summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Remove pkinit_win2k_require_binding optionGreg Hudson2014-06-133-37/+4
| | | | | | | | | | | | When constructing a draft9 PKINIT request, always include KRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack. Do not accept a draft9 ReplyKeyPack in the KDC response. For now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC support for generating a draft9 ReplyKeyPack when a draft9 PKINIT request does not contain KRB5_PADATA_AS_CHECKSUM. ticket: 7933
* Remove PKINIT longhorn compatibility optionGreg Hudson2014-06-123-239/+45
| | | | | | | | Remove the PKINIT Windows Server 2008 beta compatibility code conditionalized under the "longhorn" variable. It is not required to interoperate with any released version of Windows. ticket: 7934 (new)
* Simplify and fix k5_check_cert_addressGreg Hudson2014-06-121-19/+12
| | | | | | | | | | | Get rid of the address union. Store the result of get_cert_cn in a signed variable so we can meaningfully check for negative results. Make get_cert_cn return int for consistency with X509_NAME_get_text_by_NID and its two callers. Also add an emacs mode line to the top of the file. ticket: 7929
* Remove stub pkinit_win2k codeGreg Hudson2014-06-113-7/+0
| | | | | | As contributed, the PKINIT module contained code to read the pkinit_win2k variable, but never used it. Get rid of the structure field and the code to populate it.
* Add missing profile functions to libkrb5 exportsGreg Hudson2014-06-111-0/+5
| | | | | | | | | | | | | | | profile_flush_to_buffer, profile_flush_to_file, profile_free_buffer, profile_init_flags, and profile_init_vtable are all public profile functions, but are inaccessible to libkrb5 applications on some platforms because they were never added to the export list. Add them now. (libprofile functions have never been part of the Windows DLL export list, so do not change krb5_32.def at this time.) ticket: 7930 (new) target_version: 1.12.2 tags: pullup
* Simplify ticket retrieval from AP-REQsGreg Hudson2014-06-103-31/+31
| | | | | | | | | After krb5_rd_req_decoded or krb5_rd_req_decoded_anyflag, the ticket (with enc_part2 if we could decrypt it) is accessible via request->ticket; there is no need to copy it. Stop using the ticket parameter of those functions. Where we need to save the ticket beyond the lifetime of the krb5_ap_req, steal the pointer before freeing the request.
* Add test for KDC client loggingGreg Hudson2014-06-102-0/+24
| | | | | | | Add a test case which performed a TGS request with an expired ticket and checks that the client principal is logged. ticket: 7910
* In KDC, log client principal in bad header ticketrbasch2014-06-102-9/+18
| | | | | | | | | | | | | | | | | | | | Fix KDC logging to include client principal in TGS_REQ logging even during error conditions such as "Ticket expired". As long as the TGS_REQ can be decrypted and the client principal is available, it should be included in the log, regardless of other errors which might be detected. krb5_rd_req_decoded and krb5_rd_req_decoded_anyflag (not public interfaces) now leave the decrypted ticket in req->ticket->enc_part2 on success or failure, if the ticket was successfully decrypted. This does not affect the behavior of krb5_rd_req. [ghudson@mit.edu: removed extraneous change, added commit message summary and description of internal API change, fixed possible memory leak, removed comment and #if 0 code block of purely historical interest] ticket: 7910
* Do not loop on add_cred_from and other new methodsSam Hartman2014-06-051-4/+4
| | | | | | | | | | | | | Several new GSS-API methods were added but GSSAPI_ADD_METHOD was called to add them rather than GSSAPI_ADD_METHOD_NOLOOP. This means that the implementation from the GSS-API mechglue would be used if the mechanism had no implementation. As a result, the mechglue will call into itself exhausting the call stack in an endless loop when one of these methods is called. ticket: 7926 target_version: 1.12.2 tags: pullup
* Treat LDAP KrbKey salt field as optionalGreg Hudson2014-06-053-6/+21
| | | | | | | | | | | | | | | | | | | | | | | | | Per the ASN.1 definition, the KrbKey salt field is optional. Since 1.7, we have been treating it as mandatory in the encoder; since 1.11, we have been treating it as mandatory in the decoder. Mostly by luck, we have been encoding a salt type of 0 when key_data_ver is 1, but we really should not be looking at key_data_type[1] or key_data_length[1] in this situation. Treat the salt field as optional in the encoder and decoder. Although the previous commit ensures that we continue to always encode a salt (without any dangerous assumptions about krb5_key_data constructors), this change will allow us to decode key data encoded by 1.6 without salt fields. This also fixes issue #7918, by properly setting key_data_ver to 2 if a salt type but no salt value is present. It is difficult to get the decoder to actually assign 2 to key_data_ver just because the salt field is there, so take care of that in asn1_decode_sequence_of_keys. Adjust kdbtest.c to match the new behavior by setting key_data_ver to 2 in both test keys. ticket: 7919 target_version: 1.12.2 tags: pullup
* Always include salt in LDAP KrbKey encodingGreg Hudson2014-06-052-1/+21
| | | | | | | | | | | | | | | | | | | In the LDAP KDB module, ensure that every krb5_key_data we pass to asn1_encode_sequence_of_keys includes a salt type, for compatibility with the decoder in unpatched krb5 1.11 and 1.12. This is not a behavior change by itself; since 1.7 the encoder has always included a KrbKey salt field because it erroneously treats that field as non-optional. (Luckily, the encoded salt always happens to have salt type 0 because krb5_key_data constructors start with zeroed memory.) The next commit will fix the encoder and decoder to properly treat the KrbKey salt field as optional, so we need this change to ensure that our encodings remain compatible. Also fix the ASN.1 tests to set key_data_ver correctly for the sample test key data. ticket: 7919
* Use k5_setmsgGreg Hudson2014-06-0546-445/+360
| | | | | | Replace most calls to krb5_set_error_message with k5_setmsg for brevity. Leave alone plugin sources where we don't include k5-int.h (mostly PKINIT).
* Define k5_setmsg internal aliasGreg Hudson2014-06-051-0/+3
| | | | | | This is just a shorter internal name for krb5_set_error_message. The full name is so long that we have to wrap error messages more than we'd like.
* Remove DEBUG_ERROR_LOCATIONS supportGreg Hudson2014-06-056-90/+1
| | | | | It wasn't being used and it added too much complexity to the error-handling functions.
* Read /etc/gss/mech if no mech.d/*.conf foundGreg Hudson2014-06-041-17/+24
| | | | | | | | | | Always read /etc/gss/mech, even if globbing /etc/gss/mech.d/*.conf doesn't work. Doing this using GLOB_DOOFFS proved error-prone, so use a simpler approach: factor out the per-pathname handling into a helper function load_if_changed, call it with MECH_CONF before the glob, then pass each glob result through the helper. ticket: 7925
* Remove stub pkinit_mapping_file codeGreg Hudson2014-06-033-7/+0
| | | | | | As contributed, the PKINIT code contained code to read a mapping filename, but never used the resulting structure variable. Get rid of the structure field and the code to populate it.
* Add tests for MS-KKDCP client supportNalin Dahyabhai2014-06-022-0/+220
| | | | | | | | Exercise the MS-KKDCP client support using the test proxy server, for AS, TGS, and kpasswd requests while also checking the certificate verification and name checks. ticket: 7929
* Add a simple KDC proxy test serverNalin Dahyabhai2014-06-028-0/+446
| | | | | | | | This proxy server uses python-paste to run the kdcproxy from https://pypi.python.org/pypi/kdcproxy. It should be used along with the proxy.pem certificate in ../tests/dejagnu/proxy-certs. ticket: 7929
* Have k5test.py provide 'runenv' to python testsNalin Dahyabhai2014-06-021-5/+10
| | | | | | | Expose the formerly-internal _runenv module as k5test.runenv, so that settings we store in the top-level runenv.py will be available to them. ticket: 7929
* Check names in the server's cert when using KKDCPNalin Dahyabhai2014-06-026-10/+355
| | | | | | | | When we connect to a KDC using an HTTPS proxy, check that the naming information in the certificate matches the name or address which we extracted from the server URL in the configuration. ticket: 7929
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-023-2/+175
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* HTTPS transport (Microsoft KKDCPP implementation)Nalin Dahyabhai2014-06-026-28/+471
| | | | | | | | | | | | | | | | | | | | Add an 'HTTPS' transport type which connects to an [MS-KKDCP] proxy server using HTTPS to communicate with a KDC. The KDC's name should take the form of an HTTPS URL (e.g. "https://proxybox/KdcProxy"). An HTTPS connection's encryption layer can be reading and writing when the application layer is expecting to write and read, so the HTTPS callbacks have to handle being called multiple times. [nalin@redhat.com: use cleanup labels, make sure we always send the realm name, keep a copy of the URI on-hand, move most of the conditionally-compiled sections into their own conditionally-built functions, break out HTTPS request formatting into a helper function, handle the MS-KKDCP length bytes, update comments to mention specific versions of the MS-KKDCP spec, differentiate TCP and HTTP trace messages, trace unparseable responses] ticket: 7929
* Dispatch-style protocol switching for transportRobbie Harwood (frozencemetery)2014-06-023-133/+171
| | | | | | | | | | | | | Switch to using per-transport-type functions when a socket that we're using to communicate with a server becomes readable or writable, and add them as pointers to the connection state. The functions are passed the name of the realm of the server being contacted, as we expect to need this in the near future. [nalin@redhat.com: replace macros with typedefs] [nalin@redhat.com: compare transports with TCP_OR_UDP rather than with 0] ticket: 7929
* Add ASN.1 codec for KKDCP's KDC-PROXY-MESSAGENathaniel McCallum2014-06-0212-0/+147
| | | | | | | | | | | | | Handle encoding and decoding [MS-KKDCP] proxy messages, including handling of the additional length bytes. Early versions of [MS-KKDCP] incorrectly omit that the size of the proxied message is prepended to the proxied message, as it is when we're using plain TCP, before encoding the proxy-message structure. This is fixed at least as of version 2.1 of the spec. [nalin@redhat.com: add tests] ticket: 7929
* Build support for TLS used by HTTPS proxy supportRobbie Harwood (frozencemetery)2014-06-028-2/+66
| | | | | | | | | Add a --with-proxy-tls-impl option to configure, taking 'openssl', 'auto', or invocation as --without-proxy-tls-impl. Use related CFLAGS when building lib/krb5/os, and LIBS when linking libkrb5. Call the OpenSSL library startup functions during library initialization. ticket: 7929
* Use k5_transport(_strategy) enums for k5_sendtoRobbie Harwood (frozencemetery)2014-06-0210-122/+178
| | | | | | | | | | | | | | | | | | In k5_sendto and k5_locate_server, replace "socktype" parameters with a new enumerator k5_transport, so that we can add new transports which are not in the socket type namespace. Control the order in which we make connections of different types using a new k5_transport_strategy enumerator, to simplify the logic for adding new transports later. Control the result of k5_locate_server with a no_udp boolean rather than a socket type. [ghudson@mit.edu: renamed type to k5_transport; k5_locate_server no_udp change; clarified commit message; fix for Solaris getaddrinfo] [kaduk@mit.edu: name variables of type k5_transport 'transport'] [nalin@redhat.com: use transport rather than sock_type in more places, add and use k5_transport_strategy, update the test program] ticket: 7929
* Add helper to determine if a KDC is the masterGreg Hudson2014-06-023-64/+80
| | | | | | Add a new function k5_kdc_is_master in locate_kdc.c to determine whether a KDC matches one of the masters, and use it in krb5_sendto_kdc.
* Simplify sendto_kdc.cGreg Hudson2014-06-021-80/+79
| | | | | | | | | | | | | | | | | | * Get rid of the "x" member of conn_state, which used to be a union but hasn't been since r14742. * Define a structure type for the "out" member of conn_state. * Rename incoming_krb5_message to incoming_message for brevity. * Make the "pos" member of incoming_message an offset instead of a pointer, simplifying several present and future computations. * Use "in" and "out" aliases to the conn_state in and out members where it improves brevity. * Rename set_conn_state_msg_length to set_transport_message and give it a descriptive comment. * Call set_transport_message from start_connection only, instead of once in add_connection and perhaps again in start_connection. To make this possible, pass the original message argument to maybe_send and start_connection. * Use make_data and empty_data helpers where appropriate.
* Make x-deltat.y work with bison 3Greg Hudson2014-06-012-762/+629
| | | | | | | | | | | | | | | | | Bison 3 removed support for YYPARSE_PARAM and YYLEX_PARAM, breaking x-deltat.y. Use %parse-param and %lex-param instead. (In Bison 3 we could use just %param, but that doesn't work in 2.x.) The parameter added by %parse-param is also passed to yyerror, so adjust the macro we use to suppress yyerror accordingly. Also use "%define api.pure" instead of "%pure_parser", which was deprecated in bison 2.3b. (The correct spelling was actually "%pure-parser", and bison 3 generates a warning about the underscore spelling.) Regenerate deltat.c using the new x-deltat.y and bison 3.0.2. ticket: 7923
* Make tcl_kadm5.c work with Tcl 8.6Greg Hudson2014-05-281-27/+15
| | | | | | | | | | Directly accessing the result field of Tcl_Interp has been deprecated for a long time, requires a special define in Tcl 8.6, and will be impossible in Tcl 9. Use Tcl_SetResult instead. The new error messages are less helpful than the old ones, but this is just support infrastructure for old tests, so it isn't important. ticket: 7924
* Fix uninitialized variable bug in KEYRING ccacheGreg Hudson2014-05-281-1/+1
| | | | | | | Commit 5f4a4d7d357fedac5feadc65c09ecf487ff98db8 removed the only unconditional assignment of ret in get_time_offsets, causing the function to return an uninitialized value if nothing goes wrong. Initialize ret at declaration time to fix this.
* Properly handle PKCS11 label in PKINITGreg Hudson2014-05-241-10/+18
| | | | | | | | | | | The CK_TOKEN_INFO label field is defined to be zero-filled, but it may not be zero-terminated if all bytes of the field are used. Use only length-counted operations to process it. Also avoid underrunning the buffer pointer if the label is empty or contains only whitespace. ticket: 7917 target_version: 1.12.2 tags: pullup
* Don't blindly use PKCS11 slot IDs in PKINITGreg Hudson2014-05-241-14/+13
| | | | | | | | | | | Passing invalid slot IDs to C_OpenSession can cause some PKCS #11 implementations (such as the Solaris one) to crash. If a PKINIT identity specifies a slotid, use it to filter the result of C_GetSlotList, but don't try it if it does not appear in the list. ticket: 7916 target_version: 1.12.2 tags: pullup
* Improve pointer hygiene around gss_display_nameGreg Hudson2014-05-242-3/+7
| | | | | | | | | | | | | | | | | | | | GSSAPI functions are responsible for setting their output parameters on failure. Take greater care to do so in krb5_gss_display_name. The mechglue is generally defensive about initializing variables used as outputs, and not assuming that mechs will set them on failure. Make gssint_convert_name_to_union_name initialize union_name->external_name before calling mech->gss_display_name, so that if the mech's gss_display_name doesn't touch it, we don't free an uninitialized pointer. Either one of these changes prevents an unlikely memory bug which could occur if krb5_gss_init_context fails within krb5_gss_display_name when called from gssint_convert_name_to_union_name. ticket: 7915 (new) target_version: 1.12.2
* Fix fencepost error in krad timeout handlerGreg Hudson2014-05-241-1/+1
| | | | | | ticket: 7911 target_version: 1.12.2 tags: pullup
* Load mechglue config files from /etc/gss/mech.dGünther Deschner2014-05-221-11/+54
| | | | | | | | | | | | | In addition to loading /etc/gss/mech, glob for *.conf files in /etc/gss/mech.d. Load only config files which have changed since the highest mtime we saw in the previous scan. Scan at most once per second to avoid excessive numbers of filesystem syscalls for busy GSSAPI applications. [ghudson@mit.edu: rewrote commit message; style changes; added once-per-second throttle on glob/stat calls] ticket: 7882 (new)
* Remove dead code from the mechglue initializationGünther Deschner2014-05-221-27/+0
| | | | | | | | The stat check in gss_indicate_mechs had no consequent and would have been redundant with logic in updateMechList if it did. [ghudson@mit.edu: elaborated commit message; removed unused g_mechSetTime and now-irrelevant comment]
* Test that kinit -k -i picks the intended principalBen Kaduk2014-05-221-0/+3
| | | | | | | Prior to ticket 7892 it would use the default host/ principal when no principal was given on the command line. ticket: 7892
* Do not default to host/ for client keytabsBen Kaduk2014-05-221-0/+17
| | | | | | | | | | | | | | | When the normal (acceptor) keytab is being used to obtain initial credentials, it is reasonable to use the default hostbased service principal (host/fully.qualified.localhost.domain) when no client principal is given. This behavior is not very reasonable when the default client keytab is being used, as host/ credentials are not normally client credentials. Make kinit -i match up with the GSS-API behavior when client keytabs are in use, using the name of the first entry in the keytab when no name is explicitly given. ticket: 7892
* Add tests for krb5int_c_combine_keysGreg Hudson2014-05-213-3/+98
| | | | | | | | | | | | krb5int_c_combine_keys is used only by SAM-2 preauth with neither the send-encrypted-sad nor use-sad-as-key flags, so it isn't covered by any automated function tests. Add some unit tests to make sure that it works and returns the expected results for two randomly generated test vectors. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix krb5int_c_combine_keysKen Hornstein2014-05-211-0/+1
| | | | | | | | | | | | When krb5int_c_combine_keys was updated to use the new crypto interface, a small bug was introduced. It turns out the temporary keyblock created needs to have its enctype set; otherwise, when krb5int_derive_keyblock() is called later, it will fail with KRB5_BAD_ENCTYPE. ticket: 7914 target_version: 1.12.2 tags: pullup
* Fix typo in k5test.pyBen Kaduk2014-05-191-1/+1
| | | | The principal/principle confusion strikes again.
* Use case insensitive DNS SAN matching in PKINITTomas Kuthan2014-05-191-1/+1
| | | | | | | Matching Subject Alternative Name from certificate with pkinit_kdc_hostname value from krb5.conf should disregard case. ticket: 7913 (new)
* Fix invalid JSON handling in KDC OTP moduleGreg Hudson2014-05-191-0/+2
| | | | | | | | | | | If the OTP configuration for a principal contains invalid JSON, the KDC OTP module calls k5_json_get_tid on a null pointer, causing the KDC process to crash. Fix this bug by checking the return value of k5_json_decode in decode_config_json. ticket: 7912 (new) target_version: 1.12.2 tags: pullup
* Fix t_marshal on big-endian platformsGreg Hudson2014-05-191-6/+12
| | | | | | | t_marshal.c attempts to skip the version 1 and 2 tests on big-endian platforms, but didn't do so correctly. Correctly start at version 3 on big-endian platforms, and change the way we do it to avoid preprocessor conditionals inside a function body.
* Use cred marshalling functions in cc_keyring.cGreg Hudson2014-05-171-1039/+56
| | | | | | | Replace the cc_keyring.c credential and principal marshalling functions with calls to the ccmarshal.c functions. Simplify the remaining parsing functions (for the index and time offsets) and fold the resulting code into the calling functions where appropriate.
* Use cred marshalling functions in cc_file.cGreg Hudson2014-05-171-653/+170
| | | | | | | | | | | Replace the cc_file.c credential and principal marshalling and unmarshalling functions with calls to the ccmarshal.c functions. For unmarshalling, we still need code to read the appropriate amount of data into a memory buffer. Because there is no outer length header for principals and credentials, this code needs to understand the credential and principal representations, but is much simpler than the old code as it only needs to store the data it reads, not assemble a data structure.
* Modernize cc_file.c and cc_keyring.cGreg Hudson2014-05-172-2348/+1665
| | | | | | | | | | | | | | | | | | | Rename functions not to use the krb5_ prefix, and to use the fcc_ or krcc_ prefixes only for ccache method implementations. Use shorter function comments and add missing comments in some cases. Remove forward declarations where they aren't needed. Use native types (uint16_t, void *, etc.) in preference to Kerberos type wrappers. Use "ret" as the variable name for krb5_error_code return values. Use 0 instead of KRB5_OK. Make whitespace conform to current practice. Remove old #if 0 blocks. Don't cast to and from void * or between integer types when C guarantees an implicit cast. Use literal 2 and 4 for the size of fixed-width 16-bit and 32-bit types. In cc_file.c, rewrite the header comment to specify the header format as updated by version 4 and refer to ccmarshal.c for the principal and credential format. Also add a helper function to return the cache version as an integer from 1 to 4, allowing more concise version checks.
* Add ccache marshalling testsGreg Hudson2014-05-173-2/+413
| | | | | | | Add a new ccache test program t_marshal.c which verifies the new marshalling functions and also the FILE ccache type against the expected representations of the ccache header, default principal, and credentials.
* Add cred marshalling functionsGreg Hudson2014-05-173-0/+495
| | | | | | | Add a new file ccmarshal.c containing functions to marshal and unmarshal credentials in file formats version 1-4. These will replace the functions in cc_file.c and cc_keyring.c, and can be used for KCM in the future.
generated by cgit (git 2.34.1) at 2024-11-16 12:00:51 +0000