-09-035-1/+19
| | | | | | | | In the KDC, if we see the hide-client-names option, identify the client as the anonymous principal in KDC-REP and KRB-ERROR responses. The actual client name is present in encrypted FAST elements. ticket: 7700 (new)
* Make it possible to renew aliased service ticketsGreg Hudson2013-08-292-3/+11
| | | | | | | | | We always allow aliases in the service principal when processing AS-REQs and TGS-REQs. If the ticket we issued is presented back to us in a TGS-REQ as a header ticket for renewal or similar, we should allow aliases when looking up its key to decode the AP-REQ. ticket: 7699 (new)
* Don't change realm in find_alternate_tgsGreg Hudson2013-08-291-1/+1
| | | | | | | | | | | | | | | | If a client makes a TGS request for a cross-realm TGS within a different realm from the one we normally serve (e.g. the KDC realm is X, and a client makes a TGS request for the server krbtgt/Y@Z), look for alternate TGS principals within the requested server realm, not the realm we normally serve. This change shouldn't break any working well-formed TGS requests, because changing the realm would trigger a failure in check_tgs_tgt. It may fix some corner cases when multiple realms are served out of the same KDB. But primarily, this change makes referrals and aliases easier to reason about, by eliminating a case where server->princ has a different realm from request->server after the call to search_sprinc().
* Add test for alias to local TGSGreg Hudson2013-08-281-0/+17
|
* Don't treat local krbtgt principal as referralGreg Hudson2013-08-281-8/+7
| | | | | | | | | If we look up a principal and in the KDB and get back the local TGS principal, the KDC should treat this as an alias, not a referral, and should therefore issue a ticket for the requested principal rather the canonical name. ticket: 7698
* Add tests for service aliases using LDAP moduleGreg Hudson2013-08-281-8/+34
|
* Fix KDC reply service principal for aliasesGreg Hudson2013-08-281-8/+15
| | | | | | | | | | | | | | If a client requests a service ticket for the alias of a service principal, RFC 6806 section 6 requires that the KDC issue a ticket which appears to be for the alias and not for the canonical name. After calling search_sprinc(), only replace request->server with server->princ if the latter is a TGT; this will be the case for an alternate cross-realm TGT or a host referral, but not for a simple service alias. ticket: 7698 target_version: 1.11.4 tags: pullup
* Clarify flag handling in dump.cGreg Hudson2013-08-273-65/+70
| | | | | | Get rid of "flags" bitfields and just use boolean values, to make the internal contracts for dump and load functions more precise. Rename "add_update" to "iprop_load" and reverse its sense.
* Update ulog state after promoting DB when loadingGreg Hudson2013-08-271-30/+21
| | | | | | | | If we are doing a full load, do not touch the ulog header until after we promote the temporary DB to live. This avoids the same bugs as the #7588 fix, but more robustly. Based on a patch from Richard Basch. ticket: 7695
* Omit signedpath if no_auth_data_required is setGreg Hudson2013-08-201-1/+2
| | | | | | | | | | The no_auth_data_required bit was introduced to suppress PACs in service tickets when the back end supports them. Make it also suppress AD-SIGNEDPATH, so that the ~70-byte expansion of the ticket can be avoided for services which aren't going to do constrained delegation. ticket: 7697 (new)
* Simplify krb5_krcc_start_seq_getSimo Sorce2013-08-191-41/+20
| | | | | | | | | | This code can be simplified (and a potential race avoided) by using keyctl_read_alloc() and letting it allocate the necessary memory. This also allows to remove a helper function that is not used anymore as well as make the code more readable. The only penalty is that we have two allocations instad of one. [ghudson@mit.edu: trivial simplifications]
* Remove unused counter in keyring ccacheSimo Sorce2013-08-161-23/+10
| | | | | | | | | numkeys is never really used in the single cache data structure. Every time a new iteration is started, numkeys is recalculated anyway, and then only the copy held in the cursor is used. Remove it from the cache data and keep it only in the cursor. [ghudson@mit.edu: clarified commit message]
* Remove unused _gssd_keyring_ids_ featureSimo Sorce2013-08-161-85/+3
| | | | | | | This feature was intended to be used by gssd to access users' keyring credentials, but it was never used. [ghudson@mit.edu: clarified commit message]
* Save the full residual for keyring cachesSimo Sorce2013-08-151-1/+1
| | | | | | | | | | | krb5_cc_get_name() should allow the caller to reconstruct the full cache name. That is not possible if thread: and process: are omitted here. (The saved name is not used by anything except krb5_krcc_get_name, so this change is safe.) [ghudson@mit.edu: proofread and clarified commit message] ticket: 7692 (new)
* Use dry-run unparses in keyring ccacheSimo Sorce2013-08-151-40/+78
| | | | | | | | | | Support credentials larger than 4K in cc_keyring.c by calculating the payload size in one pass, allocating a buffer of precisely the right size, and then unparsing into that buffer. [ghudson@mit.edu: squashed two commits; rewrote message; added length field instead of doing pointer arithmetic on null pointers; used proper English comments and clarified what code they apply to.]
* Add hostrealm interface testsGreg Hudson2013-08-159-3/+471
| | | | | | | | | | Create a test module for the hostrealm interface, a harness to call the realm mapping functions and display their results, and a Python script to exercise the functionality of the interface and each module (except the dns module, which we cannot easily test since it relies on TXT records in the public DNS). ticket: 7687
* Move utility functions to hostrealm.cGreg Hudson2013-08-154-184/+134
| | | | | | | Move the remaining internal functions from hst_realm.c to hostrealm.c, and get rid of hst_realm.c. ticket: 7687
* Use hostrealm interface for realm mappingGreg Hudson2013-08-1513-473/+884
| | | | | | | | | Reimplement krb5_get_host_realm, krb5_get_fallback_host_realm, and krb5_get_default_realm in terms of the hostrealm interface. Three built-in modules (dns, domain, and profile) implement the current behavior. ticket: 7687
* Add hostrealm pluggable interface definitionGreg Hudson2013-08-154-2/+140
| | | | ticket: 7687 (new)
* Remove KRB5_DNS_LOOKUP_KDCBen Kaduk2013-08-146-63/+30
| | | | | | | | | | | | | It has been unconditionally activated by all supported build systems for almost two years, and no complaints or issues have been reported. In particular, aclocal.m4 has had an unconditional AC_DEFINE() since 3d708e55 in 2003, and win-pre.in has unconditionally set KRB5_USE_DNS_KDC since 17ffebf7 in 2011. While here, simplify some other DNS conditionals in win-pre.in where only one branch was ever taken. ticket: 7691 (new)
* Fix windows buildBen Kaduk2013-08-141-0/+1
| | | | | | | This routine is now used in the gssapi library and must be exported as such. ticket: 7688
* Remove redundant domain_realm mappingsBen Kaduk2013-08-123-18/+8
| | | | | | | | | | | | | | | | | | | This fixes a long-standing documentation bug where we claimed that a domain_realm mapping for a host name would not affect entries under that domain name. The code has always had the behavior where a host name mapping implies the corresponding domain name mapping, since the 1.0 release. While here, replace media-lab with csail in example files, as the media lab realm is no longer in use. Also strip port 88 from KDC specifications, and drop the harmful default_{tgs,tkt}_enctypes lines from src/util/profile/krb5.conf. Further cleanup on these files to remove defunct realms may be in order. ticket: 7690 (new) tags: pullup target_version: 1.11.4
* Fix localauth memory leakGreg Hudson2013-08-124-0/+10
| | | | | localauth modules were not freed by krb5_free_context(), causing a memory leak.
* Actually build t_enctypesTom Yu2013-08-121-4/+4
| | | | | | | | Commit 2e956074b228ff4df3b7462037ab69e4e88ffffe omitted adding a dependency to the "all" target to force the build of the t_enctypes test program. ticket: 7688
* Add trace logging for TXT lookupsGreg Hudson2013-08-126-12/+20
| | | | | | Rename krb5_try_realm_txt_rr (an internal function despite the name) and add a context parameter. Generate trace logs when we successfully look up a record and when a record is not found.
* Fix gss_krb5_set_allowable_enctypes for acceptorGreg Hudson2013-08-124-2/+383
| | | | | | | | | | | | | | | | | | | The acceptor implementation of gss_krb5_set_allowable_enctypes (added in 1.9.1) is intended to restrict the acceptor subkey negotiated by krb5_rd_req(). It uses the same approach as the initiator, calling krb5_set_default_tgs_enctypes on the context. This has the unwanted side effect of restricting the encryption key of the ticket, because krb5_decrypt_tkt_part has checked krb5_is_permitted_enctype on the ticket encryption key since 1.8. Instead, use krb5_auth_con_setpermetypes on the auth context. This list is only used for session key enctype negotiation. Also add automated tests to verify that gss_krb5_set_allowable_enctypes works as desired. ticket: 7688 (new) target_version: 1.11.4 tags: pullup
* Report KDC response sizes in trace logsGreg Hudson2013-08-072-3/+3
|
* Update config.guess and config.subBen Kaduk2013-08-072-132/+192
| | | | | | | | | | | | Copy in the latest config.guess and config.sub from upstream git master as of 2013-07-26 (revision 79c4c50fc754d742286706b4db5ed8ce2a0de925). Our previous version didn't recognize arm64. Reported as Debian bug 717840. ticket: 7683 (new) tags: pullup target_version: 1.11.4
* Correct an error in kdb.h commentsGreg Hudson2013-08-051-2/+2
| | | | | The check_policy functions return com_err codes, not protocol codes, so use a com_err constant in the example.
* Remove unused function arguments in cc_keyring.cSimo Sorce2013-08-021-172/+149
| | | | | | | The credential serialization functions do not operate on a ccache, so do not need it as an argument. [ghudson@mit.edu: clarified commit message, rewrapped shortened lines]
* Fix leak in krb5_krcc_unparse_cred on errorGreg Hudson2013-08-021-1/+3
| | | | Based on a patch from simo@redhat.com.
* Document krb5_db_iterate restriction on writingGreg Hudson2013-07-311-0/+6
|
* Don't reopen the KDB in update_princ_encryptionGreg Hudson2013-07-311-0/+12
| | | | | | | | | | kdb5_util update_princ_encryption iterates over the KDB and writes modified entries. With the DB2 back end, the first write operation has to upgrade the lock and reopen the DB, which resets the cursor state. Take out an explicit write lock before iterating to avoid this step. ticket: 7684 (new)
* Remove old comments in sendto_kdc.cRobbie Harwood (frozencemetery)2013-07-301-12/+0
| | | | | | | The commented code in question is present in set_conn_state_msg_length which is called immediately after the comments. [ghudson@mit.edu: clarified commit message]
* Remove is_udp field in sendto_kdc.c conn_stateRobbie Harwood (frozencemetery)2013-07-301-5/+1
| | | | | | | This field is redundant with addr.type. [ghudson@mit.edu: removed extraneous changes; clarified commit message]
* Add base64 functions to libkrb5support exportsRobbie Harwood (frozencemetery)2013-07-301-0/+2
| | | | | This was previously not an issue because nothing outside of libkrb5support used them.
* Don't ask empty responder questions in PKINITNalin Dahyabhai2013-07-223-9/+34
| | | | | | | | | When putting together the set of identity prompts for a responder challenge, if we don't need a PIN or password of some kind, don't ask an empty question. [ghudson@mit.edu: squashed commits, modified commit message, merged PKCS11 test with current Python script]
* Load import/export cred functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the import/export credential feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom import/export credential extensions if they wish. ticket: 7682
* Load cred store functions from GSS modulesSimo Sorce2013-07-211-0/+4
| | | | | | | | | | | | When the credential store feature was implement the related functions were added to struct gss_config, but the initialization function that dynamically loads modules was not changed to see if the plugin being loaded provided such functions. This will allow non-builtin mechanism and interposer mechanism to implement custom credential store extensions if they wish. ticket: 7682
* Allow self-service for kadmin purgekeys RPCGreg Hudson2013-07-192-3/+7
| | | | | | | Make the purgekeys RPC allow self-service, like the chpass and chrand RPCs. ticket: 7681 (new)
* Clean up and improve PKINIT test scriptGreg Hudson2013-07-191-78/+35
| | | | | | | | | Don't create a bunch of identically configured realms; just reuse the same one. Remove a redundant assignment from the soft-pkcs11.so check. Move the pkinit_identity setting from krb5.conf to kdc.conf, since it's only used by the KDC. Add a test for trying anonymous PKINIT when it isn't configured. Check for a specific error message when testing restricted anonymous PKINIT.
generated by cgit (git 2.34.1) at 2025-09-23 20:07:12 +0000