summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Fix krb5_rd_req usage in user-to-user sample appGreg Hudson2013-05-221-2/+2
| | | | | Pass the server principal to krb5_rd_req so it can do proper transited checking.
* Clarify krb5_rd_req documentationGreg Hudson2013-05-221-9/+19
| | | | | | | | | | For the user-to-user case, document that callers should pass a server principal to krb5_rd_req. For the keytab case, more accurately document which keytab keys are tried against the ticket. ticket: 7641 (new) target_version: 1.11.3 tags: pullup
* Fix transited handling for GSSAPI acceptorsGreg Hudson2013-05-212-3/+18
| | | | | | | | | | | | | | | | | | The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. ticket: 7639 target_version: 1.11.3 tags: pullup
* Try to use best DNS search functions in dnsglue.cGreg Hudson2013-05-191-23/+45
| | | | | | | | | | Create macros to declare a DNS search handle, initialize a handle, perform a search, and destroy a handle. On OS X, use the native dns_open, dns_search, and dns_free functions, since using the res_* interfaces may not contact the correct servers. On systems with res_ninit, use res_nclose if we don't have res_ndestroy. Based on a patch by Nate Rosenblum.
* Reduce boilerplate in makefilesGreg Hudson2013-05-16121-797/+63
| | | | | | | | | Provide default values in pre.in for PROG_LIBPATH, PROG_RPATH, SHLIB_DIRS, SHLIB_RDIRS, and STOBJLISTS so that they don't have to be specified in the common case. Rename KRB5_RUN_ENV and KRB5_RUN_VARS to RUN_SETUP (already the most commonly used name) and RUN_VARS. Make sure to use DEFINES for local defines (not DEFS). Remove some other unnecessary makefile content.
* Remove unused build system variablesGreg Hudson2013-05-163-34/+4
|
* Fix windows buildBen Kaduk2013-05-163-19/+12
| | | | | Catch a few stragglers that missed the memo that k5_mutex_lock cannot fail, and sprinkle some cc-int.h as needed.
* Fix NSS crypto back end for mutex changesGreg Hudson2013-05-161-5/+2
| | | | | Adjust a stray k5_mutex_lock invocation in the NSS crypto back end after 6350fd0c909d84c00200885e722cc902049ada05.
* Assume mutex locking cannot failGreg Hudson2013-05-1436-736/+296
| | | | | | | | | | | | Locking and unlocking a non-recursive mutex is a simple memory operation and should not fail on any reasonable platform with correct usage. A pthread mutex can return EDEADLK on lock or EPERM on unlock, or EINVAL if the mutex is uninitialized, but all of these conditions would reflect serious bugs in the calling code. Change the k5_mutex_lock and k5_mutex_unlock wrappers to return void and adjust all call sites. Propagate this change through k5_cc_mutex_lock and k5_cc_mutex_unlock as well.
* Don't use "bool" for ASN.1 boolean macrosNate Rosenblum2013-05-141-2/+2
| | | | | | | | | | | | When building for IOS targets with clang, the stdbool.h header is included by default. This header includes the following C99 definition: #define bool _Bool which wrecks havoc with the DEFBOOLTYPE macro. ticket: 7525
* Rename internal Camellia symbolsGreg Hudson2013-05-131-0/+12
| | | | | | | | | | | Symbols from the NTT Camellia sources, used in the builtin crypto provider, could conflict with symbols from other libraries such as OpenSSL's libcrypto. Rename those like we rename the Gladman AES symbols. ticket: 7626 target_version: 1.11.3 tags: pullup
* Fix kpasswd UDP ping-pong [CVE-2002-2443]Tom Yu2013-05-131-4/+4
| | | | | | | | | | | | | | | | | | | | The kpasswd service provided by kadmind was vulnerable to a UDP "ping-pong" attack [CVE-2002-2443]. Don't respond to packets unless they pass some basic validation, and don't respond to our own error packets. Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong attack or UDP ping-pong attacks in general, but there is discussion leading toward narrowing the definition of CVE-1999-0103 to the echo, chargen, or other similar built-in inetd services. Thanks to Vincent Danen for alerting us to this issue. CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C ticket: 7637 (new) target_version: 1.11.3 tags: pullup
* Fixes for leaking of refcounted resourcesNalin Dahyabhai2013-05-131-11/+22
| | | | | | | | | | | | | | | | Some fixes, some use of different APIs which seem to clean things up better, with the goal of being able to cleanly shut down NSS when we're done using it. * Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a database opened with SECMOD_OpenUserDB(). * Fix a typo and use PK11_DestroyGenericObject() instead of PK11_DestroyGenericObjects() to destroy one object. * Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule() to close a module loaded with SECMOD_LoadUserModule(). * crypto_check_for_revocation_information(): don't leak a reference to the CRL, or to intermediate issuers. * Don't leak a reference to a PEM private key.
* In PKINIT NSS crypto, support encrypted PEM keysNalin Dahyabhai2013-05-131-0/+26
| | | | | | | | | | | | | When the PEM module is given an encrypted key, it changes its token flags to indicate that a password is required (by setting needs-login) to signal the application that we need to supply a password to decrypt it. Attempts to load any other items will fail until the flag is cleared. If we detect that the flag is set after we've attempted to load a private key, attempt to "log in" to the "token" using a password. Even if we fail, the token will reset its needs-login flag, which is necessary before we can import anything else.
* Get better at locating the just-loaded certificateNalin Dahyabhai2013-05-131-58/+35
| | | | | | When loading certificates using the PEM module, use a better method for finding the just-loaded certificate that will still work if we've already got a copy of the certificate loaded somewhere else.
* In PKINIT NSS crypto code, load certificates firstNalin Dahyabhai2013-05-131-61/+62
| | | | | | | | | | | | When using NSS's CMS API to generate signed-data messages, we identify the key that we want to use for signing by specifying a certificate. The library then looks up the corresponding private key when it needs to generate the signature. This lookup fails if a certificate and a its corresponding private key were loaded key-first, but succeeds if they were loaded certificate-first (RHBZ#859535). To work around this, switch to loading the certificate first. (We switch to using different _pkinit_identity_crypto_file pointers for each instead of reusing just one, so the diff is messier than it might have been.)
* When DEBUG=1, log why we fail to log in to a tokenNalin Dahyabhai2013-05-101-4/+6
| | | | | | Use PORT_ErrorToName() to let us print an error name instead of an error code in a couple of debug messages, since in practice we just end up looking up the code in <secerr.h> anyway.
* Traverse tokens like we do with OpenSSL for NSSNalin Dahyabhai2013-05-101-15/+14
| | | | | | | | When PKINIT is built with NSS, change how it traverses tokens to match the way it's done when built using OpenSSL: ignore slot names (we used to treat the token label as a possible slot label, too), and either only look at the token with the specified label, or the first token if a no token label was specified.
* Only call SEC_PKCS12DecoderFinish() onceNalin Dahyabhai2013-05-101-1/+0
| | | | | We already call SEC_PKCS12DecoderFinish() before entering the switch() statement, so don't call it again.
* Make the text of NSS's prompts look like OpenSSL'sNalin Dahyabhai2013-05-101-4/+8
| | | | | | | | When PKINIT is built with NSS, make the text of prompts that we issue to the user better match the text we use when we build with OpenSSL: ask for a pass phrase when we're asking about a hardware token, ask for a password the rest of the time, and take advantage of translations for requests for a password.
* Don't fail if a candidate certificate has no SANsNalin Dahyabhai2013-05-101-6/+2
| | | | | | | | When we're doing certificate matching and we're asked for the list of SAN values for a certifiate, and it contains none, don't return an error, as that will eventually cause the module to just return an error. Instead, just return an empty list of SAN values so that processing will continue on to check if other certificates match.
* Fix type mismatch in db2_exp.cGreg Hudson2013-05-101-1/+1
| | | | | | The locking wrapper for audit_as_req used the wrong function signature, which was harmless but produced a couple of warnings. Fix it.
* Fix check for KDB: prefix in kinitRichard Basch2013-05-101-1/+1
| | | | | | | | | The string "KDB:" has four characters, not three; check for all four of them. [ghudson@mit.edu: commit message] ticket: 7636
* Add test case for CVE-2013-1416Tom Yu2013-05-092-0/+16
| | | | ticket: 7635 (new)
* fix crypto openssl hmac warningGilles Espinasse2013-05-091-1/+1
| | | | ticket: 7634
* Improve LDAP password file error messagesGreg Hudson2013-05-081-2/+6
| | | | | | | If we cannot open the LDAP password file or cannot find the bind DN in it, include the filename and DN in the error message. ticket: 7632
* Make reassembled PKCS11 names parseableNalin Dahyabhai2013-05-082-10/+10
| | | | | | The reassembled names used "," as a separator between attributes, when passed-in values use ":". This was due to the original submitter being confused - they weren't intended to be different.
* Fix a typo that caused us to not skip removing "."Nalin Dahyabhai2013-05-081-1/+1
| | | | | | When attempting to clean the files out from our temporary directory, correct the test which was supposed to let us skip over "." and ".." so that we actually don't try to remove them with remove().
* Fix checking unencrypted PKCS12: twiceNalin Dahyabhai2013-05-081-1/+1
| | | | | | The test, as submitted, included a copy/paste error which caused it to test PKINIT using unencrypted PKCS12 bundles twice, and to not test a DIR: location containing unencrypted PEM-formatted keys at all.
* Remove some apparently-accidental debug whitespaceNalin Dahyabhai2013-05-082-4/+4
|
* Remove dangling reference to $with_edirectoryNalin Dahyabhai2013-05-081-4/+1
| | | | | | | Remove a reference to eDirectory that persisted after support for eDirectory was removed. Almost certainly harmless anyway. [ghudson@mit.edu: also quote $with_ldap]
* Make AS requests work with no client keyGreg Hudson2013-05-032-16/+26
| | | | | | | | If we cannot find a client key while preparing an AS reply, give preauth mechanisms a chance to replace the reply key before erroring out. ticket: 7630
* Don't send empty etype info from KDCGreg Hudson2013-05-031-0/+5
| | | | | | | | RFC 4120 prohibits empty ETYPE-INFO2 sequences (though not ETYPE-INFO sequences), and our client errors out if it sees an empty sequence of either. ticket: 7630
* Check for keys in encrypted timestamp/challengeGreg Hudson2013-05-032-2/+11
| | | | | | | | Encrypted timestamp and encrypted challenge cannot succeed if the client has no long-term key matching the request enctypes, so do not offer them in that case. ticket: 7630
* Add kdcpreauth callback to check for client keysGreg Hudson2013-05-032-2/+26
| | | | | | | | Add a new have_client_keys callback to the kdcpreauth interface, allowing modules to efficiently check whether the client DB entry has any keys matching the request enctypes. ticket: 7630
* Fix mismatched spnego_mech.c declarationsGreg Hudson2013-05-031-3/+4
| | | | | The mechglue definitions of gssint_get_der_length and friends use unsigned int for the buffer length, not OM_uint32.
* Add missing plugins.c to SRCS in util/supportGreg Hudson2013-05-022-0/+5
| | | | | | Reported by Arlene Berry. ticket: 7629
* Fix link line for t_fortunaGilles Espinasse2013-05-011-1/+1
| | | | ticket: 7628
* Don't use portmapper in RPC testsGreg Hudson2013-05-014-32/+48
| | | | | | | | On many Linux systems, due to what is arguably a bug in rpcbind, the portmapper doesn't allow service registration from non-root processes. This causes the RPC tests to be frequently skipped. Modify the tests so that they don't need the portmapper, by grabbing the port number from the server process and passing it to the client.
* Disable UDP pass of gssrpc tests on all platformsGreg Hudson2013-05-011-10/+1
| | | | | | | | | | | | | | | The AUTH_GSSAPI flavor of rpc authentication uses IP address channel bindings. These are broken over UDP, because svcudp_recv() fails to get the destination address of incoming packets (it tries to use the recvmsg() msg_name field to get the destination IP address, which instead gets the source address; see ticket #5540). There is no simple or comprehensive way to fix this; using IP_PKTINFO is a fair amount of code and only works on some platforms. It's also not very important--nobody should be using AUTH_GSSAPI except perhaps for compatibility with really old kadmin, and kadmin only runs over TCP. Since the gssrpc tests are closely wedded to AUTH_GSSAPI, the simplest fix is to only run the TCP pass.
* Disable the gssrpc expired-cred testGreg Hudson2013-05-011-2/+3
| | | | | | | | | | | | | The "expired" test in expire.exp tries to authenticate to the server process with an expired TGT (obtained using kinit -l -1m). Using an expired TGT to get an expired service cred no longer works after #6948. We could use kinit -S to get an expired service cred, but krb5_get_credentials won't return expired service cred from the cache (even before #6948). We could use time offsets to simulate clock skew between the client and server process, but that would be difficult because the test programs don't have access to the krb5_context objects used by the client or server process. Since we don't have a simple workaround, disable the test.
* Add gssrpc to pkg-configGünther Deschner2013-05-015-5/+21
| | | | ticket: 7620
* Add gssrpc to krb5-configGünther Deschner2013-05-011-3/+7
| | | | ticket: 7620
* Add internal KDC_DIR macroGreg Hudson2013-04-291-10/+11
| | | | | Define KDC_DIR in osconf.hin and use it for paths within the KDC directory.
* Better fix for not using expired TGTs in TGS-REQsGreg Hudson2013-04-291-53/+91
| | | | | | | | | | | | We want to generate a KRB5_AP_ERR_TKT_EXPIRED code when the TGT is expired, like we would if we tried the TGT against the KCD. To make this work, separate the helpers for getting local and crossrealm cached TGTs. For a crossrealm TGT, match against the endtime, as there could be multiple entries. For a local TGT, find any match, but check if it's expired. The cache_code field is no longer needed after this change, so get rid of it. ticket: 6948
* Don't use expired TGTs in TGS-REQsNicolas Williams2013-04-261-8/+10
| | | | ticket: 6948
* Add various client-authenticating PKINIT testsNalin Dahyabhai2013-04-246-0/+203
| | | | | | | | | | | | | | Add tests for non-anonymous PKINIT: * FILE: with no password * FILE: with a password * DIR: with no password * DIR: with a password * PKCS12: with no password * PKCS12: with a password * PKCS11: with a password, if soft-pkcs11.so is found via ctypes [ghudson@mit.edu: reformatted to 79 columns; removed intermediate success() calls]
* Add a script for [re]generating test PKI credsNalin Dahyabhai2013-04-241-0/+117
| | | | [ghudson@mit.edu: reformatted to limit lines to 79 columns]
* Include default DIR::file ccache in collectionGreg Hudson2013-04-222-3/+41
| | | | | | | | If the context's default ccache name is a subsidiary file of a directory collection, include that single cache in the cursor walk over the DIR type. ticket: 7172
* Add a few comments to `PADATA types` in krb5.hinZhanna Tsitkov2013-04-181-27/+28
| | | | | Mostly, based on http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml
generated by cgit (git 2.34.1) at 2025-06-18 12:23:46 +0000