summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Combine PKINIT test scriptsGreg Hudson2013-07-183-44/+23
|
* Test that password preauth works without PKINITNalin Dahyabhai2013-07-171-0/+12
| | | | | | Before we test authenticated PKINIT, slip in a test to check that password-based preauthentication still works when the KDC is offering PKINIT, but the client has no PKINIT credentials.
* Teach the responder test helper about OTPNalin Dahyabhai2013-07-171-10/+50
|
* Add the error to some PKINIT NSS debug messagesNalin Dahyabhai2013-07-171-10/+14
|
* Add tests for PKINIT using responder functionalityNalin Dahyabhai2013-07-171-0/+160
| | | | | | | | | | | | | | We now also test that the PKINIT challenge looks like we expect it to look, that PKINIT fails if we don't provide a response or a prompter callback, and that PKINIT succeeds with a response provided using either the raw responder API or the PKINIT responder functions. One thing that we don't check is which specific error code we get when PKINIT fails: the OpenSSL and NSS versions return different error codes (some mixture of EIO, ENOMEM, ENOENT, and KRB5KDC_ERR_PREAUTH_FAILED) when they encounter trouble loading client credentials. ticket: 7680
* Add a helper for testing PKINIT and responder cbNalin Dahyabhai2013-07-173-4/+404
| | | | ticket: 7680
* Add non-JSON APIs for PKINIT responder itemsNalin Dahyabhai2013-07-176-0/+284
| | | | | | | | | | | | | | | | | Add wrappers for the JSON-oriented APIs for PKINIT responder items, modeled after the API we provide for OTP items: * krb5_responder_pkinit_get_challenge() returns the list of identities for which we need PINs * krb5_responder_pkinit_challenge_free() frees the structure that was returned by krb5_responder_pkinit_get_challenge() * krb5_responder_pkinit_set_answer() sets the answer to the PIN for one of the identities [ghudson@mit.edu: style cleanup; added comment pointing to main body of PKINIT module] ticket: 7680
* Support PKINIT OpenSSL deferred identity promptingNalin Dahyabhai2013-07-171-55/+159
| | | | | | | | | | | | | | | | Add a password to the set of things that we can pass to a PEM password callback and the function we use for loading PKCS12 bundles. If we're meant to defer identity prompts, just store the name of the identity which we're loading. Otherwise, if we're passed a password, use it. Otherwise, use the prompter callback. Add a password to the set of things that we can pass to the function that we use for logging in to PKCS11 tokens, too, but if we're deferring identity prompts, just return the identity name without doing anything else. If not, and we're passed a password, use that. Otherwise, try to use the prompter callback to get one. ticket: 7680
* Support PKINIT NSS deferred identity promptingNalin Dahyabhai2013-07-171-60/+252
| | | | | | | | | | | | | | | | | | The password callback which we usually supply to NSS already gets a pointer to the pkinit_identity_crypto_context structure, but it needs to be passed the name of the identity for which it's being called. If it gets a name, and it's deferring prompting, just add the identity to the list of deferred identity prompts (the password callback wouldn't have been called if its result wasn't needed), and either return NULL (as an indication that we couldn't get a password) or an empty string (a value which we know is invalid) if that's handier. Otherwise, check for a password that's been stashed for its use for that identity, and return a copy of it if one's found. If none of that works, try to use the prompter callback to ask for the password. ticket: 7680
* Pass PKINIT identity prompts to the responder cbNalin Dahyabhai2013-07-173-19/+262
| | | | | | | | | | | | | | | | | Use the list of deferred identity prompts and warnings, which we have after calling pkinit_identity_initialize(), to build a list of questions to supply to responder callbacks. Before calling pkinit_identity_prompt() to actually load identities that are protected, save any passwords and PINs which a responder callback may have supplied. Because pkinit_client_prep_questions() can be called multiple times, and we don't want to try to load all of our identities each of those times, take some steps to ensure that we only call pkinit_identity_initialize() and pkinit_identity_prompt() once per request. ticket: 7680
* Make the PKINIT NSS path also check for NULL certsNalin Dahyabhai2013-07-171-1/+6
| | | | | When called to free identity information, do what the OpenSSL-based version does, and error out if the identity information is NULL.
* Use PKCS11_MODNAME for NSS PKINIT by defaultNalin Dahyabhai2013-07-171-0/+7
| | | | | Do what the OpenSSL-using code paths do, and load PKCS11_MODNAME if no module is specified when we're told to use a PKCS11 identity.
* Add support for PKINIT deferring identity promptsNalin Dahyabhai2013-07-176-0/+226
| | | | | | | | | | | Learn to manage a list of deferred identities, for which we want to prompt for passwords or PINs, in pkinit_identity_crypto_context structures, along with their associated token flags. These are opaque outside of pkinit_crypto_openssl and pkinit_crypto_nss, so both implementations need to provide wrapper functions that can be called from elsewhere in the module to populate and query the lists. ticket: 7680
* Split pkinit_identity_initialize into two phasesNalin Dahyabhai2013-07-177-15/+97
| | | | | | | | | | | Split part of pkinit_identity_initialize() into a second piece named pkinit_identity_prompt(). Have each piece pass a new boolean flag to crypto_load_certs() to indicate if it should defer prompting for a password/PIN for client identities that require one. If the flag isn't set, then crypto_load_certs() should attempt to use a responder-supplied value, or call the prompter if there isn't one. ticket: 7680
* Fix OTP KDC module get_string error handlingGreg Hudson2013-07-171-2/+4
| | | | | | If cb->get_string returns 0 with no result in otp_edata, make sure we set retval to avoid sending an empty OTP hint. If cb->get_string returns an error code in otp_verify, avoid masking that code.
* Clarify and improve k5_json_object_setGreg Hudson2013-07-163-4/+30
| | | | | Document that k5_json_object_set can be used to overwrite an existing key, and make it possible to remove a key by setting it to NULL.
* Add kadmin support for principals without keysGreg Hudson2013-07-1511-18/+122
| | | | | | | | | Add kadmin support for "addprinc -nokey", which creates a principal with no keys, and "purgekeys -all", which deletes all keys from a principal. The KDC was modified by #7630 to support principals without keys. ticket: 7679 (new)
* Avoid allocating zero key_data structuresGreg Hudson2013-07-153-22/+22
| | | | | | | | When we allocate space for an array of key_data structures, make sure we allocate at least one, so we don't spuriously fail on platforms where malloc(0) returns NULL. Where we use malloc, use k5calloc instead. Where we use krb5_db_alloc or realloc, just allocate an extra entry.
* Fix a leak when parsing PKINIT cert SANs with NSSNalin Dahyabhai2013-07-151-0/+1
| | | | | When retrieving the list of a certificate's subjectAltName values, we weren't freeing some of the temporary memory we used.
* Fix minor leaks in klistGreg Hudson2013-07-151-3/+4
| | | | | | When walking the cache, if we skip a cred because it's a config entry, make sure to free it. Also free the result of krb5_cc_get_principal. Based on a patch from Nalin Dahyabhai.
* Don't leak PKINIT CMS signed data certs and CRLsNalin Dahyabhai2013-07-151-2/+4
| | | | | | | | The stacks of certificates and CRLs that we retrieve from CMS objects include newly-owned references to the certificates and CRLs, so when we go to free them, we need to remember to free those. [ghudson@mit.edu: minor formatting change; removed unrelated style fix]
* Don't leak the reply key's memory during PKINITNalin Dahyabhai2013-07-151-1/+3
|
* Use pipe instead of sigwait for krad testsGreg Hudson2013-07-142-27/+17
| | | | | | | | We've never used sigwait() before, and it has some problems on Solaris 10 (a nonconformant prototype by default, and experimentally it didn't seem to work correctly with _POSIX_PTHREAD_SEMANTICS defined). Use a pipe instead. Make t_daemon.py less chatty on stdout to avoid filling the pipe buffer.
* Fix minor type issues in krad testsGreg Hudson2013-07-142-2/+2
| | | | | Use unsigned char for test encodings, since the initializers use values greater than 127.
* Use k5calloc instead of k5alloc where appropriateGreg Hudson2013-07-1119-34/+36
| | | | | Wherever we use k5alloc with a multiplication in the size parameter,, use the new k5calloc helper function instead.
* Add k5calloc internal helper functionGreg Hudson2013-07-111-2/+9
| | | | | | Letting calloc() do multiplication helps avoid overflow bugs, so provide an internal k5calloc() helper which accepts both calloc arguments, and reimplement k5alloc() in terms of it.
* Fix skip logic in t_otp.pyGreg Hudson2013-07-111-7/+1
| | | | | | | Reorder (and trim) the imports in t_otp.py so that k5test is pulled in before we try to import pyrad and multiprocessing. Otherwise success() isn't defined in the case where we decide to skip the entire test script.
* Add server-side otp preauth pluginNathaniel McCallum2013-07-1111-0/+1376
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Add libkradNathaniel McCallum2013-07-1124-2/+3693
| | | | | | | | The new library libkrad provides code for the parsing of RADIUS packets as well as client implementation based around libverto. This library should be considered unstable. ticket: 7678 (new)
* Add test case for CVE-2013-1417Tom Yu2013-07-012-0/+14
| | | | | | ticket: 7670 (new) tags: pullup target_version: 1.11.4
* KDC null deref due to referrals [CVE-2013-1417]Tom Yu2013-07-011-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An authenticated remote client can cause a KDC to crash by making a valid TGS-REQ to a KDC serving a realm with a single-component name. The process_tgs_req() function dereferences a null pointer because an unusual failure condition causes a helper function to return success. While attempting to provide cross-realm referrals for host-based service principals, the find_referral_tgs() function could return a TGS principal for a zero-length realm name (indicating that the hostname in the service principal has no known realm associated with it). Subsequently, the find_alternate_tgs() function would attempt to construct a path to this empty-string realm, and return success along with a null pointer in its output parameter. This happens because krb5_walk_realm_tree() returns a list of length one when it attempts to construct a transit path between a single-component realm and the empty-string realm. This list causes a loop in find_alternate_tgs() to iterate over zero elements, resulting in the unexpected output of a null pointer, which process_tgs_req() proceeds to dereference because there is no error condition. Add an error condition to find_referral_tgs() when krb5_get_host_realm() returns an empty realm name. Also add an error condition to find_alternate_tgs() to handle the length-one output from krb5_walk_realm_tree(). The vulnerable configuration is not likely to arise in practice. (Realm names that have a single component are likely to be test realms.) Releases prior to krb5-1.11 are not vulnerable. Thanks to Sol Jerome for reporting this problem. CVSSv2: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C ticket: 7668 (new) tags: pullup target_version: 1.11.4
* Install localauth_plugin.hGreg Hudson2013-07-011-0/+1
| | | | | The localauth pluggable interface was added on master in February, but we neglected to install its header file.
* Install ccselect_plugin.hGreg Hudson2013-07-011-0/+1
| | | | | | | | | The ccselect pluggable interface was added in release 1.10, but we neglected to install its header file. ticket: 7671 (new) target_version: 1.11.4 tags: pullup
* Update windows README for VS2012/Windows SDK 8Ben Kaduk2013-06-281-5/+15
| | | | | | | | | | | The Windows SDK 8 dropped the command-line build environment, so provide instructions for building with the Visual Studio (2012) command-line build environment. ticket: 7669 (new) queue: kfw tags: pullup target_version: 1.11.4
* Require Windows Installer 4.5 or higherBen Kaduk2013-06-281-1/+1
| | | | | | | | | | | | | | | As advised by the VC 11 merge modules. Windows Installer 4.5 requires Windows Server 2008, Windows Vista, Windows XP with Service Pack 2 (SP2) and later, or Windows Server 2003 with Service Pack 1 (SP1) and later. I believe we already enforce these restrictions manually elsewhere, so this should not restrict our set of valid target machines. ticket: 7667 (new) queue: kfw tags: pullup target_version: 1.11.4
* WiX support for building with VS 2012Ben Kaduk2013-06-283-28/+35
| | | | | | | | | | | The merge modules need to reference VC110 paths. Use a variable for VC100 versus VC110 so that we don't copy a lot of boilerplate around. ticket: 7666 (new) queue: kfw tags: pullup target_version: 1.11.4
* Fix uninitialized variable bugsGreg Hudson2013-06-272-1/+2
| | | | | The previous few commits introduced a couple of bugs where variables could be used without being initialized. Fix them.
* Add tests for pwqual modules and plugin orderingGreg Hudson2013-06-2710-4/+466
| | | | | | | | | | Create a test module for the pwqual interface, and script to exercise the built-in and test modules through kadmin.local. Also create a test harness to display the order of pwqual modules for the current configuration, and use it to test the plugin module ordering guarantees. ticket: 7665
* Rely on module ordering for localauthGreg Hudson2013-06-271-25/+6
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Provide plugin module ordering guaranteesGreg Hudson2013-06-272-200/+267
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Fix spin loop reading from KDC TCP socketViktor Dukhovni2013-06-261-2/+2
| | | | | | | | | | | | In the k5_sendto code for reading from a TCP socket, detect end-of-stream when reading the length. Otherwise we can get stuck in an infinite loop of poll() and read(). [ghudson@mit.edu: commit message] ticket: 7508 target_version: 1.11.4 tags: pullup
* Build with Visual Studio 2012Ben Kaduk2013-06-252-1/+12
| | | | | | | | | | | | It's more aggressive about enforcing that keywords are not macros in C++ mode, and has bumped the MFC version to 11. Keep compatibility with older versions of Visual Studio, appropriately conditionalized. ticket: 7664 (new) tags: pullup target_version: 1.11.4
* [Leash] Notify the user of password change successBen Kaduk2013-06-251-0/+2
| | | | | | ticket: 7440 tags: pullup target_version: 1.11.4
* Fix timing edge cases in t_renew.pyGreg Hudson2013-06-161-6/+6
| | | | | | | | | When we are testing maximum renewable lifetimes, the KDC might process the request at a later time than the request time (typically by no more than one second). So we need to ask for a ticket lifetime longer than the maximum renewable lifetime, not equal to it, or we risk getting a just-barely-renewable ticket instead of a non-renewable one. Also fix a couple of typos in comments.
* Fix sentinel position in sample u2u serverGreg Hudson2013-06-131-4/+4
| | | | | | Print "Server started" after calling listen(), or there wil be a race where the client tries to connect before there is a listen queue and gets ECONNREFUSED.
* Fix various warningsGreg Hudson2013-06-0754-305/+177
|
* Refactor KDC renewable ticket handlingGreg Hudson2013-06-066-64/+124
| | | | | | | | | | | | | | | | | | | | | Create a new helper to compute the renewable lifetime for AS and TGS requests. This has some minor behavior differences: * We only issue a renewable ticket if the renewable lifetime is greater than the normal ticket lifetime. * We give RENEWABLE precedence over RENEWABLE-OK in determining the requested renewable lifetime, instead of sometimes doing the reverse. * We use the client's maximum renewable life for TGS requests if we have looked up its DB entry. * Instead of rejecting requests for renewable tickets (if the client or server principal doesn't allow it, or a TGS request's TGT isn't renewable), issue non-renewable tickets. ticket: 7661 (new)
* Use KDC clock skew for AS-REQ timestampsGreg Hudson2013-06-051-5/+12
| | | | | | | | | | | | | | | | Calculate request timestamps each time we encode a request, and use the adjusted current time when calculating them, including adjustments resulting from preauth-required errors early in the AS exchange. As a side effect, this reverts one of the changes in commit 37b0e55e21926c7875b7176e24e13005920915a6 (#7063); we will once again use the time adjustment from any ccache we read before the AS exchange, if we don't have a more specific adjustment from a preauth-required error. Based on a patch from Stef Walter. ticket: 7657 (new)
* Refactor AS-REQ nonce and timestamp handlingGreg Hudson2013-06-053-67/+78
| | | | | | | | | | | | Create helper functions to set the request nonce and to set the request timestamp. Don't bother picking a nonce in restart_init_creds_loop since we will just pick a new one in init_creds_step_request. Create a library-internal function to get the current time with possible adjustment from a preauth-required error. Only set ctx->request_time in one place (just before encoding each request). Remove unused parameters from stash_as_reply. Partially based on a patch from Stef Walter.
* Untabify and reindent t_authpkinit.pyGreg Hudson2013-06-031-17/+16
|
generated by cgit (git 2.34.1) at 2025-09-23 22:19:49 +0000