authhub-commits March 2011

authhub-commits@lists.fedorahosted.org

1 participants
93 discussions

[AuthHub/krb5-1-8: 81/111] ticket: 6734 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4ba8cb9423ae395ed48d896890e876f1247412d7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 18:41:45 2010 +0000 ticket: 6734 version_fixed: 1.8.2 status: resolved pull up r24102 from trunk ------------------------------------------------------------------------ r24102 | ghudson | 2010-05-24 22:44:45 -0400 (Mon, 24 May 2010) | 11 lines ticket: 6734 subject: FAST negotiation could erroneously succeed target_version: 1.8.2 tags: pullup When FAST negotiation is performed against an older KDC (rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set), krb5int_fast_verify_nego did not set the value of *fast_avail, causing stack garbage to be used in init_creds_step_reply. Initialize *fast_avail at the beginning of the function per coding practices. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24111 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 1ff2d67..e991261 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -572,6 +572,7 @@ krb5int_fast_verify_nego(krb5_context context, krb5_data scratch; krb5_boolean valid; + *fast_avail = FALSE; if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) { pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata, KRB5_ENCPADATA_REQ_ENC_PA_REP);

1 0

[AuthHub/krb5-1-8: 80/111] ticket: 6730 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a3ea5a28ebacb79a9a4e95b5b574a140d8bfc064 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:53 2010 +0000 ticket: 6730 version_fixed: 1.8.2 status: resolved pull up r24074 from trunk ------------------------------------------------------------------------ r24074 | tlyu | 2010-05-20 16:42:26 -0400 (Thu, 20 May 2010) | 11 lines ticket: 6730 subject: kdc_tcp_ports not documented in kdc.conf.M target_version: 1.8.2 tags: pullup The kdc.conf setting kdc_tcp_ports was not documented in kdc.conf.M, though it was documented in doc/admin.texinfo. Copy text from there for now. The setting defaults to an empty string at the moment, causing the KDC to not listen on TCP by default, confusing some users. Changing this behavior is a separate issue. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24077 dc483132-0cff-0310-8789-dd5450dbe970 src/config-files/kdc.conf.M | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) --- diff --git a/src/config-files/kdc.conf.M b/src/config-files/kdc.conf.M index 4d3576d..db7d5a6 100644 --- a/src/config-files/kdc.conf.M +++ b/src/config-files/kdc.conf.M @@ -53,7 +53,17 @@ This relation lists the ports which the Kerberos server should listen on, by default. This list is a comma separated list of integers. If this relation is not specified, the compiled-in default is usually port 88 and port 750. +.IP kdc_tcp_ports +This relation lists the ports on which the Kerberos server should +listen for TCP connections by default. This list is a comma separated +list of integers. +If this relation is not specified, the compiled-in default is not to +listen for TCP connections at all. +If you wish to change this (which we do not recommend, because the +current implementation has little protection against denial-of-service +attacks), the standard port number assigned for Kerberos TCP traffic +is port 88. .IP v4_mode This .B string @@ -201,6 +211,16 @@ as specified in the .I [kdcdefaults] section is used. +.IP kdc_tcp_ports +This +.B string +specifies the list of ports that the KDC is to listen to +for TCP requests for this realm. By default, the value of +.I kdc_tcp_ports +as specified in the +.I [kdcdefaults] +section is used. + .IP master_key_name This .B string

1 0

[AuthHub/krb5-1-8: 79/111] ticket: 6726 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0e6901440b641d196bbb816314fa63b113da6d99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:50 2010 +0000 ticket: 6726 version_fixed: 1.8.2 status: resolved pull up r24075 from trunk ------------------------------------------------------------------------ r24075 | tlyu | 2010-05-20 17:32:47 -0400 (Thu, 20 May 2010) | 8 lines ticket: 6726 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to detect and ignore a duplicate mechanism token sent in the mechListMIC field, such as sent by Windows 2000 Server. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24076 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index cda76d1..6c4ea0a 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3149,6 +3149,18 @@ get_negTokenResp(OM_uint32 *minor_status, *mechListMIC = get_input_token(&ptr, REMAIN); if (*mechListMIC == GSS_C_NO_BUFFER) return GSS_S_DEFECTIVE_TOKEN; + + /* Handle Windows 2000 duplicate response token */ + if (*responseToken && + ((*responseToken)->length == (*mechListMIC)->length) && + !memcmp((*responseToken)->value, (*mechListMIC)->value, + (*responseToken)->length)) { + OM_uint32 tmpmin; + + gss_release_buffer(&tmpmin, *mechListMIC); + free(*mechListMIC); + *mechListMIC = NULL; + } } return GSS_S_COMPLETE; #undef REMAIN

1 0

[AuthHub/krb5-1-8: 78/111] ticket: 6562 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 789fdf3068dbc35cd3a142ef9f02f7f576052f60 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 20:41:16 2010 +0000 ticket: 6562 version_fixed: 1.8.2 status: resolved pull up r24055 from trunk ------------------------------------------------------------------------ r24055 | ghudson | 2010-05-18 13:19:15 -0400 (Tue, 18 May 2010) | 6 lines ticket: 6562 When parsing a KDC or admin server string, allow the name or address to be enclosed in brackets so that IPv6 addresses can be represented. (IPv6 addresses contain colons, which look like port separators.) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24073 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 14 ++++++---- src/lib/kadm5/alt_prof.c | 39 ++++++++++++++++++++++++----- src/lib/krb5/os/locate_kdc.c | 56 +++++++++++++++++------------------------ 3 files changed, 63 insertions(+), 46 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index 1ec4685..fbdc592 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -680,12 +680,14 @@ tags may be specified in the realm's subsection: @table @b @itemx kdc -The name of a host running a KDC for that realm. An optional port -number (separated from the hostname by a colon) may be included. For -your computer to be able to communicate with the KDC for each realm, -this tag must be given a value in each realm subsection in the -configuration file, or there must be DNS SRV records specifying the -KDCs (see @ref{Using DNS}). +The name or address of a host running a KDC for that realm. An optional +port number, separated from the hostname by a colon, may be included. +If the name or address contains colons (for example, if it is an IPv6 +address), enclose it in square brackets to distinguish the colon from a +port separator. For your computer to be able to communicate with the +KDC for each realm, this tag must be given a value in each realm +subsection in the configuration file, or there must be DNS SRV records +specifying the KDCs (see @ref{Using DNS}). @itemx master_kdc Identifies the master KDC(s). Currently, this tag is used in only one diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c index 5b967a0..7d28738 100644 --- a/src/lib/kadm5/alt_prof.c +++ b/src/lib/kadm5/alt_prof.c @@ -482,6 +482,36 @@ get_deltat_param(krb5_deltat *param_out, krb5_deltat param_in, } /* + * Parse out the port number from an admin_server setting. Modify server to + * contain just the hostname or address. If a port is given, set *port, and + * set the appropriate bit in *mask. + */ +static void +parse_admin_server_port(char *server, int *port, long *mask) +{ + char *end, *portstr; + + /* Allow the name or addr to be enclosed in brackets, for IPv6 addrs. */ + if (*server == '[' && (end = strchr(server + 1, ']')) != NULL) { + portstr = (*(end + 1) == ':') ? end + 2 : NULL; + /* Shift the bracketed name or address back into server. */ + memmove(server, server + 1, end - (server + 1)); + *(end - 1) = '\0'; + } else { + /* Terminate the name at the colon, if any. */ + end = server + strcspn(server, ":"); + portstr = (*end == ':') ? end + 1 : NULL; + *end = '\0'; + } + + /* If we found a port string, parse it and set the appropriate bit. */ + if (portstr) { + *port = atoi(portstr); + *mask |= KADM5_CONFIG_KADMIND_PORT; + } +} + +/* * Function: kadm5_get_config_params * * Purpose: Merge configuration parameters provided by the caller with @@ -581,13 +611,8 @@ krb5_error_code kadm5_get_config_params(context, use_kdc_config, NULL); if (params.mask & KADM5_CONFIG_ADMIN_SERVER) { - char *p; - p = strchr(params.admin_server, ':'); - if (p) { - params.kadmind_port = atoi(p+1); - params.mask |= KADM5_CONFIG_KADMIND_PORT; - *p = '\0'; - } + parse_admin_server_port(params.admin_server, &params.kadmind_port, + &params.mask); } /* Get the value for the database */ diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c index 0ecb2d9..d0134c1 100644 --- a/src/lib/krb5/os/locate_kdc.c +++ b/src/lib/krb5/os/locate_kdc.c @@ -374,19 +374,11 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, if (code == 0) { for (i=0; masterlist[i]; i++) { host = masterlist[i]; - - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - cp = strchr(host, ':'); - if (cp) - *cp = 0; + /* Strip off excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + *(cp + 1) = '\0'; + else + *(host + strcspn(host, " \t:")) = '\0'; } } } else { @@ -407,20 +399,13 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, host = hostlist[i]; Tprintf ("entry %d is '%s'\n", i, host); - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - port = strchr(host, ':'); - if (port) { - *port = 0; - port++; - } + /* Find port number, and strip off any excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + cp = cp + 1; + else + cp = host + strcspn(host, " \t:"); + port = (*cp == ':') ? cp + 1 : NULL; + *cp = '\0'; ismaster = 0; if (masterlist) { @@ -454,15 +439,20 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, p2 = sec_udpport; } + /* If the hostname was in brackets, strip those off now. */ + if (*host == '[' && (cp = strchr(host, ']'))) { + host++; + *cp = '\0'; + } + if (socktype != 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - socktype, family); + code = add_host_to_list(addrlist, host, p1, p2, socktype, family); else { - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_DGRAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_DGRAM, + family); if (code == 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_STREAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_STREAM, + family); } if (code) { Tprintf ("error %d (%s) returned from add_host_to_list\n", code,

1 0

[AuthHub/krb5-1-8: 77/111] ticket: 6725 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 3e3c54d3e2d1f98a3959df577c2f6797ee087050 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:54 2010 +0000 ticket: 6725 version_fixed: 1.8.2 status: resolved pull up r24056 from trunk ------------------------------------------------------------------------ r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines ticket: 6725 subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) tags: pullup target_version: 1.8.2 Make krb5_gss_accept_sec_context() check for a null authenticator checksum pointer before attempting to dereference it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24063 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/accept_sec_context.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index ce3075f..6241055 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -607,6 +607,13 @@ kg_accept_krb5(minor_status, context_handle, } #endif + if (authdat->checksum == NULL) { + /* missing checksum counts as "inappropriate type" */ + code = KRB5KRB_AP_ERR_INAPP_CKSUM; + major_status = GSS_S_FAILURE; + goto fail; + } + if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) { /* Samba does not send 0x8003 GSS-API checksums */ krb5_boolean valid;

1 0

[AuthHub/krb5-1-8: 76/111] ticket: 6722 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 07ba1f811fff7147228f2e5e1189c82ba2ed0ca6 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:49 2010 +0000 ticket: 6722 version_fixed: 1.8.2 status: resolved pull up r24020 from trunk ------------------------------------------------------------------------ r24020 | ghudson | 2010-05-13 14:49:20 -0400 (Thu, 13 May 2010) | 8 lines ticket: 6722 subject: Error handling bug in krb5_init_creds_init() tags: pullup target_version: 1.8.2 Fix a bug in krb5_init_creds_init() where a freed context could be returned to the caller in certain error cases. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24062 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index b1b837d..41059af 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1489,14 +1489,15 @@ krb5_init_creds_init(krb5_context context, krb5_princ_type(context, ctx->request->client) = KRB5_NT_WELLKNOWN; } code = restart_init_creds_loop(context, ctx, NULL); + if (code) + goto cleanup; *pctx = ctx; + ctx = NULL; cleanup: - if (code != 0) - krb5_init_creds_free(context, ctx); - if (str != NULL) - free(str); + krb5_init_creds_free(context, ctx); + free(str); return code; }

1 0

[AuthHub/krb5-1-8: 75/111] ticket: 6718 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1bb245e6355bdd21c1db0afdfee446fd031833fe Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:46 2010 +0000 ticket: 6718 version_fixed: 1.8.2 status: resolved pull up r24002 from trunk ------------------------------------------------------------------------ r24002 | ghudson | 2010-05-10 18:23:57 -0400 (Mon, 10 May 2010) | 14 lines ticket: 6718 subject: Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP target_version: 1.8.2 tags: pullup In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine whether krbLoginFailedCount existed on the entry when it was retrieved. If it didn't exist, don't try to use LDAP_MOD_INCREMENT, and don't assert an old value when not using LDAP_MOD_INCREMENT. Also, create the krbLoginFailedCount attribute when creating new entries. This allows us to use LDAP_MOD_INCREMENT during the first failed login (if the server supports it), avoiding a race condition. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24061 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 51 +++++++++++-------- 1 files changed, 29 insertions(+), 22 deletions(-) --- diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index 220602a..7ad31da 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -891,6 +891,16 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, if (st != 0) goto cleanup; } else if (entries->mask & KADM5_FAIL_AUTH_COUNT_INCREMENT) { + int attr_mask = 0; + krb5_boolean has_fail_count; + + /* Check if the krbLoginFailedCount attribute exists. (Through + * krb5 1.8.1, it wasn't set in new entries.) */ + st = krb5_get_attributes_mask(context, entries, &attr_mask); + if (st != 0) + goto cleanup; + has_fail_count = ((attr_mask & KDB_FAIL_AUTH_COUNT_ATTR) != 0); + /* * If the client library and server supports RFC 4525, * then use it to increment by one the value of the @@ -898,38 +908,35 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, * (provided) old value by deleting it before adding. */ #ifdef LDAP_MOD_INCREMENT - if (ldap_server_handle->server_info->modify_increment) { + if (ldap_server_handle->server_info->modify_increment && + has_fail_count) { st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", LDAP_MOD_INCREMENT, 1); if (st != 0) goto cleanup; - } else + } else { #endif /* LDAP_MOD_INCREMENT */ - if (entries->fail_auth_count == 0) { - /* - * Unfortunately we have no way of distinguishing between - * an absent and a zero-valued attribute by the time we are - * called here. So, although this creates a race condition, - * it appears impossible to assert the old value as that - * would fail were the attribute absent. - */ - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_REPLACE, 1); - if (st != 0) - goto cleanup; - } else { - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + if (has_fail_count) { + st = krb5_add_int_mem_ldap_mod(&mods, + "krbLoginFailedCount", LDAP_MOD_DELETE, entries->fail_auth_count); if (st != 0) goto cleanup; - - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_ADD, - entries->fail_auth_count + 1); - if (st != 0) - goto cleanup; } + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, + entries->fail_auth_count + 1); + if (st != 0) + goto cleanup; +#ifdef LDAP_MOD_INCREMENT + } +#endif + } else if (optype == ADD_PRINCIPAL) { + /* Initialize krbLoginFailedCount in new entries to help avoid a + * race during the first failed login. */ + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, 0); } if (entries->mask & KADM5_MAX_LIFE) {

1 0

[AuthHub/krb5-1-8: 74/111] ticket: 6711 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 394bd3cbad6abd1e8ba82f9e6b43acfceb4d0baf Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:43 2010 +0000 ticket: 6711 version_fixed: 1.8.2 status: resolved pull up r23959 from trunk ------------------------------------------------------------------------ r23959 | tlyu | 2010-04-30 17:10:55 -0400 (Fri, 30 Apr 2010) | 8 lines ticket: 6711 subject: memory leak in process_tgs_req in r23724 tags: pullup target_version: 1.8.2 Fix a KDC memory leak that was introduced by r23724 that could leak the decoded request. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24060 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 76ca94a..29546bd 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -144,8 +144,10 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from, retval = decode_krb5_tgs_req(pkt, &request); if (retval) return retval; - if (request->msg_type != KRB5_TGS_REQ) + if (request->msg_type != KRB5_TGS_REQ) { + krb5_free_kdc_req(kdc_context, request); return KRB5_BADMSGTYPE; + } /* * setup_server_realm() sets up the global realm-specific data pointer.

1 0

[AuthHub/krb5-1-8: 73/111] ticket: 6698 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5eb9d5e188e468e516d295e69ae3d4c66980622c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:39 2010 +0000 ticket: 6698 version_fixed: 1.8.2 status: resolved pull up r23928 from trunk ------------------------------------------------------------------------ r23928 | tlyu | 2010-04-22 21:10:20 -0400 (Thu, 22 Apr 2010) | 10 lines ticket: 6698 target_version: 1.8.2 tags: pullup Adapted patch from Jason Rogers. It wasn't complete, so this commit fixes the other instances of the 64-bit problem. Also fix krb5_deltat_to_str(), which would previously always return an empty string. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24059 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/str_conv.c | 10 ---------- src/slave/kproplog.c | 37 ++++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 19 deletions(-) --- diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c index 1f2edcc..6ed6392 100644 --- a/src/lib/krb5/krb/str_conv.c +++ b/src/lib/krb5/krb/str_conv.c @@ -300,7 +300,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) * This will break if bytes are more than 8 bits. */ #define MAX_CHARS_FOR_INT_TYPE(TYPE) ((int) (2 + 2.408241 * sizeof (TYPE))) - char tmpbuf[MAX_CHARS_FOR_INT_TYPE(int) * 4 + 8]; days = (int) (deltat / (24*3600L)); dt = deltat % (24*3600L); @@ -309,7 +308,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) minutes = (int) (dt / 60); seconds = (int) (dt % 60); - memset (tmpbuf, 0, sizeof (tmpbuf)); if (days == 0) snprintf(buffer, buflen, "%d:%02d:%02d", hours, minutes, seconds); else if (hours || minutes || seconds) @@ -319,14 +317,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) else snprintf(buffer, buflen, "%d %s", days, (days > 1) ? "days" : "day"); - if (tmpbuf[sizeof(tmpbuf)-1] != 0) - /* Something must be very wrong with my math above, or the - assumptions going into it... */ - abort (); - if (strlen (tmpbuf) > buflen) - return ENOMEM; - else - strncpy (buffer, tmpbuf, buflen); return 0; } diff --git a/src/slave/kproplog.c b/src/slave/kproplog.c index 0134631..0af30d9 100644 --- a/src/slave/kproplog.c +++ b/src/slave/kproplog.c @@ -74,20 +74,40 @@ print_flags(unsigned int flags) } } +/* ctime() for uint32_t* */ +static char * +ctime_uint32(uint32_t *time32) +{ + time_t tmp; + tmp = *time32; + return ctime(&tmp); +} + /* * Display time information. */ static void -print_time(unsigned int *timep) +print_time(uint32_t *timep) { if (*timep == 0L) printf("\t\t\tNone\n"); else { - time_t ltime = *timep; - printf("\t\t\t%s", ctime(&ltime)); + printf("\t\t\t%s", ctime_uint32(timep)); } } +static void +print_deltat(uint32_t *deltat) +{ + krb5_error_code ret; + static char buf[30]; + ret = krb5_deltat_to_string(*deltat, buf, sizeof(buf)); + if (ret) + printf("\t\t\t(error)\n"); + else + printf("\t\t\t%s\n", buf); +} + /* * Display string in hex primitive. */ @@ -251,13 +271,13 @@ print_attr(kdbe_val_t *val, int vverbose) case AT_MAX_LIFE: (void) printf(_("\t\tMaximum ticket life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_life); + print_deltat(&val->kdbe_val_t_u.av_max_life); } break; case AT_MAX_RENEW_LIFE: (void) printf(_("\t\tMaximum renewable life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_renew_life); + print_deltat(&val->kdbe_val_t_u.av_max_renew_life); } break; case AT_EXP: @@ -447,7 +467,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, unsigned int verbose) (void) printf(_("\tUpdate time stamp : None\n")); else (void) printf(_("\tUpdate time stamp : %s"), - ctime((time_t *)&(indx_log->kdb_time.seconds))); + ctime_uint32(&indx_log->kdb_time.seconds)); (void) printf(_("\tAttributes changed : %d\n"), upd.kdb_update.kdbe_t_len); @@ -581,12 +601,11 @@ main(int argc, char **argv) (void) printf(_("\tFirst time stamp : None\n")); else { (void) printf(_("\tFirst time stamp : %s"), - ctime((time_t *) - &(ulog->kdb_first_time.seconds))); + ctime_uint32(&ulog->kdb_first_time.seconds)); } (void) printf(_("\tLast time stamp : %s\n"), - ctime((time_t *)&(ulog->kdb_last_time.seconds))); + ctime_uint32(&ulog->kdb_last_time.seconds)); } if ((!headeronly) && ulog->kdb_num) {

1 0

[AuthHub/krb5-1-8: 72/111] ticket: 6697 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 2c7245905ba456b2143587b7347e59dbda7ff2d8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:36 2010 +0000 ticket: 6697 version_fixed: 1.8.2 status: resolved pull up r23929 from trunk ------------------------------------------------------------------------ r23929 | tlyu | 2010-04-22 21:30:48 -0400 (Thu, 22 Apr 2010) | 7 lines ticket: 6697 target_version: 1.8.2 tags: pullup Adapted patch from Arlene Berry to handle dlerror() returning a null pointer. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24058 dc483132-0cff-0310-8789-dd5450dbe970 src/util/support/plugins.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c index fa7b36e..4e92254 100644 --- a/src/util/support/plugins.c +++ b/src/util/support/plugins.c @@ -268,6 +268,8 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); if (handle == NULL) { const char *e = dlerror(); + if (e == NULL) + e = "unknown failure"; Tprintf ("dlopen(%s): %s\n", filepath, e); err = ENOENT; /* XXX */ krb5int_set_error (ep, err, "%s", e); @@ -335,6 +337,8 @@ krb5int_get_plugin_sym (struct plugin_file_handle *h, sym = dlsym (h->dlhandle, csymname); if (sym == NULL) { const char *e = dlerror (); /* XXX copy and save away */ + if (e == NULL) + e = "unknown failure"; Tprintf ("dlsym(%s): %s\n", csymname, e); err = ENOENT; /* XXX */ krb5int_set_error(ep, err, "%s", e);

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011