authhub-commits March 2011

authhub-commits@lists.fedorahosted.org

1 participants
93 discussions

[AuthHub/krb5-1-8: 51/111] ticket: 6668 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5d0be00079af34e0442a11c2a1bb19c031a4f9c1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:46 2010 +0000 ticket: 6668 version_fixed: 1.8.1 status: resolved pull up r23749 from trunk ------------------------------------------------------------------------ r23749 | ghudson | 2010-02-24 13:57:08 -0500 (Wed, 24 Feb 2010) | 9 lines ticket: 6668 subject: Two problems in kadm5_get_principal mask handling target_version: 1.8 tags: pullup KADM5_MOD_NAME was being applied to entry->principal instead of entry->mod_name. KADM5_MKVNO was not being applied to entry->mkvno. Patch from Marcus Watts <mdw(a)umich.edu>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23807 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/svr_principal.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index 3cb3b6b..469a8e8 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -858,8 +858,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (! (mask & KADM5_MOD_TIME)) entry->mod_date = 0; if (! (mask & KADM5_MOD_NAME)) { - krb5_free_principal(handle->context, entry->principal); - entry->principal = NULL; + krb5_free_principal(handle->context, entry->mod_name); + entry->mod_name = NULL; } } @@ -871,10 +871,12 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (kdb.key_data[i].key_data_kvno > entry->kvno) entry->kvno = kdb.key_data[i].key_data_kvno; - ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, - &entry->mkvno); - if (ret) - goto done; + if (mask & KADM5_MKVNO) { + ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, + &entry->mkvno); + if (ret) + goto done; + } if (mask & KADM5_MAX_RLIFE) entry->max_renewable_life = kdb.max_renewable_life;

1 0

[AuthHub/krb5-1-8: 50/111] ticket: 6661 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 407a20de4e615b612a53538c7bc78ad6ced498d4 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:40 2010 +0000 ticket: 6661 version_fixed: 1.8.1 status: resolved pull up r23767 from trunk ------------------------------------------------------------------------ r23767 | ghudson | 2010-03-05 14:19:42 -0500 (Fri, 05 Mar 2010) | 7 lines ticket: 6661 target_version: 1.8.1 tags: pullup Add IPv6 support to changepw.c (reverting r21004 since it is no longer necessary). Patch from Submit Bose <sbose(a)redhat.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23806 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/os/changepw.c | 33 ++++++++++++++++++++++++++------- 1 files changed, 26 insertions(+), 7 deletions(-) --- diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c index 46bb828..7cab0d6 100644 --- a/src/lib/krb5/os/changepw.c +++ b/src/lib/krb5/os/changepw.c @@ -65,20 +65,23 @@ locate_kpasswd(krb5_context context, const krb5_data *realm, int sockType = (useTcp ? SOCK_STREAM : SOCK_DGRAM); code = krb5int_locate_server (context, realm, addrlist, - locate_service_kpasswd, sockType, AF_INET); + locate_service_kpasswd, sockType, AF_UNSPEC); if (code == KRB5_REALM_CANT_RESOLVE || code == KRB5_REALM_UNKNOWN) { code = krb5int_locate_server (context, realm, addrlist, locate_service_kadmin, SOCK_STREAM, - AF_INET); + AF_UNSPEC); if (!code) { /* Success with admin_server but now we need to change the port number to use DEFAULT_KPASSWD_PORT and the socktype. */ size_t i; for (i=0; i<addrlist->naddrs; i++) { struct addrinfo *a = addrlist->addrs[i].ai; + krb5_ui_2 kpasswd_port = htons(DEFAULT_KPASSWD_PORT); if (a->ai_family == AF_INET) - sa2sin (a->ai_addr)->sin_port = htons(DEFAULT_KPASSWD_PORT); + sa2sin (a->ai_addr)->sin_port = kpasswd_port; + if (a->ai_family == AF_INET6) + sa2sin6 (a->ai_addr)->sin6_port = kpasswd_port; if (sockType != SOCK_STREAM) a->ai_socktype = sockType; } @@ -131,10 +134,16 @@ kpasswd_sendto_msg_callback(struct conn_state *conn, /* some brain-dead OS's don't return useful information from * the getsockname call. Namely, windows and solaris. */ - if (ss2sin(&local_addr)->sin_addr.s_addr != 0) { + if (local_addr.ss_family == AF_INET && + ss2sin(&local_addr)->sin_addr.s_addr != 0) { local_kaddr.addrtype = ADDRTYPE_INET; local_kaddr.length = sizeof(ss2sin(&local_addr)->sin_addr); local_kaddr.contents = (krb5_octet *) &ss2sin(&local_addr)->sin_addr; + } else if (local_addr.ss_family == AF_INET6 && + ss2sin6(&local_addr)->sin6_addr.s6_addr != 0) { + local_kaddr.addrtype = ADDRTYPE_INET6; + local_kaddr.length = sizeof(ss2sin6(&local_addr)->sin6_addr); + local_kaddr.contents = (krb5_octet *) &ss2sin6(&local_addr)->sin6_addr; } else { krb5_address **addrs; @@ -278,9 +287,19 @@ change_set_password(krb5_context context, break; } - remote_kaddr.addrtype = ADDRTYPE_INET; - remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); - remote_kaddr.contents = (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + if (remote_addr.ss_family == AF_INET) { + remote_kaddr.addrtype = ADDRTYPE_INET; + remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + } else if (remote_addr.ss_family == AF_INET6) { + remote_kaddr.addrtype = ADDRTYPE_INET6; + remote_kaddr.length = sizeof(ss2sin6(&remote_addr)->sin6_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin6(&remote_addr)->sin6_addr; + } else { + break; + } if ((code = krb5_auth_con_setaddrs(callback_ctx.context, callback_ctx.auth_context,

1 0

[AuthHub/krb5-1-8: 49/111] Revert KRB5_CONF_ macro change intended for trunk.
by sbose 15 Mar '11

15 Mar '11

commit aab50b5b7c039979c80ddc7639e4e5687effe0f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 20:33:05 2010 +0000 Revert KRB5_CONF_ macro change intended for trunk. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23797 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++----- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 6 insertions(+), 8 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index fa0fc29..43b780e 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" -#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,7 +206,6 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -228,21 +227,20 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" -#define KRB5_CONF_LOGGING "logging" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index b43a96f..384e7a8 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = KRB5_CONF_LOGGING; + logging_profent[0] = "logging"; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = KRB5_CONF_LOGGING; - logging_defent[1] = KRB5_CONF_DEFAULT; + logging_defent[0] = "logging"; + logging_defent[1] = "default"; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 48/111] Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "loggi
by sbose 15 Mar '11

15 Mar '11

commit a4b7b5f3407f922e66c675efd90c21feab2fcca7 Author: tsitkova <tsitkova@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 15:59:30 2010 +0000 Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "logging" git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23795 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++++--- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index 43b780e..fa0fc29 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" +#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,6 +206,7 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -227,20 +228,21 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" +#define KRB5_CONF_LOGGING "logging" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index 384e7a8..b43a96f 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = "logging"; + logging_profent[0] = KRB5_CONF_LOGGING; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = "logging"; - logging_defent[1] = "default"; + logging_defent[0] = KRB5_CONF_LOGGING; + logging_defent[1] = KRB5_CONF_DEFAULT; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 47/111] krb5-1.8-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 206926d82fc23d4a4036e1e111bd556b4073a63f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:21:06 2010 +0000 krb5-1.8-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23762 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 2a5126f..aadebb9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 46/111] README and patchlevel.h for krb5-1.8 final
by sbose 15 Mar '11

15 Mar '11

commit 0c1ad197fd4a5e4ea06d4d57ddce7dca9e0a84f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:13:43 2010 +0000 README and patchlevel.h for krb5-1.8 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23760 dc483132-0cff-0310-8789-dd5450dbe970 README | 8 +++++++- src/patchlevel.h | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 1135b8f..8063109 100644 --- a/README +++ b/README @@ -74,7 +74,13 @@ krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which now defaults to "false" beginning with krb5-1.8. The krb5-1.8 release includes additional -measures to ease the transition away from single-DES. +measures to ease the transition away from single-DES. These +additional measures include: + +* enctype config enhancements (so you can do "DEFAULT +des", etc.) +* new API to allow applications (e.g. AFS) to explicitly reenable weak + crypto +* easier kadmin history key changes Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index c151756..2a5126f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-final"

1 0

[AuthHub/krb5-1-8: 45/111] krb5-1.8-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit e75e264f1b2bc9271256904533a31aa53c8edc03 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:29 2010 +0000 krb5-1.8-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23755 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 1dd918e..c151756 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 44/111] README and patchlevel.h for krb5-1.8-beta2
by sbose 15 Mar '11

15 Mar '11

commit b34189eb4d7899db3a17b402e09636ad135d2cf3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:22 2010 +0000 README and patchlevel.h for krb5-1.8-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23754 dc483132-0cff-0310-8789-dd5450dbe970 README | 15 +++++++++++++-- src/patchlevel.h | 4 ++-- 2 files changed, 15 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 26e516b..1135b8f 100644 --- a/README +++ b/README @@ -64,6 +64,11 @@ and logging in as "guest" with password "guest". DES transition -------------- +The krb5-1.8 release disables single-DES cryptosystems by default. As +a result, you may need to add the libdefaults setting +"allow_weak_crypto = true" to communicate with existing Kerberos +infrastructures if they do not support stronger ciphers. + The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration @@ -192,6 +197,7 @@ krb5-1.8 changes by ticket ID 6599 memory leak in krb5_rd_req_decrypt_tkt_part 6600 gss_inquire_context cannot handle no target name from mechanism 6601 gsssspi_set_cred_option cannot handle mech specific option +6603 issues with SPNEGO 6605 PKINIT client should validate SAN for TGS, not service principal 6606 allow testing when offline 6607 anonymous PKINIT @@ -202,7 +208,8 @@ krb5-1.8 changes by ticket ID 6622 kinit_fast fails if weak enctype is among client principal keys 6623 Always treat anonymous as preauth required 6624 automated tests for anonymous pkinit -6625 yarrow code does not initialize keyblock enctype and uses unitialized value +6625 yarrow code does not initialize keyblock enctype and uses + unitialized value 6626 Restore interoperability with 1.6 addprinc -randkey 6627 Set enctype in crypto_tests to prevent memory leaks 6628 krb5int_dk_string_to_key fails to set enctype @@ -217,7 +224,8 @@ krb5-1.8 changes by ticket ID 6645 Add krb5_allow_weak_crypto API 6648 define MIN() in lib/gssapi/krb5/prf.c 6649 Get rid of kdb_ext.h and allow out-of-tree KDB plugins -6651 Handle migration from pre-1.7 databases with master key kvno != 1 (1.8 pullup) +6651 Handle migration from pre-1.7 databases with master key + kvno != 1 (1.8 pullup) 6652 Make decryption of master key list more robust 6653 set_default_enctype_var should filter not reject weak enctypes 6654 Fix greet_server build @@ -225,9 +233,12 @@ krb5-1.8 changes by ticket ID 6656 krb5int_fast_free_state segfaults if state is null 6657 enc_padata can include empty sequence 6658 Implement gss_set_neg_mechs +6659 Additional memory leaks in kdc 6660 Minimal support for updating history key 6662 MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service 6663 update mkrel to deal with changed source layout +6665 Fix cipher state chaining in OpenSSL back end +6669 doc updates for allow_weak_crypto Acknowledgements ---------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index 7b8dc9f..1dd918e 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-beta2"

1 0

[AuthHub/krb5-1-8: 43/111] ticket: 6669 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1f1506d37300ac8ed3100641702135355e929fe1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 20:14:21 2010 +0000 ticket: 6669 version_fixed: 1.8 status: resolved pull up r23750 from trunk ------------------------------------------------------------------------ r23750 | tlyu | 2010-02-25 15:09:45 -0500 (Thu, 25 Feb 2010) | 7 lines ticket: 6669 target_version: 1.8 tags: pullup subject: doc updates for allow_weak_crypto Update documentation to be more helpful about allow_weak_crypto. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23751 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 7 +++++-- src/config-files/krb5.conf.M | 8 ++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index b7c87ac..5e80af3 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -456,8 +456,11 @@ key encryption. The default value for this tag is @itemx allow_weak_crypto If this is set to 0 (for false), then weak encryption types will be filtered out of the previous three lists (as noted in @ref{Supported -Encryption Types}). The default value for this tag is true, but that -default may change in the future. +Encryption Types}). The default value for this tag is false, which +may cause authentication failures in existing Kerberos infrastructures +that do not support strong crypto. Users in affected environments +should set this tag to true until their infrastructure adopts stronger +ciphers. @itemx clockskew Sets the maximum allowable amount of clockskew in seconds that the diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M index b60836f..9778e81 100644 --- a/src/config-files/krb5.conf.M +++ b/src/config-files/krb5.conf.M @@ -128,6 +128,14 @@ types that should be requested by the client, in the same format. This relation identifies the permitted list of session key encryption types. +.IP allow_weak_crypto +If this is set to 0 (for false), then weak encryption types will be +filtered out of the previous three lists. The default value for this +tag is false, which may cause authentication failures in existing +Kerberos infrastructures that do not support strong crypto. Users in +affected environments should set this tag to true until their +infrastructure adopts stronger ciphers. + .IP clockskew This relation sets the maximum allowable amount of clockskew in seconds that the library will tolerate before assuming that a Kerberos message

1 0

[AuthHub/krb5-1-8: 42/111] ticket: 6603 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0a70aed9791deab5ece6b173f4c116091328f835 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 23 00:25:58 2010 +0000 ticket: 6603 version_fixed: 1.8 status: resolved pull up r23742 from trunk ------------------------------------------------------------------------ r23742 | ghudson | 2010-02-21 23:52:30 -0500 (Sun, 21 Feb 2010) | 24 lines ticket: 6603 target_version: 1.8 tags: pullup Fix two unrelated problems in SPNEGO which don't crop up with the krb5 mechanism. 1. The third call to spnego_init_accept_context uses faulty logic to determine if the exchange is complete, preventing a third mech token from being sent to the acceptor if no MIC exchange is required. Follow the logic used in the second call (in init_ctx_nego), which is correct. 2. If the acceptor selects a mech other than the optimistic mech, it sets sc->mic_reqd to 1 whether or not the selected mech supports MICs (which isn't known until the mech completes). Most code outside of handle_mic checks sc->mic_reqd along with (sc->ctx_flags & GSS_C_INTEG_FLAG), but the code in acc_ctx_call_acc neglected to do so, so it could improperly delegate responsibility for deciding when the negotiation was finished to handle_mic--which never gets called if (sc->ctx_flags & GSS_C_INTEG_FLAG) is false. Fix acc_ctx_call_acc to check sc->ctx_flags so that mechs which don't support integrity protection can complete if they are selected non-optimistically. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23748 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 60fadd5..cb286bc 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -448,8 +448,9 @@ create_spnego_ctx(void) } /* - * Both initiator and acceptor call here to verify and/or create - * mechListMIC, and to consistency-check the MIC state. + * Both initiator and acceptor call here to verify and/or create mechListMIC, + * and to consistency-check the MIC state. handle_mic is invoked only if the + * negotiated mech has completed and supports MICs. */ static OM_uint32 handle_mic(OM_uint32 *minor_status, gss_buffer_t mic_in, @@ -658,18 +659,20 @@ init_ctx_cont(OM_uint32 *minor_status, gss_ctx_id_t *ctx, gss_buffer_t buf, supportedMech, responseToken, mechListMIC, negState, tokflag); - } else if (!sc->mech_complete && - *responseToken == GSS_C_NO_BUFFER) { - /* - * mech not finished and mech token missing - */ + } else if ((!sc->mech_complete && *responseToken == GSS_C_NO_BUFFER) || + (sc->mech_complete && *responseToken != GSS_C_NO_BUFFER)) { + /* Missing or spurious token from acceptor. */ ret = GSS_S_DEFECTIVE_TOKEN; - } else if (sc->mic_reqd && - (sc->ctx_flags & GSS_C_INTEG_FLAG)) { + } else if (!sc->mech_complete || + (sc->mic_reqd && + (sc->ctx_flags & GSS_C_INTEG_FLAG))) { + /* Not obviously done; we may decide we're done later in + * init_ctx_call_init or handle_mic. */ *negState = ACCEPT_INCOMPLETE; *tokflag = CONT_TOKEN_SEND; ret = GSS_S_CONTINUE_NEEDED; } else { + /* mech finished on last pass and no MIC required, so done. */ *negState = ACCEPT_COMPLETE; *tokflag = NO_TOKEN_SEND; ret = GSS_S_COMPLETE; @@ -1535,10 +1538,13 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, if (ret_flags != NULL) *ret_flags = sc->ctx_flags; - if (!sc->mic_reqd) { + if (!sc->mic_reqd || + !(sc->ctx_flags & GSS_C_INTEG_FLAG)) { + /* No MIC exchange required, so we're done. */ *negState = ACCEPT_COMPLETE; ret = GSS_S_COMPLETE; } else { + /* handle_mic will decide if we're done. */ ret = GSS_S_CONTINUE_NEEDED; } } else if (ret != GSS_S_CONTINUE_NEEDED) {

1 0

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011