March 2011 - authhub-commits - Fedora mailing-lists

[AuthHub/krb5-1-8: 91/111] ticket: 6750 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 256fde166deb74b2b40a5afdaa14729624430aa8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:48 2010 +0000 ticket: 6750 version_fixed: 1.8.3 status: resolved pull up r24176 from trunk ------------------------------------------------------------------------ r24176 | ghudson | 2010-07-07 16:52:06 -0400 (Wed, 07 Jul 2010) | 7 lines ticket: 6750 target_version: 1.8.3 tags: pullup Add a missing break in the parsing of krb5kdc's -P option. Reported by nalin(a)redhat.com. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24197 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/main.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/main.c b/src/kdc/main.c index 9d8022a..c739964 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -728,6 +728,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv) break; case 'P': pid_file = optarg; + break; case 'p': if (default_udp_ports) free(default_udp_ports);

1 0

[AuthHub/krb5-1-8: 90/111] ticket: 6745 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit c49301ae36e35d5ebf07798a82a805b982403144 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:44 2010 +0000 ticket: 6745 version_fixed: 1.8.3 status: resolved pull up r24139 from trunk ------------------------------------------------------------------------ r24139 | ghudson | 2010-06-21 11:18:37 -0400 (Mon, 21 Jun 2010) | 12 lines ticket: 6745 subject: Add correct error table when initializing gss-krb5 target_version: 1.8.3 tags: pullup gss_krb5int_lib_init was adding the generic GSS error table (again) instead of the krb5 error table, which could lead to crashes on library unload. This bug was introduced in krb5 1.7; the fix is also applicable there. Patch from Leonardo Chiquitto <leonardo.lists(a)gmail.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24196 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/gssapi_krb5.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c index 9e5ba76..0420085 100644 --- a/src/lib/gssapi/krb5/gssapi_krb5.c +++ b/src/lib/gssapi/krb5/gssapi_krb5.c @@ -740,7 +740,7 @@ int gss_krb5int_lib_init(void) printf("gss_krb5int_lib_init\n"); #endif - add_error_table(&et_ggss_error_table); + add_error_table(&et_k5g_error_table); #ifndef LEAN_CLIENT err = k5_mutex_finish_init(&gssint_krb5_keytab_lock);

1 0

[AuthHub/krb5-1-8: 89/111] ticket: 6744 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1898f9f52ae2c6897b9f6f61205aa9b5d9e0520e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:41 2010 +0000 ticket: 6744 version_fixed: 1.8.3 status: resolved pull up r24138 from trunk ------------------------------------------------------------------------ r24138 | tlyu | 2010-06-18 15:41:48 -0400 (Fri, 18 Jun 2010) | 13 lines ticket: 6744 subject: only test t_locate_kdc if known-good DNS name is present target_version: 1.8.3 tags: pullup Running "make check" while offline or on a firewalled network may result in failure in lib/krb5/os because the invocation of t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be reachable. Autodetect DNS utilities "dig" and "nslookup", and use them to check for existence of the known-good DNS name. Also parameterize the test so that the known-good DNS name can be overridden on the make command line. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24195 dc483132-0cff-0310-8789-dd5450dbe970 src/configure.in | 5 +++++ src/lib/krb5/os/Makefile.in | 26 ++++++++++++++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) --- diff --git a/src/configure.in b/src/configure.in index d4647cb..e353065 100644 --- a/src/configure.in +++ b/src/configure.in @@ -662,6 +662,11 @@ int main () { AC_MSG_RESULT($ac_cv_printf_positional) +# for t_locate_kdc test + +AC_PATH_PROG(DIG, dig, false) +AC_PATH_PROG(NSLOOKUP, nslookup, false) + # for kadmin AC_PROG_YACC diff --git a/src/lib/krb5/os/Makefile.in b/src/lib/krb5/os/Makefile.in index 6a1ffd1..4da3ebf 100644 --- a/src/lib/krb5/os/Makefile.in +++ b/src/lib/krb5/os/Makefile.in @@ -189,7 +189,9 @@ lclint-localaddr: localaddr.c $(LCLINT) $(LCLINTOPTS) $(CPPFLAGS) $(LOCALINCLUDES) $(DEFS) \ -DTEST $(srcdir)/localaddr.c -check-unix:: $(TEST_PROGS) +check-unix:: check-unix-stdconf check-unix-locate check-unix-antoln + +check-unix-stdconf:: t_std_conf KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ $(KRB5_RUN_ENV) $(VALGRIND) ./t_std_conf -d -s NEW.DEFAULT.REALM -d \ -k IGGY.ORG -k DEFAULT_REALM.TST \ @@ -198,17 +200,29 @@ check-unix:: $(TEST_PROGS) -r pgp.good.idea -r no_domain > test.out cmp test.out $(srcdir)/ref_std_conf.out $(RM) test.out - KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ - if test "$(OFFLINE)" != yes; then \ - $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc ATHENA.MIT.EDU; \ + +# The following can be overriden on the make command line if needed: +LOCREALM = ATHENA.MIT.EDU +SRVNAME = _kerberos._udp.athena.mit.edu. +DIGPAT = '^_kerberos.*srv' +NSPAT = '^_kerberos.*service' +DIG = @DIG@ +NSLOOKUP = @NSLOOKUP@ + +check-unix-locate:: t_locate_kdc + if [ "$(OFFLINE)" = no ] && \ + $(DIG) $(SRVNAME) srv | grep -i $(DIGPAT) || \ + $(NSLOOKUP) -q=srv $(SRVNAME) | grep -i $(NSPAT); then \ + KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ + $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc $(LOCREALM); \ else \ - echo SKIPPING t_locate_kdc TEST WHILE OFFLINE; \ + echo '*** WARNING: skipped t_locate_kdc test: known DNS name not found'; \ fi # # Do some aname-to-lname testing. # -check-unix:: +check-unix-antoln:: t_an_to_ln echo '[libdefaults]' > ./t_an.conf echo ' default_realm = r' >> ./t_an.conf echo '[realms]' >> ./t_an.conf

1 0

[AuthHub/krb5-1-8: 88/111] ticket: 6738 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 80833cb9e6d3f6a1d61b168af91c26c5f7a07178 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:35 2010 +0000 ticket: 6738 version_fixed: 1.8.3 status: resolved pull up r24137 from trunk ------------------------------------------------------------------------ r24137 | ghudson | 2010-06-14 16:46:27 -0400 (Mon, 14 Jun 2010) | 7 lines ticket: 6738 target_version: 1.8.3 tags: pullup In PKINIT, notice if DH_compute_key() returns a value less than the buffer size, and pad it on the left if so. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24194 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) --- diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index d000466..af09d69 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -2092,6 +2092,22 @@ cleanup: return retval; } +/* Call DH_compute_key() and ensure that we left-pad short results instead of + * leaving junk bytes at the end of the buffer. */ +static void +compute_dh(unsigned char *buf, int size, BIGNUM *server_pub_key, DH *dh) +{ + int len, pad; + + len = DH_compute_key(buf, server_pub_key, dh); + assert(len >= 0 && len <= size); + if (len < size) { + pad = size - len; + memmove(buf + pad, buf, len); + memset(buf, 0, pad); + } +} + krb5_error_code client_create_dh(krb5_context context, pkinit_plg_crypto_context plg_cryptoctx, @@ -2243,7 +2259,7 @@ client_process_dh(krb5_context context, if ((server_pub_key = ASN1_INTEGER_to_BN(pub_key, NULL)) == NULL) goto cleanup; - DH_compute_key(*client_key, server_pub_key, cryptoctx->dh); + compute_dh(*client_key, *client_key_len, server_pub_key, cryptoctx->dh); #ifdef DEBUG_DH print_pubkey(server_pub_key, "server's pub_key="); pkiDebug("client secret key (%d)= ", *client_key_len); @@ -2378,7 +2394,7 @@ server_process_dh(krb5_context context, *server_key_len = DH_size(dh_server); if ((*server_key = malloc(*server_key_len)) == NULL) goto cleanup; - DH_compute_key(*server_key, dh->pub_key, dh_server); + compute_dh(*server_key, *server_key_len, dh->pub_key, dh_server); #ifdef DEBUG_DH print_dh(dh_server, "client&server's DH params\n");

1 0

[AuthHub/krb5-1-8: 87/111] ticket: 6740 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 6cf770c1f98e5747e187481fe504ff7f29b32591 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:34 2010 +0000 ticket: 6740 version_fixed: 1.8.3 status: resolved pull up r24123 from trunk ------------------------------------------------------------------------ r24123 | ghudson | 2010-06-08 14:18:03 -0400 (Tue, 08 Jun 2010) | 11 lines ticket: 6740 subject: kadmin ktadd may display wrong name of default keytab target_version: 1.8.2 tags: pullup kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever it uses the default keytab, even if the default has been overridden (e.g. by KRB5_KTNAME). Use krb5_kt_get_name to get the correct name of the default cache instead of displaying the string we think was used to open it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24131 dc483132-0cff-0310-8789-dd5450dbe970 src/kadmin/cli/kadmin.h | 1 - src/kadmin/cli/keytab.c | 10 +++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) --- diff --git a/src/kadmin/cli/kadmin.h b/src/kadmin/cli/kadmin.h index 5c9decc..9f657a6 100644 --- a/src/kadmin/cli/kadmin.h +++ b/src/kadmin/cli/kadmin.h @@ -68,7 +68,6 @@ extern time_t get_date(char *); /* Yucky global variables */ extern krb5_context context; -extern char *krb5_defkeyname; extern char *whoami; extern void *handle; diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c index 8d14f86..1f81032 100644 --- a/src/kadmin/cli/keytab.c +++ b/src/kadmin/cli/keytab.c @@ -84,9 +84,7 @@ process_keytab(krb5_context my_context, char **keytab_str, char *name = *keytab_str; if (name == NULL) { - /* XXX krb5_defkeyname is an internal library global and - should go away */ - name = strdup(krb5_defkeyname); + name = malloc(BUFSIZ); if (!name) { com_err(whoami, ENOMEM, "while creating keytab name"); return 1; @@ -97,6 +95,12 @@ process_keytab(krb5_context my_context, char **keytab_str, free(name); return 1; } + code = krb5_kt_get_name(my_context, *keytab, name, BUFSIZ); + if (code != 0) { + com_err(whoami, code, "while getting keytab name"); + free(name); + return 1; + } } else { if (strchr(name, ':') != NULL) name = strdup(name);

1 0

[AuthHub/krb5-1-8: 86/111] ticket: 6739 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 67952a359d7008eedfa7d488886048460732c853 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:26 2010 +0000 ticket: 6739 version_fixed: 1.8.3 status: resolved pull up r24120, r24121 from trunk ------------------------------------------------------------------------ r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines ticket: 6739 target_version: 1.8.2 tags: pullup Stop checking the current time against the context expiration time in the message wrap/unwrap functions in the krb5 GSS mech. Heimdal doesn't do it, and it generally results in poor app behavior when a ticket expires. In exchange, it doesn't provide much security benefit since it's not enforced across the board--for example, ssh sessions can persist beyond ticket expiration time since they don't use GSS to wrap payload data. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24130 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/k5seal.c | 9 +-------- src/lib/gssapi/krb5/k5sealiov.c | 12 ++---------- src/lib/gssapi/krb5/k5unseal.c | 11 ----------- src/lib/gssapi/krb5/k5unsealiov.c | 14 -------------- 4 files changed, 3 insertions(+), 43 deletions(-) --- diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c index 51faaaa..18c83df 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c @@ -328,7 +328,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; output_message_buffer->length = 0; @@ -359,12 +358,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, } context = ctx->k5_context; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - save_error_info(*minor_status, context); - return(GSS_S_FAILURE); - } - switch (ctx->proto) { case 0: @@ -396,5 +389,5 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, *conf_state = conf_req_flag; *minor_status = 0; - return((ctx->krb_times.endtime < now)?GSS_S_CONTEXT_EXPIRED:GSS_S_COMPLETE); + return(GSS_S_COMPLETE); } diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c index 9ff823e..c15e4e7 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c @@ -279,7 +279,6 @@ kg_seal_iov(OM_uint32 *minor_status, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; if (qop_req != 0) { @@ -298,19 +297,12 @@ kg_seal_iov(OM_uint32 *minor_status, return GSS_S_NO_CONTEXT; } - context = ctx->k5_context; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - save_error_info(*minor_status, context); - return GSS_S_FAILURE; - } - if (conf_req_flag && kg_integ_only_iov(iov, iov_count)) { /* may be more sensible to return an error here */ conf_req_flag = FALSE; } + context = ctx->k5_context; switch (ctx->proto) { case 0: code = make_seal_token_v1_iov(context, ctx, conf_req_flag, @@ -333,7 +325,7 @@ kg_seal_iov(OM_uint32 *minor_status, *minor_status = 0; - return (ctx->krb_times.endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; + return GSS_S_COMPLETE; } #define INIT_IOV_DATA(_iov) do { (_iov)->buffer.value = NULL; \ diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c index b56cd2d..5fa52fe 100644 --- a/src/lib/gssapi/krb5/k5unseal.c +++ b/src/lib/gssapi/krb5/k5unseal.c @@ -79,7 +79,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, krb5_checksum md5cksum; krb5_data plaind; char *data_ptr; - krb5_timestamp now; unsigned char *plain; unsigned int cksum_len = 0; size_t plainlen; @@ -441,16 +440,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, if (qop_state) *qop_state = GSS_C_QOP_DEFAULT; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - return(GSS_S_FAILURE); - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - return(GSS_S_CONTEXT_EXPIRED); - } - /* do sequencing checks */ if ((ctx->initiate && direction != 0xff) || diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c index a489f0d..2be7b82 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -52,7 +52,6 @@ kg_unseal_v1_iov(krb5_context context, int signalg; krb5_checksum cksum; krb5_checksum md5cksum; - krb5_timestamp now; size_t cksum_len = 0; size_t conflen = 0; int direction; @@ -280,19 +279,6 @@ kg_unseal_v1_iov(krb5_context context, if (qop_state != NULL) *qop_state = GSS_C_QOP_DEFAULT; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - retval = GSS_S_FAILURE; - goto cleanup; - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - retval = GSS_S_CONTEXT_EXPIRED; - goto cleanup; - } - if ((ctx->initiate && direction != 0xff) || (!ctx->initiate && direction != 0)) { *minor_status = (OM_uint32)G_BAD_DIRECTION;

1 0

[AuthHub/krb5-1-8: 85/111] krb5-1.8.2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 7b6f4e1a0e819ed80c3e474a67f9371baa7ed1c0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:29:35 2010 +0000 krb5-1.8.2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24129 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index e8a08c0..72e202b 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 84/111] README and patchlevel for krb5-1.8.2
by sbose 15 Mar '11

15 Mar '11

commit 482967a673cede9d0140d8b5ead78a2e6397bdcb Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:14:11 2010 +0000 README and patchlevel for krb5-1.8.2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24127 dc483132-0cff-0310-8789-dd5450dbe970 README | 2 ++ src/patchlevel.h | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) --- diff --git a/README b/README index fddc00b..9310c2d 100644 --- a/README +++ b/README @@ -324,6 +324,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: Microsoft The National Aeronautics and Space Administration of the United States of America (NASA) + Network Appliance (NetApp) Nippon Telephone and Telegraph (NTT) Oracle Pennsylvania State University @@ -332,6 +333,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: TeamF1, Inc. The University of Alaska The University of Michigan + The University of Pennsylvania Past and present members of the Kerberos Team at MIT: diff --git a/src/patchlevel.h b/src/patchlevel.h index f84a0c9..e8a08c0 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-final"

1 0

[AuthHub/krb5-1-8: 83/111] krb5-1.8.2-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 590e098f27a61cabc3b9ebd41dee5d15100bc6b3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 23:00:02 2010 +0000 krb5-1.8.2-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24114 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 44bc2d3..f84a0c9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 82/111] README and patchlevel.h for krb5-1.8.2-beta1
by sbose 15 Mar '11

15 Mar '11

commit d4bf438c50dd6c659f8cfea343e3893a58c6e9a9 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 22:55:45 2010 +0000 README and patchlevel.h for krb5-1.8.2-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24112 dc483132-0cff-0310-8789-dd5450dbe970 README | 34 +++++++++++++++++++++++++++++++++- src/patchlevel.h | 6 +++--- 2 files changed, 36 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 924710c..fddc00b 100644 --- a/README +++ b/README @@ -82,6 +82,35 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.2 +---------------------- + +This is primarily a bugfix release. + +* Fix vulnerabilities: + ** CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) + ** CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) + +* Allow numeric IPv6 addresses for configuring KDC locations. + +krb5-1.8.2 changes by ticket ID +------------------------------- + +6562 kinit not working if kdc is configured with numerical IPv6 address +6696 gss_accept_sec_context doesn't produce error tokens +6697 segfault caused by dlerror returning NULL +6698 kproplog displays incorrect iprop timestamps on 64-bit platforms +6702 CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) +6711 memory leak in process_tgs_req in r23724 +6718 Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP +6722 Error handling bug in krb5_init_creds_init() +6725 CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) +6726 SPNEGO doesn't interoperate with Windows 2000 +6730 kdc_tcp_ports not documented in kdc.conf.M +6734 FAST negotiation could erroneously succeed + Major changes in 1.8.1 ---------------------- @@ -362,6 +391,7 @@ reports, suggestions, and valuable resources: Brandon Allbery Russell Allbery + Brian Almeida Michael B Allen Derek Atkins David Bantz @@ -405,6 +435,7 @@ reports, suggestions, and valuable resources: Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg + Joel Johnson Mikkel Kruse Volker Lendecke Jan iankko Lieskovsky @@ -420,9 +451,9 @@ reports, suggestions, and valuable resources: Ezra Peisach W. Michael Petullo Mark Phalan - Xu Qiang Robert Relyea Martin Rex + Jason Rogers Guillaume Rousse Tom Shaw Peter Shoults @@ -437,6 +468,7 @@ reports, suggestions, and valuable resources: Simon Wilkinson Nicolas Williams Ross Wilper + Xu Qiang Hanz van Zijst The above is not an exhaustive list; many others have contributed in diff --git a/src/patchlevel.h b/src/patchlevel.h index 904d40a..44bc2d3 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 2 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-beta1"

1 0

[AuthHub/krb5-1-8: 81/111] ticket: 6734 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4ba8cb9423ae395ed48d896890e876f1247412d7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 18:41:45 2010 +0000 ticket: 6734 version_fixed: 1.8.2 status: resolved pull up r24102 from trunk ------------------------------------------------------------------------ r24102 | ghudson | 2010-05-24 22:44:45 -0400 (Mon, 24 May 2010) | 11 lines ticket: 6734 subject: FAST negotiation could erroneously succeed target_version: 1.8.2 tags: pullup When FAST negotiation is performed against an older KDC (rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set), krb5int_fast_verify_nego did not set the value of *fast_avail, causing stack garbage to be used in init_creds_step_reply. Initialize *fast_avail at the beginning of the function per coding practices. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24111 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 1ff2d67..e991261 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -572,6 +572,7 @@ krb5int_fast_verify_nego(krb5_context context, krb5_data scratch; krb5_boolean valid; + *fast_avail = FALSE; if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) { pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata, KRB5_ENCPADATA_REQ_ENC_PA_REP);

1 0

[AuthHub/krb5-1-8: 80/111] ticket: 6730 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a3ea5a28ebacb79a9a4e95b5b574a140d8bfc064 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:53 2010 +0000 ticket: 6730 version_fixed: 1.8.2 status: resolved pull up r24074 from trunk ------------------------------------------------------------------------ r24074 | tlyu | 2010-05-20 16:42:26 -0400 (Thu, 20 May 2010) | 11 lines ticket: 6730 subject: kdc_tcp_ports not documented in kdc.conf.M target_version: 1.8.2 tags: pullup The kdc.conf setting kdc_tcp_ports was not documented in kdc.conf.M, though it was documented in doc/admin.texinfo. Copy text from there for now. The setting defaults to an empty string at the moment, causing the KDC to not listen on TCP by default, confusing some users. Changing this behavior is a separate issue. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24077 dc483132-0cff-0310-8789-dd5450dbe970 src/config-files/kdc.conf.M | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) --- diff --git a/src/config-files/kdc.conf.M b/src/config-files/kdc.conf.M index 4d3576d..db7d5a6 100644 --- a/src/config-files/kdc.conf.M +++ b/src/config-files/kdc.conf.M @@ -53,7 +53,17 @@ This relation lists the ports which the Kerberos server should listen on, by default. This list is a comma separated list of integers. If this relation is not specified, the compiled-in default is usually port 88 and port 750. +.IP kdc_tcp_ports +This relation lists the ports on which the Kerberos server should +listen for TCP connections by default. This list is a comma separated +list of integers. +If this relation is not specified, the compiled-in default is not to +listen for TCP connections at all. +If you wish to change this (which we do not recommend, because the +current implementation has little protection against denial-of-service +attacks), the standard port number assigned for Kerberos TCP traffic +is port 88. .IP v4_mode This .B string @@ -201,6 +211,16 @@ as specified in the .I [kdcdefaults] section is used. +.IP kdc_tcp_ports +This +.B string +specifies the list of ports that the KDC is to listen to +for TCP requests for this realm. By default, the value of +.I kdc_tcp_ports +as specified in the +.I [kdcdefaults] +section is used. + .IP master_key_name This .B string

1 0

[AuthHub/krb5-1-8: 79/111] ticket: 6726 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0e6901440b641d196bbb816314fa63b113da6d99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:50 2010 +0000 ticket: 6726 version_fixed: 1.8.2 status: resolved pull up r24075 from trunk ------------------------------------------------------------------------ r24075 | tlyu | 2010-05-20 17:32:47 -0400 (Thu, 20 May 2010) | 8 lines ticket: 6726 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to detect and ignore a duplicate mechanism token sent in the mechListMIC field, such as sent by Windows 2000 Server. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24076 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index cda76d1..6c4ea0a 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3149,6 +3149,18 @@ get_negTokenResp(OM_uint32 *minor_status, *mechListMIC = get_input_token(&ptr, REMAIN); if (*mechListMIC == GSS_C_NO_BUFFER) return GSS_S_DEFECTIVE_TOKEN; + + /* Handle Windows 2000 duplicate response token */ + if (*responseToken && + ((*responseToken)->length == (*mechListMIC)->length) && + !memcmp((*responseToken)->value, (*mechListMIC)->value, + (*responseToken)->length)) { + OM_uint32 tmpmin; + + gss_release_buffer(&tmpmin, *mechListMIC); + free(*mechListMIC); + *mechListMIC = NULL; + } } return GSS_S_COMPLETE; #undef REMAIN

1 0

[AuthHub/krb5-1-8: 78/111] ticket: 6562 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 789fdf3068dbc35cd3a142ef9f02f7f576052f60 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 20:41:16 2010 +0000 ticket: 6562 version_fixed: 1.8.2 status: resolved pull up r24055 from trunk ------------------------------------------------------------------------ r24055 | ghudson | 2010-05-18 13:19:15 -0400 (Tue, 18 May 2010) | 6 lines ticket: 6562 When parsing a KDC or admin server string, allow the name or address to be enclosed in brackets so that IPv6 addresses can be represented. (IPv6 addresses contain colons, which look like port separators.) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24073 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 14 ++++++---- src/lib/kadm5/alt_prof.c | 39 ++++++++++++++++++++++++----- src/lib/krb5/os/locate_kdc.c | 56 +++++++++++++++++------------------------ 3 files changed, 63 insertions(+), 46 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index 1ec4685..fbdc592 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -680,12 +680,14 @@ tags may be specified in the realm's subsection: @table @b @itemx kdc -The name of a host running a KDC for that realm. An optional port -number (separated from the hostname by a colon) may be included. For -your computer to be able to communicate with the KDC for each realm, -this tag must be given a value in each realm subsection in the -configuration file, or there must be DNS SRV records specifying the -KDCs (see @ref{Using DNS}). +The name or address of a host running a KDC for that realm. An optional +port number, separated from the hostname by a colon, may be included. +If the name or address contains colons (for example, if it is an IPv6 +address), enclose it in square brackets to distinguish the colon from a +port separator. For your computer to be able to communicate with the +KDC for each realm, this tag must be given a value in each realm +subsection in the configuration file, or there must be DNS SRV records +specifying the KDCs (see @ref{Using DNS}). @itemx master_kdc Identifies the master KDC(s). Currently, this tag is used in only one diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c index 5b967a0..7d28738 100644 --- a/src/lib/kadm5/alt_prof.c +++ b/src/lib/kadm5/alt_prof.c @@ -482,6 +482,36 @@ get_deltat_param(krb5_deltat *param_out, krb5_deltat param_in, } /* + * Parse out the port number from an admin_server setting. Modify server to + * contain just the hostname or address. If a port is given, set *port, and + * set the appropriate bit in *mask. + */ +static void +parse_admin_server_port(char *server, int *port, long *mask) +{ + char *end, *portstr; + + /* Allow the name or addr to be enclosed in brackets, for IPv6 addrs. */ + if (*server == '[' && (end = strchr(server + 1, ']')) != NULL) { + portstr = (*(end + 1) == ':') ? end + 2 : NULL; + /* Shift the bracketed name or address back into server. */ + memmove(server, server + 1, end - (server + 1)); + *(end - 1) = '\0'; + } else { + /* Terminate the name at the colon, if any. */ + end = server + strcspn(server, ":"); + portstr = (*end == ':') ? end + 1 : NULL; + *end = '\0'; + } + + /* If we found a port string, parse it and set the appropriate bit. */ + if (portstr) { + *port = atoi(portstr); + *mask |= KADM5_CONFIG_KADMIND_PORT; + } +} + +/* * Function: kadm5_get_config_params * * Purpose: Merge configuration parameters provided by the caller with @@ -581,13 +611,8 @@ krb5_error_code kadm5_get_config_params(context, use_kdc_config, NULL); if (params.mask & KADM5_CONFIG_ADMIN_SERVER) { - char *p; - p = strchr(params.admin_server, ':'); - if (p) { - params.kadmind_port = atoi(p+1); - params.mask |= KADM5_CONFIG_KADMIND_PORT; - *p = '\0'; - } + parse_admin_server_port(params.admin_server, &params.kadmind_port, + &params.mask); } /* Get the value for the database */ diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c index 0ecb2d9..d0134c1 100644 --- a/src/lib/krb5/os/locate_kdc.c +++ b/src/lib/krb5/os/locate_kdc.c @@ -374,19 +374,11 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, if (code == 0) { for (i=0; masterlist[i]; i++) { host = masterlist[i]; - - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - cp = strchr(host, ':'); - if (cp) - *cp = 0; + /* Strip off excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + *(cp + 1) = '\0'; + else + *(host + strcspn(host, " \t:")) = '\0'; } } } else { @@ -407,20 +399,13 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, host = hostlist[i]; Tprintf ("entry %d is '%s'\n", i, host); - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - port = strchr(host, ':'); - if (port) { - *port = 0; - port++; - } + /* Find port number, and strip off any excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + cp = cp + 1; + else + cp = host + strcspn(host, " \t:"); + port = (*cp == ':') ? cp + 1 : NULL; + *cp = '\0'; ismaster = 0; if (masterlist) { @@ -454,15 +439,20 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, p2 = sec_udpport; } + /* If the hostname was in brackets, strip those off now. */ + if (*host == '[' && (cp = strchr(host, ']'))) { + host++; + *cp = '\0'; + } + if (socktype != 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - socktype, family); + code = add_host_to_list(addrlist, host, p1, p2, socktype, family); else { - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_DGRAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_DGRAM, + family); if (code == 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_STREAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_STREAM, + family); } if (code) { Tprintf ("error %d (%s) returned from add_host_to_list\n", code,

1 0

[AuthHub/krb5-1-8: 77/111] ticket: 6725 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 3e3c54d3e2d1f98a3959df577c2f6797ee087050 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:54 2010 +0000 ticket: 6725 version_fixed: 1.8.2 status: resolved pull up r24056 from trunk ------------------------------------------------------------------------ r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines ticket: 6725 subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) tags: pullup target_version: 1.8.2 Make krb5_gss_accept_sec_context() check for a null authenticator checksum pointer before attempting to dereference it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24063 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/accept_sec_context.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index ce3075f..6241055 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -607,6 +607,13 @@ kg_accept_krb5(minor_status, context_handle, } #endif + if (authdat->checksum == NULL) { + /* missing checksum counts as "inappropriate type" */ + code = KRB5KRB_AP_ERR_INAPP_CKSUM; + major_status = GSS_S_FAILURE; + goto fail; + } + if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) { /* Samba does not send 0x8003 GSS-API checksums */ krb5_boolean valid;

1 0

[AuthHub/krb5-1-8: 76/111] ticket: 6722 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 07ba1f811fff7147228f2e5e1189c82ba2ed0ca6 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:49 2010 +0000 ticket: 6722 version_fixed: 1.8.2 status: resolved pull up r24020 from trunk ------------------------------------------------------------------------ r24020 | ghudson | 2010-05-13 14:49:20 -0400 (Thu, 13 May 2010) | 8 lines ticket: 6722 subject: Error handling bug in krb5_init_creds_init() tags: pullup target_version: 1.8.2 Fix a bug in krb5_init_creds_init() where a freed context could be returned to the caller in certain error cases. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24062 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index b1b837d..41059af 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1489,14 +1489,15 @@ krb5_init_creds_init(krb5_context context, krb5_princ_type(context, ctx->request->client) = KRB5_NT_WELLKNOWN; } code = restart_init_creds_loop(context, ctx, NULL); + if (code) + goto cleanup; *pctx = ctx; + ctx = NULL; cleanup: - if (code != 0) - krb5_init_creds_free(context, ctx); - if (str != NULL) - free(str); + krb5_init_creds_free(context, ctx); + free(str); return code; }

1 0

[AuthHub/krb5-1-8: 75/111] ticket: 6718 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1bb245e6355bdd21c1db0afdfee446fd031833fe Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:46 2010 +0000 ticket: 6718 version_fixed: 1.8.2 status: resolved pull up r24002 from trunk ------------------------------------------------------------------------ r24002 | ghudson | 2010-05-10 18:23:57 -0400 (Mon, 10 May 2010) | 14 lines ticket: 6718 subject: Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP target_version: 1.8.2 tags: pullup In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine whether krbLoginFailedCount existed on the entry when it was retrieved. If it didn't exist, don't try to use LDAP_MOD_INCREMENT, and don't assert an old value when not using LDAP_MOD_INCREMENT. Also, create the krbLoginFailedCount attribute when creating new entries. This allows us to use LDAP_MOD_INCREMENT during the first failed login (if the server supports it), avoiding a race condition. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24061 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 51 +++++++++++-------- 1 files changed, 29 insertions(+), 22 deletions(-) --- diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index 220602a..7ad31da 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -891,6 +891,16 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, if (st != 0) goto cleanup; } else if (entries->mask & KADM5_FAIL_AUTH_COUNT_INCREMENT) { + int attr_mask = 0; + krb5_boolean has_fail_count; + + /* Check if the krbLoginFailedCount attribute exists. (Through + * krb5 1.8.1, it wasn't set in new entries.) */ + st = krb5_get_attributes_mask(context, entries, &attr_mask); + if (st != 0) + goto cleanup; + has_fail_count = ((attr_mask & KDB_FAIL_AUTH_COUNT_ATTR) != 0); + /* * If the client library and server supports RFC 4525, * then use it to increment by one the value of the @@ -898,38 +908,35 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, * (provided) old value by deleting it before adding. */ #ifdef LDAP_MOD_INCREMENT - if (ldap_server_handle->server_info->modify_increment) { + if (ldap_server_handle->server_info->modify_increment && + has_fail_count) { st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", LDAP_MOD_INCREMENT, 1); if (st != 0) goto cleanup; - } else + } else { #endif /* LDAP_MOD_INCREMENT */ - if (entries->fail_auth_count == 0) { - /* - * Unfortunately we have no way of distinguishing between - * an absent and a zero-valued attribute by the time we are - * called here. So, although this creates a race condition, - * it appears impossible to assert the old value as that - * would fail were the attribute absent. - */ - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_REPLACE, 1); - if (st != 0) - goto cleanup; - } else { - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + if (has_fail_count) { + st = krb5_add_int_mem_ldap_mod(&mods, + "krbLoginFailedCount", LDAP_MOD_DELETE, entries->fail_auth_count); if (st != 0) goto cleanup; - - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_ADD, - entries->fail_auth_count + 1); - if (st != 0) - goto cleanup; } + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, + entries->fail_auth_count + 1); + if (st != 0) + goto cleanup; +#ifdef LDAP_MOD_INCREMENT + } +#endif + } else if (optype == ADD_PRINCIPAL) { + /* Initialize krbLoginFailedCount in new entries to help avoid a + * race during the first failed login. */ + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, 0); } if (entries->mask & KADM5_MAX_LIFE) {

1 0

[AuthHub/krb5-1-8: 74/111] ticket: 6711 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 394bd3cbad6abd1e8ba82f9e6b43acfceb4d0baf Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:43 2010 +0000 ticket: 6711 version_fixed: 1.8.2 status: resolved pull up r23959 from trunk ------------------------------------------------------------------------ r23959 | tlyu | 2010-04-30 17:10:55 -0400 (Fri, 30 Apr 2010) | 8 lines ticket: 6711 subject: memory leak in process_tgs_req in r23724 tags: pullup target_version: 1.8.2 Fix a KDC memory leak that was introduced by r23724 that could leak the decoded request. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24060 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 76ca94a..29546bd 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -144,8 +144,10 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from, retval = decode_krb5_tgs_req(pkt, &request); if (retval) return retval; - if (request->msg_type != KRB5_TGS_REQ) + if (request->msg_type != KRB5_TGS_REQ) { + krb5_free_kdc_req(kdc_context, request); return KRB5_BADMSGTYPE; + } /* * setup_server_realm() sets up the global realm-specific data pointer.

1 0

[AuthHub/krb5-1-8: 73/111] ticket: 6698 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5eb9d5e188e468e516d295e69ae3d4c66980622c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:39 2010 +0000 ticket: 6698 version_fixed: 1.8.2 status: resolved pull up r23928 from trunk ------------------------------------------------------------------------ r23928 | tlyu | 2010-04-22 21:10:20 -0400 (Thu, 22 Apr 2010) | 10 lines ticket: 6698 target_version: 1.8.2 tags: pullup Adapted patch from Jason Rogers. It wasn't complete, so this commit fixes the other instances of the 64-bit problem. Also fix krb5_deltat_to_str(), which would previously always return an empty string. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24059 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/str_conv.c | 10 ---------- src/slave/kproplog.c | 37 ++++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 19 deletions(-) --- diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c index 1f2edcc..6ed6392 100644 --- a/src/lib/krb5/krb/str_conv.c +++ b/src/lib/krb5/krb/str_conv.c @@ -300,7 +300,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) * This will break if bytes are more than 8 bits. */ #define MAX_CHARS_FOR_INT_TYPE(TYPE) ((int) (2 + 2.408241 * sizeof (TYPE))) - char tmpbuf[MAX_CHARS_FOR_INT_TYPE(int) * 4 + 8]; days = (int) (deltat / (24*3600L)); dt = deltat % (24*3600L); @@ -309,7 +308,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) minutes = (int) (dt / 60); seconds = (int) (dt % 60); - memset (tmpbuf, 0, sizeof (tmpbuf)); if (days == 0) snprintf(buffer, buflen, "%d:%02d:%02d", hours, minutes, seconds); else if (hours || minutes || seconds) @@ -319,14 +317,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) else snprintf(buffer, buflen, "%d %s", days, (days > 1) ? "days" : "day"); - if (tmpbuf[sizeof(tmpbuf)-1] != 0) - /* Something must be very wrong with my math above, or the - assumptions going into it... */ - abort (); - if (strlen (tmpbuf) > buflen) - return ENOMEM; - else - strncpy (buffer, tmpbuf, buflen); return 0; } diff --git a/src/slave/kproplog.c b/src/slave/kproplog.c index 0134631..0af30d9 100644 --- a/src/slave/kproplog.c +++ b/src/slave/kproplog.c @@ -74,20 +74,40 @@ print_flags(unsigned int flags) } } +/* ctime() for uint32_t* */ +static char * +ctime_uint32(uint32_t *time32) +{ + time_t tmp; + tmp = *time32; + return ctime(&tmp); +} + /* * Display time information. */ static void -print_time(unsigned int *timep) +print_time(uint32_t *timep) { if (*timep == 0L) printf("\t\t\tNone\n"); else { - time_t ltime = *timep; - printf("\t\t\t%s", ctime(&ltime)); + printf("\t\t\t%s", ctime_uint32(timep)); } } +static void +print_deltat(uint32_t *deltat) +{ + krb5_error_code ret; + static char buf[30]; + ret = krb5_deltat_to_string(*deltat, buf, sizeof(buf)); + if (ret) + printf("\t\t\t(error)\n"); + else + printf("\t\t\t%s\n", buf); +} + /* * Display string in hex primitive. */ @@ -251,13 +271,13 @@ print_attr(kdbe_val_t *val, int vverbose) case AT_MAX_LIFE: (void) printf(_("\t\tMaximum ticket life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_life); + print_deltat(&val->kdbe_val_t_u.av_max_life); } break; case AT_MAX_RENEW_LIFE: (void) printf(_("\t\tMaximum renewable life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_renew_life); + print_deltat(&val->kdbe_val_t_u.av_max_renew_life); } break; case AT_EXP: @@ -447,7 +467,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, unsigned int verbose) (void) printf(_("\tUpdate time stamp : None\n")); else (void) printf(_("\tUpdate time stamp : %s"), - ctime((time_t *)&(indx_log->kdb_time.seconds))); + ctime_uint32(&indx_log->kdb_time.seconds)); (void) printf(_("\tAttributes changed : %d\n"), upd.kdb_update.kdbe_t_len); @@ -581,12 +601,11 @@ main(int argc, char **argv) (void) printf(_("\tFirst time stamp : None\n")); else { (void) printf(_("\tFirst time stamp : %s"), - ctime((time_t *) - &(ulog->kdb_first_time.seconds))); + ctime_uint32(&ulog->kdb_first_time.seconds)); } (void) printf(_("\tLast time stamp : %s\n"), - ctime((time_t *)&(ulog->kdb_last_time.seconds))); + ctime_uint32(&ulog->kdb_last_time.seconds)); } if ((!headeronly) && ulog->kdb_num) {

1 0

[AuthHub/krb5-1-8: 72/111] ticket: 6697 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 2c7245905ba456b2143587b7347e59dbda7ff2d8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:36 2010 +0000 ticket: 6697 version_fixed: 1.8.2 status: resolved pull up r23929 from trunk ------------------------------------------------------------------------ r23929 | tlyu | 2010-04-22 21:30:48 -0400 (Thu, 22 Apr 2010) | 7 lines ticket: 6697 target_version: 1.8.2 tags: pullup Adapted patch from Arlene Berry to handle dlerror() returning a null pointer. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24058 dc483132-0cff-0310-8789-dd5450dbe970 src/util/support/plugins.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c index fa7b36e..4e92254 100644 --- a/src/util/support/plugins.c +++ b/src/util/support/plugins.c @@ -268,6 +268,8 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); if (handle == NULL) { const char *e = dlerror(); + if (e == NULL) + e = "unknown failure"; Tprintf ("dlopen(%s): %s\n", filepath, e); err = ENOENT; /* XXX */ krb5int_set_error (ep, err, "%s", e); @@ -335,6 +337,8 @@ krb5int_get_plugin_sym (struct plugin_file_handle *h, sym = dlsym (h->dlhandle, csymname); if (sym == NULL) { const char *e = dlerror (); /* XXX copy and save away */ + if (e == NULL) + e = "unknown failure"; Tprintf ("dlsym(%s): %s\n", csymname, e); err = ENOENT; /* XXX */ krb5int_set_error(ep, err, "%s", e);

1 0

[AuthHub/krb5-1-8: 71/111] ticket: 6696 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e1886905c0a51473493a3a8348ee6075139a02ec Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:32 2010 +0000 ticket: 6696 version_fixed: 1.8.2 status: resolved pull up r23925 from trunk ------------------------------------------------------------------------ r23925 | tlyu | 2010-04-22 16:04:01 -0400 (Thu, 22 Apr 2010) | 8 lines ticket: 6696 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to cease freeing error tokens output by accept_sec_context, allowing them to actually be sent to the initiator. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24057 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/g_accept_sec_context.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c index b4b1525..498bfc4 100644 --- a/src/lib/gssapi/mechglue/g_accept_sec_context.c +++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c @@ -356,9 +356,6 @@ error_out: free(union_ctx_id); } - if (output_token->length) - (void) gss_release_buffer(&temp_minor_status, output_token); - if (src_name) *src_name = GSS_C_NO_NAME;

1 0

[AuthHub/krb5-1-8: 70/111] ticket: 6702 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4c995cb142c4c089e67393865affb523f399cab0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Apr 20 22:37:22 2010 +0000 ticket: 6702 version_fixed: 1.8.2 status: resolved pull up r23912 from trunk ------------------------------------------------------------------------ r23912 | tlyu | 2010-04-20 17:12:10 -0400 (Tue, 20 Apr 2010) | 11 lines ticket: 6702 target_version: 1.8.2 tags: pullup Fix CVE-2010-1230 (MITKRB5-SA-2010-004) double-free in KDC triggered by ticket renewal. Add a test case. See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577490 Thanks to Joel Johnson and Brian Almeida for the reports. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23914 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 2 + src/tests/dejagnu/config/default.exp | 35 +++++++++++++++++++++++ src/tests/dejagnu/krb-standalone/standalone.exp | 4 ++ 3 files changed, 41 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index b2f0655..76ca94a 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -543,6 +543,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; clear(enc_tkt_reply.flags, TKT_FLG_INVALID); } @@ -554,6 +555,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; old_life = enc_tkt_reply.times.endtime - enc_tkt_reply.times.starttime; diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp index 98a9a43..79afd09 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -2226,6 +2226,41 @@ proc kinit { name pass standalone } { return 1 } + +proc kinit_renew { name pass standalone } { + global REALMNAME + global KINIT + global spawn_id + + spawn $KINIT -5 -f $name@$REALMNAME + expect { + "Password for $name@$REALMNAME:" { + verbose "kinit started" + } + timeout { + fail "kinit" + return 0 + } + eof { + fail "kinit" + return 0 + } + } + send "$pass\r" + expect eof + if ![check_exit_status kinit] { + return 0 + } + + spawn $KINIT -R + expect eof + if ![check_exit_status "kinit_renew"] { + return 0 + } + + return 1 +} + # Retrieve a ticket using FAST armor proc kinit_fast { name pass standalone } { global REALMNAME diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp index c511798..dbaf95d 100644 --- a/src/tests/dejagnu/krb-standalone/standalone.exp +++ b/src/tests/dejagnu/krb-standalone/standalone.exp @@ -201,6 +201,10 @@ proc doit { } { return } + if ![kinit_renew krbtest/admin adminpass$KEY 1] { + return + } + # Make sure that klist can see the ticket. if ![do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist"] { return

1 0

[AuthHub/krb5-1-8: 69/111] krb5-1.8.1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit ddb381a3977a0d805d93f2d601ec356c96c3f1a3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:35:03 2010 +0000 krb5-1.8.1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23880 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 9be96cf..904d40a 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 68/111] README and patchlevel.h for krb5-1.8.1 final
by sbose 15 Mar '11

15 Mar '11

commit 382e1390ab63ddaa95c01643be2eff71eb995ace Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:33:32 2010 +0000 README and patchlevel.h for krb5-1.8.1 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23878 dc483132-0cff-0310-8789-dd5450dbe970 README | 3 +++ src/patchlevel.h | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 13f20e3..924710c 100644 --- a/README +++ b/README @@ -400,16 +400,19 @@ reports, suggestions, and valuable resources: Ken Hornstein Henry B. Hotz Luke Howard + Jakub Hrozek Shumon Huque Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg Mikkel Kruse Volker Lendecke + Jan iankko Lieskovsky Ryan Lynch Franklyn Mendez Markus Moeller Paul Moore + Zbysek Mraz Edward Murrell Nikos Nikoleris Dmitri Pal diff --git a/src/patchlevel.h b/src/patchlevel.h index ab1b84f..9be96cf 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-final"

1 0

[AuthHub/krb5-1-8: 67/111] krb5-1.8.1-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 955b77f413f8291f4d75115ca1a91663a641931f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:54:21 2010 +0000 krb5-1.8.1-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23849 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 614b047..ab1b84f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 66/111] README and patchlevel for krb5-1.8.1-beta2
by sbose 15 Mar '11

15 Mar '11

commit 2790f09141fd6e0921d7a66ae18feaa2fbac7879 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:52:51 2010 +0000 README and patchlevel for krb5-1.8.1-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23847 dc483132-0cff-0310-8789-dd5450dbe970 README | 1 + src/patchlevel.h | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 95cc02b..13f20e3 100644 --- a/README +++ b/README @@ -111,6 +111,7 @@ krb5-1.8.1 changes by ticket ID 6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX 6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO +6693 Fix backwards flag output in krb5_init_creds_step() Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index e50b21f..614b047 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta2"

1 0

[AuthHub/krb5-1-8: 65/111] make depend
by sbose 15 Mar '11

15 Mar '11

commit d2065da320f8ae3eb4169fd5664391011cd26511 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:11 2010 +0000 make depend git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23846 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/deps | 8 ++++ src/lib/krb5/krb/deps | 74 ++++------------------------------------- src/util/ss/deps | 2 +- 3 files changed, 17 insertions(+), 67 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/deps b/src/lib/gssapi/mechglue/deps index 39ea22c..950c5cf 100644 --- a/src/lib/gssapi/mechglue/deps +++ b/src/lib/gssapi/mechglue/deps @@ -358,6 +358,14 @@ g_set_name_attr.so g_set_name_attr.po $(OUTPRE)g_set_name_attr.$(OBJEXT): \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ ../generic/gssapi_err_generic.h g_set_name_attr.c mechglue.h \ mglueP.h +g_set_neg_mechs.so g_set_neg_mechs.po $(OUTPRE)g_set_neg_mechs.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ + $(BUILDTOP)/include/gssapi/gssapi_ext.h $(COM_ERR_DEPS) \ + $(srcdir)/../generic/gssapiP_generic.h $(srcdir)/../generic/gssapi_ext.h \ + $(srcdir)/../generic/gssapi_generic.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ + ../generic/gssapi_err_generic.h g_set_neg_mechs.c mechglue.h \ + mglueP.h g_sign.so g_sign.po $(OUTPRE)g_sign.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \ $(COM_ERR_DEPS) $(srcdir)/../generic/gssapiP_generic.h \ diff --git a/src/lib/krb5/krb/deps b/src/lib/krb5/krb/deps index 0267483..fa1d550 100644 --- a/src/lib/krb5/krb/deps +++ b/src/lib/krb5/krb/deps @@ -63,45 +63,10 @@ authdata.so authdata.po $(OUTPRE)authdata.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.c \ - authdata.h int-proto.h -authdata_exp.so authdata_exp.po $(OUTPRE)authdata_exp.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - authdata_exp.c int-proto.h -authdata_enc.so authdata_enc.po $(OUTPRE)authdata_enc.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_enc.c -authdata_dec.so authdata_dec.po $(OUTPRE)authdata_dec.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_dec.c int-proto.h + auth_con.h authdata.c authdata.h int-proto.h bld_pr_ext.so bld_pr_ext.po $(OUTPRE)bld_pr_ext.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -190,7 +155,7 @@ copy_auth.so copy_auth.po $(OUTPRE)copy_auth.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - copy_auth.c int-proto.h + copy_auth.c copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -201,7 +166,7 @@ copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - auth_con.h copy_athctr.c + copy_athctr.c copy_cksum.so copy_cksum.po $(OUTPRE)copy_cksum.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -669,17 +634,6 @@ pac.so pac.po $(OUTPRE)pac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ authdata.h pac.c -pac_sign.so pac_sign.po $(OUTPRE)pac_sign.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h authdata.h pac_sign.c parse.so parse.po $(OUTPRE)parse.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -722,17 +676,6 @@ preauth2.so preauth2.po $(OUTPRE)preauth2.$(OBJEXT): \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ fast.h int-proto.h preauth2.c -gic_opt_set_pa.so gic_opt_set_pa.po $(OUTPRE)gic_opt_set_pa.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - gic_opt_set_pa.c int-proto.h princ_comp.so princ_comp.po $(OUTPRE)princ_comp.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -805,11 +748,10 @@ rd_req_dec.so rd_req_dec.po $(OUTPRE)rd_req_dec.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - int-proto.h rd_req_dec.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + auth_con.h authdata.h int-proto.h rd_req_dec.c rd_safe.so rd_safe.po $(OUTPRE)rd_safe.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -1038,7 +980,7 @@ valid_times.so valid_times.po $(OUTPRE)valid_times.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - int-proto.h valid_times.c + valid_times.c vfy_increds.so vfy_increds.po $(OUTPRE)vfy_increds.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/util/ss/deps b/src/util/ss/deps index c71d18c..7ad73c5 100644 --- a/src/util/ss/deps +++ b/src/util/ss/deps @@ -63,7 +63,7 @@ utils.so utils.po $(OUTPRE)utils.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ ss_internal.h utils.c options.so options.po $(OUTPRE)options.$(OBJEXT): $(BUILDTOP)/include/ss/ss_err.h \ $(COM_ERR_DEPS) copyright.h options.c ss.h -cmd_tbl.lex.o: cmd_tbl.lex.c +cmd_tbl.lex.o: cmd_tbl.lex.c ct.tab.h ct.tab.o: $(BUILDTOP)/include/ss/ss_err.h $(COM_ERR_DEPS) \ ct.tab.c ss.h ss_err.so ss_err.po $(OUTPRE)ss_err.$(OBJEXT): $(COM_ERR_DEPS) \

1 0

[AuthHub/krb5-1-8: 64/111] ticket: 6693 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 692433183006b8cb5f0d8b5b3014614822a4881f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:04 2010 +0000 ticket: 6693 version_fixed: 1.8.1 status: resolved pull up r23844 from trunk ------------------------------------------------------------------------ r23844 | ghudson | 2010-03-29 18:08:21 -0400 (Mon, 29 Mar 2010) | 9 lines ticket: 6693 subject: Fix backwards flag output in krb5_init_creds_step() tags: pullup target_version: 1.8.1 krb5_init_creds_step() is taken from Heimdal, which sets *flags to 1 for "continue" and 0 for "stop". Unfortunately, we got it backwards in 1.8; fix it for 1.8.1. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23845 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index ab92ee1..b1b837d 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1083,7 +1083,7 @@ init_creds_get(krb5_context context, &flags); if (code == KRB5KRB_ERR_RESPONSE_TOO_BIG && !tcp_only) tcp_only = 1; - else if (code != 0 || (flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE)) + else if (code != 0 || (flags & 1) == 0) break; krb5_free_data_contents(context, &reply); @@ -2065,7 +2065,7 @@ cleanup: } } - *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE); + *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE) ? 0 : 1; return code; }

1 0

[AuthHub/krb5-1-8: 63/111] krb5-1.8.1-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 130f11fcd3ece80c87bcd178c44a8f14d7827333 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 23:00:08 2010 +0000 krb5-1.8.1-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23841 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 99f2abe..e50b21f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 62/111] README and patchlevel for krb5-1.8.1-beta1
by sbose 15 Mar '11

15 Mar '11

commit f366db0fcb5e66d6710d5582d6670c438961414d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 22:47:01 2010 +0000 README and patchlevel for krb5-1.8.1-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23839 dc483132-0cff-0310-8789-dd5450dbe970 README | 30 ++++++++++++++++++++++++++++++ src/patchlevel.h | 6 +++--- 2 files changed, 33 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 8063109..95cc02b 100644 --- a/README +++ b/README @@ -82,6 +82,36 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.1 +---------------------- + +This is primarily a bugfix release. + +* MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + +* Support IPv6 in kpasswd client. + +* Fix an authorization data type number assignment that conflicted + with an undocumented Microsoft usage. + +krb5-1.8.1 changes by ticket ID +------------------------------- + +6661 [RFE] properly support IPv6 in kpasswd +6668 Two problems in kadm5_get_principal mask handling +6674 memory leak in SPNEGO +6676 Ignore improperly encoded signedpath AD elements +6678 use of freed memory in gss_import_sec_context error path +6680 the "ticket_lifetime" setting isn't documented +6681 krb5_get_init_creds_password() can crash with NULL options and + expired keys +6683 kpasswd doesn't guess the client principal name correctly + without a ccache +6685 handle NT_SRV_INST in service principal referrals +6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 +6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX +6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index aadebb9..99f2abe 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 1 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta1"

1 0

[AuthHub/krb5-1-8: 61/111] ticket: 6678 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 8bb942e3e1307fd4ebcbeda896097c9ac14ee404 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 22:31:00 2010 +0000 ticket: 6678 version_fixed: 1.8.1 status: resolved pull up r23834 from trunk ------------------------------------------------------------------------ r23834 | tlyu | 2010-03-23 15:00:13 -0700 (Tue, 23 Mar 2010) | 7 lines ticket: 6678 target_version: 1.8.1 tags: pullup Apply patch from Arlene Berry to not use freed memory in gss_import_sec_context in some error paths. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23835 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/import_sec_context.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) --- diff --git a/src/lib/gssapi/krb5/import_sec_context.c b/src/lib/gssapi/krb5/import_sec_context.c index d4ef1e3..30ec230 100644 --- a/src/lib/gssapi/krb5/import_sec_context.c +++ b/src/lib/gssapi/krb5/import_sec_context.c @@ -106,12 +106,13 @@ krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle) ibp = (krb5_octet *) interprocess_token->value; blen = (size_t) interprocess_token->length; kret = kg_ctx_internalize(context, (krb5_pointer *) &ctx, &ibp, &blen); - krb5_free_context(context); if (kret) { *minor_status = (OM_uint32) kret; save_error_info(*minor_status, context); + krb5_free_context(context); return(GSS_S_FAILURE); } + krb5_free_context(context); /* intern the context handle */ if (! kg_save_ctx_id((gss_ctx_id_t) ctx)) {

1 0

[AuthHub/krb5-1-8: 60/111] ticket: 6690 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1bc3fac4b3a8c0255551e7d063cd6e7f3c195e4a Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 19:08:53 2010 +0000 ticket: 6690 version_fixed: 1.8.1 status: resolved pull up r23832 from trunk ------------------------------------------------------------------------ r23832 | tlyu | 2010-03-23 11:53:52 -0700 (Tue, 23 Mar 2010) | 8 lines ticket: 6690 target_version: 1.8.1 tags: pullup subject: MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO The SPNEGO implementation in krb5-1.7 and later could crash due to assertion failure when receiving some sorts of invalid GSS-API tokens. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23833 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 38 ++++++++++++++-------------------- 1 files changed, 16 insertions(+), 22 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 7a3ff24..cda76d1 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -1576,7 +1576,7 @@ spnego_gss_accept_sec_context( spnego_gss_ctx_id_t sc = NULL; spnego_gss_cred_id_t spcred = NULL; OM_uint32 mechstat = GSS_S_FAILURE; - int sendTokenInit = 0; + int sendTokenInit = 0, tmpret; mechtok_in = mic_in = mic_out = GSS_C_NO_BUFFER; @@ -1609,7 +1609,6 @@ spnego_gss_accept_sec_context( if (delegated_cred_handle != NULL) *delegated_cred_handle = GSS_C_NO_CREDENTIAL; if (input_token->length == 0) { - sendTokenInit = 1; ret = acc_ctx_hints(minor_status, context_handle, spcred, &mic_out, @@ -1617,6 +1616,7 @@ spnego_gss_accept_sec_context( &return_token); if (ret != GSS_S_COMPLETE) goto cleanup; + sendTokenInit = 1; ret = GSS_S_CONTINUE_NEEDED; } else { /* Can set negState to REQUEST_MIC */ @@ -1664,27 +1664,21 @@ spnego_gss_accept_sec_context( &negState, &return_token); } cleanup: - if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) { - /* For acceptor-sends-first send a tokenInit */ - int tmpret; - + if (return_token == INIT_TOKEN_SEND && sendTokenInit) { assert(sc != NULL); - - if (sendTokenInit) { - tmpret = make_spnego_tokenInit_msg(sc, - 1, - mic_out, - 0, - GSS_C_NO_BUFFER, - return_token, - output_token); - } else { - tmpret = make_spnego_tokenTarg_msg(negState, - sc ? sc->internal_mech : GSS_C_NO_OID, - &mechtok_out, mic_out, - return_token, - output_token); - } + tmpret = make_spnego_tokenInit_msg(sc, 1, mic_out, 0, + GSS_C_NO_BUFFER, + return_token, output_token); + if (tmpret < 0) + ret = GSS_S_FAILURE; + } else if (return_token != NO_TOKEN_SEND && + return_token != CHECK_MIC) { + tmpret = make_spnego_tokenTarg_msg(negState, + sc ? sc->internal_mech : + GSS_C_NO_OID, + &mechtok_out, mic_out, + return_token, + output_token); if (tmpret < 0) ret = GSS_S_FAILURE; }

1 0

[AuthHub/krb5-1-8: 59/111] ticket: 6689 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 62ec2dfcd29db5b1180bce0cbbaa71e23d0bcbb0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 07:21:04 2010 +0000 ticket: 6689 version_fixed: 1.8.1 status: resolved pull up r23829 from trunk ------------------------------------------------------------------------ r23829 | tlyu | 2010-03-22 23:09:02 -0700 (Mon, 22 Mar 2010) | 10 lines ticket: 6689 target_version: 1.8.1 tags: pullup subject: krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX Move krb5_typed_data to krb5.hin from k5-int-pkinit.h because krb5int_fast_process_error was assuming that it was safe to cast it to krb5_pa_data. It's not safe to do the cast on 64-bit MacOSX because krb5.hin uses #pragma pack on that platform. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23830 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int-pkinit.h | 11 ----------- src/include/krb5/krb5.hin | 13 +++++++++++++ 2 files changed, 13 insertions(+), 11 deletions(-) --- diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h index 8dcbd5d..0c5ab0e 100644 --- a/src/include/k5-int-pkinit.h +++ b/src/include/k5-int-pkinit.h @@ -101,17 +101,6 @@ typedef struct _krb5_trusted_ca { } u; } krb5_trusted_ca; -/* typed data */ -/* The FAST error handling logic currently assumes that this structure and krb5_pa_data * can be safely cast to each other - * if this structure changes, that code needs to be updated to copy. - */ -typedef struct _krb5_typed_data { - krb5_magic magic; - krb5_int32 type; - unsigned int length; - krb5_octet *data; -} krb5_typed_data; - /* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */ typedef struct _krb5_pa_pk_as_req_draft9 { krb5_octet_data signedAuthPack; diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index 875d14a..d9f3ba8 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -1184,6 +1184,19 @@ typedef struct _krb5_pa_data { krb5_octet *contents; } krb5_pa_data; +/* typed data */ +/* + * The FAST error handling logic currently assumes that this structure and + * krb5_pa_data * can be safely cast to each other if this structure changes, + * that code needs to be updated to copy. + */ +typedef struct _krb5_typed_data { + krb5_magic magic; + krb5_int32 type; + unsigned int length; + krb5_octet *data; +} krb5_typed_data; + typedef struct _krb5_kdc_req { krb5_magic magic; krb5_msgtype msg_type; /* AS_REQ or TGS_REQ? */

1 0

[AuthHub/krb5-1-8: 58/111] ticket: 6687 version_fixed: 1.8.1
by sbose 15 Mar '11

15 Mar '11

commit 1ac3f3b36515b7f0ea50585cb5d661f76cea2e15 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:29 2010 +0000 ticket: 6687 version_fixed: 1.8.1 pull up r23821 from trunk ------------------------------------------------------------------------ r23821 | ghudson | 2010-03-19 20:50:06 -0700 (Fri, 19 Mar 2010) | 17 lines ticket: 6687 subject: Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 target_version: 1.8.1 tags: pullup KRB5_AUTHDATA_SIGNTICKET, originally a Heimdal authorization data type, was used to implement PAC-less constrained delegation in krb5 1.8. Unfortunately, it was found that Microsoft was using 142 for other purposes, which could result in a ticket issued by an MIT or Heimdal KDC being rejected by a Windows Server 2008 R2 application server. Because KRB5_AUTHDATA_SIGNTICKET is only used to communicate among a realm's KDCs, it is relatively easy to change the number, so MIT and Heimdal are both migrating to a new number. This change will cause a transitional interoperability issue when a realm mixes MIT krb5 1.8 (or Heimdal 1.3.1) KDCs with MIT krb5 1.8.1 (or Heimdal 1.3.2) KDCs, but only for constrained delegation evidence tickets. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23828 dc483132-0cff-0310-8789-dd5450dbe970 src/include/krb5/krb5.hin | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index 63b6971..875d14a 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -1066,7 +1066,7 @@ krb5_verify_checksum(krb5_context context, krb5_cksumtype ctype, #define KRB5_AUTHDATA_SESAME 65 #define KRB5_AUTHDATA_WIN2K_PAC 128 #define KRB5_AUTHDATA_ETYPE_NEGOTIATION 129 /* RFC 4537 */ -#define KRB5_AUTHDATA_SIGNTICKET 142 +#define KRB5_AUTHDATA_SIGNTICKET 512 /* formerly 142 in krb5 1.8 */ #define KRB5_AUTHDATA_FX_ARMOR 71 /* password change constants */

1 0

[AuthHub/krb5-1-8: 57/111] ticket: 6680 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a7c94a2d49da51e0325089219c9d72366e113b12 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:22 2010 +0000 ticket: 6680 version_fixed: 1.8.1 status: resolved pull up r23820 from trunk ------------------------------------------------------------------------ r23820 | ghudson | 2010-03-19 09:17:05 -0700 (Fri, 19 Mar 2010) | 7 lines ticket: 6680 target_version: 1.8.1 tags: pullup Document the ticket_lifetime libdefaults setting (which was added in r16656, #2656). Based on a patch from nalin(a)redhat.com. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23827 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 12 +++++------- src/config-files/krb5.conf.M | 4 ++++ 2 files changed, 9 insertions(+), 7 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index 5e80af3..1ec4685 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -516,13 +516,6 @@ DCE do not support the default cache as created by this version of Kerberos. Use a value of 1 on DCE 1.0.3a systems, and a value of 2 on DCE 1.1 systems. The default value is @value{DefaultCcacheType}. -@ignore -@itemx tkt_lifetime -The default lifetime of a ticket. The default is -@value{DefaultTktLifetime}. This is currently not supported by the -code. -@end ignore - @itemx dns_lookup_kdc Indicate whether DNS SRV records should be used to locate the KDCs and other servers for a realm, if they are not listed in the information for @@ -583,6 +576,11 @@ If this flag is set, then an attempt to get initial credentials will fail if the client machine does not have a keytab. The default for the flag is @value{DefaultVerifyApReqNofail}. +@itemx ticket_lifetime +The value of this tag is the default lifetime for +initial tickets. The default value for the tag is +@value{DefaultTktLifetime}. + @itemx renew_lifetime The value of this tag is the default renewable lifetime for initial tickets. The default value for the tag is diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M index 9778e81..412156b 100644 --- a/src/config-files/krb5.conf.M +++ b/src/config-files/krb5.conf.M @@ -220,6 +220,10 @@ If this flag is set, then an attempt to get initial credentials will fail if the client machine does not have a keytab. The default for the flag is false. +.IP ticket_lifetime +The value of this tag is the default lifetime for initial tickets. The +default value for the tag is 1 day (1d). + .IP renew_lifetime The value of this tag is the default renewable lifetime for initial tickets. The default value for the tag is 0.

1 0

[AuthHub/krb5-1-8: 56/111] ticket: 6683 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit efdfcf9efe69feaca6144e02d7a6e770ab4e7c6f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:15 2010 +0000 ticket: 6683 version_fixed: 1.8.1 status: resolved pull up r23819 from trunk ------------------------------------------------------------------------ r23819 | ghudson | 2010-03-18 10:37:31 -0700 (Thu, 18 Mar 2010) | 7 lines ticket: 6683 target_version: 1.8.1 tags: pullup Fix the kpasswd fallback from the ccache principal name to the username in the case where the ccache doesn't exist. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23826 dc483132-0cff-0310-8789-dd5450dbe970 src/clients/kpasswd/kpasswd.c | 18 +++++++++++------- 1 files changed, 11 insertions(+), 7 deletions(-) --- diff --git a/src/clients/kpasswd/kpasswd.c b/src/clients/kpasswd/kpasswd.c index 6bc0668..c79f2c8 100644 --- a/src/clients/kpasswd/kpasswd.c +++ b/src/clients/kpasswd/kpasswd.c @@ -47,7 +47,7 @@ int main(int argc, char *argv[]) { krb5_error_code ret; krb5_context context; - krb5_principal princ; + krb5_principal princ = NULL; char *pname; krb5_ccache ccache; krb5_get_init_creds_opt *opts = NULL; @@ -84,23 +84,27 @@ int main(int argc, char *argv[]) com_err(argv[0], ret, "parsing client name"); exit(1); } - } else if ((ret = krb5_cc_default(context, &ccache)) != KRB5_CC_NOTFOUND) { - if (ret) { + } else { + ret = krb5_cc_default(context, &ccache); + if (ret != 0) { com_err(argv[0], ret, "opening default ccache"); exit(1); } - if ((ret = krb5_cc_get_principal(context, ccache, &princ))) { + ret = krb5_cc_get_principal(context, ccache, &princ); + if (ret != 0 && ret != KRB5_CC_NOTFOUND && ret != KRB5_FCC_NOFILE) { com_err(argv[0], ret, "getting principal from ccache"); exit(1); } - if ((ret = krb5_cc_close(context, ccache))) { + ret = krb5_cc_close(context, ccache); + if (ret != 0) { com_err(argv[0], ret, "closing ccache"); exit(1); } - } else { - get_name_from_passwd_file(argv[0], context, &princ); + + if (princ == NULL) + get_name_from_passwd_file(argv[0], context, &princ); } if ((ret = krb5_get_init_creds_opt_alloc(context, &opts))) {

1 0

[AuthHub/krb5-1-8: 55/111] ticket: 6681 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 26ef9e92afc87efffb643024a39ecfcbd20bd28e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:07 2010 +0000 ticket: 6681 version_fixed: 1.8.1 status: resolved pull up r23815 from trunk ------------------------------------------------------------------------ r23815 | ghudson | 2010-03-17 14:10:10 -0700 (Wed, 17 Mar 2010) | 7 lines ticket: 6681 target_version: 1.8.1 tags: pullup When checking for KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT, don't dereference options if it's NULL. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23825 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/gic_pwd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c index cadd7ad..7b43727 100644 --- a/src/lib/krb5/krb/gic_pwd.c +++ b/src/lib/krb5/krb/gic_pwd.c @@ -218,7 +218,7 @@ krb5_get_init_creds_password(krb5_context context, * to prompt. Prompting is only disabled if the option has been set * and the value has been set to false. */ - if (!(options->flags & KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT)) + if (options && !(options->flags & KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT)) goto cleanup; /* ok, we have an expired password. Give the user a few chances

1 0

[AuthHub/krb5-1-8: 54/111] ticket: 6685 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0b25fb78017c54a4f2feaa51a063ad62a2f7b114 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:00 2010 +0000 ticket: 6685 version_fixed: 1.8.1 status: resolved pull up r23810 from trunk ------------------------------------------------------------------------ r23810 | tlyu | 2010-03-16 12:14:33 -0700 (Tue, 16 Mar 2010) | 8 lines ticket: 6685 target_version: 1.8.1 subject: handle NT_SRV_INST in service principal referrals Handle NT_SRV_INST in service principal cross-realm referrals, as Windows apparently uses that instead of NT_SRV_HST for at least some service principals. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23824 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index f808276..b2f0655 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -1215,6 +1215,7 @@ prep_reprocess_req(krb5_kdc_req *request, krb5_principal *krbtgt_princ) strlcpy(comp1_str,comp1->data,comp1->length+1); if ((krb5_princ_type(kdc_context, request->server) == KRB5_NT_SRV_HST || + krb5_princ_type(kdc_context, request->server) == KRB5_NT_SRV_INST || (krb5_princ_type(kdc_context, request->server) == KRB5_NT_UNKNOWN && kdc_active_realm->realm_host_based_services != NULL && (krb5_match_config_pattern(kdc_active_realm->realm_host_based_services,

1 0

[AuthHub/krb5-1-8: 53/111] ticket: 6676 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a602ced730c88d6b4c0459c9712302fce2a4990c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:52 2010 +0000 ticket: 6676 version_fixed: 1.8.1 status: resolved pull up r23766 from trunk ------------------------------------------------------------------------ r23766 | ghudson | 2010-03-05 12:45:46 -0500 (Fri, 05 Mar 2010) | 10 lines ticket: 6676 subject: Ignore improperly encoded signedpath AD elements target_version: 1.8.1 tags: pullup We have some reason to believe Microsoft and Heimdal are both using the authdata value 142 for different purposes, leading to failures in verify_ad_signedpath(). For better interoperability, treat such tickets as unsigned, rather than invalid. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23809 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/kdc_authdata.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c index 5097558..b5de64d 100644 --- a/src/kdc/kdc_authdata.c +++ b/src/kdc/kdc_authdata.c @@ -934,8 +934,12 @@ verify_ad_signedpath(krb5_context context, enc_sp.length = sp_authdata[0]->length; code = decode_krb5_ad_signedpath(&enc_sp, &sp); - if (code != 0) + if (code != 0) { + /* Treat an invalid signedpath authdata element as a missing one, since + * we believe MS is using the same number for something else. */ + code = 0; goto cleanup; + } code = verify_ad_signedpath_checksum(context, krbtgt,

1 0

[AuthHub/krb5-1-8: 52/111] ticket: 6674 status: resolved version_fixed: 1.8.1
by sbose 15 Mar '11

15 Mar '11

commit 1a098ade60d44f7f69a4a99996724201582007e5 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:49 2010 +0000 ticket: 6674 status: resolved version_fixed: 1.8.1 pull up r23772 from trunk ------------------------------------------------------------------------ r23772 | ghudson | 2010-03-05 15:35:26 -0500 (Fri, 05 Mar 2010) | 7 lines ticket: 6674 target_version: 1.8.1 tags: pullup Release the internal_name field of a SPNEGO context if it has not been claimed for a caller argument. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23808 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index cb286bc..7a3ff24 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -1693,6 +1693,7 @@ cleanup: if (sc->internal_name != GSS_C_NO_NAME && src_name != NULL) { *src_name = sc->internal_name; + sc->internal_name = GSS_C_NO_NAME; } release_spnego_ctx(&sc); } else if (ret != GSS_S_CONTINUE_NEEDED) { @@ -2578,6 +2579,8 @@ release_spnego_ctx(spnego_gss_ctx_id_t *ctx) (void) generic_gss_release_oid(&minor_stat, &context->internal_mech); + (void) gss_release_name(&minor_stat, &context->internal_name); + if (context->optionStr != NULL) { free(context->optionStr); context->optionStr = NULL;

1 0

[AuthHub/krb5-1-8: 51/111] ticket: 6668 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5d0be00079af34e0442a11c2a1bb19c031a4f9c1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:46 2010 +0000 ticket: 6668 version_fixed: 1.8.1 status: resolved pull up r23749 from trunk ------------------------------------------------------------------------ r23749 | ghudson | 2010-02-24 13:57:08 -0500 (Wed, 24 Feb 2010) | 9 lines ticket: 6668 subject: Two problems in kadm5_get_principal mask handling target_version: 1.8 tags: pullup KADM5_MOD_NAME was being applied to entry->principal instead of entry->mod_name. KADM5_MKVNO was not being applied to entry->mkvno. Patch from Marcus Watts <mdw(a)umich.edu>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23807 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/svr_principal.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index 3cb3b6b..469a8e8 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -858,8 +858,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (! (mask & KADM5_MOD_TIME)) entry->mod_date = 0; if (! (mask & KADM5_MOD_NAME)) { - krb5_free_principal(handle->context, entry->principal); - entry->principal = NULL; + krb5_free_principal(handle->context, entry->mod_name); + entry->mod_name = NULL; } } @@ -871,10 +871,12 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (kdb.key_data[i].key_data_kvno > entry->kvno) entry->kvno = kdb.key_data[i].key_data_kvno; - ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, - &entry->mkvno); - if (ret) - goto done; + if (mask & KADM5_MKVNO) { + ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, + &entry->mkvno); + if (ret) + goto done; + } if (mask & KADM5_MAX_RLIFE) entry->max_renewable_life = kdb.max_renewable_life;

1 0

[AuthHub/krb5-1-8: 50/111] ticket: 6661 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 407a20de4e615b612a53538c7bc78ad6ced498d4 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:40 2010 +0000 ticket: 6661 version_fixed: 1.8.1 status: resolved pull up r23767 from trunk ------------------------------------------------------------------------ r23767 | ghudson | 2010-03-05 14:19:42 -0500 (Fri, 05 Mar 2010) | 7 lines ticket: 6661 target_version: 1.8.1 tags: pullup Add IPv6 support to changepw.c (reverting r21004 since it is no longer necessary). Patch from Submit Bose <sbose(a)redhat.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23806 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/os/changepw.c | 33 ++++++++++++++++++++++++++------- 1 files changed, 26 insertions(+), 7 deletions(-) --- diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c index 46bb828..7cab0d6 100644 --- a/src/lib/krb5/os/changepw.c +++ b/src/lib/krb5/os/changepw.c @@ -65,20 +65,23 @@ locate_kpasswd(krb5_context context, const krb5_data *realm, int sockType = (useTcp ? SOCK_STREAM : SOCK_DGRAM); code = krb5int_locate_server (context, realm, addrlist, - locate_service_kpasswd, sockType, AF_INET); + locate_service_kpasswd, sockType, AF_UNSPEC); if (code == KRB5_REALM_CANT_RESOLVE || code == KRB5_REALM_UNKNOWN) { code = krb5int_locate_server (context, realm, addrlist, locate_service_kadmin, SOCK_STREAM, - AF_INET); + AF_UNSPEC); if (!code) { /* Success with admin_server but now we need to change the port number to use DEFAULT_KPASSWD_PORT and the socktype. */ size_t i; for (i=0; i<addrlist->naddrs; i++) { struct addrinfo *a = addrlist->addrs[i].ai; + krb5_ui_2 kpasswd_port = htons(DEFAULT_KPASSWD_PORT); if (a->ai_family == AF_INET) - sa2sin (a->ai_addr)->sin_port = htons(DEFAULT_KPASSWD_PORT); + sa2sin (a->ai_addr)->sin_port = kpasswd_port; + if (a->ai_family == AF_INET6) + sa2sin6 (a->ai_addr)->sin6_port = kpasswd_port; if (sockType != SOCK_STREAM) a->ai_socktype = sockType; } @@ -131,10 +134,16 @@ kpasswd_sendto_msg_callback(struct conn_state *conn, /* some brain-dead OS's don't return useful information from * the getsockname call. Namely, windows and solaris. */ - if (ss2sin(&local_addr)->sin_addr.s_addr != 0) { + if (local_addr.ss_family == AF_INET && + ss2sin(&local_addr)->sin_addr.s_addr != 0) { local_kaddr.addrtype = ADDRTYPE_INET; local_kaddr.length = sizeof(ss2sin(&local_addr)->sin_addr); local_kaddr.contents = (krb5_octet *) &ss2sin(&local_addr)->sin_addr; + } else if (local_addr.ss_family == AF_INET6 && + ss2sin6(&local_addr)->sin6_addr.s6_addr != 0) { + local_kaddr.addrtype = ADDRTYPE_INET6; + local_kaddr.length = sizeof(ss2sin6(&local_addr)->sin6_addr); + local_kaddr.contents = (krb5_octet *) &ss2sin6(&local_addr)->sin6_addr; } else { krb5_address **addrs; @@ -278,9 +287,19 @@ change_set_password(krb5_context context, break; } - remote_kaddr.addrtype = ADDRTYPE_INET; - remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); - remote_kaddr.contents = (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + if (remote_addr.ss_family == AF_INET) { + remote_kaddr.addrtype = ADDRTYPE_INET; + remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + } else if (remote_addr.ss_family == AF_INET6) { + remote_kaddr.addrtype = ADDRTYPE_INET6; + remote_kaddr.length = sizeof(ss2sin6(&remote_addr)->sin6_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin6(&remote_addr)->sin6_addr; + } else { + break; + } if ((code = krb5_auth_con_setaddrs(callback_ctx.context, callback_ctx.auth_context,

1 0

[AuthHub/krb5-1-8: 49/111] Revert KRB5_CONF_ macro change intended for trunk.
by sbose 15 Mar '11

15 Mar '11

commit aab50b5b7c039979c80ddc7639e4e5687effe0f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 20:33:05 2010 +0000 Revert KRB5_CONF_ macro change intended for trunk. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23797 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++----- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 6 insertions(+), 8 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index fa0fc29..43b780e 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" -#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,7 +206,6 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -228,21 +227,20 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" -#define KRB5_CONF_LOGGING "logging" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index b43a96f..384e7a8 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = KRB5_CONF_LOGGING; + logging_profent[0] = "logging"; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = KRB5_CONF_LOGGING; - logging_defent[1] = KRB5_CONF_DEFAULT; + logging_defent[0] = "logging"; + logging_defent[1] = "default"; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 48/111] Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "loggi
by sbose 15 Mar '11

15 Mar '11

commit a4b7b5f3407f922e66c675efd90c21feab2fcca7 Author: tsitkova <tsitkova@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 15:59:30 2010 +0000 Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "logging" git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23795 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++++--- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index 43b780e..fa0fc29 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" +#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,6 +206,7 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -227,20 +228,21 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" +#define KRB5_CONF_LOGGING "logging" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index 384e7a8..b43a96f 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = "logging"; + logging_profent[0] = KRB5_CONF_LOGGING; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = "logging"; - logging_defent[1] = "default"; + logging_defent[0] = KRB5_CONF_LOGGING; + logging_defent[1] = KRB5_CONF_DEFAULT; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 47/111] krb5-1.8-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 206926d82fc23d4a4036e1e111bd556b4073a63f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:21:06 2010 +0000 krb5-1.8-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23762 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 2a5126f..aadebb9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 46/111] README and patchlevel.h for krb5-1.8 final
by sbose 15 Mar '11

15 Mar '11

commit 0c1ad197fd4a5e4ea06d4d57ddce7dca9e0a84f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:13:43 2010 +0000 README and patchlevel.h for krb5-1.8 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23760 dc483132-0cff-0310-8789-dd5450dbe970 README | 8 +++++++- src/patchlevel.h | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 1135b8f..8063109 100644 --- a/README +++ b/README @@ -74,7 +74,13 @@ krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which now defaults to "false" beginning with krb5-1.8. The krb5-1.8 release includes additional -measures to ease the transition away from single-DES. +measures to ease the transition away from single-DES. These +additional measures include: + +* enctype config enhancements (so you can do "DEFAULT +des", etc.) +* new API to allow applications (e.g. AFS) to explicitly reenable weak + crypto +* easier kadmin history key changes Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index c151756..2a5126f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-final"

1 0

[AuthHub/krb5-1-8: 45/111] krb5-1.8-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit e75e264f1b2bc9271256904533a31aa53c8edc03 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:29 2010 +0000 krb5-1.8-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23755 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 1dd918e..c151756 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 44/111] README and patchlevel.h for krb5-1.8-beta2
by sbose 15 Mar '11

15 Mar '11

commit b34189eb4d7899db3a17b402e09636ad135d2cf3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:22 2010 +0000 README and patchlevel.h for krb5-1.8-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23754 dc483132-0cff-0310-8789-dd5450dbe970 README | 15 +++++++++++++-- src/patchlevel.h | 4 ++-- 2 files changed, 15 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 26e516b..1135b8f 100644 --- a/README +++ b/README @@ -64,6 +64,11 @@ and logging in as "guest" with password "guest". DES transition -------------- +The krb5-1.8 release disables single-DES cryptosystems by default. As +a result, you may need to add the libdefaults setting +"allow_weak_crypto = true" to communicate with existing Kerberos +infrastructures if they do not support stronger ciphers. + The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration @@ -192,6 +197,7 @@ krb5-1.8 changes by ticket ID 6599 memory leak in krb5_rd_req_decrypt_tkt_part 6600 gss_inquire_context cannot handle no target name from mechanism 6601 gsssspi_set_cred_option cannot handle mech specific option +6603 issues with SPNEGO 6605 PKINIT client should validate SAN for TGS, not service principal 6606 allow testing when offline 6607 anonymous PKINIT @@ -202,7 +208,8 @@ krb5-1.8 changes by ticket ID 6622 kinit_fast fails if weak enctype is among client principal keys 6623 Always treat anonymous as preauth required 6624 automated tests for anonymous pkinit -6625 yarrow code does not initialize keyblock enctype and uses unitialized value +6625 yarrow code does not initialize keyblock enctype and uses + unitialized value 6626 Restore interoperability with 1.6 addprinc -randkey 6627 Set enctype in crypto_tests to prevent memory leaks 6628 krb5int_dk_string_to_key fails to set enctype @@ -217,7 +224,8 @@ krb5-1.8 changes by ticket ID 6645 Add krb5_allow_weak_crypto API 6648 define MIN() in lib/gssapi/krb5/prf.c 6649 Get rid of kdb_ext.h and allow out-of-tree KDB plugins -6651 Handle migration from pre-1.7 databases with master key kvno != 1 (1.8 pullup) +6651 Handle migration from pre-1.7 databases with master key + kvno != 1 (1.8 pullup) 6652 Make decryption of master key list more robust 6653 set_default_enctype_var should filter not reject weak enctypes 6654 Fix greet_server build @@ -225,9 +233,12 @@ krb5-1.8 changes by ticket ID 6656 krb5int_fast_free_state segfaults if state is null 6657 enc_padata can include empty sequence 6658 Implement gss_set_neg_mechs +6659 Additional memory leaks in kdc 6660 Minimal support for updating history key 6662 MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service 6663 update mkrel to deal with changed source layout +6665 Fix cipher state chaining in OpenSSL back end +6669 doc updates for allow_weak_crypto Acknowledgements ---------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index 7b8dc9f..1dd918e 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-beta2"

1 0

[AuthHub/krb5-1-8: 43/111] ticket: 6669 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1f1506d37300ac8ed3100641702135355e929fe1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 20:14:21 2010 +0000 ticket: 6669 version_fixed: 1.8 status: resolved pull up r23750 from trunk ------------------------------------------------------------------------ r23750 | tlyu | 2010-02-25 15:09:45 -0500 (Thu, 25 Feb 2010) | 7 lines ticket: 6669 target_version: 1.8 tags: pullup subject: doc updates for allow_weak_crypto Update documentation to be more helpful about allow_weak_crypto. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23751 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 7 +++++-- src/config-files/krb5.conf.M | 8 ++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index b7c87ac..5e80af3 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -456,8 +456,11 @@ key encryption. The default value for this tag is @itemx allow_weak_crypto If this is set to 0 (for false), then weak encryption types will be filtered out of the previous three lists (as noted in @ref{Supported -Encryption Types}). The default value for this tag is true, but that -default may change in the future. +Encryption Types}). The default value for this tag is false, which +may cause authentication failures in existing Kerberos infrastructures +that do not support strong crypto. Users in affected environments +should set this tag to true until their infrastructure adopts stronger +ciphers. @itemx clockskew Sets the maximum allowable amount of clockskew in seconds that the diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M index b60836f..9778e81 100644 --- a/src/config-files/krb5.conf.M +++ b/src/config-files/krb5.conf.M @@ -128,6 +128,14 @@ types that should be requested by the client, in the same format. This relation identifies the permitted list of session key encryption types. +.IP allow_weak_crypto +If this is set to 0 (for false), then weak encryption types will be +filtered out of the previous three lists. The default value for this +tag is false, which may cause authentication failures in existing +Kerberos infrastructures that do not support strong crypto. Users in +affected environments should set this tag to true until their +infrastructure adopts stronger ciphers. + .IP clockskew This relation sets the maximum allowable amount of clockskew in seconds that the library will tolerate before assuming that a Kerberos message

1 0

[AuthHub/krb5-1-8: 42/111] ticket: 6603 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0a70aed9791deab5ece6b173f4c116091328f835 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 23 00:25:58 2010 +0000 ticket: 6603 version_fixed: 1.8 status: resolved pull up r23742 from trunk ------------------------------------------------------------------------ r23742 | ghudson | 2010-02-21 23:52:30 -0500 (Sun, 21 Feb 2010) | 24 lines ticket: 6603 target_version: 1.8 tags: pullup Fix two unrelated problems in SPNEGO which don't crop up with the krb5 mechanism. 1. The third call to spnego_init_accept_context uses faulty logic to determine if the exchange is complete, preventing a third mech token from being sent to the acceptor if no MIC exchange is required. Follow the logic used in the second call (in init_ctx_nego), which is correct. 2. If the acceptor selects a mech other than the optimistic mech, it sets sc->mic_reqd to 1 whether or not the selected mech supports MICs (which isn't known until the mech completes). Most code outside of handle_mic checks sc->mic_reqd along with (sc->ctx_flags & GSS_C_INTEG_FLAG), but the code in acc_ctx_call_acc neglected to do so, so it could improperly delegate responsibility for deciding when the negotiation was finished to handle_mic--which never gets called if (sc->ctx_flags & GSS_C_INTEG_FLAG) is false. Fix acc_ctx_call_acc to check sc->ctx_flags so that mechs which don't support integrity protection can complete if they are selected non-optimistically. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23748 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 60fadd5..cb286bc 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -448,8 +448,9 @@ create_spnego_ctx(void) } /* - * Both initiator and acceptor call here to verify and/or create - * mechListMIC, and to consistency-check the MIC state. + * Both initiator and acceptor call here to verify and/or create mechListMIC, + * and to consistency-check the MIC state. handle_mic is invoked only if the + * negotiated mech has completed and supports MICs. */ static OM_uint32 handle_mic(OM_uint32 *minor_status, gss_buffer_t mic_in, @@ -658,18 +659,20 @@ init_ctx_cont(OM_uint32 *minor_status, gss_ctx_id_t *ctx, gss_buffer_t buf, supportedMech, responseToken, mechListMIC, negState, tokflag); - } else if (!sc->mech_complete && - *responseToken == GSS_C_NO_BUFFER) { - /* - * mech not finished and mech token missing - */ + } else if ((!sc->mech_complete && *responseToken == GSS_C_NO_BUFFER) || + (sc->mech_complete && *responseToken != GSS_C_NO_BUFFER)) { + /* Missing or spurious token from acceptor. */ ret = GSS_S_DEFECTIVE_TOKEN; - } else if (sc->mic_reqd && - (sc->ctx_flags & GSS_C_INTEG_FLAG)) { + } else if (!sc->mech_complete || + (sc->mic_reqd && + (sc->ctx_flags & GSS_C_INTEG_FLAG))) { + /* Not obviously done; we may decide we're done later in + * init_ctx_call_init or handle_mic. */ *negState = ACCEPT_INCOMPLETE; *tokflag = CONT_TOKEN_SEND; ret = GSS_S_CONTINUE_NEEDED; } else { + /* mech finished on last pass and no MIC required, so done. */ *negState = ACCEPT_COMPLETE; *tokflag = NO_TOKEN_SEND; ret = GSS_S_COMPLETE; @@ -1535,10 +1538,13 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, if (ret_flags != NULL) *ret_flags = sc->ctx_flags; - if (!sc->mic_reqd) { + if (!sc->mic_reqd || + !(sc->ctx_flags & GSS_C_INTEG_FLAG)) { + /* No MIC exchange required, so we're done. */ *negState = ACCEPT_COMPLETE; ret = GSS_S_COMPLETE; } else { + /* handle_mic will decide if we're done. */ ret = GSS_S_CONTINUE_NEEDED; } } else if (ret != GSS_S_CONTINUE_NEEDED) {

1 0

[AuthHub/krb5-1-8: 41/111] ticket: 6659 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 6f7d2a9f4c1ca9c4dfb99427682ff45c1612db16 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 23 00:25:54 2010 +0000 ticket: 6659 version_fixed: 1.8 status: resolved pull up r23735 from trunk ------------------------------------------------------------------------ r23735 | ghudson | 2010-02-18 13:49:11 -0500 (Thu, 18 Feb 2010) | 8 lines ticket: 6659 target_version: 1.8 tags: pullup The TGS code was not freeing authdata. This is an old leak which was made more evident in 1.8 by the addition of ad-signedpath authdata appearing in most tickets issued through the TGS path. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23747 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 44b5791..f808276 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -136,6 +136,7 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from, reply.padata = 0; /* For cleanup handler */ reply_encpart.enc_padata = 0; + enc_tkt_reply.authorization_data = NULL; e_data.data = NULL; session_key.contents = NULL; @@ -726,8 +727,6 @@ tgt_again: } } - enc_tkt_reply.authorization_data = NULL; - if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION) && !isflagset(c_flags, KRB5_KDB_FLAG_CROSS_REALM)) enc_tkt_reply.client = s4u_x509_user->user_id.user; @@ -1045,6 +1044,8 @@ cleanup: krb5_free_pa_data(kdc_context, reply.padata); if (reply_encpart.enc_padata) krb5_free_pa_data(kdc_context, reply_encpart.enc_padata); + if (enc_tkt_reply.authorization_data != NULL) + krb5_free_authdata(kdc_context, enc_tkt_reply.authorization_data); krb5_free_data_contents(kdc_context, &e_data); return retval;

1 0

[AuthHub/krb5-1-8: 40/111] ticket: 6665 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit b12b92d22b7d5289e9841d475a899909bfea35cb Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 23 00:25:51 2010 +0000 ticket: 6665 version_fixed: 1.8 status: resolved pull up r23734 from trunk ------------------------------------------------------------------------ r23734 | ghudson | 2010-02-18 13:04:47 -0500 (Thu, 18 Feb 2010) | 17 lines ticket: 6665 subject: Fix cipher state chaining in OpenSSL back end target_version: 1.8 tags: pullup Make cipher state chaining work in the OpenSSL back end for des, des3, and arcfour enc providers. Subtleties: * DES and DES3 have checks to avoid clobbering ivec with uninitialized data if there is no data to encrypt. * Arcfour saves the OpenSSL cipher context across calls. To protect against a caller improperly copying the state (which happens to work with other enc providers), a loopback pointer is used, as in GSSAPI. * EVP_EncryptFinal_ex is unnecessary with stream ciphers and would interfere with cipher state chaining if it did anything, so just remove it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23746 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/openssl/enc_provider/des.c | 22 ++++-- src/lib/crypto/openssl/enc_provider/des3.c | 23 ++++--- src/lib/crypto/openssl/enc_provider/rc4.c | 106 ++++++++++++++++------------ 3 files changed, 90 insertions(+), 61 deletions(-) --- diff --git a/src/lib/crypto/openssl/enc_provider/des.c b/src/lib/crypto/openssl/enc_provider/des.c index a1a5245..bf56cf9 100644 --- a/src/lib/crypto/openssl/enc_provider/des.c +++ b/src/lib/crypto/openssl/enc_provider/des.c @@ -60,8 +60,8 @@ #define DES_KEY_BYTES 7 static krb5_error_code -validate(krb5_key key, const krb5_data *ivec, - const krb5_crypto_iov *data, size_t num_data) +validate(krb5_key key, const krb5_data *ivec, const krb5_crypto_iov *data, + size_t num_data, krb5_boolean *empty) { size_t i, input_length; @@ -78,6 +78,7 @@ validate(krb5_key key, const krb5_data *ivec, if (ivec && (ivec->length != 8)) return(KRB5_BAD_MSIZE); + *empty = (input_length == 0); return 0; } @@ -89,13 +90,13 @@ k5_des_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, unsigned char iblock[MIT_DES_BLOCK_LENGTH], oblock[MIT_DES_BLOCK_LENGTH]; struct iov_block_state input_pos, output_pos; EVP_CIPHER_CTX ciph_ctx; + krb5_boolean empty; IOV_BLOCK_STATE_INIT(&input_pos); IOV_BLOCK_STATE_INIT(&output_pos); - - ret = validate(key, ivec, data, num_data); - if (ret) + ret = validate(key, ivec, data, num_data, &empty); + if (ret != 0 || empty) return ret; EVP_CIPHER_CTX_init(&ciph_ctx); @@ -122,6 +123,9 @@ k5_des_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, &output_pos); } + if (ivec != NULL) + memcpy(ivec->data, oblock, MIT_DES_BLOCK_LENGTH); + EVP_CIPHER_CTX_cleanup(&ciph_ctx); zap(iblock, sizeof(iblock)); @@ -140,12 +144,13 @@ k5_des_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, unsigned char iblock[MIT_DES_BLOCK_LENGTH], oblock[MIT_DES_BLOCK_LENGTH]; struct iov_block_state input_pos, output_pos; EVP_CIPHER_CTX ciph_ctx; + krb5_boolean empty; IOV_BLOCK_STATE_INIT(&input_pos); IOV_BLOCK_STATE_INIT(&output_pos); - ret = validate(key, ivec, data, num_data); - if (ret) + ret = validate(key, ivec, data, num_data, &empty); + if (ret != 0 || empty) return ret; EVP_CIPHER_CTX_init(&ciph_ctx); @@ -172,6 +177,9 @@ k5_des_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, MIT_DES_BLOCK_LENGTH, &output_pos); } + if (ivec != NULL) + memcpy(ivec->data, iblock, MIT_DES_BLOCK_LENGTH); + EVP_CIPHER_CTX_cleanup(&ciph_ctx); zap(iblock, sizeof(iblock)); diff --git a/src/lib/crypto/openssl/enc_provider/des3.c b/src/lib/crypto/openssl/enc_provider/des3.c index 3f0d213..b62d6e4 100644 --- a/src/lib/crypto/openssl/enc_provider/des3.c +++ b/src/lib/crypto/openssl/enc_provider/des3.c @@ -59,8 +59,8 @@ #define DES_BLOCK_SIZE 8 static krb5_error_code -validate(krb5_key key, const krb5_data *ivec, - const krb5_crypto_iov *data, size_t num_data) +validate(krb5_key key, const krb5_data *ivec, const krb5_crypto_iov *data, + size_t num_data, krb5_boolean *empty) { size_t i, input_length; @@ -77,6 +77,7 @@ validate(krb5_key key, const krb5_data *ivec, if (ivec && (ivec->length != 8)) return(KRB5_BAD_MSIZE); + *empty = (input_length == 0); return 0; } @@ -88,9 +89,10 @@ k5_des3_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, unsigned char iblock[MIT_DES_BLOCK_LENGTH], oblock[MIT_DES_BLOCK_LENGTH]; struct iov_block_state input_pos, output_pos; EVP_CIPHER_CTX ciph_ctx; + krb5_boolean empty; - ret = validate(key, ivec, data, num_data); - if (ret) + ret = validate(key, ivec, data, num_data, &empty); + if (ret != 0 || empty) return ret; IOV_BLOCK_STATE_INIT(&input_pos); @@ -121,8 +123,8 @@ k5_des3_encrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, oblock, MIT_DES_BLOCK_LENGTH, &output_pos); } - /*if (ivec != NULL && ivec->data) - memcpy(ivec->data, oblock, MIT_DES_BLOCK_LENGTH); */ + if (ivec != NULL) + memcpy(ivec->data, oblock, MIT_DES_BLOCK_LENGTH); EVP_CIPHER_CTX_cleanup(&ciph_ctx); @@ -142,9 +144,10 @@ k5_des3_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, unsigned char iblock[MIT_DES_BLOCK_LENGTH], oblock[MIT_DES_BLOCK_LENGTH]; struct iov_block_state input_pos, output_pos; EVP_CIPHER_CTX ciph_ctx; + krb5_boolean empty; - ret = validate(key, ivec, data, num_data); - if (ret) + ret = validate(key, ivec, data, num_data, &empty); + if (ret != 0 || empty) return ret; IOV_BLOCK_STATE_INIT(&input_pos); @@ -175,8 +178,8 @@ k5_des3_decrypt(krb5_key key, const krb5_data *ivec, krb5_crypto_iov *data, &output_pos); } - /*if (ivec != NULL && ivec->data) - memcpy(ivec->data, oblock, MIT_DES_BLOCK_LENGTH); */ + if (ivec != NULL) + memcpy(ivec->data, iblock, MIT_DES_BLOCK_LENGTH); EVP_CIPHER_CTX_cleanup(&ciph_ctx); diff --git a/src/lib/crypto/openssl/enc_provider/rc4.c b/src/lib/crypto/openssl/enc_provider/rc4.c index 7ce9436..a41b2d6 100644 --- a/src/lib/crypto/openssl/enc_provider/rc4.c +++ b/src/lib/crypto/openssl/enc_provider/rc4.c @@ -40,19 +40,17 @@ #include <rand2key.h> #include <openssl/evp.h> -typedef struct -{ - EVP_CIPHER_CTX evp_ctx; - unsigned int x; - unsigned int y; - unsigned char state[256]; - -} ArcfourContext; - -typedef struct { - int initialized; - ArcfourContext ctx; -} ArcFourCipherState; +/* + * The loopback field is NULL if ctx is uninitialized (no encrypt or decrypt + * operation has taken place), or a pointer to the structure address if ctx is + * initialized. If the application copies the state (not a valid operation, + * but one which happens to works with some other enc providers), we can detect + * it via the loopback field and return a sane error code. + */ +struct arcfour_state { + struct arcfour_state *loopback; + EVP_CIPHER_CTX ctx; +}; #define RC4_KEY_SIZE 16 #define RC4_BLOCK_SIZE 1 @@ -76,59 +74,79 @@ k5_arcfour_docrypt(krb5_key key,const krb5_data *state, krb5_crypto_iov *data, size_t num_data) { size_t i; - int ret = 0, tmp_len = 0; - unsigned char *tmp_buf = NULL; + int ret = 1, tmp_len = 0; krb5_crypto_iov *iov = NULL; - EVP_CIPHER_CTX ciph_ctx; - - - EVP_CIPHER_CTX_init(&ciph_ctx); - - ret = EVP_EncryptInit_ex(&ciph_ctx, EVP_rc4(), NULL, key->keyblock.contents, NULL); - if (!ret){ - EVP_CIPHER_CTX_cleanup(&ciph_ctx); - return KRB5_CRYPTO_INTERNAL; + EVP_CIPHER_CTX ciph_ctx, *ctx; + struct arcfour_state *arcstate; + krb5_boolean do_init = TRUE; + + arcstate = (state != NULL) ? (struct arcfour_state *) state->data : NULL; + if (arcstate != NULL) { + ctx = &arcstate->ctx; + if (arcstate->loopback == arcstate) + do_init = FALSE; + else if (arcstate->loopback != NULL) + return KRB5_CRYPTO_INTERNAL; + } else { + ctx = &ciph_ctx; + } + if (do_init) { + EVP_CIPHER_CTX_init(ctx); + ret = EVP_EncryptInit_ex(ctx, EVP_rc4(), NULL, key->keyblock.contents, + NULL); + if (!ret) + return KRB5_CRYPTO_INTERNAL; } for (i = 0; i < num_data; i++) { iov = &data[i]; - if (iov->data.length <= 0) break; - tmp_len = iov->data.length; - if (ENCRYPT_IOV(iov)) { - tmp_buf=(unsigned char *)iov->data.data; - ret = EVP_EncryptUpdate(&ciph_ctx, - tmp_buf, &tmp_len, - (unsigned char *)iov->data.data, iov->data.length); - if (!ret) break; - iov->data.length = tmp_len; + ret = EVP_EncryptUpdate(ctx, + (unsigned char *) iov->data.data, &tmp_len, + (unsigned char *) iov->data.data, + iov->data.length); + if (!ret) + break; } } - if(ret) - ret = EVP_EncryptFinal_ex(&ciph_ctx, (unsigned char *)tmp_buf, &tmp_len); - EVP_CIPHER_CTX_cleanup(&ciph_ctx); + if (arcstate) /* Context is saved; mark as initialized. */ + arcstate->loopback = arcstate; + else /* Context is not saved; clean it up now. */ + EVP_CIPHER_CTX_cleanup(ctx); - if (ret != 1) + if (!ret) return KRB5_CRYPTO_INTERNAL; - iov->data.length += tmp_len; - return 0; } static krb5_error_code k5_arcfour_free_state ( krb5_data *state) { - return 0; /* not implemented */ + struct arcfour_state *arcstate = (struct arcfour_state *) state->data; + + /* Clean up the OpenSSL context if it was initialized. */ + if (arcstate && arcstate->loopback == arcstate) + EVP_CIPHER_CTX_cleanup(&arcstate->ctx); + free(arcstate); + return 0; } static krb5_error_code k5_arcfour_init_state (const krb5_keyblock *key, krb5_keyusage keyusage, krb5_data *new_state) { - return 0; /* not implemented */ - + struct arcfour_state *arcstate; + + /* Create a state structure with an uninitialized context. */ + arcstate = calloc(1, sizeof(*arcstate)); + if (arcstate == NULL) + return ENOMEM; + arcstate->loopback = NULL; + new_state->data = (char *) arcstate; + new_state->length = sizeof(*arcstate); + return 0; } /* Since the arcfour cipher is identical going forwards and backwards, @@ -147,6 +165,6 @@ const struct krb5_enc_provider krb5int_enc_arcfour = { k5_arcfour_docrypt, NULL, krb5int_arcfour_make_key, - k5_arcfour_init_state, /*xxx not implemented */ - k5_arcfour_free_state /*xxx not implemented */ + k5_arcfour_init_state, + k5_arcfour_free_state };

1 0

[AuthHub/krb5-1-8: 39/111] krb5-1.8-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit a4e3eb5f9406193227792ab7c370b996252438ff Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Feb 17 03:41:03 2010 +0000 krb5-1.8-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23730 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 4074085..7b8dc9f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 38/111] README and patchlevel.h for krb5-1.8-beta1
by sbose 15 Mar '11

15 Mar '11

commit cea94b67509e4685b240780714debf7b4394f77d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Feb 17 03:13:29 2010 +0000 README and patchlevel.h for krb5-1.8-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23728 dc483132-0cff-0310-8789-dd5450dbe970 NOTICE | 548 ++++++++++++++++++++++++++++++++++++ README | 820 ++++++++++++++++-------------------------------------- src/patchlevel.h | 4 +- 3 files changed, 786 insertions(+), 586 deletions(-) --- diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..b34a0be --- /dev/null +++ b/NOTICE @@ -0,0 +1,548 @@ +Copyright (C) 1985-2010 by the Massachusetts Institute of Technology. + +All rights reserved. + +Export of this software from the United States of America may require +a specific license from the United States Government. It is the +responsibility of any person or organization contemplating export to +obtain such a license before exporting. + +WITHIN THAT CONSTRAINT, permission to use, copy, modify, and +distribute this software and its documentation for any purpose and +without fee is hereby granted, provided that the above copyright +notice appear in all copies and that both that copyright notice and +this permission notice appear in supporting documentation, and that +the name of M.I.T. not be used in advertising or publicity pertaining +to distribution of the software without specific, written prior +permission. Furthermore if you modify this software you must label +your software as modified software and not distribute it in such a +fashion that it might be confused with the original MIT software. +M.I.T. makes no representations about the suitability of this software +for any purpose. It is provided "as is" without express or implied +warranty. + +THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED +WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. + +Individual source code files are copyright MIT, Cygnus Support, +Novell, OpenVision Technologies, Oracle, Red Hat, Sun Microsystems, +FundsXpress, and others. + +Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira, +and Zephyr are trademarks of the Massachusetts Institute of Technology +(MIT). No commercial use of these trademarks may be made without +prior written permission of MIT. + +"Commercial use" means use of a name in a product or other for-profit +manner. It does NOT prevent a commercial firm from referring to the +MIT trademarks in order to convey information (although in doing so, +recognition of their trademark status should be given). + + -------------------- + +Portions of src/lib/crypto have the following copyright: + + Copyright (C) 1998 by the FundsXpress, INC. + + All rights reserved. + + Export of this software from the United States of America may require + a specific license from the United States Government. It is the + responsibility of any person or organization contemplating export to + obtain such a license before exporting. + + WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + distribute this software and its documentation for any purpose and + without fee is hereby granted, provided that the above copyright + notice appear in all copies and that both that copyright notice and + this permission notice appear in supporting documentation, and that + the name of FundsXpress. not be used in advertising or publicity pertaining + to distribution of the software without specific, written prior + permission. FundsXpress makes no representations about the suitability of + this software for any purpose. It is provided "as is" without express + or implied warranty. + + THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED + WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. + + + -------------------- + +The following copyright and permission notice applies to the +OpenVision Kerberos Administration system located in kadmin/create, +kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions +of lib/rpc: + + Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved + + WARNING: Retrieving the OpenVision Kerberos Administration system + source code, as described below, indicates your acceptance of the + following terms. If you do not agree to the following terms, do not + retrieve the OpenVision Kerberos administration system. + + You may freely use and distribute the Source Code and Object Code + compiled from it, with or without modification, but this Source + Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY, + INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR + FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER + EXPRESS OR IMPLIED. IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY + FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR + CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, + WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE + CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY + OTHER REASON. + + OpenVision retains all copyrights in the donated Source Code. OpenVision + also retains copyright to derivative works of the Source Code, whether + created by OpenVision or by a third party. The OpenVision copyright + notice must be preserved if derivative works are made based on the + donated Source Code. + + OpenVision Technologies, Inc. has donated this Kerberos + Administration system to MIT for inclusion in the standard + Kerberos 5 distribution. This donation underscores our + commitment to continuing Kerberos technology development + and our gratitude for the valuable work which has been + performed by MIT and the Kerberos community. + + -------------------- + + Portions contributed by Matt Crawford <crawdad(a)fnal.gov> were + work performed at Fermi National Accelerator Laboratory, which is + operated by Universities Research Association, Inc., under + contract DE-AC02-76CHO3000 with the U.S. Department of Energy. + + -------------------- + +The implementation of the Yarrow pseudo-random number generator in +src/lib/crypto/yarrow has the following copyright: + + Copyright 2000 by Zero-Knowledge Systems, Inc. + + Permission to use, copy, modify, distribute, and sell this software + and its documentation for any purpose is hereby granted without fee, + provided that the above copyright notice appear in all copies and that + both that copyright notice and this permission notice appear in + supporting documentation, and that the name of Zero-Knowledge Systems, + Inc. not be used in advertising or publicity pertaining to + distribution of the software without specific, written prior + permission. Zero-Knowledge Systems, Inc. makes no representations + about the suitability of this software for any purpose. It is + provided "as is" without express or implied warranty. + + ZERO-KNOWLEDGE SYSTEMS, INC. DISCLAIMS ALL WARRANTIES WITH REGARD TO + THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND + FITNESS, IN NO EVENT SHALL ZERO-KNOWLEDGE SYSTEMS, INC. BE LIABLE FOR + ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTUOUS ACTION, ARISING OUT + OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + + -------------------- + +The implementation of the AES encryption algorithm in +src/lib/crypto/aes has the following copyright: + + Copyright (c) 2001, Dr Brian Gladman <brg(a)gladman.uk.net>, Worcester, UK. + All rights reserved. + + LICENSE TERMS + + The free distribution and use of this software in both source and binary + form is allowed (with or without changes) provided that: + + 1. distributions of this source code include the above copyright + notice, this list of conditions and the following disclaimer; + + 2. distributions in binary form include the above copyright + notice, this list of conditions and the following disclaimer + in the documentation and/or other associated materials; + + 3. the copyright holder's name is not used to endorse products + built using this software without specific written permission. + + DISCLAIMER + + This software is provided 'as is' with no explcit or implied warranties + in respect of any properties, including, but not limited to, correctness + and fitness for purpose. + + -------------------- + +Portions contributed by Red Hat, including the pre-authentication +plug-ins framework, contain the following copyright: + + Copyright (c) 2006 Red Hat, Inc. + Portions copyright (c) 2006 Massachusetts Institute of Technology + All Rights Reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided + with the distribution. + + * Neither the name of Red Hat, Inc., nor the names of its + contributors may be used to endorse or promote products derived + from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER + OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------- + +The implementations of GSSAPI mechglue in GSSAPI-SPNEGO in +src/lib/gssapi, including the following files: + + lib/gssapi/generic/gssapi_err_generic.et + lib/gssapi/mechglue/g_accept_sec_context.c + lib/gssapi/mechglue/g_acquire_cred.c + lib/gssapi/mechglue/g_canon_name.c + lib/gssapi/mechglue/g_compare_name.c + lib/gssapi/mechglue/g_context_time.c + lib/gssapi/mechglue/g_delete_sec_context.c + lib/gssapi/mechglue/g_dsp_name.c + lib/gssapi/mechglue/g_dsp_status.c + lib/gssapi/mechglue/g_dup_name.c + lib/gssapi/mechglue/g_exp_sec_context.c + lib/gssapi/mechglue/g_export_name.c + lib/gssapi/mechglue/g_glue.c + lib/gssapi/mechglue/g_imp_name.c + lib/gssapi/mechglue/g_imp_sec_context.c + lib/gssapi/mechglue/g_init_sec_context.c + lib/gssapi/mechglue/g_initialize.c + lib/gssapi/mechglue/g_inquire_context.c + lib/gssapi/mechglue/g_inquire_cred.c + lib/gssapi/mechglue/g_inquire_names.c + lib/gssapi/mechglue/g_process_context.c + lib/gssapi/mechglue/g_rel_buffer.c + lib/gssapi/mechglue/g_rel_cred.c + lib/gssapi/mechglue/g_rel_name.c + lib/gssapi/mechglue/g_rel_oid_set.c + lib/gssapi/mechglue/g_seal.c + lib/gssapi/mechglue/g_sign.c + lib/gssapi/mechglue/g_store_cred.c + lib/gssapi/mechglue/g_unseal.c + lib/gssapi/mechglue/g_userok.c + lib/gssapi/mechglue/g_utils.c + lib/gssapi/mechglue/g_verify.c + lib/gssapi/mechglue/gssd_pname_to_uid.c + lib/gssapi/mechglue/mglueP.h + lib/gssapi/mechglue/oid_ops.c + lib/gssapi/spnego/gssapiP_spnego.h + lib/gssapi/spnego/spnego_mech.c + +and the initial implementation of incremental propagation, including +the following new or changed files: + + include/iprop_hdr.h + kadmin/server/ipropd_svc.c + lib/kdb/iprop.x + lib/kdb/kdb_convert.c + lib/kdb/kdb_log.c + lib/kdb/kdb_log.h + lib/krb5/error_tables/kdb5_err.et + slave/kpropd_rpc.c + slave/kproplog.c + +and marked portions of the following files: + + lib/krb5/os/hst_realm.c + +are subject to the following license: + + Copyright (c) 2004 Sun Microsystems, Inc. + + Permission is hereby granted, free of charge, to any person obtaining a + copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. + IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY + CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, + TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE + SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + -------------------- + +MIT Kerberos includes documentation and software developed at the +University of California at Berkeley, which includes this copyright +notice: + + Copyright (C) 1983 Regents of the University of California. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions + are met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided + with the distribution. + + 3. Neither the name of the University nor the names of its + contributors may be used to endorse or promote products derived + from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS" AND + ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + SUCH DAMAGE. + + -------------------- + +Portions contributed by Novell, Inc., including the LDAP database +backend, are subject to the following license: + + Copyright (c) 2004-2005, Novell, Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + * The copyright holder's name is not used to endorse or promote products + derived from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE + LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + -------------------- + +Portions funded by Sandia National Laboratory and developed by the +University of Michigan's Center for Information Technology +Integration, including the PKINIT implementation, are subject to the +following license: + + COPYRIGHT (C) 2006-2007 + THE REGENTS OF THE UNIVERSITY OF MICHIGAN + ALL RIGHTS RESERVED + + Permission is granted to use, copy, create derivative works + and redistribute this software and such derivative works + for any purpose, so long as the name of The University of + Michigan is not used in any advertising or publicity + pertaining to the use of distribution of this software + without specific, written prior authorization. If the + above copyright notice or any other identification of the + University of Michigan is included in any copy of any + portion of this software, then the disclaimer below must + also be included. + + THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION + FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY + PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF + MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING + WITHOUT LIMITATION THE IMPLIED WARRANTIES OF + MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE + REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE + FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR + CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING + OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN + IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF + SUCH DAMAGES. + + -------------------- + +The pkcs11.h file included in the PKINIT code has the following +license: + + Copyright 2006 g10 Code GmbH + Copyright 2006 Andreas Jellinghaus + + This file is free software; as a special exception the author gives + unlimited permission to copy and/or distribute it, with or without + modifications, as long as this notice is preserved. + + This file is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY, to the extent permitted by law; without even + the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR + PURPOSE. + + -------------------- + +Portions contributed by Apple Inc. are subject to the following license: + +Copyright 2004-2008 Apple Inc. All Rights Reserved. + +Export of this software from the United States of America may require +a specific license from the United States Government. It is the +responsibility of any person or organization contemplating export to +obtain such a license before exporting. + +WITHIN THAT CONSTRAINT, permission to use, copy, modify, and +distribute this software and its documentation for any purpose and +without fee is hereby granted, provided that the above copyright +notice appear in all copies and that both that copyright notice and +this permission notice appear in supporting documentation, and that +the name of Apple Inc. not be used in advertising or publicity pertaining +to distribution of the software without specific, written prior +permission. Apple Inc. makes no representations about the suitability of +this software for any purpose. It is provided "as is" without express +or implied warranty. + +THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED +WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. + + -------------------- + +The implementations of strlcpy and strlcat in +src/util/support/strlcat.c have the following copyright and permission +notice: + +Copyright (c) 1998 Todd C. Miller <Todd.Miller(a)courtesan.com> + +Permission to use, copy, modify, and distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + + -------------------- + +The implementations of UTF-8 string handling in src/util/support and +src/lib/krb5/unicode are subject to the following copyright and +permission notice: + +The OpenLDAP Public License + Version 2.8, 17 August 2003 + +Redistribution and use of this software and associated documentation +("Software"), with or without modification, are permitted provided +that the following conditions are met: + +1. Redistributions in source form must retain copyright statements + and notices, + +2. Redistributions in binary form must reproduce applicable copyright + statements and notices, this list of conditions, and the following + disclaimer in the documentation and/or other materials provided + with the distribution, and + +3. Redistributions must contain a verbatim copy of this document. + +The OpenLDAP Foundation may revise this license from time to time. +Each revision is distinguished by a version number. You may use +this Software under terms of this license revision or under the +terms of any subsequent revision of the license. + +THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS +CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY +AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT +SHALL THE OPENLDAP FOUNDATION, ITS CONTRIBUTORS, OR THE AUTHOR(S) +OR OWNER(S) OF THE SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, +BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; +LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN +ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +The names of the authors and copyright holders must not be used in +advertising or otherwise to promote the sale, use or other dealing +in this Software without specific, written prior permission. Title +to copyright in this Software shall at all times remain with copyright +holders. + +OpenLDAP is a registered trademark of the OpenLDAP Foundation. + +Copyright 1999-2003 The OpenLDAP Foundation, Redwood City, +California, USA. All Rights Reserved. Permission to copy and +distribute verbatim copies of this document is granted. + + -------------------- + +Marked test programs in src/lib/krb5/krb have the following copyright: + +Copyright (c) 2006 Kungliga Tekniska Högskolan +(Royal Institute of Technology, Stockholm, Sweden). +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: + +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +3. Neither the name of KTH nor the names of its contributors may be + used to endorse or promote products derived from this software without + specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY +EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE +LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF +ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------- diff --git a/README b/README index c1eabc5..26e516b 100644 --- a/README +++ b/README @@ -3,24 +3,22 @@ Release Notes The MIT Kerberos Team -Unpacking the Source Distribution ---------------------------------- +Copyright and Other Notices +--------------------------- -The source distribution of Kerberos 5 comes in a gzipped tarfile, -krb5-1.8.tar.gz. Instructions on how to extract the entire -distribution follow. +Copyright (C) 1985-2010 by the Massachusetts Institute of Technology +and its contributors. All rights reserved. -If you have the GNU tar program and gzip installed, you can simply do: +Please see the file named NOTICE for additional notices. - gtar zxpf krb5-1.8.tar.gz +MIT Kerberos is a project of the MIT Kerberos Consortium. For more +information about the Kerberos Consortium, see http://kerberos.org/ -If you don't have GNU tar, you will need to get the FSF gzip -distribution and use gzcat: +For more information about the MIT Kerberos software, see + http://web.mit.edu/kerberos/ - gzcat krb5-1.8.tar.gz | tar xpf - - -Both of these methods will extract the sources into krb5-1.8/src and -the documentation into krb5-1.8/doc. +People interested in participating in the MIT Kerberos development +effort should see http://k5wiki.kerberos.org/ Building and Installing Kerberos 5 ---------------------------------- @@ -53,9 +51,13 @@ If you are not able to use krb5-send-pr because you haven't been able compile and install Kerberos V5 on any platform, you may send mail to krb5-bugs(a)mit.edu. +Please keep in mind that unencrypted e-mail is not secure. If you need +to report a security vulnerability, or send sensitive information, +please PGP-encrypt it to krbcore-security(a)mit.edu. + You may view bug reports by visiting -http://krbdev.mit.edu/rt/ + http://krbdev.mit.edu/rt/ and logging in as "guest" with password "guest". @@ -65,8 +67,9 @@ DES transition The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration -variable that enables "weak" enctypes, which defaults to "false" -beginning with krb5-1.8. +variable that enables "weak" enctypes, which now defaults to "false" +beginning with krb5-1.8. The krb5-1.8 release includes additional +measures to ease the transition away from single-DES. Major changes in 1.8 -------------------- @@ -75,7 +78,7 @@ The krb5-1.8 release contains a large number of changes, featuring improvements in the following broad areas: * Code quality -* Modularity +* Developer experience * Performance * End-user experience * Administrator experience @@ -86,19 +89,23 @@ Code quality: * Move toward test-driven development -- new features have test code, or at least written testing procedures. +* Remove applications to a separate distribution to simplify + independent maintenance. + * Increase conformance to coding style + "The great reindent" + Selective refactoring -Modularity: +Developer experience: * Crypto modularity -- vendors can more easily substitute their own crypto implementations, which might be hardware-accelerated or validated to FIPS 140, for the builtin crypto implementation that has historically shipped as part of MIT Kerberos. Currently, only - an OpenSSL provider is included, but others are possible. + an OpenSSL provider is included, but others are planned for the + future. * Move toward improved KDB interface @@ -130,9 +137,15 @@ Administrator experience: password guessing attacks, and helps with some enterprise regulatory compliance. +* Bridge layer to allow Heimdal HDB modules to act as KDB backend + modules. This provides a migration path from a Heimdal to an MIT + KDC. + Protocol evolution: -* FAST enhancements -- preauthentication framework enhancements +* FAST enhancements -- preauthentication framework enhancements to + allow a client to securely negotiate the use of FAST with a KDC of + unknown capabilities. * Microsoft Services for User (S4U) compatibility: S4U2Self, also known as "protocol transition", allows for service to ask a KDC for @@ -143,6 +156,10 @@ Protocol evolution: * Anonymous PKINIT -- allows the use of public-key cryptography to anonymously authenticate to a realm +* Support doing constrained delegation similar to Microsoft's + S4U2Proxy without the use of the Windows PAC. This functionality + uses a protocol compatible with Heimdal. + krb5-1.8 changes by ticket ID ----------------------------- @@ -152,6 +169,7 @@ krb5-1.8 changes by ticket ID 6454 Make krb5_mkt_resolve error handling work 6510 Restore limited support for static linking 6539 Enctype list configuration enhancements +6546 KDB should use enctype of stashed master key 6547 Modify kadm5 initializers to accept krb5 contexts 6563 Implement s4u extensions 6564 s4u extensions integration broke test suite... @@ -166,9 +184,14 @@ krb5-1.8 changes by ticket ID 6586 libkrb5 support for non-blocking AS requests 6590 allow testing even if name->addr->name mapping doesn't work 6591 fix slow behavior on Mac OS X with link-local addresses +6592 handle negative enctypes better 6593 Remove dependency on /bin/csh in test suite 6595 FAST (preauth framework) negotiation 6597 Add GSS extensions to store credentials, generate random bits +6598 gss_init_sec_context potential segfault +6599 memory leak in krb5_rd_req_decrypt_tkt_part +6600 gss_inquire_context cannot handle no target name from mechanism +6601 gsssspi_set_cred_option cannot handle mech specific option 6605 PKINIT client should validate SAN for TGS, not service principal 6606 allow testing when offline 6607 anonymous PKINIT @@ -176,567 +199,196 @@ krb5-1.8 changes by ticket ID 6618 Support optional creation of PID files for krb5kdc and kadmind 6620 kdc_supported_enctypes does nothing; eradicate mentions thereof 6621 disable weak crypto by default - -Copyright and Other Legal Notices ---------------------------------- - -Copyright (C) 1985-2010 by the Massachusetts Institute of Technology. - -All rights reserved. - -Export of this software from the United States of America may require -a specific license from the United States Government. It is the -responsibility of any person or organization contemplating export to -obtain such a license before exporting. - -WITHIN THAT CONSTRAINT, permission to use, copy, modify, and -distribute this software and its documentation for any purpose and -without fee is hereby granted, provided that the above copyright -notice appear in all copies and that both that copyright notice and -this permission notice appear in supporting documentation, and that -the name of M.I.T. not be used in advertising or publicity pertaining -to distribution of the software without specific, written prior -permission. Furthermore if you modify this software you must label -your software as modified software and not distribute it in such a -fashion that it might be confused with the original MIT software. -M.I.T. makes no representations about the suitability of this software -for any purpose. It is provided "as is" without express or implied -warranty. - -THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR -IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. - -Individual source code files are copyright MIT, Cygnus Support, -Novell, OpenVision Technologies, Oracle, Red Hat, Sun Microsystems, -FundsXpress, and others. - -Project Athena, Athena, Athena MUSE, Discuss, Hesiod, Kerberos, Moira, -and Zephyr are trademarks of the Massachusetts Institute of Technology -(MIT). No commercial use of these trademarks may be made without -prior written permission of MIT. - -"Commercial use" means use of a name in a product or other for-profit -manner. It does NOT prevent a commercial firm from referring to the -MIT trademarks in order to convey information (although in doing so, -recognition of their trademark status should be given). - - -------------------- - -Portions of src/lib/crypto have the following copyright: - - Copyright (C) 1998 by the FundsXpress, INC. - - All rights reserved. - - Export of this software from the United States of America may require - a specific license from the United States Government. It is the - responsibility of any person or organization contemplating export to - obtain such a license before exporting. - - WITHIN THAT CONSTRAINT, permission to use, copy, modify, and - distribute this software and its documentation for any purpose and - without fee is hereby granted, provided that the above copyright - notice appear in all copies and that both that copyright notice and - this permission notice appear in supporting documentation, and that - the name of FundsXpress. not be used in advertising or publicity pertaining - to distribution of the software without specific, written prior - permission. FundsXpress makes no representations about the suitability of - this software for any purpose. It is provided "as is" without express - or implied warranty. - - THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR - IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED - WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. - - - -------------------- - -The following copyright and permission notice applies to the -OpenVision Kerberos Administration system located in kadmin/create, -kadmin/dbutil, kadmin/passwd, kadmin/server, lib/kadm5, and portions -of lib/rpc: - - Copyright, OpenVision Technologies, Inc., 1996, All Rights Reserved - - WARNING: Retrieving the OpenVision Kerberos Administration system - source code, as described below, indicates your acceptance of the - following terms. If you do not agree to the following terms, do not - retrieve the OpenVision Kerberos administration system. - - You may freely use and distribute the Source Code and Object Code - compiled from it, with or without modification, but this Source - Code is provided to you "AS IS" EXCLUSIVE OF ANY WARRANTY, - INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY OR - FITNESS FOR A PARTICULAR PURPOSE, OR ANY OTHER WARRANTY, WHETHER - EXPRESS OR IMPLIED. IN NO EVENT WILL OPENVISION HAVE ANY LIABILITY - FOR ANY LOST PROFITS, LOSS OF DATA OR COSTS OF PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES, OR FOR ANY SPECIAL, INDIRECT, OR - CONSEQUENTIAL DAMAGES ARISING OUT OF THIS AGREEMENT, INCLUDING, - WITHOUT LIMITATION, THOSE RESULTING FROM THE USE OF THE SOURCE - CODE, OR THE FAILURE OF THE SOURCE CODE TO PERFORM, OR FOR ANY - OTHER REASON. - - OpenVision retains all copyrights in the donated Source Code. OpenVision - also retains copyright to derivative works of the Source Code, whether - created by OpenVision or by a third party. The OpenVision copyright - notice must be preserved if derivative works are made based on the - donated Source Code. - - OpenVision Technologies, Inc. has donated this Kerberos - Administration system to MIT for inclusion in the standard - Kerberos 5 distribution. This donation underscores our - commitment to continuing Kerberos technology development - and our gratitude for the valuable work which has been - performed by MIT and the Kerberos community. - - -------------------- - - Portions contributed by Matt Crawford <crawdad(a)fnal.gov> were - work performed at Fermi National Accelerator Laboratory, which is - operated by Universities Research Association, Inc., under - contract DE-AC02-76CHO3000 with the U.S. Department of Energy. - - -------------------- - -The implementation of the Yarrow pseudo-random number generator in -src/lib/crypto/yarrow has the following copyright: - - Copyright 2000 by Zero-Knowledge Systems, Inc. - - Permission to use, copy, modify, distribute, and sell this software - and its documentation for any purpose is hereby granted without fee, - provided that the above copyright notice appear in all copies and that - both that copyright notice and this permission notice appear in - supporting documentation, and that the name of Zero-Knowledge Systems, - Inc. not be used in advertising or publicity pertaining to - distribution of the software without specific, written prior - permission. Zero-Knowledge Systems, Inc. makes no representations - about the suitability of this software for any purpose. It is - provided "as is" without express or implied warranty. - - ZERO-KNOWLEDGE SYSTEMS, INC. DISCLAIMS ALL WARRANTIES WITH REGARD TO - THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND - FITNESS, IN NO EVENT SHALL ZERO-KNOWLEDGE SYSTEMS, INC. BE LIABLE FOR - ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES - WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN - ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTUOUS ACTION, ARISING OUT - OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - - -------------------- - -The implementation of the AES encryption algorithm in -src/lib/crypto/aes has the following copyright: - - Copyright (c) 2001, Dr Brian Gladman <brg(a)gladman.uk.net>, Worcester, UK. - All rights reserved. - - LICENSE TERMS - - The free distribution and use of this software in both source and binary - form is allowed (with or without changes) provided that: - - 1. distributions of this source code include the above copyright - notice, this list of conditions and the following disclaimer; - - 2. distributions in binary form include the above copyright - notice, this list of conditions and the following disclaimer - in the documentation and/or other associated materials; - - 3. the copyright holder's name is not used to endorse products - built using this software without specific written permission. - - DISCLAIMER - - This software is provided 'as is' with no explcit or implied warranties - in respect of any properties, including, but not limited to, correctness - and fitness for purpose. - - -------------------- - -Portions contributed by Red Hat, including the pre-authentication -plug-ins framework, contain the following copyright: - - Copyright (c) 2006 Red Hat, Inc. - Portions copyright (c) 2006 Massachusetts Institute of Technology - All Rights Reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions - are met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above - copyright notice, this list of conditions and the following - disclaimer in the documentation and/or other materials provided - with the distribution. - - * Neither the name of Red Hat, Inc., nor the names of its - contributors may be used to endorse or promote products derived - from this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS - IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED - TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A - PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER - OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, - EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, - PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR - PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF - LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING - NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - -------------------- - -The implementations of GSSAPI mechglue in GSSAPI-SPNEGO in -src/lib/gssapi, including the following files: - - lib/gssapi/generic/gssapi_err_generic.et - lib/gssapi/mechglue/g_accept_sec_context.c - lib/gssapi/mechglue/g_acquire_cred.c - lib/gssapi/mechglue/g_canon_name.c - lib/gssapi/mechglue/g_compare_name.c - lib/gssapi/mechglue/g_context_time.c - lib/gssapi/mechglue/g_delete_sec_context.c - lib/gssapi/mechglue/g_dsp_name.c - lib/gssapi/mechglue/g_dsp_status.c - lib/gssapi/mechglue/g_dup_name.c - lib/gssapi/mechglue/g_exp_sec_context.c - lib/gssapi/mechglue/g_export_name.c - lib/gssapi/mechglue/g_glue.c - lib/gssapi/mechglue/g_imp_name.c - lib/gssapi/mechglue/g_imp_sec_context.c - lib/gssapi/mechglue/g_init_sec_context.c - lib/gssapi/mechglue/g_initialize.c - lib/gssapi/mechglue/g_inquire_context.c - lib/gssapi/mechglue/g_inquire_cred.c - lib/gssapi/mechglue/g_inquire_names.c - lib/gssapi/mechglue/g_process_context.c - lib/gssapi/mechglue/g_rel_buffer.c - lib/gssapi/mechglue/g_rel_cred.c - lib/gssapi/mechglue/g_rel_name.c - lib/gssapi/mechglue/g_rel_oid_set.c - lib/gssapi/mechglue/g_seal.c - lib/gssapi/mechglue/g_sign.c - lib/gssapi/mechglue/g_store_cred.c - lib/gssapi/mechglue/g_unseal.c - lib/gssapi/mechglue/g_userok.c - lib/gssapi/mechglue/g_utils.c - lib/gssapi/mechglue/g_verify.c - lib/gssapi/mechglue/gssd_pname_to_uid.c - lib/gssapi/mechglue/mglueP.h - lib/gssapi/mechglue/oid_ops.c - lib/gssapi/spnego/gssapiP_spnego.h - lib/gssapi/spnego/spnego_mech.c - -and the initial implementation of incremental propagation, including -the following new or changed files: - - include/iprop_hdr.h - kadmin/server/ipropd_svc.c - lib/kdb/iprop.x - lib/kdb/kdb_convert.c - lib/kdb/kdb_log.c - lib/kdb/kdb_log.h - lib/krb5/error_tables/kdb5_err.et - slave/kpropd_rpc.c - slave/kproplog.c - -and marked portions of the following files: - - lib/krb5/os/hst_realm.c - -are subject to the following license: - - Copyright (c) 2004 Sun Microsystems, Inc. - - Permission is hereby granted, free of charge, to any person obtaining a - copy of this software and associated documentation files (the - "Software"), to deal in the Software without restriction, including - without limitation the rights to use, copy, modify, merge, publish, - distribute, sublicense, and/or sell copies of the Software, and to - permit persons to whom the Software is furnished to do so, subject to - the following conditions: - - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. - IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY - CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, - TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE - SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - -------------------- - -MIT Kerberos includes documentation and software developed at the -University of California at Berkeley, which includes this copyright -notice: - - Copyright (C) 1983 Regents of the University of California. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions - are met: - - 1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above - copyright notice, this list of conditions and the following - disclaimer in the documentation and/or other materials provided - with the distribution. - - 3. Neither the name of the University nor the names of its - contributors may be used to endorse or promote products derived - from this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS" AND - ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE - FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - SUCH DAMAGE. - - -------------------- - -Portions contributed by Novell, Inc., including the LDAP database -backend, are subject to the following license: - - Copyright (c) 2004-2005, Novell, Inc. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - * The copyright holder's name is not used to endorse or promote products - derived from this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" - AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE - LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR - CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - -------------------- - -Portions funded by Sandia National Laboratory and developed by the -University of Michigan's Center for Information Technology -Integration, including the PKINIT implementation, are subject to the -following license: - - COPYRIGHT (C) 2006-2007 - THE REGENTS OF THE UNIVERSITY OF MICHIGAN - ALL RIGHTS RESERVED - - Permission is granted to use, copy, create derivative works - and redistribute this software and such derivative works - for any purpose, so long as the name of The University of - Michigan is not used in any advertising or publicity - pertaining to the use of distribution of this software - without specific, written prior authorization. If the - above copyright notice or any other identification of the - University of Michigan is included in any copy of any - portion of this software, then the disclaimer below must - also be included. - - THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION - FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY - PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF - MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING - WITHOUT LIMITATION THE IMPLIED WARRANTIES OF - MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE - REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE - FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR - CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING - OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN - IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF - SUCH DAMAGES. - - -------------------- - -The pkcs11.h file included in the PKINIT code has the following -license: - - Copyright 2006 g10 Code GmbH - Copyright 2006 Andreas Jellinghaus - - This file is free software; as a special exception the author gives - unlimited permission to copy and/or distribute it, with or without - modifications, as long as this notice is preserved. - - This file is distributed in the hope that it will be useful, but - WITHOUT ANY WARRANTY, to the extent permitted by law; without even - the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR - PURPOSE. - - -------------------- - -Portions contributed by Apple Inc. are subject to the following license: - -Copyright 2004-2008 Apple Inc. All Rights Reserved. - -Export of this software from the United States of America may require -a specific license from the United States Government. It is the -responsibility of any person or organization contemplating export to -obtain such a license before exporting. - -WITHIN THAT CONSTRAINT, permission to use, copy, modify, and -distribute this software and its documentation for any purpose and -without fee is hereby granted, provided that the above copyright -notice appear in all copies and that both that copyright notice and -this permission notice appear in supporting documentation, and that -the name of Apple Inc. not be used in advertising or publicity pertaining -to distribution of the software without specific, written prior -permission. Apple Inc. makes no representations about the suitability of -this software for any purpose. It is provided "as is" without express -or implied warranty. - -THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR -IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. - - -------------------- - -The implementations of strlcpy and strlcat in -src/util/support/strlcat.c have the following copyright and permission -notice: - -Copyright (c) 1998 Todd C. Miller <Todd.Miller(a)courtesan.com> - -Permission to use, copy, modify, and distribute this software for any -purpose with or without fee is hereby granted, provided that the above -copyright notice and this permission notice appear in all copies. - -THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES -WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR -ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES -WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN -ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF -OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. - - -------------------- - -The implementations of UTF-8 string handling in src/util/support and -src/lib/krb5/unicode are subject to the following copyright and -permission notice: - -The OpenLDAP Public License - Version 2.8, 17 August 2003 - -Redistribution and use of this software and associated documentation -("Software"), with or without modification, are permitted provided -that the following conditions are met: - -1. Redistributions in source form must retain copyright statements - and notices, - -2. Redistributions in binary form must reproduce applicable copyright - statements and notices, this list of conditions, and the following - disclaimer in the documentation and/or other materials provided - with the distribution, and - -3. Redistributions must contain a verbatim copy of this document. - -The OpenLDAP Foundation may revise this license from time to time. -Each revision is distinguished by a version number. You may use -this Software under terms of this license revision or under the -terms of any subsequent revision of the license. - -THIS SOFTWARE IS PROVIDED BY THE OPENLDAP FOUNDATION AND ITS -CONTRIBUTORS ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, -INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT -SHALL THE OPENLDAP FOUNDATION, ITS CONTRIBUTORS, OR THE AUTHOR(S) -OR OWNER(S) OF THE SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, -INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, -BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN -ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -POSSIBILITY OF SUCH DAMAGE. - -The names of the authors and copyright holders must not be used in -advertising or otherwise to promote the sale, use or other dealing -in this Software without specific, written prior permission. Title -to copyright in this Software shall at all times remain with copyright -holders. - -OpenLDAP is a registered trademark of the OpenLDAP Foundation. - -Copyright 1999-2003 The OpenLDAP Foundation, Redwood City, -California, USA. All Rights Reserved. Permission to copy and -distribute verbatim copies of this document is granted. - - -------------------- - -Marked test programs in src/lib/krb5/krb have the following copyright: - -Copyright (c) 2006 Kungliga Tekniska Högskolan -(Royal Institute of Technology, Stockholm, Sweden). -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions -are met: - -1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - -3. Neither the name of KTH nor the names of its contributors may be - used to endorse or promote products derived from this software without - specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY -EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE -LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR -CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF -SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR -BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, -WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR -OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF -ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Acknowledgements for krb5-1.8 ------------------------------ - -Thanks to the members of the Kerberos V5 development team at MIT, both -past and present: Danilo Almeida, Jeffrey Altman, Justin Anderson, -Richard Basch, Jay Berkenbilt, Mitch Berger, Andrew Boardman, Joe -Calzaretta, John Carr, Don Davis, Alexandra Ellwood, Nancy Gilman, -Matt Hancher, Sam Hartman, Paul Hill, Marc Horowitz, Eva Jacobus, -Miroslav Jurisic, Barry Jaspan, Geoffrey King, Kevin Koch, John Kohl, -Peter Litwack, Scott McGuire, Kevin Mitchell, Cliff Neuman, Paul Park, -Ezra Peisach, Chris Provenzano, Ken Raeburn, Jon Rochlis, Jeff -Schiller, Jen Selby, Robert Silk, Brad Thompson, Harry Tsai, Zhanna -Tsitkova, Ted Ts'o, Marshall Vale, Tom Yu. +6622 kinit_fast fails if weak enctype is among client principal keys +6623 Always treat anonymous as preauth required +6624 automated tests for anonymous pkinit +6625 yarrow code does not initialize keyblock enctype and uses unitialized value +6626 Restore interoperability with 1.6 addprinc -randkey +6627 Set enctype in crypto_tests to prevent memory leaks +6628 krb5int_dk_string_to_key fails to set enctype +6629 krb5int_derive_key results in cache with uninitialized values +6630 krb5int_pbkdf2_hmac_sha1 fails to set enctype on keyblock +6632 Simplify and fix FAST check for keyed checksum type +6634 Use keyed checksum type for DES FAST +6640 Make history key exempt from permitted_enctypes +6642 Add test program for decryption of overly short buffers +6643 Problem with krb5 libcom_err vs. system libcom_err +6644 Change basename of libkadm5 libraries to avoid Heimdal conflict +6645 Add krb5_allow_weak_crypto API +6648 define MIN() in lib/gssapi/krb5/prf.c +6649 Get rid of kdb_ext.h and allow out-of-tree KDB plugins +6651 Handle migration from pre-1.7 databases with master key kvno != 1 (1.8 pullup) +6652 Make decryption of master key list more robust +6653 set_default_enctype_var should filter not reject weak enctypes +6654 Fix greet_server build +6655 Fix cross-realm handling of AD-SIGNEDPATH +6656 krb5int_fast_free_state segfaults if state is null +6657 enc_padata can include empty sequence +6658 Implement gss_set_neg_mechs +6660 Minimal support for updating history key +6662 MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service +6663 update mkrel to deal with changed source layout + +Acknowledgements +---------------- + +Past and present Sponsors of the MIT Kerberos Consortium: + + Apple + Carnegie Mellon University + Centrify Corporation + Columbia University + Cornell University + The Department of Defense of the United States of America (DoD) + Google + Iowa State University + MIT + Michigan State University + Microsoft + The National Aeronautics and Space Administration + of the United States of America (NASA) + Nippon Telephone and Telegraph (NTT) + Oracle + Pennsylvania State University + Red Hat + Stanford University + TeamF1, Inc. + The University of Alaska + The University of Michigan + +Past and present members of the Kerberos Team at MIT: + + Danilo Almeida + Jeffrey Altman + Justin Anderson + Richard Basch + Mitch Berger + Jay Berkenbilt + Andrew Boardman + Bill Bryant + Steve Buckley + Joe Calzaretta + John Carr + Mark Colan + Don Davis + Alexandra Ellwood + Dan Geer + Nancy Gilman + Matt Hancher + Thomas Hardjono + Sam Hartman + Paul Hill + Marc Horowitz + Eva Jacobus + Miroslav Jurisic + Barry Jaspan + Geoffrey King + Kevin Koch + John Kohl + HaoQi Li + Peter Litwack + Scott McGuire + Steve Miller + Kevin Mitchell + Cliff Neuman + Paul Park + Ezra Peisach + Chris Provenzano + Ken Raeburn + Jon Rochlis + Jeff Schiller + Jen Selby + Robert Silk + Bill Sommerfeld + Jennifer Steiner + Ralph Swick + Brad Thompson + Harry Tsai + Zhanna Tsitkova + Ted Ts'o + Marshall Vale + Tom Yu + +The following external contributors have provided code, patches, bug +reports, suggestions, and valuable resources: + + Brandon Allbery + Russell Allbery + Michael B Allen + Derek Atkins + David Bantz + Alex Baule + Arlene Berry + Jeff Blaine + Radoslav Bodo + Emmanuel Bouillon + Michael Calmer + Ravi Channavajhala + Srinivas Cheruku + Howard Chu + Andrea Cirulli + Christopher D. Clausen + Kevin Coffman + Simon Cooper + Sylvain Cortes + Nalin Dahyabhai + Roland Dowdeswell + Jason Edgecombe + Mark Eichin + Shawn M. Emery + Douglas E. Engert + Peter Eriksson + Ronni Feldt + JC Ferguson + William Fiveash + Ákos Frohner + Marcus Granado + Scott Grizzard + Steve Grubb + Philip Guenther + Jakob Haufe + Jeff Hodges + Love Hörnquist Åstrand + Ken Hornstein + Henry B. Hotz + Luke Howard + Shumon Huque + Jeffrey Hutzelman + Wyllys Ingersoll + Holger Isenberg + Mikkel Kruse + Volker Lendecke + Ryan Lynch + Franklyn Mendez + Markus Moeller + Paul Moore + Edward Murrell + Nikos Nikoleris + Dmitri Pal + Javier Palacios + Ezra Peisach + W. Michael Petullo + Mark Phalan + Xu Qiang + Robert Relyea + Martin Rex + Guillaume Rousse + Tom Shaw + Peter Shoults + Simo Sorce + Michael Ströder + Bjørn Tore Sund + Rathor Vipin + Jorgen Wahlsten + Max (Weijun) Wang + John Washington + Marcus Watts + Simon Wilkinson + Nicolas Williams + Ross Wilper + Hanz van Zijst + +The above is not an exhaustive list; many others have contributed in +various ways to the MIT Kerberos development effort over the years. +Other acknowledgments (for bug reports and patches) are in the +doc/CHANGES file. diff --git a/src/patchlevel.h b/src/patchlevel.h index 1b2a0c6..4074085 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "alpha1-postrelease" +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-beta1"

1 0

[AuthHub/krb5-1-8: 37/111] ticket: 6663 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e0f0d4a2f90c78dfd49ebc4307a6cf9cf5750a99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 16 23:01:30 2010 +0000 ticket: 6663 version_fixed: 1.8 status: resolved pull up r23726 from trunk ------------------------------------------------------------------------ r23726 | tlyu | 2010-02-16 17:41:27 -0500 (Tue, 16 Feb 2010) | 8 lines ticket: 6663 subject: update mkrel to deal with changed source layout target_version: 1.8 tags: pullup Update mkrel so it deals somewhat better with removed src/lib/des425, NOTICES, etc. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23727 dc483132-0cff-0310-8789-dd5450dbe970 src/util/mkrel | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-) --- diff --git a/src/util/mkrel b/src/util/mkrel index ca91087..8d00357 100755 --- a/src/util/mkrel +++ b/src/util/mkrel @@ -200,6 +200,12 @@ fi echo "Generating tarfiles..." GZIP=-9; export GZIP if test $multitar = t; then + if test -d $reldir/src/lib/des425; then + des425=$reldir/src/lib/des425 + fi + if test -f $reldir/NOTICE; + then notice=$reldir/NOTICE + fi if test $dosrc = t; then gtar --exclude $reldir/src/lib/crypto \ --exclude $reldir/src/lib/des425 \ @@ -208,10 +214,10 @@ if test $multitar = t; then gtar zcf ${reldir}.crypto.tar.gz \ $reldir/src/lib/crypto \ - $reldir/src/lib/des425 + $des425 fi if test $dodoc = t; then - gtar zcf ${reldir}.doc.tar.gz $reldir/doc $reldir/README + gtar zcf ${reldir}.doc.tar.gz $reldir/doc $reldir/README $notice fi ls -l ${reldir}.*.tar.gz fi

1 0

[AuthHub/krb5-1-8: 36/111] ticket: 6662 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1d5f5b49b5809ba136c844b7d39aecfac0a14043 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 16 22:21:08 2010 +0000 ticket: 6662 version_fixed: 1.8 status: resolved pull up r23724 from trunk ------------------------------------------------------------------------ r23724 | tlyu | 2010-02-16 17:10:17 -0500 (Tue, 16 Feb 2010) | 10 lines ticket: 6662 subject: MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service tags: pullup target_version: 1.8 Code introduced in krb5-1.7 can cause an assertion failure if a KDC-REQ is internally inconsistent, specifically if the ASN.1 tag doesn't match the msg_type field. Thanks to Emmanuel Bouillon (NATO C3 Agency) for discovering and reporting this vulnerability. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23725 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_as_req.c | 5 +++++ src/kdc/do_tgs_req.c | 2 ++ src/kdc/fast_util.c | 2 +- 3 files changed, 8 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index b183dcf..3924297 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -139,6 +139,11 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, session_key.contents = 0; enc_tkt_reply.authorization_data = NULL; + if (request->msg_type != KRB5_AS_REQ) { + status = "msg_type mismatch"; + errcode = KRB5_BADMSGTYPE; + goto errout; + } errcode = kdc_make_rstate(&state); if (errcode != 0) { status = "constructing state"; diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index cb0496f..44b5791 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -143,6 +143,8 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from, retval = decode_krb5_tgs_req(pkt, &request); if (retval) return retval; + if (request->msg_type != KRB5_TGS_REQ) + return KRB5_BADMSGTYPE; /* * setup_server_realm() sets up the global realm-specific data pointer. diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index 06b1e2b..e411e32 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -384,7 +384,7 @@ kdc_fast_handle_error(krb5_context context, krb5_data *encoded_e_data = NULL; memset(outer_pa, 0, sizeof(outer_pa)); - if (!state->armor_key) + if (!state || !state->armor_key) return 0; fx_error = *err; fx_error.e_data.data = NULL;

1 0

[AuthHub/krb5-1-8: 35/111] ticket: 6660 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 41d6311cada2befe71424d79baa0bb946db4ae16 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Feb 12 20:28:51 2010 +0000 ticket: 6660 version_fixed: 1.8 status: resolved pull up r23716 from trunk ------------------------------------------------------------------------ r23716 | ghudson | 2010-02-11 11:07:08 -0500 (Thu, 11 Feb 2010) | 15 lines ticket: 6660 subject: Minimal support for updating history key target_version: 1.8 tags: pullup Add minimal support for re-randomizing the history key: * cpw -randkey kadmin/history now works, but creates only one key. * cpw -randkey -keepold kadmin/history still fails. * libkadm5 no longer caches the history key. Performance impact is minimal since password changes are not common. * randkey no longer checks the newly randomized key against old keys, and the disabled code to do so in setkey/setv4key is gone, so now only kadm5_chpass_principal_3 accesses the password history. ------------------------------------------------------------------------ git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23721 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 28 +++++- src/lib/kadm5/server_internal.h | 12 ++ src/lib/kadm5/srv/libkadm5srv_mit.exports | 3 - src/lib/kadm5/srv/server_kdb.c | 109 +++++++++---------- src/lib/kadm5/srv/svr_principal.c | 116 ++++++++------------ .../unit-test/api.current/randkey-principal.exp | 4 +- 6 files changed, 140 insertions(+), 132 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index a10a2ee..b7c87ac 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -2534,6 +2534,7 @@ passwords kept in the database. * Retrieving the List of Policies:: * Adding or Modifying Policies:: * Deleting Policies:: +* Updating the History Key:: @end menu @node Retrieving Policies, Retrieving the List of Policies, Policies, Policies @@ -2653,7 +2654,7 @@ Sets the number of past keys kept for a principal to @i{number}. This option is @noindent Note: The policies are created under realm container in the LDAP database. -@node Deleting Policies, , Adding or Modifying Policies, Policies +@node Deleting Policies, Updating the History Key, Adding or Modifying Policies, Policies @subsection Deleting Policies To delete a policy, use the @code{kadmin} @code{delete_policy} command, @@ -2680,6 +2681,31 @@ Note that you must cancel the policy from all principals before deleting it. The @code{delete_policy} command will fail if it is in use by any principals. +@node Updating the History Key, , Deleting Policies, Policies + +If a policy specifies a number of old keys kept of two or more, the +stored old keys are encrypted in a history key, which is found in the +key data of the kadmin/history principal. + +Currently there is no support for proper rollover of the history key, +but you can change the history key (for example, to use a better +encryption type) at the cost of invalidating currently stored old keys. +To change the history key, run: + +@smallexample +@group +@b{kadmin:} change_password -randkey kadmin/history +@end group +@end smallexample + +This command will fail if you specify the @b{-keepold} flag. Only one +new history key will be created, even if you specify multiple key/salt +combinations. + +In the future, we plan to migrate towards encrypting old keys in the +master key instead of the history key, and implementing proper rollover +support for stored old keys. + @node Global Operations on the Kerberos Database, Global Operations on the Kerberos LDAP Database, Policies, Administrating the Kerberos Database @section Global Operations on the Kerberos Database diff --git a/src/lib/kadm5/server_internal.h b/src/lib/kadm5/server_internal.h index 7f58750..3276b27 100644 --- a/src/lib/kadm5/server_internal.h +++ b/src/lib/kadm5/server_internal.h @@ -24,6 +24,15 @@ #include <kadm5/admin.h> #include "admin_internal.h" +/* + * This is the history key version for a newly created DB. We use this value + * for principals which have no password history yet to avoid having to look up + * the history key. Values other than 2 will cause compatibility issues with + * pre-1.8 libkadm5 code; the older code will reject key changes when it sees + * an unexpected value of admin_history_kvno. + */ +#define INITIAL_HIST_KVNO 2 + typedef struct _kadm5_server_handle_t { krb5_ui_4 magic_number; krb5_ui_4 struct_version; @@ -64,6 +73,9 @@ krb5_error_code kdb_init_master(kadm5_server_handle_t handle, char *r, int from_keyboard); krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r); +krb5_error_code kdb_get_hist_key(kadm5_server_handle_t handle, + krb5_keyblock *hist_keyblock, + krb5_kvno *hist_kvno); krb5_error_code kdb_get_entry(kadm5_server_handle_t handle, krb5_principal principal, krb5_db_entry *kdb, osa_princ_ent_rec *adb); diff --git a/src/lib/kadm5/srv/libkadm5srv_mit.exports b/src/lib/kadm5/srv/libkadm5srv_mit.exports index d8d3b22..7ba5c1a 100644 --- a/src/lib/kadm5/srv/libkadm5srv_mit.exports +++ b/src/lib/kadm5/srv/libkadm5srv_mit.exports @@ -9,9 +9,6 @@ adb_policy_close adb_policy_init destroy_dict find_word -hist_db -hist_key -hist_kvno hist_princ init_dict kadm5_set_use_password_server diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c index e1ffca2..337c142 100644 --- a/src/lib/kadm5/srv/server_kdb.c +++ b/src/lib/kadm5/srv/server_kdb.c @@ -27,9 +27,6 @@ krb5_actkvno_node *active_mkey_list = NULL; krb5_db_entry master_db; krb5_principal hist_princ; -krb5_keyblock hist_key; -krb5_db_entry hist_db; -krb5_kvno hist_kvno; /* much of this code is stolen from the kdc. there should be some library code to deal with this. */ @@ -116,28 +113,16 @@ done: * handle (r) kadm5 api server handle * r (r) realm of history principal to use, or NULL * - * Effects: This function sets the value of the following global - * variables: - * - * hist_princ krb5_principal holding the history principal - * hist_db krb5_db_entry of the history principal - * hist_key krb5_keyblock holding the history principal's key - * hist_encblock krb5_encrypt_block holding the procssed hist_key - * hist_kvno the version number of the history key - * - * If the history principal does not already exist, this function - * attempts to create it with kadm5_create_principal. WARNING! - * If the history principal is deleted and this function is executed - * (by kadmind, or kadmin.local, or anything else with permission), - * the principal will be assigned a new random key and all existing - * password history information will become useless. + * Effects: This function sets the value of the hist_princ global variable. If + * the history principal does not already exist, this function attempts to + * create it with kadm5_create_principal. */ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) { int ret = 0; char *realm, *hist_name; krb5_key_salt_tuple ks[1]; - krb5_keyblock *tmp_mkey; + krb5_db_entry kdb; if (r == NULL) { if ((ret = krb5_get_default_realm(handle->context, &realm))) @@ -154,78 +139,90 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) if ((ret = krb5_parse_name(handle->context, hist_name, &hist_princ))) goto done; - if ((ret = kdb_get_entry(handle, hist_princ, &hist_db, NULL))) { + if ((ret = kdb_get_entry(handle, hist_princ, &kdb, NULL))) { kadm5_principal_ent_rec ent; if (ret != KADM5_UNK_PRINC) goto done; - /* try to create the principal */ - + /* Create the history principal. */ memset(&ent, 0, sizeof(ent)); - ent.principal = hist_princ; ent.max_life = KRB5_KDB_DISALLOW_ALL_TIX; ent.attributes = 0; - - /* this uses hist_kvno. So we set it to 2, which will be the - correct value once the principal is created and randomized. - Of course, it doesn't make sense to keep a history for the - history principal, anyway. */ - - hist_kvno = 2; ks[0].ks_enctype = handle->params.enctype; ks[0].ks_salttype = KRB5_KDB_SALTTYPE_NORMAL; ret = kadm5_create_principal_3(handle, &ent, (KADM5_PRINCIPAL | KADM5_MAX_LIFE | KADM5_ATTRIBUTES), - 1, ks, - "to-be-random"); + 1, ks, NULL); if (ret) goto done; - /* this won't let us randomize the hist_princ. So we cheat. */ - - hist_princ = NULL; - + /* For better compatibility with pre-1.8 libkadm5 code, we want the + * initial history kvno to be 2, so re-randomize it. */ ret = kadm5_randkey_principal_3(handle, ent.principal, 0, 1, ks, NULL, NULL); - - hist_princ = ent.principal; - if (ret) goto done; + } else { + kdb_free_entry(handle, &kdb, NULL); + } - /* now read the newly-created kdb record out of the - database. */ +done: + free(hist_name); + if (r == NULL) + free(realm); + return ret; +} - if ((ret = kdb_get_entry(handle, hist_princ, &hist_db, NULL))) - goto done; +/* + * Function: kdb_get_hist_key + * + * Purpose: Fetches the current history key + * + * Arguments: + * + * handle (r) kadm5 api server handle + * hist_keyblock (w) keyblock to fill in with history key + * hist_kvno (w) kvno to fill in with history kvno + * + * Effects: This function looks up the history principal and retrieves the + * current history key and version. + */ +krb5_error_code +kdb_get_hist_key(kadm5_server_handle_t handle, krb5_keyblock *hist_keyblock, + krb5_kvno *hist_kvno) +{ + krb5_error_code ret; + krb5_db_entry kdb; + krb5_keyblock *mkey; - } + ret = kdb_get_entry(handle, hist_princ, &kdb, NULL); + if (ret) + return ret; - if (hist_db.n_key_data <= 0) { - krb5_set_error_message(handle->context, KRB5_KDB_NO_MATCHING_KEY, + if (kdb.n_key_data <= 0) { + ret = KRB5_KDB_NO_MATCHING_KEY; + krb5_set_error_message(handle->context, ret, "History entry contains no key data"); - return KRB5_KDB_NO_MATCHING_KEY; + goto done; } - ret = krb5_dbe_find_mkey(handle->context, master_keylist, &hist_db, - &tmp_mkey); + ret = krb5_dbe_find_mkey(handle->context, master_keylist, &kdb, + &mkey); if (ret) goto done; - ret = krb5_dbekd_decrypt_key_data(handle->context, tmp_mkey, - &hist_db.key_data[0], &hist_key, NULL); + ret = krb5_dbekd_decrypt_key_data(handle->context, mkey, + &kdb.key_data[0], hist_keyblock, NULL); if (ret) goto done; - hist_kvno = hist_db.key_data[0].key_data_kvno; + *hist_kvno = kdb.key_data[0].key_data_kvno; done: - free(hist_name); - if (r == NULL) - free(realm); + kdb_free_entry(handle, &kdb, NULL); return ret; } @@ -289,7 +286,7 @@ kdb_get_entry(kadm5_server_handle_t handle, in), and when the entry is written, the admin data will get stored correctly. */ - adb->admin_history_kvno = hist_kvno; + adb->admin_history_kvno = INITIAL_HIST_KVNO; return(ret); } diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index a01f072..3cb3b6b 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -36,10 +36,7 @@ extern krb5_principal hist_princ; extern krb5_keyblock master_keyblock; extern krb5_keylist_node *master_keylist; extern krb5_actkvno_node *active_mkey_list; -extern krb5_keyblock hist_key; extern krb5_db_entry master_db; -extern krb5_db_entry hist_db; -extern krb5_kvno hist_kvno; static int decrypt_key_data(krb5_context context, krb5_keyblock *mkey, int n_key_data, krb5_key_data *key_data, @@ -428,7 +425,7 @@ kadm5_create_principal_3(void *server_handle, I'm going to keep it, and make all the admin stuff occupy a single tl_data record, */ - adb.admin_history_kvno = hist_kvno; + adb.admin_history_kvno = INITIAL_HIST_KVNO; if ((mask & KADM5_POLICY)) { adb.aux_attributes = KADM5_POLICY; @@ -1020,6 +1017,8 @@ check_pw_reuse(krb5_context context, * Arguments: * * context (r) krb5_context to use + * mkey (r) master keyblock to decrypt key data with + * hist_key (r) history keyblock to encrypt key data with * n_key_data (r) number of elements in key_data * key_data (r) keys to add to the history entry * hist (w) history entry to fill in @@ -1032,7 +1031,8 @@ check_pw_reuse(krb5_context context, * set to n_key_data. */ static -int create_history_entry(krb5_context context, krb5_keyblock *mkey, int n_key_data, +int create_history_entry(krb5_context context, krb5_keyblock *mkey, + krb5_keyblock *hist_key, int n_key_data, krb5_key_data *key_data, osa_pw_hist_ent *hist) { int i, ret; @@ -1052,7 +1052,7 @@ int create_history_entry(krb5_context context, krb5_keyblock *mkey, int n_key_da if (ret) return ret; - ret = krb5_dbekd_encrypt_key_data(context, &hist_key, + ret = krb5_dbekd_encrypt_key_data(context, hist_key, &key, &salt, key_data[i].key_data_kvno, &hist->key_data[i]); @@ -1085,6 +1085,7 @@ void free_history_entry(krb5_context context, osa_pw_hist_ent *hist) * Arguments: * * context (r) krb5_context to use + * hist_kvno (r) kvno of current history key * adb (r/w) admin principal entry to add keys to * pol (r) adb's policy * pw (r) keys for the password to add to adb's key history @@ -1104,6 +1105,7 @@ void free_history_entry(krb5_context context, osa_pw_hist_ent *hist) * adb->old_key_len). */ static kadm5_ret_t add_to_history(krb5_context context, + krb5_kvno hist_kvno, osa_princ_ent_t adb, kadm5_policy_ent_t pol, osa_pw_hist_ent *pw) @@ -1117,6 +1119,16 @@ static kadm5_ret_t add_to_history(krb5_context context, if (nhist <= 1) return 0; + if (adb->admin_history_kvno != hist_kvno) { + /* The history key has changed since the last password change, so we + * have to reset the password history. */ + free(adb->old_keys); + adb->old_keys = NULL; + adb->old_key_len = 0; + adb->old_key_next = 0; + adb->admin_history_kvno = hist_kvno; + } + nkeys = adb->old_key_len; knext = adb->old_key_next; /* resize the adb->old_keys array if necessary */ @@ -1335,8 +1347,8 @@ kadm5_chpass_principal_3(void *server_handle, int have_pol = 0; kadm5_server_handle_t handle = server_handle; osa_pw_hist_ent hist; - krb5_keyblock *act_mkey; - krb5_kvno act_kvno; + krb5_keyblock *act_mkey, hist_keyblock; + krb5_kvno act_kvno, hist_kvno; CHECK_HANDLE(server_handle); @@ -1344,6 +1356,7 @@ kadm5_chpass_principal_3(void *server_handle, hist_added = 0; memset(&hist, 0, sizeof(hist)); + memset(&hist_keyblock, 0, sizeof(hist_keyblock)); if (principal == NULL || password == NULL) return EINVAL; @@ -1415,32 +1428,36 @@ kadm5_chpass_principal_3(void *server_handle, } #endif + ret = kdb_get_hist_key(handle, &hist_keyblock, &hist_kvno); + if (ret) + goto done; + ret = create_history_entry(handle->context, - act_mkey, + act_mkey, &hist_keyblock, kdb_save.n_key_data, kdb_save.key_data, &hist); if (ret) goto done; - ret = check_pw_reuse(handle->context, act_mkey, &hist_key, + ret = check_pw_reuse(handle->context, act_mkey, &hist_keyblock, kdb.n_key_data, kdb.key_data, 1, &hist); if (ret) goto done; if (pol.pw_history_num > 1) { - if (adb.admin_history_kvno != hist_kvno) { - ret = KADM5_BAD_HIST_KEY; - goto done; + /* If hist_kvno has changed since the last password change, we + * can't check the history. */ + if (adb.admin_history_kvno == hist_kvno) { + ret = check_pw_reuse(handle->context, act_mkey, &hist_keyblock, + kdb.n_key_data, kdb.key_data, + adb.old_key_len, adb.old_keys); + if (ret) + goto done; } - ret = check_pw_reuse(handle->context, act_mkey, &hist_key, - kdb.n_key_data, kdb.key_data, - adb.old_key_len, adb.old_keys); - if (ret) - goto done; - - ret = add_to_history(handle->context, &adb, &pol, &hist); + ret = add_to_history(handle->context, hist_kvno, &adb, &pol, + &hist); if (ret) goto done; hist_added = 1; @@ -1505,6 +1522,7 @@ done: kdb_free_entry(handle, &kdb, &adb); kdb_free_entry(handle, &kdb_save, NULL); krb5_db_free_principal(handle->context, &kdb, 1); + krb5_free_keyblock_contents(handle->context, &hist_keyblock); if (have_pol && (ret2 = kadm5_free_policy_ent(handle->lhandle, &pol)) && !ret) @@ -1549,10 +1567,14 @@ kadm5_randkey_principal_3(void *server_handle, if (principal == NULL) return EINVAL; - if (hist_princ && /* this will be NULL when initializing the databse */ - ((krb5_principal_compare(handle->context, - principal, hist_princ)) == TRUE)) - return KADM5_PROTECT_PRINCIPAL; + if (krb5_principal_compare(handle->context, principal, hist_princ)) { + /* If changing the history entry, the new entry must have exactly one + * key. */ + if (keepold) + return KADM5_PROTECT_PRINCIPAL; + ks_tuple = n_ks_tuple ? ks_tuple : handle->params.keysalts, + n_ks_tuple = 1; + } if ((ret = kdb_get_entry(handle, principal, &kdb, &adb))) return(ret); @@ -1601,18 +1623,6 @@ kadm5_randkey_principal_3(void *server_handle, } #endif - if(pol.pw_history_num > 1) { - if(adb.admin_history_kvno != hist_kvno) { - ret = KADM5_BAD_HIST_KEY; - goto done; - } - - ret = check_pw_reuse(handle->context, act_mkey, &hist_key, - kdb.n_key_data, kdb.key_data, - adb.old_key_len, adb.old_keys); - if (ret) - goto done; - } if (pol.pw_max_life) kdb.pw_expiration = now + pol.pw_max_life; else @@ -1776,23 +1786,6 @@ kadm5_setv4key_principal(void *server_handle, goto done; } #endif -#if 0 - /* - * Should we be checking/updating pw history here? - */ - if(pol.pw_history_num > 1) { - if(adb.admin_history_kvno != hist_kvno) { - ret = KADM5_BAD_HIST_KEY; - goto done; - } - - if (ret = check_pw_reuse(handle->context, - &hist_key, - kdb.n_key_data, kdb.key_data, - adb.old_key_len, adb.old_keys)) - goto done; - } -#endif if (pol.pw_max_life) kdb.pw_expiration = now + pol.pw_max_life; @@ -2017,23 +2010,6 @@ kadm5_setkey_principal_3(void *server_handle, goto done; } #endif -#if 0 - /* - * Should we be checking/updating pw history here? - */ - if (pol.pw_history_num > 1) { - if(adb.admin_history_kvno != hist_kvno) { - ret = KADM5_BAD_HIST_KEY; - goto done; - } - - if (ret = check_pw_reuse(handle->context, - &hist_key, - kdb.n_key_data, kdb.key_data, - adb.old_key_len, adb.old_keys)) - goto done; - } -#endif if (pol.pw_max_life) kdb.pw_expiration = now + pol.pw_max_life; diff --git a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp b/src/lib/kadm5/unit-test/api.current/randkey-principal.exp index f003863..5fcb1c0 100644 --- a/src/lib/kadm5/unit-test/api.current/randkey-principal.exp +++ b/src/lib/kadm5/unit-test/api.current/randkey-principal.exp @@ -279,9 +279,9 @@ proc test32 {} { perror "$test: unexpected failure in init" return } - one_line_fail_test { + one_line_succeed_test { kadm5_randkey_principal $server_handle kadmin/history keys num_keys - } "PROTECT" + } if { ! [cmd {kadm5_destroy $server_handle}]} { perror "$test: unexpected failure in destroy" return

1 0

[AuthHub/krb5-1-8: 34/111] ticket: 6658 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit d630aaafb84fdcee07fe2da4c87d7c0feba5a4ba Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Feb 12 20:28:47 2010 +0000 ticket: 6658 version_fixed: 1.8 status: resolved pull up r23715 from trunk ------------------------------------------------------------------------ r23715 | ghudson | 2010-02-10 18:44:18 -0500 (Wed, 10 Feb 2010) | 14 lines ticket: 6658 subject: Implement gss_set_neg_mechs target_version: 1.8 tags: pullup Implement gss_set_neg_mechs in SPNEGO by intersecting the provided mech set with the mechanisms available in the union credential. As we now need space to hold the mech set, the SPNEGO credential is now a structure and not just a mechglue credential. t_spnego.c is a test program which exercises the new logic. Like the other GSSAPI tests, it is not run as part of "make check" at this time. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23720 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/generic/gssapi.hin | 6 + src/lib/gssapi/krb5/gssapi_krb5.c | 1 + src/lib/gssapi/libgssapi_krb5.exports | 1 + src/lib/gssapi/mechglue/Makefile.in | 3 + src/lib/gssapi/mechglue/g_initialize.c | 2 + src/lib/gssapi/mechglue/g_set_neg_mechs.c | 77 ++++++++ src/lib/gssapi/mechglue/mglueP.h | 6 + src/lib/gssapi/spnego/gssapiP_spnego.h | 14 ++ src/lib/gssapi/spnego/spnego_mech.c | 272 ++++++++++++++++++++--------- src/tests/gssapi/Makefile.in | 6 +- src/tests/gssapi/t_spnego.c | 265 ++++++++++++++++++++++++++++ 11 files changed, 570 insertions(+), 83 deletions(-) --- diff --git a/src/lib/gssapi/generic/gssapi.hin b/src/lib/gssapi/generic/gssapi.hin index e60d04d..fb82e3c 100644 --- a/src/lib/gssapi/generic/gssapi.hin +++ b/src/lib/gssapi/generic/gssapi.hin @@ -805,6 +805,12 @@ gss_store_cred( gss_OID_set *, /* elements_stored */ gss_cred_usage_t *);/* cred_usage_stored */ +OM_uint32 KRB5_CALLCONV +gss_set_neg_mechs( + OM_uint32 *, /* minor_status */ + gss_cred_id_t, /* cred_handle */ + const gss_OID_set); /* mech_set */ + #if TARGET_OS_MAC # pragma pack(pop) #endif diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c index b68bc9a..9e5ba76 100644 --- a/src/lib/gssapi/krb5/gssapi_krb5.c +++ b/src/lib/gssapi/krb5/gssapi_krb5.c @@ -694,6 +694,7 @@ static struct gss_config krb5_mechanism = { krb5_gss_map_name_to_any, krb5_gss_release_any_name_mapping, krb5_gss_pseudo_random, + NULL, /* set_neg_mechs */ }; diff --git a/src/lib/gssapi/libgssapi_krb5.exports b/src/lib/gssapi/libgssapi_krb5.exports index e7f7b36..e038f50 100644 --- a/src/lib/gssapi/libgssapi_krb5.exports +++ b/src/lib/gssapi/libgssapi_krb5.exports @@ -80,6 +80,7 @@ gss_release_oid gss_release_oid_set gss_seal gss_set_name_attribute +gss_set_neg_mechs gss_set_sec_context_option gss_sign gss_store_cred diff --git a/src/lib/gssapi/mechglue/Makefile.in b/src/lib/gssapi/mechglue/Makefile.in index 0858a4a..f435711 100644 --- a/src/lib/gssapi/mechglue/Makefile.in +++ b/src/lib/gssapi/mechglue/Makefile.in @@ -54,6 +54,7 @@ SRCS = \ $(srcdir)/g_set_context_option.c \ $(srcdir)/g_set_cred_option.c \ $(srcdir)/g_set_name_attr.c \ + $(srcdir)/g_set_neg_mechs.c \ $(srcdir)/g_sign.c \ $(srcdir)/g_store_cred.c \ $(srcdir)/g_unseal.c \ @@ -108,6 +109,7 @@ OBJS = \ $(OUTPRE)g_set_context_option.$(OBJEXT) \ $(OUTPRE)g_set_cred_option.$(OBJEXT) \ $(OUTPRE)g_set_name_attr.$(OBJEXT) \ + $(OUTPRE)g_set_neg_mechs.$(OBJEXT) \ $(OUTPRE)g_sign.$(OBJEXT) \ $(OUTPRE)g_store_cred.$(OBJEXT) \ $(OUTPRE)g_unseal.$(OBJEXT) \ @@ -162,6 +164,7 @@ STLIBOBJS = \ g_set_context_option.o \ g_set_cred_option.o \ g_set_name_attr.o \ + g_set_neg_mechs.o \ g_sign.o \ g_store_cred.o \ g_unseal.o \ diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c index e01d174..70c2203 100644 --- a/src/lib/gssapi/mechglue/g_initialize.c +++ b/src/lib/gssapi/mechglue/g_initialize.c @@ -775,6 +775,8 @@ build_dynamicMech(void *dl, const gss_OID mech_type) GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_release_any_name_mapping); /* RFC 4401 (introduced in 1.8) */ GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_pseudo_random); + /* RFC 4178 (introduced in 1.8; gss_get_neg_mechs not implemented) */ + GSS_ADD_DYNAMIC_METHOD(dl, mech, gss_set_neg_mechs); assert(mech_type != GSS_C_NO_OID); diff --git a/src/lib/gssapi/mechglue/g_set_neg_mechs.c b/src/lib/gssapi/mechglue/g_set_neg_mechs.c new file mode 100644 index 0000000..1675376 --- /dev/null +++ b/src/lib/gssapi/mechglue/g_set_neg_mechs.c @@ -0,0 +1,77 @@ +/* + * lib/gssapi/mechglue/g_set_neg_mechs.c + * + * Copyright (C) 2010 by the Massachusetts Institute of Technology. + * All rights reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * + * Glue routine for gss_set_neg_mechs. + */ + +#include "mglueP.h" + +OM_uint32 KRB5_CALLCONV +gss_set_neg_mechs(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + const gss_OID_set mech_set) +{ + gss_union_cred_t union_cred; + gss_mechanism mech; + int i, avail; + OM_uint32 status; + + if (minor_status == NULL) + return GSS_S_CALL_INACCESSIBLE_WRITE; + + if (cred_handle == GSS_C_NO_CREDENTIAL) + return GSS_S_CALL_INACCESSIBLE_READ | GSS_S_NO_CRED; + + *minor_status = 0; + + union_cred = (gss_union_cred_t) cred_handle; + + avail = 0; + status = GSS_S_COMPLETE; + for (i = 0; i < union_cred->count; i++) { + mech = gssint_get_mechanism(&union_cred->mechs_array[i]); + if (mech == NULL) { + status = GSS_S_BAD_MECH; + break; + } + + if (mech->gss_set_neg_mechs == NULL) + continue; + + avail = 1; + status = (mech->gss_set_neg_mechs)(minor_status, + union_cred->cred_array[i], + mech_set); + if (status != GSS_S_COMPLETE) { + map_error(minor_status, mech); + break; + } + } + + if (status == GSS_S_COMPLETE && !avail) + return GSS_S_UNAVAILABLE; + return status; +} diff --git a/src/lib/gssapi/mechglue/mglueP.h b/src/lib/gssapi/mechglue/mglueP.h index 517ca48..3769caf 100644 --- a/src/lib/gssapi/mechglue/mglueP.h +++ b/src/lib/gssapi/mechglue/mglueP.h @@ -583,6 +583,12 @@ typedef struct gss_config { gss_buffer_t /* prf_out */ /* */); + OM_uint32 (*gss_set_neg_mechs) + ( + OM_uint32 *, /* minor_status */ + gss_cred_id_t, /* cred_handle */ + const gss_OID_set /* mech_set */ + /* */); } *gss_mechanism; /* This structure MUST NOT be used by any code outside libgss */ diff --git a/src/lib/gssapi/spnego/gssapiP_spnego.h b/src/lib/gssapi/spnego/gssapiP_spnego.h index 4bfe863..a1cd2b4 100644 --- a/src/lib/gssapi/spnego/gssapiP_spnego.h +++ b/src/lib/gssapi/spnego/gssapiP_spnego.h @@ -82,6 +82,12 @@ typedef struct { gss_name_t mech_name; } spnego_name_desc, *spnego_name_t; +/* Structure for credential */ +typedef struct { + gss_cred_id_t mcred; /* mechglue union of obtainable creds */ + gss_OID_set neg_mechs; /* app-specified list of allowable mechs */ +} spnego_gss_cred_id_rec, *spnego_gss_cred_id_t; + /* Structure for context handle */ typedef struct { OM_uint32 magic_num; @@ -539,6 +545,14 @@ spnego_gss_pseudo_random gss_buffer_t prf_out ); +OM_uint32 +spnego_gss_set_neg_mechs +( + OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + const gss_OID_set mech_list +); + #ifdef __cplusplus } #endif diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 669b343..60fadd5 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -103,6 +103,8 @@ static gss_OID_set get_mech_set(OM_uint32 *, unsigned char **, unsigned int); static OM_uint32 get_req_flags(unsigned char **, OM_uint32, OM_uint32 *); static OM_uint32 get_available_mechs(OM_uint32 *, gss_name_t, gss_cred_usage_t, gss_cred_id_t *, gss_OID_set *); +static OM_uint32 get_negotiable_mechs(OM_uint32 *, spnego_gss_cred_id_t, + gss_cred_usage_t, gss_OID_set *); static void release_spnego_ctx(spnego_gss_ctx_id_t *); static void check_spnego_options(spnego_gss_ctx_id_t); static spnego_gss_ctx_id_t create_spnego_ctx(void); @@ -119,7 +121,7 @@ handle_mic(OM_uint32 *, gss_buffer_t, int, spnego_gss_ctx_id_t, gss_buffer_t *, OM_uint32 *, send_token_flag *); static OM_uint32 -init_ctx_new(OM_uint32 *, gss_cred_id_t, gss_ctx_id_t *, +init_ctx_new(OM_uint32 *, spnego_gss_cred_id_t, gss_ctx_id_t *, gss_OID_set *, send_token_flag *); static OM_uint32 init_ctx_nego(OM_uint32 *, spnego_gss_ctx_id_t, OM_uint32, gss_OID, @@ -134,14 +136,14 @@ init_ctx_reselect(OM_uint32 *, spnego_gss_ctx_id_t, OM_uint32, gss_OID, gss_buffer_t *, gss_buffer_t *, OM_uint32 *, send_token_flag *); static OM_uint32 -init_ctx_call_init(OM_uint32 *, spnego_gss_ctx_id_t, gss_cred_id_t, +init_ctx_call_init(OM_uint32 *, spnego_gss_ctx_id_t, spnego_gss_cred_id_t, gss_name_t, OM_uint32, OM_uint32, gss_buffer_t, gss_OID *, gss_buffer_t, OM_uint32 *, OM_uint32 *, OM_uint32 *, send_token_flag *); static OM_uint32 acc_ctx_new(OM_uint32 *, gss_buffer_t, gss_ctx_id_t *, - gss_cred_id_t, gss_buffer_t *, + spnego_gss_cred_id_t, gss_buffer_t *, gss_buffer_t *, OM_uint32 *, send_token_flag *); static OM_uint32 acc_ctx_cont(OM_uint32 *, gss_buffer_t, gss_ctx_id_t *, @@ -151,7 +153,7 @@ static OM_uint32 acc_ctx_vfy_oid(OM_uint32 *, spnego_gss_ctx_id_t, gss_OID, OM_uint32 *, send_token_flag *); static OM_uint32 -acc_ctx_call_acc(OM_uint32 *, spnego_gss_ctx_id_t, gss_cred_id_t, +acc_ctx_call_acc(OM_uint32 *, spnego_gss_ctx_id_t, spnego_gss_cred_id_t, gss_buffer_t, gss_OID *, gss_buffer_t, OM_uint32 *, OM_uint32 *, gss_cred_id_t *, OM_uint32 *, send_token_flag *); @@ -195,10 +197,10 @@ static const gss_OID_set_desc spnego_oidsets[] = { }; const gss_OID_set_desc * const gss_mech_set_spnego = spnego_oidsets+0; -static int make_NegHints(OM_uint32 *, gss_cred_id_t, gss_buffer_t *); +static int make_NegHints(OM_uint32 *, spnego_gss_cred_id_t, gss_buffer_t *); static int put_neg_hints(unsigned char **, gss_buffer_t, unsigned int); static OM_uint32 -acc_ctx_hints(OM_uint32 *, gss_ctx_id_t *, gss_cred_id_t, +acc_ctx_hints(OM_uint32 *, gss_ctx_id_t *, spnego_gss_cred_id_t, gss_buffer_t *, OM_uint32 *, send_token_flag *); /* @@ -269,6 +271,7 @@ static struct gss_config spnego_mechanism = spnego_gss_map_name_to_any, spnego_gss_release_any_name_mapping, spnego_gss_pseudo_random, + spnego_gss_set_neg_mechs, }; #ifdef _GSS_STATIC_LINK @@ -323,6 +326,8 @@ spnego_gss_acquire_cred(OM_uint32 *minor_status, { OM_uint32 status; gss_OID_set amechs; + gss_cred_id_t mcred = NULL; + spnego_gss_cred_id_t spcred = NULL; dsyslog("Entering spnego_gss_acquire_cred\n"); if (actual_mechs) @@ -331,6 +336,13 @@ spnego_gss_acquire_cred(OM_uint32 *minor_status, if (time_rec) *time_rec = 0; + spcred = malloc(sizeof(spnego_gss_cred_id_rec)); + if (spcred == NULL) { + *minor_status = ENOMEM; + return (GSS_S_FAILURE); + } + spcred->neg_mechs = GSS_C_NULL_OID_SET; + /* * If the user did not specify a list of mechs, * use get_available_mechs to collect a list of @@ -339,7 +351,7 @@ spnego_gss_acquire_cred(OM_uint32 *minor_status, if (desired_mechs == GSS_C_NULL_OID_SET) { status = get_available_mechs(minor_status, desired_name, cred_usage, - output_cred_handle, &amechs); + &mcred, &amechs); } else { /* * The caller gave a specific list of mechanisms, @@ -350,8 +362,7 @@ spnego_gss_acquire_cred(OM_uint32 *minor_status, status = gss_acquire_cred(minor_status, desired_name, time_req, desired_mechs, cred_usage, - output_cred_handle, &amechs, - time_rec); + &mcred, &amechs, time_rec); } if (actual_mechs && amechs != GSS_C_NULL_OID_SET) { @@ -359,6 +370,14 @@ spnego_gss_acquire_cred(OM_uint32 *minor_status, } (void) gss_release_oid_set(minor_status, &amechs); + if (status == GSS_S_COMPLETE) { + spcred->mcred = mcred; + *output_cred_handle = (gss_cred_id_t)spcred; + } else { + free(spcred); + *output_cred_handle = GSS_C_NO_CREDENTIAL; + } + dsyslog("Leaving spnego_gss_acquire_cred\n"); return (status); } @@ -368,7 +387,7 @@ OM_uint32 spnego_gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle) { - OM_uint32 status; + spnego_gss_cred_id_t spcred = NULL; dsyslog("Entering spnego_gss_release_cred\n"); @@ -380,10 +399,14 @@ spnego_gss_release_cred(OM_uint32 *minor_status, if (*cred_handle == GSS_C_NO_CREDENTIAL) return (GSS_S_COMPLETE); - status = gss_release_cred(minor_status, cred_handle); + spcred = (spnego_gss_cred_id_t)*cred_handle; + *cred_handle = GSS_C_NO_CREDENTIAL; + gss_release_oid_set(minor_status, &spcred->neg_mechs); + gss_release_cred(minor_status, &spcred->mcred); + free(spcred); dsyslog("Leaving spnego_gss_release_cred\n"); - return (status); + return (GSS_S_COMPLETE); } static void @@ -540,28 +563,17 @@ process_mic(OM_uint32 *minor_status, gss_buffer_t mic_in, */ static OM_uint32 init_ctx_new(OM_uint32 *minor_status, - gss_cred_id_t cred, + spnego_gss_cred_id_t spcred, gss_ctx_id_t *ctx, gss_OID_set *mechSet, send_token_flag *tokflag) { OM_uint32 ret, tmpmin; - gss_cred_id_t creds = GSS_C_NO_CREDENTIAL; spnego_gss_ctx_id_t sc = NULL; /* determine negotiation mech set */ - if (cred == GSS_C_NO_CREDENTIAL) { - ret = get_available_mechs(minor_status, GSS_C_NO_NAME, - GSS_C_INITIATE, &creds, mechSet); - gss_release_cred(&tmpmin, &creds); - } else { - /* - * Use the list of mechs included in the cred that we - * were given. - */ - ret = gss_inquire_cred(minor_status, cred, - NULL, NULL, NULL, mechSet); - } + ret = get_negotiable_mechs(minor_status, spcred, GSS_C_INITIATE, + mechSet); if (ret != GSS_S_COMPLETE) return ret; @@ -795,7 +807,7 @@ init_ctx_reselect(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, static OM_uint32 init_ctx_call_init(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, - gss_cred_id_t claimant_cred_handle, + spnego_gss_cred_id_t spcred, gss_name_t target_name, OM_uint32 req_flags, OM_uint32 time_req, @@ -808,9 +820,11 @@ init_ctx_call_init(OM_uint32 *minor_status, send_token_flag *send_token) { OM_uint32 ret; + gss_cred_id_t mcred; + mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; ret = gss_init_sec_context(minor_status, - claimant_cred_handle, + mcred, &sc->ctx_handle, target_name, sc->internal_mech, @@ -887,6 +901,7 @@ spnego_gss_init_sec_context( gss_buffer_t mechtok_in, mechListMIC_in, mechListMIC_out; gss_buffer_desc mechtok_out = GSS_C_EMPTY_BUFFER; gss_OID_set mechSet = GSS_C_NO_OID_SET; + spnego_gss_cred_id_t spcred = NULL; spnego_gss_ctx_id_t spnego_ctx = NULL; dsyslog("Entering init_sec_context\n"); @@ -908,8 +923,9 @@ spnego_gss_init_sec_context( if (actual_mech != NULL) *actual_mech = GSS_C_NO_OID; + spcred = (spnego_gss_cred_id_t)claimant_cred_handle; if (*context_handle == GSS_C_NO_CONTEXT) { - ret = init_ctx_new(minor_status, claimant_cred_handle, + ret = init_ctx_new(minor_status, spcred, context_handle, &mechSet, &send_token); if (ret != GSS_S_CONTINUE_NEEDED) { goto cleanup; @@ -925,8 +941,7 @@ spnego_gss_init_sec_context( spnego_ctx = (spnego_gss_ctx_id_t)*context_handle; if (!spnego_ctx->mech_complete) { ret = init_ctx_call_init( - minor_status, spnego_ctx, - claimant_cred_handle, + minor_status, spnego_ctx, spcred, target_name, req_flags, time_req, mechtok_in, actual_mech, &mechtok_out, @@ -1045,7 +1060,7 @@ put_neg_hints(unsigned char **buf_out, gss_buffer_t input_token, static int make_NegHints(OM_uint32 *minor_status, - gss_cred_id_t cred, gss_buffer_t *outbuf) + spnego_gss_cred_id_t spcred, gss_buffer_t *outbuf) { gss_buffer_desc hintNameBuf; gss_name_t hintName = GSS_C_NO_NAME; @@ -1061,9 +1076,9 @@ make_NegHints(OM_uint32 *minor_status, *outbuf = GSS_C_NO_BUFFER; - if (cred != GSS_C_NO_CREDENTIAL) { + if (spcred != NULL) { major_status = gss_inquire_cred(minor_status, - cred, + spcred->mcred, &hintName, NULL, NULL, @@ -1188,7 +1203,7 @@ errout: static OM_uint32 acc_ctx_hints(OM_uint32 *minor_status, gss_ctx_id_t *ctx, - gss_cred_id_t cred, + spnego_gss_cred_id_t spcred, gss_buffer_t *mechListMIC, OM_uint32 *negState, send_token_flag *return_token) @@ -1206,24 +1221,14 @@ acc_ctx_hints(OM_uint32 *minor_status, *ctx = GSS_C_NO_CONTEXT; ret = GSS_S_DEFECTIVE_TOKEN; - if (cred != GSS_C_NO_CREDENTIAL) { - ret = gss_inquire_cred(minor_status, cred, NULL, NULL, - NULL, &supported_mechSet); - if (ret != GSS_S_COMPLETE) { - *return_token = NO_TOKEN_SEND; - goto cleanup; - } - } else { - ret = get_available_mechs(minor_status, GSS_C_NO_NAME, - GSS_C_ACCEPT, NULL, - &supported_mechSet); - if (ret != GSS_S_COMPLETE) { - *return_token = NO_TOKEN_SEND; - goto cleanup; - } + ret = get_negotiable_mechs(minor_status, spcred, GSS_C_ACCEPT, + &supported_mechSet); + if (ret != GSS_S_COMPLETE) { + *return_token = NO_TOKEN_SEND; + goto cleanup; } - ret = make_NegHints(minor_status, cred, mechListMIC); + ret = make_NegHints(minor_status, spcred, mechListMIC); if (ret != GSS_S_COMPLETE) { *return_token = NO_TOKEN_SEND; goto cleanup; @@ -1268,7 +1273,7 @@ static OM_uint32 acc_ctx_new(OM_uint32 *minor_status, gss_buffer_t buf, gss_ctx_id_t *ctx, - gss_cred_id_t cred, + spnego_gss_cred_id_t spcred, gss_buffer_t *mechToken, gss_buffer_t *mechListMIC, OM_uint32 *negState, @@ -1297,21 +1302,11 @@ acc_ctx_new(OM_uint32 *minor_status, if (ret != GSS_S_COMPLETE) { goto cleanup; } - if (cred != GSS_C_NO_CREDENTIAL) { - ret = gss_inquire_cred(minor_status, cred, NULL, NULL, - NULL, &supported_mechSet); - if (ret != GSS_S_COMPLETE) { - *return_token = NO_TOKEN_SEND; - goto cleanup; - } - } else { - ret = get_available_mechs(minor_status, GSS_C_NO_NAME, - GSS_C_ACCEPT, NULL, - &supported_mechSet); - if (ret != GSS_S_COMPLETE) { - *return_token = NO_TOKEN_SEND; - goto cleanup; - } + ret = get_negotiable_mechs(minor_status, spcred, GSS_C_ACCEPT, + &supported_mechSet); + if (ret != GSS_S_COMPLETE) { + *return_token = NO_TOKEN_SEND; + goto cleanup; } /* * Select the best match between the list of mechs @@ -1484,7 +1479,7 @@ cleanup: */ static OM_uint32 acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, - gss_cred_id_t cred, gss_buffer_t mechtok_in, + spnego_gss_cred_id_t spcred, gss_buffer_t mechtok_in, gss_OID *mech_type, gss_buffer_t mechtok_out, OM_uint32 *ret_flags, OM_uint32 *time_rec, gss_cred_id_t *delegated_cred_handle, @@ -1492,6 +1487,7 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, { OM_uint32 ret; gss_OID_desc mechoid; + gss_cred_id_t mcred; if (sc->ctx_handle == GSS_C_NO_CONTEXT) { /* @@ -1508,9 +1504,10 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, return ret; } + mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; ret = gss_accept_sec_context(minor_status, &sc->ctx_handle, - cred, + mcred, mechtok_in, GSS_C_NO_CHANNEL_BINDINGS, &sc->internal_name, @@ -1571,6 +1568,7 @@ spnego_gss_accept_sec_context( gss_buffer_t mechtok_in, mic_in, mic_out; gss_buffer_desc mechtok_out = GSS_C_EMPTY_BUFFER; spnego_gss_ctx_id_t sc = NULL; + spnego_gss_cred_id_t spcred = NULL; OM_uint32 mechstat = GSS_S_FAILURE; int sendTokenInit = 0; @@ -1592,6 +1590,7 @@ spnego_gss_accept_sec_context( return GSS_S_CALL_INACCESSIBLE_READ; sc = (spnego_gss_ctx_id_t)*context_handle; + spcred = (spnego_gss_cred_id_t)verifier_cred_handle; if (sc == NULL || sc->internal_mech == GSS_C_NO_OID) { if (src_name != NULL) *src_name = GSS_C_NO_NAME; @@ -1606,8 +1605,7 @@ spnego_gss_accept_sec_context( if (input_token->length == 0) { sendTokenInit = 1; ret = acc_ctx_hints(minor_status, - context_handle, - verifier_cred_handle, + context_handle, spcred, &mic_out, &negState, &return_token); @@ -1617,7 +1615,7 @@ spnego_gss_accept_sec_context( } else { /* Can set negState to REQUEST_MIC */ ret = acc_ctx_new(minor_status, input_token, - context_handle, verifier_cred_handle, + context_handle, spcred, &mechtok_in, &mic_in, &negState, &return_token); if (ret != GSS_S_COMPLETE) @@ -1643,9 +1641,8 @@ spnego_gss_accept_sec_context( */ mechstat = GSS_S_FAILURE; if (negState != REQUEST_MIC && mechtok_in != GSS_C_NO_BUFFER) { - ret = acc_ctx_call_acc(minor_status, sc, - verifier_cred_handle, mechtok_in, - mech_type, &mechtok_out, + ret = acc_ctx_call_acc(minor_status, sc, spcred, + mechtok_in, mech_type, &mechtok_out, ret_flags, time_rec, delegated_cred_handle, &negState, &return_token); @@ -1808,6 +1805,7 @@ spnego_gss_inquire_cred( gss_OID_set *mechanisms) { OM_uint32 status; + spnego_gss_cred_id_t spcred = NULL; gss_cred_id_t creds = GSS_C_NO_CREDENTIAL; OM_uint32 tmp_minor_status; OM_uint32 initiator_lifetime, acceptor_lifetime; @@ -1819,7 +1817,8 @@ spnego_gss_inquire_cred( * supplied we call gss_inquire_cred_by_mech() on the * first non-SPNEGO mechanism. */ - if (cred_handle == GSS_C_NO_CREDENTIAL) { + spcred = (spnego_gss_cred_id_t)cred_handle; + if (spcred == NULL) { status = get_available_mechs(minor_status, GSS_C_NO_NAME, GSS_C_BOTH, @@ -1858,7 +1857,7 @@ spnego_gss_inquire_cred( gss_release_cred(&tmp_minor_status, &creds); } else { - status = gss_inquire_cred(minor_status, cred_handle, + status = gss_inquire_cred(minor_status, spcred->mcred, name, lifetime, cred_usage, mechanisms); } @@ -2179,8 +2178,11 @@ spnego_gss_inquire_cred_by_oid( gss_buffer_set_t *data_set) { OM_uint32 ret; + spnego_gss_cred_id_t spcred = (spnego_gss_cred_id_t)cred_handle; + gss_cred_id_t mcred; + mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; ret = gss_inquire_cred_by_oid(minor_status, - cred_handle, + mcred, desired_object, data_set); return (ret); @@ -2194,8 +2196,11 @@ spnego_gss_set_cred_option( const gss_buffer_t value) { OM_uint32 ret; + spnego_gss_cred_id_t spcred = (spnego_gss_cred_id_t)cred_handle; + gss_cred_id_t mcred; + mcred = (spcred == NULL) ? GSS_C_NO_CREDENTIAL : spcred->mcred; ret = gssspi_set_cred_option(minor_status, - cred_handle, + mcred, desired_object, value); return (ret); @@ -2344,6 +2349,8 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, { OM_uint32 status; gss_OID_set amechs = GSS_C_NULL_OID_SET; + spnego_gss_cred_id_t imp_spcred = NULL, out_spcred = NULL; + gss_cred_id_t mcred; dsyslog("Entering spnego_gss_acquire_cred_impersonate_name\n"); @@ -2364,16 +2371,27 @@ spnego_gss_acquire_cred_impersonate_name(OM_uint32 *minor_status, desired_mechs = amechs; } + imp_spcred = (spnego_gss_cred_id_t)impersonator_cred_handle; status = gss_acquire_cred_impersonate_name(minor_status, - impersonator_cred_handle, + imp_spcred ? imp_spcred->mcred : GSS_C_NO_CREDENTIAL, desired_name, time_req, desired_mechs, cred_usage, - output_cred_handle, actual_mechs, + &mcred, actual_mechs, time_rec); if (amechs != GSS_C_NULL_OID_SET) (void) gss_release_oid_set(minor_status, &amechs); + out_spcred = malloc(sizeof(spnego_gss_cred_id_rec)); + if (out_spcred == NULL) { + gss_release_cred(minor_status, &mcred); + *minor_status = ENOMEM; + return (GSS_S_FAILURE); + } + out_spcred->mcred = mcred; + out_spcred->neg_mechs = GSS_C_NULL_OID_SET; + *output_cred_handle = (gss_cred_id_t)out_spcred; + dsyslog("Leaving spnego_gss_acquire_cred_impersonate_name\n"); return (status); } @@ -2519,6 +2537,21 @@ spnego_gss_pseudo_random(OM_uint32 *minor_status, return (ret); } +OM_uint32 +spnego_gss_set_neg_mechs(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + const gss_OID_set mech_list) +{ + OM_uint32 ret; + spnego_gss_cred_id_t spcred = (spnego_gss_cred_id_t)cred_handle; + + /* Store mech_list in spcred for use in negotiation logic. */ + gss_release_oid_set(minor_status, &spcred->neg_mechs); + ret = generic_gss_copy_oid_set(minor_status, mech_list, + &spcred->neg_mechs); + return (ret); +} + /* * We will release everything but the ctx_handle so that it * can be passed back to init/accept context. This routine should @@ -2632,6 +2665,83 @@ get_available_mechs(OM_uint32 *minor_status, return (major_status); } +/* + * Return a list of mechanisms we are willing to negotiate for a credential, + * taking into account the mech set provided with gss_set_neg_mechs if it + * exists. + */ +static OM_uint32 +get_negotiable_mechs(OM_uint32 *minor_status, spnego_gss_cred_id_t spcred, + gss_cred_usage_t usage, gss_OID_set *rmechs) +{ + OM_uint32 ret, tmpmin; + gss_cred_id_t creds = GSS_C_NO_CREDENTIAL, *credptr; + gss_OID_set cred_mechs = GSS_C_NULL_OID_SET; + gss_OID_set intersect_mechs = GSS_C_NULL_OID_SET; + unsigned int i, j; + + if (spcred == NULL) { + /* + * The default credentials were supplied. Return a list of all + * available mechs except SPNEGO. When initiating, trim this + * list to mechs we can acquire credentials for. + */ + credptr = (usage == GSS_C_INITIATE) ? &creds : NULL; + ret = get_available_mechs(minor_status, GSS_C_NO_NAME, usage, + credptr, rmechs); + gss_release_cred(&tmpmin, &creds); + return (ret); + } + + /* Get the list of mechs in the mechglue cred. */ + ret = gss_inquire_cred(minor_status, spcred->mcred, NULL, NULL, NULL, + &cred_mechs); + if (ret != GSS_S_COMPLETE) + return (ret); + + if (spcred->neg_mechs == GSS_C_NULL_OID_SET) { + /* gss_set_neg_mechs was never called; return cred_mechs. */ + *rmechs = cred_mechs; + *minor_status = 0; + return (GSS_S_COMPLETE); + } + + /* Compute the intersection of cred_mechs and spcred->neg_mechs, + * preserving the order in spcred->neg_mechs. */ + ret = gss_create_empty_oid_set(minor_status, &intersect_mechs); + if (ret != GSS_S_COMPLETE) { + gss_release_oid_set(&tmpmin, &cred_mechs); + return (ret); + } + + for (i = 0; i < spcred->neg_mechs->count; i++) { + for (j = 0; j < cred_mechs->count; j++) { + if (!g_OID_equal(&spcred->neg_mechs->elements[i], + &cred_mechs->elements[j])) + break; + } + if (j == cred_mechs->count) + continue; + ret = gss_add_oid_set_member(minor_status, + &spcred->neg_mechs->elements[i], + &intersect_mechs); + if (ret != GSS_S_COMPLETE) + break; + } + + gss_release_oid_set(&tmpmin, &cred_mechs); + if (intersect_mechs->count == 0 || ret != GSS_S_COMPLETE) { + gss_release_oid_set(&tmpmin, &intersect_mechs); + *minor_status = ERR_SPNEGO_NO_MECHS_AVAILABLE; + map_errcode(minor_status); + return (GSS_S_FAILURE); + } + + *rmechs = intersect_mechs; + *minor_status = 0; + return (GSS_S_COMPLETE); +} + /* following are token creation and reading routines */ /* diff --git a/src/tests/gssapi/Makefile.in b/src/tests/gssapi/Makefile.in index 98020d4..6a15414 100644 --- a/src/tests/gssapi/Makefile.in +++ b/src/tests/gssapi/Makefile.in @@ -8,7 +8,7 @@ SRCS= $(srcdir)/t_imp_name.c $(srcdir)/t_s4u.c $(srcdir)/t_namingexts.c $(srcdir OBJS= t_imp_name.o t_s4u.o t_namingexts.o t_gssexts.o -all:: t_imp_name t_s4u t_namingexts t_gssexts +all:: t_imp_name t_s4u t_namingexts t_gssexts t_spnego t_imp_name: t_imp_name.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) $(CC_LINK) -o t_imp_name t_imp_name.o $(GSS_LIBS) $(KRB5_BASE_LIBS) @@ -18,7 +18,9 @@ t_namingexts: t_namingexts.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) $(CC_LINK) -o t_namingexts t_namingexts.o $(GSS_LIBS) $(KRB5_BASE_LIBS) t_gssexts: t_gssexts.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) $(CC_LINK) -o t_gssexts t_gssexts.o $(GSS_LIBS) $(KRB5_BASE_LIBS) +t_spnego: t_spnego.o $(GSS_DEPLIBS) $(KRB5_BASE_DEPLIBS) + $(CC_LINK) -o t_spnego t_spnego.o $(GSS_LIBS) $(KRB5_BASE_LIBS) clean:: - $(RM) t_imp_name t_s4u t_namingexts t_gssexts + $(RM) t_imp_name t_s4u t_namingexts t_gssexts t_spnego diff --git a/src/tests/gssapi/t_spnego.c b/src/tests/gssapi/t_spnego.c new file mode 100644 index 0000000..e37b5ad --- /dev/null +++ b/src/tests/gssapi/t_spnego.c @@ -0,0 +1,265 @@ +/* -*- mode: c; indent-tabs-mode: nil -*- */ +/* + * Copyright 2010 by the Massachusetts Institute of Technology. + * All Rights Reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include <gssapi/gssapi_krb5.h> + +/* + * Test program for SPNEGO and gss_set_neg_mechs + * + * Example usage: + * + * kinit testuser + * ./t_spnego host/test.host@REALM testhost.keytab + */ + +static gss_OID_desc spnego_mech = { 6, "\053\006\001\005\005\002" }; + +static void displayStatus_1(m, code, type) + char *m; + OM_uint32 code; + int type; +{ + OM_uint32 maj_stat, min_stat; + gss_buffer_desc msg; + OM_uint32 msg_ctx; + + msg_ctx = 0; + while (1) { + maj_stat = gss_display_status(&min_stat, code, + type, GSS_C_NULL_OID, + &msg_ctx, &msg); + fprintf(stderr, "%s: %s\n", m, (char *)msg.value); + (void) gss_release_buffer(&min_stat, &msg); + + if (!msg_ctx) + break; + } +} + +static void displayStatus(msg, maj_stat, min_stat) + char *msg; + OM_uint32 maj_stat; + OM_uint32 min_stat; +{ + displayStatus_1(msg, maj_stat, GSS_C_GSS_CODE); + displayStatus_1(msg, min_stat, GSS_C_MECH_CODE); +} + +static OM_uint32 +displayCanonName(OM_uint32 *minor, gss_name_t name, char *tag) +{ + gss_name_t canon; + OM_uint32 major, tmp_minor; + gss_buffer_desc buf; + + major = gss_canonicalize_name(minor, name, + (gss_OID)gss_mech_krb5, &canon); + if (GSS_ERROR(major)) { + displayStatus("gss_canonicalize_name", major, *minor); + return major; + } + + major = gss_display_name(minor, canon, &buf, NULL); + if (GSS_ERROR(major)) { + displayStatus("gss_display_name", major, *minor); + gss_release_name(&tmp_minor, &canon); + return major; + } + + printf("%s:\t%s\n", tag, (char *)buf.value); + + gss_release_buffer(&tmp_minor, &buf); + gss_release_name(&tmp_minor, &canon); + + return GSS_S_COMPLETE; +} + +static OM_uint32 +displayOID(OM_uint32 *minor, gss_OID oid, char *tag) +{ + OM_uint32 major, tmp_minor; + gss_buffer_desc buf; + + major = gss_oid_to_str(minor, oid, &buf); + if (GSS_ERROR(major)) { + displayStatus("gss_oid_to_str", major, *minor); + return major; + } + + printf("%s:\t%s\n", tag, (char *)buf.value); + + gss_release_buffer(&tmp_minor, &buf); + + return GSS_S_COMPLETE; +} + +static OM_uint32 +initAcceptSecContext(OM_uint32 *minor, + gss_name_t target_name, + gss_cred_id_t verifier_cred_handle) +{ + OM_uint32 major; + gss_buffer_desc token, tmp; + gss_ctx_id_t initiator_context = GSS_C_NO_CONTEXT; + gss_ctx_id_t acceptor_context = GSS_C_NO_CONTEXT; + gss_name_t source_name = GSS_C_NO_NAME; + OM_uint32 time_rec; + gss_OID mech = GSS_C_NO_OID; + + token.value = NULL; + token.length = 0; + + tmp.value = NULL; + tmp.length = 0; + + major = gss_init_sec_context(minor, + GSS_C_NO_CREDENTIAL, + &initiator_context, + target_name, + &spnego_mech, + GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG, + GSS_C_INDEFINITE, + GSS_C_NO_CHANNEL_BINDINGS, + GSS_C_NO_BUFFER, + NULL, + &token, + NULL, + &time_rec); + + if (target_name != GSS_C_NO_NAME) + (void) gss_release_name(minor, &target_name); + + if (GSS_ERROR(major)) { + displayStatus("gss_init_sec_context", major, *minor); + return major; + } + + (void) gss_delete_sec_context(minor, &initiator_context, NULL); + + major = gss_accept_sec_context(minor, + &acceptor_context, + verifier_cred_handle, + &token, + GSS_C_NO_CHANNEL_BINDINGS, + &source_name, + &mech, + &tmp, + NULL, + &time_rec, + NULL); + + if (GSS_ERROR(major)) + displayStatus("gss_accept_sec_context", major, *minor); + else { + displayCanonName(minor, source_name, "Source name"); + displayOID(minor, mech, "Source mech"); + } + + (void) gss_release_name(minor, &source_name); + (void) gss_delete_sec_context(minor, &acceptor_context, NULL); + (void) gss_release_buffer(minor, &token); + (void) gss_release_buffer(minor, &tmp); + (void) gss_release_oid(minor, &mech); + + return major; +} + +int main(int argc, char *argv[]) +{ + OM_uint32 minor, major; + gss_cred_id_t verifier_cred_handle = GSS_C_NO_CREDENTIAL; + gss_OID_set_desc mechs; + gss_OID_set actual_mechs = GSS_C_NO_OID_SET; + gss_buffer_desc buf; + gss_name_t target_name; + + if (argc < 2 || argc > 3) { + fprintf(stderr, "Usage: %s target_name [keytab]\n", argv[0]); + exit(1); + } + + buf.value = argv[1]; + buf.length = strlen((char *)buf.value); + major = gss_import_name(&minor, &buf, + (gss_OID)GSS_KRB5_NT_PRINCIPAL_NAME, + &target_name); + if (GSS_ERROR(major)) { + displayStatus("gss_import_name(target_name)", major, minor); + goto out; + } + + if (argc > 2) { + major = krb5_gss_register_acceptor_identity(argv[2]); + if (GSS_ERROR(major)) { + displayStatus("krb5_gss_register_acceptor_identity", + major, minor); + goto out; + } + } + + mechs.elements = &spnego_mech; + mechs.count = 1; + + /* get default acceptor cred */ + major = gss_acquire_cred(&minor, + GSS_C_NO_NAME, + GSS_C_INDEFINITE, + &mechs, + GSS_C_ACCEPT, + &verifier_cred_handle, + &actual_mechs, + NULL); + if (GSS_ERROR(major)) { + displayStatus("gss_acquire_cred", major, minor); + goto out; + } + + /* Restrict the acceptor to krb5, to exercise the neg_mechs logic. */ + mechs.elements = (gss_OID)gss_mech_krb5; + mechs.count = 1; + major = gss_set_neg_mechs(&minor, verifier_cred_handle, &mechs); + if (GSS_ERROR(major)) { + displayStatus("gss_set_neg_mechs", major, minor); + goto out; + } + + major = initAcceptSecContext(&minor, target_name, verifier_cred_handle); + if (GSS_ERROR(major)) + goto out; + + printf("\n"); + +out: + (void) gss_release_cred(&minor, &verifier_cred_handle); + (void) gss_release_oid_set(&minor, &actual_mechs); + (void) gss_release_name(&minor, &target_name); + + return GSS_ERROR(major) ? 1 : 0; +}

1 0

[AuthHub/krb5-1-8: 33/111] ticket: 6657 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 583ecbe728ec53e4b8cc9a1ecb7bc67a847bb008 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Feb 12 20:28:43 2010 +0000 ticket: 6657 version_fixed: 1.8 status: resolved pull up r23713 from trunk ------------------------------------------------------------------------ r23713 | hartmans | 2010-02-09 14:15:12 -0500 (Tue, 09 Feb 2010) | 10 lines subject: krb5int_fast_free_state segfaults if state is null ticket: 6657 target_version: 1.8 tags: pullup krb5int_fast_free_state fails if state is null. INstead it should simply return Reorganization of the get_init_creds logic has created situations where the init_creds loop can fail between the time when the context is initialized and the fast state is initialized. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23719 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 2ebbdcf..1ff2d67 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -533,6 +533,8 @@ krb5int_fast_make_state( krb5_context context, struct krb5int_fast_request_state void krb5int_fast_free_state( krb5_context context, struct krb5int_fast_request_state *state) { + if (state == NULL) + return; /*We are responsible for none of the store in the fast_outer_req*/ krb5_free_keyblock(context, state->armor_key); krb5_free_fast_armor(context, state->armor);

1 0

[AuthHub/krb5-1-8: 32/111] ticket: 6656 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 460b23c9eb6aa826a7c8ca32d1bb28db01820a17 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Feb 12 20:28:39 2010 +0000 ticket: 6656 version_fixed: 1.8 status: resolved pull up r23712, r23714 from trunk ------------------------------------------------------------------------ r23714 | ghudson | 2010-02-09 20:55:36 -0500 (Tue, 09 Feb 2010) | 13 lines ticket: 6656 Followon fixes to r23712: * A few formatting fixes. * Fix unlikely leak in kdc_handle_protected_negotiation: if add_pa_data_element with copy == FALSE fails, it's still the caller's responsibility to free pa.contents. * Fix pre-existing (since r23465) leak of reply_encpart.enc_padata in process_as_req. * Call add_pa_data_element with copy == TRUE in return_referral_enc_padata since we are passing memory owned by the database entry. ------------------------------------------------------------------------ r23712 | hartmans | 2010-02-09 14:15:07 -0500 (Tue, 09 Feb 2010) | 14 lines subject: enc_padata can include empty sequence ticket: 6656 target_version: 1.8 tags: pullup There are two issues with return_enc_padata. 1) It often will return an empty sequence of enc_padata rather than not including the field 2) FAST negotiation is double supported in the referral tgs path and not supported in the non-referral path Rewrite the return_enc_padata logic to: * Split out referral interactions with kdb into its own function * Use add_pa_data_element git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23718 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_as_req.c | 6 +++- src/kdc/do_tgs_req.c | 31 ++++++----------------- src/kdc/kdc_preauth.c | 66 ++++++++++++++++++++++++++----------------------- src/kdc/kdc_util.c | 44 ++++++++++++-------------------- src/kdc/kdc_util.h | 5 ++- 5 files changed, 67 insertions(+), 85 deletions(-) --- diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 83d3101..b183dcf 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -133,6 +133,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, server_keyblock.contents = NULL; client_keyblock.contents = NULL; reply.padata = 0; + reply_encpart.enc_padata = 0; memset(&reply, 0, sizeof(reply)); session_key.contents = 0; @@ -623,7 +624,8 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, goto errout; } errcode = return_enc_padata(kdc_context, req_pkt, request, - as_encrypting_key, &server, &reply_encpart); + as_encrypting_key, &server, &reply_encpart, + FALSE); if (errcode) { status = "KDC_RETURN_ENC_PADATA"; goto errout; @@ -689,6 +691,8 @@ egress: krb5_free_keyblock_contents(kdc_context, &client_keyblock); if (reply.padata != NULL) krb5_free_pa_data(kdc_context, reply.padata); + if (reply_encpart.enc_padata) + krb5_free_pa_data(kdc_context, reply_encpart.enc_padata); if (cname != NULL) free(cname); diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 26fde1e..cb0496f 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -948,29 +948,14 @@ tgt_again: status = "generating reply key"; goto cleanup; } - if (is_referral && isflagset(s_flags, KRB5_KDB_FLAG_CANONICALIZE)) { - int idx = 0; - - errcode = return_enc_padata(kdc_context, pkt, request, - reply_key, &server, &reply_encpart); - if (errcode) { - status = "KDC_RETURN_ENC_PADATA"; - goto cleanup; - } - /* Not referral. */ - reply_encpart.enc_padata = calloc(3, sizeof(krb5_pa_data *)); - if (reply_encpart.enc_padata == NULL) { - errcode = ENOMEM; - status = "Allocating enc_padata"; - goto cleanup; - } - errcode = kdc_handle_protected_negotiation(pkt, request, reply_key, - reply_encpart.enc_padata, - &idx); - if (errcode != 0) { - status = "protected negotiation"; - goto cleanup; - } + errcode = return_enc_padata(kdc_context, pkt, request, + reply_key, &server, &reply_encpart, + is_referral && + isflagset(s_flags, + KRB5_KDB_FLAG_CANONICALIZE)); + if (errcode) { + status = "KDC_RETURN_ENC_PADATA"; + goto cleanup; } errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart, diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c index c5dfb1f..00800aa 100644 --- a/src/kdc/kdc_preauth.c +++ b/src/kdc/kdc_preauth.c @@ -3084,48 +3084,52 @@ include_pac_p(krb5_context context, krb5_kdc_req *request) return retval; } -krb5_error_code -return_enc_padata(krb5_context context, krb5_data *req_pkt, - krb5_kdc_req *request, krb5_keyblock *reply_key, - krb5_db_entry *server, krb5_enc_kdc_rep_part *reply_encpart) +static krb5_error_code +return_referral_enc_padata( krb5_context context, + krb5_enc_kdc_rep_part *reply, + krb5_db_entry *server) { krb5_error_code code; krb5_tl_data tl_data; - krb5_pa_data *pa_data; - int idx = 0; + krb5_pa_data pa_data; - /* This should be initialized and only used for Win2K compat and other - * specific standardized uses such as FAST negotiation. */ - assert(reply_encpart->enc_padata == NULL); - reply_encpart->enc_padata = calloc(4, sizeof(krb5_pa_data *)); - if (reply_encpart->enc_padata == NULL) - return ENOMEM; tl_data.tl_data_type = KRB5_TL_SVR_REFERRAL_DATA; code = krb5_dbe_lookup_tl_data(context, server, &tl_data); if (code || tl_data.tl_data_length == 0) - goto negotiate; /* no server referrals to return */ - - pa_data = (krb5_pa_data *)malloc(sizeof(*pa_data)); - if (pa_data == NULL) - return ENOMEM; - pa_data->magic = KV5M_PA_DATA; - pa_data->pa_type = KRB5_PADATA_SVR_REFERRAL_INFO; - pa_data->length = tl_data.tl_data_length; - pa_data->contents = malloc(pa_data->length); - if (pa_data->contents == NULL) { - free(pa_data); - return ENOMEM; - } - memcpy(pa_data->contents, tl_data.tl_data_contents, tl_data.tl_data_length); + return 0; + pa_data.magic = KV5M_PA_DATA; + pa_data.pa_type = KRB5_PADATA_SVR_REFERRAL_INFO; + pa_data.length = tl_data.tl_data_length; + pa_data.contents = tl_data.tl_data_contents; + return add_pa_data_element(context, &pa_data, &reply->enc_padata, TRUE); +} - reply_encpart->enc_padata[idx++] = pa_data; - reply_encpart->enc_padata[1] = NULL; -negotiate: - return kdc_handle_protected_negotiation(req_pkt, request, reply_key, - reply_encpart->enc_padata, &idx); +krb5_error_code +return_enc_padata(krb5_context context, krb5_data *req_pkt, + krb5_kdc_req *request, krb5_keyblock *reply_key, + krb5_db_entry *server, krb5_enc_kdc_rep_part *reply_encpart, + krb5_boolean is_referral) +{ + krb5_error_code code = 0; + /* This should be initialized and only used for Win2K compat and other + * specific standardized uses such as FAST negotiation. */ + assert(reply_encpart->enc_padata == NULL); + if (is_referral) { + code = return_referral_enc_padata(context, reply_encpart, server); + if (code) + return code; + } + code = kdc_handle_protected_negotiation(req_pkt, request, reply_key, + &reply_encpart->enc_padata); + if (code) + goto cleanup; + /*Add potentially other enc_padata providers*/ +cleanup: + return code; } + #if 0 static krb5_error_code return_server_referral(krb5_context context, krb5_pa_data * padata, diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 281bcc8..d63bba2 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -2675,23 +2675,18 @@ kdc_get_ticket_endtime(krb5_context context, krb5_error_code kdc_handle_protected_negotiation(krb5_data *req_pkt, krb5_kdc_req *request, const krb5_keyblock *reply_key, - krb5_pa_data **out_enc_padata, int *idx) + krb5_pa_data ***out_enc_padata) { krb5_error_code retval = 0; krb5_checksum checksum; krb5_data *out = NULL; - krb5_pa_data *pa; - assert(out_enc_padata != NULL); - pa = krb5int_find_pa_data(kdc_context, request->padata, + krb5_pa_data pa, *pa_in; + pa_in = krb5int_find_pa_data(kdc_context, request->padata, KRB5_ENCPADATA_REQ_ENC_PA_REP); - if (pa == NULL) + if (pa_in == NULL) return 0; - checksum.contents = NULL; - pa = malloc(sizeof(krb5_pa_data)); - if (pa == NULL) - return ENOMEM; - pa->magic = KV5M_PA_DATA; - pa->pa_type = KRB5_ENCPADATA_REQ_ENC_PA_REP; + pa.magic = KV5M_PA_DATA; + pa.pa_type = KRB5_ENCPADATA_REQ_ENC_PA_REP; retval = krb5_c_make_checksum(kdc_context,0, reply_key, KRB5_KEYUSAGE_AS_REQ, req_pkt, &checksum); if (retval != 0) @@ -2699,29 +2694,22 @@ kdc_handle_protected_negotiation(krb5_data *req_pkt, krb5_kdc_req *request, retval = encode_krb5_checksum(&checksum, &out); if (retval != 0) goto cleanup; - pa->contents = (krb5_octet *) out->data; - pa->length = out->length; - out_enc_padata[(*idx)++] = pa; - pa = NULL; - out->data = NULL; - pa = malloc(sizeof(krb5_pa_data)); - if (pa == NULL) { - retval = ENOMEM; + pa.contents = (krb5_octet *) out->data; + pa.length = out->length; + retval = add_pa_data_element(kdc_context, &pa, out_enc_padata, FALSE); + if (retval) goto cleanup; - } - pa->magic = KV5M_PA_DATA; - pa->pa_type = KRB5_PADATA_FX_FAST; - pa->length = 0; - pa->contents = NULL; - out_enc_padata[(*idx)++] = pa; - pa = NULL; + out->data = NULL; + pa.magic = KV5M_PA_DATA; + pa.pa_type = KRB5_PADATA_FX_FAST; + pa.length = 0; + pa.contents = NULL; + retval = add_pa_data_element(kdc_context, &pa, out_enc_padata, FALSE); cleanup: if (checksum.contents) krb5_free_checksum_contents(kdc_context, &checksum); if (out != NULL) krb5_free_data(kdc_context, out); - if (pa != NULL) - free(pa); return retval; } diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h index 2583895..03ecaf7 100644 --- a/src/kdc/kdc_util.h +++ b/src/kdc/kdc_util.h @@ -258,7 +258,8 @@ return_enc_padata(krb5_context context, krb5_data *req_pkt, krb5_kdc_req *request, krb5_keyblock *reply_key, krb5_db_entry *server, - krb5_enc_kdc_rep_part *reply_encpart); + krb5_enc_kdc_rep_part *reply_encpart, + krb5_boolean is_referral); krb5_error_code sign_db_authdata (krb5_context context, @@ -401,7 +402,7 @@ krb5_error_code kdc_preauth_get_cookie(struct kdc_request_state *state, krb5_error_code kdc_handle_protected_negotiation( krb5_data *req_pkt, krb5_kdc_req *request, const krb5_keyblock *reply_key, - krb5_pa_data **out_enc_padata, int *idx); + krb5_pa_data ***out_enc_padata); krb5_error_code krb5int_get_domain_realm_mapping(krb5_context context, const char *host, char ***realmsp);

1 0

[AuthHub/krb5-1-8: 31/111] ticket: 6652 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 83aa7f0bd721e646822c545f8f041ca362584db7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 21:22:18 2010 +0000 ticket: 6652 version_fixed: 1.8 status: resolved pull up r23677 from trunk ------------------------------------------------------------------------ r23677 | ghudson | 2010-01-28 20:22:17 -0500 (Thu, 28 Jan 2010) | 14 lines ticket: 6652 subject: Make decryption of master key list more robust target_version: 1.8 tags: pullup krb5_def_fetch_mkey_list was incorrectly filtering mkey_aux entries when searching the list for an entry which can be decrypted with the stashed master key. This bug was masked in most cases by the mkvno heuristic. Remove the mkvno heuristic, since performance is not an issue for this rarely-performed operation, and remove the incorrect enctype comparison in the brute-force search. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23711 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kdb/kdb_default.c | 50 +++++++++++--------------------------------- 1 files changed, 13 insertions(+), 37 deletions(-) --- diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c index 4a4cf87..225a507 100644 --- a/src/lib/kdb/kdb_default.c +++ b/src/lib/kdb/kdb_default.c @@ -542,49 +542,25 @@ krb5_def_fetch_mkey_list(krb5_context context, } if (!found_key) { - /* - * Note the mkvno may provide a hint as to which mkey_aux tuple to - * decrypt. - */ if ((retval = krb5_dbe_lookup_mkey_aux(context, &master_entry, &mkey_aux_data_list))) goto clean_n_exit; - /* mkvno may be 0 in some cases like keyboard and should be ignored */ - if (mkvno != 0) { - /* for performance sake, try decrypting with matching kvno */ - for (aux_data_entry = mkey_aux_data_list; aux_data_entry != NULL; - aux_data_entry = aux_data_entry->next) { - - if (aux_data_entry->mkey_kvno == mkvno) { - if (krb5_dbekd_decrypt_key_data(context, mkey, - &aux_data_entry->latest_mkey, - &cur_mkey, NULL) == 0) { - found_key = TRUE; - break; - } - } + for (aux_data_entry = mkey_aux_data_list; aux_data_entry != NULL; + aux_data_entry = aux_data_entry->next) { + + if (krb5_dbekd_decrypt_key_data(context, mkey, + &aux_data_entry->latest_mkey, + &cur_mkey, NULL) == 0) { + found_key = TRUE; + break; } } - if (!found_key) { - /* given the importance of acquiring the latest mkey, try brute force */ - for (aux_data_entry = mkey_aux_data_list; aux_data_entry != NULL; - aux_data_entry = aux_data_entry->next) { - - if (mkey->enctype == aux_data_entry->latest_mkey.key_data_type[0] && - (krb5_dbekd_decrypt_key_data(context, mkey, - &aux_data_entry->latest_mkey, - &cur_mkey, NULL) == 0)) { - found_key = TRUE; - break; - } - } - if (found_key != TRUE) { - krb5_set_error_message (context, KRB5_KDB_BADMASTERKEY, - "Unable to decrypt latest master key with the provided master key\n"); - retval = KRB5_KDB_BADMASTERKEY; - goto clean_n_exit; - } + if (found_key != TRUE) { + krb5_set_error_message (context, KRB5_KDB_BADMASTERKEY, + "Unable to decrypt latest master key with the provided master key\n"); + retval = KRB5_KDB_BADMASTERKEY; + goto clean_n_exit; } }

1 0

[AuthHub/krb5-1-8: 30/111] ticket: 6643 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 829f78a7ccecce27e72801c0049ba14003a2906a Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:48 2010 +0000 ticket: 6643 version_fixed: 1.8 status: resolved pull up r23699 from trunk ------------------------------------------------------------------------ r23699 | ghudson | 2010-02-05 16:46:35 -0500 (Fri, 05 Feb 2010) | 10 lines ticket: 6643 target_version: 1.8 tags: pullup Consistently place $(LDFLAGS) after $(SHLIB_EXPFLAGS) when building shared libraries. Previously we sometimes failing to use $(LDFLAGS) at all, and at other times were putting it before $(SHLIB_EXPFLAGS) where it could pick up tree-internal libraries from outside the build tree. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23710 dc483132-0cff-0310-8789-dd5450dbe970 src/config/shlib.conf | 25 ++++++++++++------------- 1 files changed, 12 insertions(+), 13 deletions(-) --- diff --git a/src/config/shlib.conf b/src/config/shlib.conf index d08b5df..beae4bf 100644 --- a/src/config/shlib.conf +++ b/src/config/shlib.conf @@ -285,7 +285,7 @@ mips-*-netbsd*) PICFLAGS=-fPIC SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBEXT=.so - LDCOMBINE='$(CC) -shared $(LDFLAGS)' + LDCOMBINE='$(CC) -shared' SHLIB_RPATH_FLAGS='-R$(SHLIB_RDIRS)' SHLIB_EXPFLAGS='$(SHLIB_RPATH_FLAGS) $(SHLIB_DIRS) $(SHLIB_EXPLIBS)' RPATH_FLAG=-R @@ -349,7 +349,7 @@ mips-*-netbsd*) SHLIBEXT=.dylib DYNOBJEXT=.so SHLIB_EXPORT_FILE_DEP=darwin.exports - LDCOMBINE='$(CC) -undefined error -dead_strip -dynamiclib -compatibility_version $(LIBMAJOR) -current_version $(LIBMAJOR).$(LIBMINOR) -install_name "$(KRB5_LIBDIR)/$(LIBPREFIX)$(LIBBASE)$(SHLIBVEXT)" -exported_symbols_list darwin.exports $(CFLAGS) $(LDFLAGS)' + LDCOMBINE='$(CC) -undefined error -dead_strip -dynamiclib -compatibility_version $(LIBMAJOR) -current_version $(LIBMAJOR).$(LIBMINOR) -install_name "$(KRB5_LIBDIR)/$(LIBPREFIX)$(LIBBASE)$(SHLIBVEXT)" -exported_symbols_list darwin.exports $(CFLAGS)' # The -dylib_file option tells the linker where to find indirect dependent # libraries, without adding them to the dependency list. We need this because # the direct dependent libraries contain the pathname where the indirect @@ -358,7 +358,7 @@ mips-*-netbsd*) for lib in libkrb5support.1.1.dylib libkadm5srv.5.1.dylib libkdb5.4.0.dylib; do LDCOMBINE_TAIL="$LDCOMBINE_TAIL -dylib_file \"\$(KRB5_LIBDIR)/$lib\":\$(TOPLIBD)/$lib" done - MAKE_DYNOBJ_COMMAND='$(CC) -bundle $(CFLAGS) $(LDFLAGS) -o $@ $$objlist $(DYNOBJ_EXPFLAGS) -exported_symbols_list darwin.exports'" ${LDCOMBINE_TAIL}" + MAKE_DYNOBJ_COMMAND='$(CC) -bundle $(CFLAGS) $(LDFLAGS) -o $@ $$objlist $(DYNOBJ_EXPFLAGS) $(LDFLAGS) -exported_symbols_list darwin.exports'" ${LDCOMBINE_TAIL}" CC_LINK_SHARED='$(CC) $(PROG_LIBPATH) -dynamic $(CFLAGS) $(LDFLAGS)' CC_LINK_STATIC='$(CC) $(PROG_LIBPATH) $(CFLAGS) $(LDFLAGS)' CXX_LINK_SHARED='$(CXX) $(PROG_LIBPATH) -dynamic $(CXXFLAGS) $(LDFLAGS)' @@ -386,7 +386,6 @@ mips-*-netbsd*) ;; esac fi - LDCOMBINE_TAIL='$(LDFLAGS)' SHLIBVEXT='.so.$(LIBMAJOR).$(LIBMINOR)' SHLIBSEXT='.so.$(LIBMAJOR)' SHLIBEXT=.so @@ -409,7 +408,7 @@ mips-*-netbsd*) SHLIBEXT=.so # Linux ld doesn't default to stuffing the SONAME field... # Use objdump -x to examine the fields of the library - LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT),--no-undefined $(LDFLAGS)' + LDCOMBINE='$(CC) -shared -fPIC -Wl,-h,$(LIBPREFIX)$(LIBBASE)$(SHLIBSEXT),--no-undefined' # LDCOMBINE_TAIL='-Wl,--version-script binutils.versions && $(PERL) -w $(top_srcdir)/util/export-check.pl $(SHLIB_EXPORT_FILE) $@' SHLIB_EXPORT_FILE_DEP=binutils.versions @@ -465,11 +464,11 @@ mips-*-netbsd*) if test "$ac_cv_c_compiler_gnu" = "yes" ; then wl_prefix=-Wl, RPATH_FLAG='-Wl,-blibpath:' - LDCOMBINE='$(CC) -shared -v -o $@ $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok -Xlinker -brtl $(SHLIB_EXPFLAGS) -lc $$initfini' + LDCOMBINE='$(CC) -shared -v -o $@ $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok -Xlinker -brtl $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' else wl_prefix= RPATH_FLAG=-blibpath: - LDCOMBINE='/bin/ld -o $@ $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok -brtl $(SHLIB_EXPFLAGS) -lc $$initfini' + LDCOMBINE='/bin/ld -o $@ $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok -brtl $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' fi # Assume initialization always delayed. INIT_FINI_PREP="wl=${wl_prefix}; "'i=1; initfini=; for f in . $(LIBFINIFUNC); do if test $$f != .; then initfini="$$initfini $${wl}-binitfini::$$f:$$i"; else :; fi; i=`expr $$i + 1`; done' @@ -499,13 +498,13 @@ mips-*-netbsd*) if test "$ac_cv_c_compiler_gnu" = "yes" ; then wl_prefix=-Wl, RPATH_FLAG='-Wl,-blibpath:' - LDCOMBINE='$(CC) -shared -v -o shr.o.$(LIBMAJOR).$(LIBMINOR) $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok $(SHLIB_EXPFLAGS) -lc $$initfini' - LDCOMBINE_DYN='$(CC) -shared -v -o $@ $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok $(SHLIB_EXPFLAGS) -lc $$initfini' + LDCOMBINE='$(CC) -shared -v -o shr.o.$(LIBMAJOR).$(LIBMINOR) $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' + LDCOMBINE_DYN='$(CC) -shared -v -o $@ $$objlist -nostartfiles -Xlinker -bgcbypass:1 -Xlinker -bfilelist -Xlinker -bM:SRE -Xlinker -bE:$(SHLIB_EXPORT_FILE) -Xlinker -bernotok $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' else wl_prefix= RPATH_FLAG=-blibpath: - LDCOMBINE='/bin/ld -o shr.o.$(LIBMAJOR).$(LIBMINOR) $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok $(SHLIB_EXPFLAGS) -lc $$initfini' - LDCOMBINE_DYN='/bin/ld -o $@ $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok $(SHLIB_EXPFLAGS) -lc $$initfini' + LDCOMBINE='/bin/ld -o shr.o.$(LIBMAJOR).$(LIBMINOR) $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' + LDCOMBINE_DYN='/bin/ld -o $@ $$objlist -H512 -T512 -bnoentry -bgcbypass:1 -bnodelcsect -bfilelist -bM:SRE -bE:$(SHLIB_EXPORT_FILE) -bernotok $(SHLIB_EXPFLAGS) $(LDFLAGS) -lc $$initfini' fi # Assume initialization always delayed. INIT_FINI_PREP="wl=${wl_prefix}; "'i=1; initfini=; for f in . $(LIBFINIFUNC); do if test $$f != .; then initfini="$$initfini $${wl}-binitfini::$$f:$$i"; else :; fi; i=`expr $$i + 1`; done' @@ -525,8 +524,8 @@ esac if test "${MAKE_SHLIB_COMMAND}" = "x" ; then if test "${INIT_FINI_PREP}" != ":"; then - MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE} -o \$@ \$\$objlist \$(SHLIB_EXPFLAGS) ${LDCOMBINE_TAIL}" + MAKE_SHLIB_COMMAND="${INIT_FINI_PREP} && ${LDCOMBINE} -o \$@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" else - MAKE_SHLIB_COMMAND="${LDCOMBINE} -o \$@ \$\$objlist \$(SHLIB_EXPFLAGS) ${LDCOMBINE_TAIL}" + MAKE_SHLIB_COMMAND="${LDCOMBINE} -o \$@ \$\$objlist \$(SHLIB_EXPFLAGS) \$(LDFLAGS) ${LDCOMBINE_TAIL}" fi fi

1 0

[AuthHub/krb5-1-8: 29/111] ticket: 6601 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 28e503d11f11d723ba5998611b923a60bcc8414c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:46 2010 +0000 ticket: 6601 version_fixed: 1.8 status: resolved pull up r23698 from trunk ------------------------------------------------------------------------ r23698 | tlyu | 2010-02-05 15:52:42 -0500 (Fri, 05 Feb 2010) | 8 lines ticket: 6601 tags: pullup target_version: 1.8 Apply patch from Arlene Berry to handle the case where a mechanism implements set_cred_option but does not implement the requested option. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23709 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/g_set_cred_option.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/g_set_cred_option.c b/src/lib/gssapi/mechglue/g_set_cred_option.c index fc8ed4c..ff388d9 100644 --- a/src/lib/gssapi/mechglue/g_set_cred_option.c +++ b/src/lib/gssapi/mechglue/g_set_cred_option.c @@ -45,6 +45,8 @@ gssspi_set_cred_option(OM_uint32 *minor_status, gss_mechanism mech; int i; OM_uint32 status; + OM_uint32 mech_status; + OM_uint32 mech_minor_status; if (minor_status == NULL) return GSS_S_CALL_INACCESSIBLE_WRITE; @@ -66,14 +68,20 @@ gssspi_set_cred_option(OM_uint32 *minor_status, } if (mech->gssspi_set_cred_option == NULL) { - status = GSS_S_UNAVAILABLE; continue; } - status = (mech->gssspi_set_cred_option)(minor_status, + mech_status = (mech->gssspi_set_cred_option)(&mech_minor_status, union_cred->cred_array[i], desired_object, value); + if (mech_status == GSS_S_UNAVAILABLE) { + continue; + } + else { + status = mech_status; + *minor_status = mech_minor_status; + } if (status != GSS_S_COMPLETE) { map_error(minor_status, mech); break;

1 0

[AuthHub/krb5-1-8: 28/111] ticket: 6655 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 7dc2424f73089651ac16adab0966e17707e86456 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:43 2010 +0000 ticket: 6655 version_fixed: 1.8 status: resolved pull up r23697 from trunk ------------------------------------------------------------------------ r23697 | ghudson | 2010-02-04 22:43:54 -0500 (Thu, 04 Feb 2010) | 12 lines ticket: 6655 subject: Fix cross-realm handling of AD-SIGNEDPATH target_version: 1.8 tags: pullup Avoid setting AD-SIGNEDPATH when returning a cross-realm TGT. Previously we were avoiding it when answering a cross-realm client, which was wrong. Don't fail out on an invalid AD-SIGNEDPATH checksum; just don't trust the ticket for S4U2Proxy (as if AD-SIGNEDPATH weren't present). git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23708 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/kdc_authdata.c | 14 +++++++------- src/kdc/kdc_util.c | 11 +++++++++++ src/kdc/kdc_util.h | 1 + 3 files changed, 19 insertions(+), 7 deletions(-) --- diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c index 8b01ad3..5097558 100644 --- a/src/kdc/kdc_authdata.c +++ b/src/kdc/kdc_authdata.c @@ -897,10 +897,6 @@ verify_ad_signedpath_checksum(krb5_context context, valid); krb5_free_data(context, data); - - if (code == 0 && *valid == FALSE) - code = KRB5KRB_AP_ERR_MODIFIED; - return code; } @@ -952,8 +948,10 @@ verify_ad_signedpath(krb5_context context, if (code != 0) goto cleanup; - *pdelegated = sp->delegated; - sp->delegated = NULL; + if (*path_is_signed) { + *pdelegated = sp->delegated; + sp->delegated = NULL; + } cleanup: krb5_free_ad_signedpath(context, sp); @@ -1179,7 +1177,9 @@ handle_signedpath_authdata (krb5_context context, } } - if (!isflagset(flags, KRB5_KDB_FLAG_CROSS_REALM) && + /* No point in including signedpath authdata for a cross-realm TGT, since + * it will be presented to a different KDC. */ + if (!is_cross_tgs_principal(server->princ) && !only_pac_p(context, enc_tkt_reply->authorization_data)) { code = make_ad_signedpath(context, for_user_princ, diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 6ee96b2..281bcc8 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -192,6 +192,17 @@ krb5_is_tgs_principal(krb5_const_principal principal) return FALSE; } +/* Returns TRUE if principal is the name of a cross-realm TGS. */ +krb5_boolean +is_cross_tgs_principal(krb5_const_principal principal) +{ + return (krb5_princ_size(kdc_context, principal) >= 2 && + data_eq_string(*krb5_princ_component(kdc_context, principal, 0), + KRB5_TGS_NAME) && + !data_eq(*krb5_princ_component(kdc_context, principal, 1), + *krb5_princ_realm(kcd_context, principal))); +} + /* * given authentication data (provides seed for checksum), verify checksum * for source data. diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h index 96e29d9..2583895 100644 --- a/src/kdc/kdc_util.h +++ b/src/kdc/kdc_util.h @@ -42,6 +42,7 @@ krb5_error_code check_hot_list (krb5_ticket *); krb5_boolean realm_compare (krb5_const_principal, krb5_const_principal); krb5_boolean is_local_principal(krb5_const_principal princ1); krb5_boolean krb5_is_tgs_principal (krb5_const_principal); +krb5_boolean is_cross_tgs_principal(krb5_const_principal); krb5_error_code add_to_transited (krb5_data *, krb5_data *,

1 0

[AuthHub/krb5-1-8: 27/111] ticket: 6600 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1a60faaa82d5aaffbf3a9accd61fe5448acabcc8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:39 2010 +0000 ticket: 6600 version_fixed: 1.8 status: resolved pull up r23696 from trunk ------------------------------------------------------------------------ r23696 | tlyu | 2010-02-04 22:25:49 -0500 (Thu, 04 Feb 2010) | 7 lines ticket: 6600 tags: pullup target_version: 1.8 Apply patch from Arlene Berry to avoid segfault if a mech gss_inquire_context returns GSS_C_NO_NAME for the target name. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23707 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/g_inq_context.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/g_inq_context.c b/src/lib/gssapi/mechglue/g_inq_context.c index fbb4127..bb6d569 100644 --- a/src/lib/gssapi/mechglue/g_inq_context.c +++ b/src/lib/gssapi/mechglue/g_inq_context.c @@ -141,6 +141,7 @@ gss_inquire_context( } if (targ_name) { + if (localTargName) { status = gssint_convert_name_to_union_name(minor_status, mech, localTargName, targ_name); @@ -150,6 +151,10 @@ gss_inquire_context( return (status); } + } + else { + *targ_name = GSS_C_NO_NAME; + } } /* spec says mech type must point to static storage */

1 0

[AuthHub/krb5-1-8: 26/111] ticket: 6598 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit dd692be8c3b1b6e725cad4a9f3f1d582af1002fd Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:36 2010 +0000 ticket: 6598 version_fixed: 1.8 status: resolved pull up r23695 from trunk ------------------------------------------------------------------------ r23695 | tlyu | 2010-02-04 22:05:42 -0500 (Thu, 04 Feb 2010) | 8 lines ticket: 6598 tags: pullup target_version: 1.8 Apply patch from Arlene Berry to return a comparable static OID object instead of the application-passed (probably dynamically allocated) OID, to avoid use-after-free problems. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23706 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/init_sec_context.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/krb5/init_sec_context.c b/src/lib/gssapi/krb5/init_sec_context.c index 9b6f3ec..cbc9ed9 100644 --- a/src/lib/gssapi/krb5/init_sec_context.c +++ b/src/lib/gssapi/krb5/init_sec_context.c @@ -979,12 +979,15 @@ krb5_gss_init_sec_context(minor_status, claimant_cred_handle, err = 1; } } else if (g_OID_equal(mech_type, gss_mech_krb5)) { + mech_type = (gss_OID) gss_mech_krb5; if (!cred->rfc_mech) err = 1; } else if (g_OID_equal(mech_type, gss_mech_krb5_old)) { + mech_type = (gss_OID) gss_mech_krb5_old; if (!cred->prerfc_mech) err = 1; } else if (g_OID_equal(mech_type, gss_mech_krb5_wrong)) { + mech_type = (gss_OID) gss_mech_krb5_wrong; if (!cred->rfc_mech) err = 1; } else {

1 0

[AuthHub/krb5-1-8: 25/111] ticket: 6654 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit dbc46034f0f9fe0a23491a9b3dc364e09b0c7e41 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:34 2010 +0000 ticket: 6654 version_fixed: 1.8 status: resolved pull up r23694 from trunk ------------------------------------------------------------------------ r23694 | ghudson | 2010-02-03 14:55:05 -0500 (Wed, 03 Feb 2010) | 7 lines ticket: 6654 subject: Fix greet_server build target_version: 1.8 tags: pullup Fix the export list for the greet_server plugin. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23705 dc483132-0cff-0310-8789-dd5450dbe970 .../authdata/greet_server/greet_server.exports | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/plugins/authdata/greet_server/greet_server.exports b/src/plugins/authdata/greet_server/greet_server.exports index 74719bf..ed34a7f 100644 --- a/src/plugins/authdata/greet_server/greet_server.exports +++ b/src/plugins/authdata/greet_server/greet_server.exports @@ -1 +1 @@ -authdata_server_1 +authdata_server_2

1 0

[AuthHub/krb5-1-8: 24/111] ticket: 6653 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 12ff01a2660c044ece04c519bd72d92768513cba Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:31 2010 +0000 ticket: 6653 version_fixed: 1.8 status: resolved pull up r23681 from trunk ------------------------------------------------------------------------ r23681 | tlyu | 2010-02-01 16:48:19 -0500 (Mon, 01 Feb 2010) | 15 lines ticket: 6653 subject: set_default_enctype_var should filter not reject weak enctypes tags: pullup target_version: 1.8 With allow_weak_crypto=false, set_default_enctype_var() (helper function for krb5_set_default_tgs_enctypes(), etc.) was rejecting any application-provided enctype list that contained any weak enctype even when valid strong enctypes were present. This broke some Samba things. Filter the weak enctypes instead. Add test cases. Reported to Debian by Holger Isenberg. (Debian bug #566977) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=566977 Thanks to Simo Sorce for testing. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23704 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/init_ctx.c | 28 ++++++++--- src/lib/krb5/krb/t_etypes.c | 109 +++++++++++++++++++++++++++++++++--------- 2 files changed, 105 insertions(+), 32 deletions(-) --- diff --git a/src/lib/krb5/krb/init_ctx.c b/src/lib/krb5/krb/init_ctx.c index 2c2beb6..e72534c 100644 --- a/src/lib/krb5/krb/init_ctx.c +++ b/src/lib/krb5/krb/init_ctx.c @@ -277,19 +277,31 @@ set_default_etype_var(krb5_context context, const krb5_enctype *etypes, { krb5_error_code code; krb5_enctype *list; - int i; + size_t src, dst; if (etypes) { - for (i = 0; etypes[i]; i++) { - if (!krb5_c_valid_enctype(etypes[i])) - return KRB5_PROG_ETYPE_NOSUPP; - if (!context->allow_weak_crypto && krb5int_c_weak_enctype(etypes[i])) - return KRB5_PROG_ETYPE_NOSUPP; - } - + /* Empty list passed in. */ + if (etypes[0] == 0) + return EINVAL; code = krb5int_copy_etypes(etypes, &list); if (code) return code; + + /* Filter list in place to exclude invalid and (optionally) weak + * enctypes. */ + for (src = dst = 0; list[src]; src++) { + if (!krb5_c_valid_enctype(list[src])) + continue; + if (!context->allow_weak_crypto + && krb5int_c_weak_enctype(list[src])) + continue; + list[dst++] = list[src]; + } + list[dst] = 0; /* Zero-terminate. */ + if (dst == 0) { + free(list); + return KRB5_CONFIG_ETYPE_NOSUPP; + } } else { list = NULL; } diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c index 47763e5..f84ffee 100644 --- a/src/lib/krb5/krb/t_etypes.c +++ b/src/lib/krb5/krb/t_etypes.c @@ -34,51 +34,60 @@ static struct { krb5_enctype defaults[64]; krb5_enctype expected_noweak[64]; krb5_enctype expected[64]; + krb5_error_code expected_err_noweak; + krb5_error_code expected_err_weak; } tests[] = { /* Empty string, unused default list */ { "", { ENCTYPE_DES_CBC_CRC, 0 }, { 0 }, - { 0 } + { 0 }, + 0, 0 }, /* Single weak enctype */ { "des-cbc-md4", { 0 }, { 0 }, - { ENCTYPE_DES_CBC_MD4, 0 } + { ENCTYPE_DES_CBC_MD4, 0 }, + 0, 0 }, /* Single non-weak enctype */ { "aes128-cts-hmac-sha1-96", { 0 }, { ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, - { ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 } + { ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, + 0, 0 }, /* Two enctypes, one an alias, one weak */ { "rc4-hmac des-cbc-md5", { 0 }, { ENCTYPE_ARCFOUR_HMAC, 0 }, - { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES_CBC_MD5, 0 } + { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES_CBC_MD5, 0 }, + 0, 0 }, /* Three enctypes, all weak, case variation, funky separators */ { " deS-HMac-shA1 , arCFour-hmaC-mD5-exp\tdeS3-Cbc-RAw\n", { 0 }, { 0 }, { ENCTYPE_DES_HMAC_SHA1, ENCTYPE_ARCFOUR_HMAC_EXP, - ENCTYPE_DES3_CBC_RAW, 0 } + ENCTYPE_DES3_CBC_RAW, 0 }, + 0, 0 }, /* Default set with enctypes added (one weak in each pair) */ { "DEFAULT des-cbc-raw +des3-hmac-sha1", { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP, 0 }, { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 }, { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP, - ENCTYPE_DES_CBC_RAW, ENCTYPE_DES3_CBC_SHA1, 0 } + ENCTYPE_DES_CBC_RAW, ENCTYPE_DES3_CBC_SHA1, 0 }, + 0, 0 }, /* Default set with enctypes removed */ { "default -aes128-cts -des-hmac-sha1", { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_HMAC_SHA1, 0 }, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 }, - { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_MD5, 0 } + { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_MD5, 0 }, + 0, 0 }, /* Family followed by enctype */ { "aes des3-cbc-sha1-kd", @@ -86,14 +95,16 @@ static struct { { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_DES3_CBC_SHA1, 0 }, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, - ENCTYPE_DES3_CBC_SHA1, 0 } + ENCTYPE_DES3_CBC_SHA1, 0 }, + 0, 0 }, /* Enctype followed by two families */ { "+rc4-hmAC des3 +des", { 0 }, { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 }, { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES_CBC_CRC, - ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4 } + ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_MD4 }, + 0, 0 }, /* Default set with family added and enctype removed */ { "DEFAULT +aes -arcfour-hmac-md5", @@ -101,7 +112,8 @@ static struct { { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_DES_CBC_CRC, - ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 } + ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, + 0, 0 }, /* Default set with families removed and enctypes added (one redundant) */ { "DEFAULT -des -des3 rc4-hmac rc4-hmac-exp", @@ -111,7 +123,8 @@ static struct { { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_ARCFOUR_HMAC, 0 }, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, - ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP, 0 } + ENCTYPE_ARCFOUR_HMAC, ENCTYPE_ARCFOUR_HMAC_EXP, 0 }, + 0, 0 }, /* Default set with family moved to front */ { "des3 +DEFAULT", @@ -120,14 +133,38 @@ static struct { { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, { ENCTYPE_DES3_CBC_SHA1, ENCTYPE_AES256_CTS_HMAC_SHA1_96, - ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 } + ENCTYPE_AES128_CTS_HMAC_SHA1_96, 0 }, + 0, 0 }, /* Two families with default set removed (exotic case), enctype added */ { "aes +rc4 -DEFaulT des3-hmac-sha1", { ENCTYPE_AES128_CTS_HMAC_SHA1_96, ENCTYPE_DES3_CBC_SHA1, ENCTYPE_ARCFOUR_HMAC, 0 }, { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES3_CBC_SHA1, 0 }, - { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES3_CBC_SHA1, 0 } + { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES3_CBC_SHA1, 0 }, + 0, 0 + }, + /* Test krb5_set_default_in_tkt_ktypes */ + { NULL, + { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_CRC, 0 }, + { ENCTYPE_AES256_CTS_HMAC_SHA1_96, 0 }, + { ENCTYPE_AES256_CTS_HMAC_SHA1_96, ENCTYPE_DES_CBC_CRC, 0 }, + 0, 0 + }, + /* Should get KRB5_CONFIG_ETYPE_NOSUPP if app-provided list has no strong + * enctypes and allow_weak_crypto=false. */ + { NULL, + { ENCTYPE_DES_CBC_CRC, 0 }, + { 0 }, + { ENCTYPE_DES_CBC_CRC, 0 }, + KRB5_CONFIG_ETYPE_NOSUPP, 0 + }, + /* Should get EINVAL if app provides an empty list. */ + { NULL, + { 0 }, + { 0 }, + { 0 }, + EINVAL, EINVAL } }; @@ -150,13 +187,16 @@ compare(krb5_context ctx, krb5_enctype *result, krb5_enctype *expected, { unsigned int i; + if (!result) + return; for (i = 0; result[i]; i++) { if (result[i] != expected[i]) break; } if (!result[i] && !expected[i]) /* Success! */ return; - fprintf(stderr, "Unexpected result while parsing: %s\n", profstr); + if (profstr != NULL) + fprintf(stderr, "Unexpected result while parsing: %s\n", profstr); fprintf(stderr, "Expected: "); show_enctypes(ctx, expected); fprintf(stderr, "Result: "); @@ -169,7 +209,7 @@ int main(int argc, char **argv) { krb5_context ctx; - krb5_error_code ret; + krb5_error_code ret, expected_err; krb5_enctype *list; krb5_boolean weak; unsigned int i; @@ -183,18 +223,39 @@ main(int argc, char **argv) for (i = 0; i < sizeof(tests) / sizeof(*tests); i++) { for (weak = FALSE; weak <= TRUE; weak++) { ctx->allow_weak_crypto = weak; - copy = strdup(tests[i].str); - ret = krb5int_parse_enctype_list(ctx, copy, tests[i].defaults, - &list); - if (ret) { - com_err("krb5int_parse_enctype_list", ret, ""); - return 2; + if (weak) + expected_err = tests[i].expected_err_weak; + else + expected_err = tests[i].expected_err_noweak; + + if (tests[i].str != NULL) { + copy = strdup(tests[i].str); + ret = krb5int_parse_enctype_list(ctx, copy, tests[i].defaults, + &list); + if (ret != expected_err) { + com_err("krb5int_parse_enctype_list", ret, ""); + return 2; + } + } else { + /* No string; test the filtering on the set_default_etype_var + * instead. */ + copy = NULL; + list = NULL; + ret = krb5_set_default_in_tkt_ktypes(ctx, tests[i].defaults); + if (ret != expected_err) { + com_err("krb5_set_default_in_tkt_ktypes", ret, ""); + return 2; + } + } + if (!expected_err) { + compare(ctx, tests[i].str ? list : ctx->in_tkt_etypes, + (weak) ? tests[i].expected : tests[i].expected_noweak, + tests[i].str, weak); } - compare(ctx, list, - (weak) ? tests[i].expected : tests[i].expected_noweak, - tests[i].str, weak); free(copy); free(list); + if (!tests[i].str) + krb5_set_default_in_tkt_ktypes(ctx, NULL); } }

1 0

[AuthHub/krb5-1-8: 23/111] ticket: 6651 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 56890d866fc431a7e8f2e2c06edac70f034ef177 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:27 2010 +0000 ticket: 6651 version_fixed: 1.8 status: resolved pull up r23676, r23679 from trunk ------------------------------------------------------------------------ r23679 | ghudson | 2010-01-31 16:04:48 -0500 (Sun, 31 Jan 2010) | 4 lines ticket: 6650 Fix minor error-handling bug in r23676. ------------------------------------------------------------------------ r23676 | ghudson | 2010-01-28 16:39:31 -0500 (Thu, 28 Jan 2010) | 17 lines ticket: 6650 subject: Handle migration from pre-1.7 databases with master key kvno != 1 target_version: 1.7.1 tags: pullup krb5_dbe_lookup_mkvno assumes an mkvno of 1 for entries with no explicit tl_data. We've seen at least one pre-1.7 KDB with a master kvno of 0, violating this assumption. Fix this as follows: * krb5_dbe_lookup_mkvno outputs 0 instead of 1 if no tl_data exists. * A new function krb5_dbe_get_mkvno translates this 0 value to the minimum version number in the mkey_list. (krb5_dbe_lookup_mkvno cannot do this as it doesn't take the mkey_list as a parameter.) * Call sites to krb5_dbe_lookup_mkvno are converted to krb5_dbe_get_mkvno, except for an LDAP case where it is acceptable to store 0 if the mkvno is unknown. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23703 dc483132-0cff-0310-8789-dd5450dbe970 src/include/kdb.h | 8 ++++++++ src/kadmin/dbutil/kdb5_mkey.c | 10 ++++++++-- src/lib/kadm5/srv/svr_principal.c | 3 ++- src/lib/kdb/kdb5.c | 36 ++++++++++++++++++++++++++++++++++-- src/lib/kdb/libkdb5.exports | 1 + 5 files changed, 53 insertions(+), 5 deletions(-) --- diff --git a/src/include/kdb.h b/src/include/kdb.h index fe0166b..be73939 100644 --- a/src/include/kdb.h +++ b/src/include/kdb.h @@ -556,11 +556,19 @@ krb5_dbe_find_mkey( krb5_context context, krb5_db_entry * entry, krb5_keyblock ** mkey); +/* Set *mkvno to mkvno in entry tl_data, or 0 if not present. */ krb5_error_code krb5_dbe_lookup_mkvno( krb5_context context, krb5_db_entry * entry, krb5_kvno * mkvno); +/* Set *mkvno to mkvno in entry tl_data, or minimum value from mkey_list. */ +krb5_error_code +krb5_dbe_get_mkvno( krb5_context context, + krb5_db_entry * entry, + krb5_keylist_node * mkey_list, + krb5_kvno * mkvno); + krb5_error_code krb5_dbe_lookup_mod_princ_data( krb5_context context, krb5_db_entry * entry, diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c index 9ea7e5e..83a23ef 100644 --- a/src/kadmin/dbutil/kdb5_mkey.c +++ b/src/kadmin/dbutil/kdb5_mkey.c @@ -866,7 +866,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent) goto skip; } p->re_match_count++; - retval = krb5_dbe_lookup_mkvno(util_context, ent, &old_mkvno); + retval = krb5_dbe_get_mkvno(util_context, ent, master_keylist, &old_mkvno); if (retval) { com_err(progname, retval, "determining master key used for principal '%s'", @@ -1137,7 +1137,7 @@ find_mkvnos_in_use(krb5_pointer ptr, args = (struct purge_args *) ptr; - retval = krb5_dbe_lookup_mkvno(args->kcontext, entry, &mkvno); + retval = krb5_dbe_get_mkvno(args->kcontext, entry, master_keylist, &mkvno); if (retval) return (retval); @@ -1193,6 +1193,12 @@ kdb5_purge_mkeys(int argc, char *argv[]) } } + if (master_keylist == NULL) { + com_err(progname, 0, "master keylist not initialized"); + exit_status++; + return; + } + /* assemble & parse the master key name */ if ((retval = krb5_db_setup_mkey_name(util_context, global_params.mkey_name, diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index 2f2faaa..a01f072 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -874,7 +874,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (kdb.key_data[i].key_data_kvno > entry->kvno) entry->kvno = kdb.key_data[i].key_data_kvno; - ret = krb5_dbe_lookup_mkvno(handle->context, &kdb, &entry->mkvno); + ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, + &entry->mkvno); if (ret) goto done; diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c index cd9f716..83dde51 100644 --- a/src/lib/kdb/kdb5.c +++ b/src/lib/kdb/kdb5.c @@ -1591,7 +1591,7 @@ krb5_dbe_find_mkey(krb5_context context, krb5_error_code retval; krb5_keylist_node *cur_keyblock = mkey_list; - retval = krb5_dbe_lookup_mkvno(context, entry, &mkvno); + retval = krb5_dbe_get_mkvno(context, entry, mkey_list, &mkvno); if (retval) return (retval); @@ -1852,7 +1852,7 @@ krb5_dbe_lookup_mkvno(krb5_context context, return (code); if (tl_data.tl_data_length == 0) { - *mkvno = 1; /* default for princs that lack the KRB5_TL_MKVNO data */ + *mkvno = 0; /* Indicates KRB5_TL_MKVNO data not present */ return (0); } else if (tl_data.tl_data_length != 2) { return (KRB5_KDB_TRUNCATED_RECORD); @@ -1864,6 +1864,38 @@ krb5_dbe_lookup_mkvno(krb5_context context, } krb5_error_code +krb5_dbe_get_mkvno(krb5_context context, + krb5_db_entry * entry, + krb5_keylist_node * mkey_list, + krb5_kvno * mkvno) +{ + krb5_error_code code; + krb5_kvno kvno; + + if (mkey_list == NULL) + return EINVAL; + + /* Output the value from entry tl_data if present. */ + code = krb5_dbe_lookup_mkvno(context, entry, &kvno); + if (code != 0) + return code; + if (kvno != 0) { + *mkvno = kvno; + return 0; + } + + /* Determine the minimum kvno in mkey_list and output that. */ + kvno = (krb5_kvno) -1; + while (mkey_list != NULL) { + if (mkey_list->kvno < kvno) + kvno = mkey_list->kvno; + mkey_list = mkey_list->next; + } + *mkvno = kvno; + return 0; +} + +krb5_error_code krb5_dbe_update_mkvno(krb5_context context, krb5_db_entry * entry, krb5_kvno mkvno) diff --git a/src/lib/kdb/libkdb5.exports b/src/lib/kdb/libkdb5.exports index b493df0..8f0644b 100644 --- a/src/lib/kdb/libkdb5.exports +++ b/src/lib/kdb/libkdb5.exports @@ -43,6 +43,7 @@ krb5_dbe_free_actkvno_list krb5_dbe_free_key_data_contents krb5_dbe_free_mkey_aux_list krb5_dbe_free_key_list +krb5_dbe_get_mkvno krb5_dbe_lookup_last_pwd_change krb5_dbe_lookup_actkvno krb5_dbe_lookup_mkey_aux

1 0

[AuthHub/krb5-1-8: 22/111] ticket: 6649 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit d324a7be9a412c9e43de506f9289dc79952f09a0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:22 2010 +0000 ticket: 6649 version_fixed: 1.8 status: resolved pull up r23674, r23675 from trunk ------------------------------------------------------------------------ r23675 | ghudson | 2010-01-27 17:17:12 -0500 (Wed, 27 Jan 2010) | 4 lines ticket: 6649 Update the LDAP dependencies for r23674. ------------------------------------------------------------------------ r23674 | ghudson | 2010-01-26 22:52:52 -0500 (Tue, 26 Jan 2010) | 10 lines ticket: 6649 subject: Get rid of kdb_ext.h and allow out-of-tree KDB plugins target_version: 1.8 tags: pullup Move the contents of kdb_ext.h into kdb.h, since there is no meaningful "extensions" category of DB interfaces now that this stuff is in our tree. Allows out-of-tree KDB plugins to be built since we install kdb.h. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23702 dc483132-0cff-0310-8789-dd5450dbe970 src/include/kdb.h | 133 ++++++++++++ src/include/kdb_ext.h | 169 --------------- src/kdc/deps | 103 ++++----- src/kdc/kdc_util.h | 1 - src/lib/crypto/crypto_tests/deps | 10 + src/lib/kdb/deps | 20 +- src/lib/kdb/kdb5.h | 1 - src/lib/krb5/krb/deps | 85 ++++++-- src/lib/krb5/os/deps | 11 - src/plugins/authdata/greet_server/greet_auth.c | 1 - src/plugins/kdb/db2/deps | 28 ++-- src/plugins/kdb/db2/kdb_ext.c | 1 - src/plugins/kdb/ldap/deps | 18 +- src/plugins/kdb/ldap/libkdb_ldap/deps | 275 +++++++++++++----------- src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c | 1 - src/util/ss/deps | 2 +- 16 files changed, 442 insertions(+), 417 deletions(-) --- diff --git a/src/include/kdb.h b/src/include/kdb.h index 8c6f532..fe0166b 100644 --- a/src/include/kdb.h +++ b/src/include/kdb.h @@ -104,6 +104,32 @@ #define KRB5_KDB_CREATE_BTREE 0x00000001 #define KRB5_KDB_CREATE_HASH 0x00000002 +/* Private flag used to indicate principal is local TGS */ +#define KRB5_KDB_TICKET_GRANTING_SERVICE 0x01000000 +/* Private flag used to indicate xrealm relationship is non-transitive */ +#define KRB5_KDB_XREALM_NON_TRANSITIVE 0x02000000 + +/* Entry get flags */ +/* Name canonicalization requested */ +#define KRB5_KDB_FLAG_CANONICALIZE 0x00000010 +/* Include authorization data generated by backend */ +#define KRB5_KDB_FLAG_INCLUDE_PAC 0x00000020 +/* Is AS-REQ (client referrals only) */ +#define KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY 0x00000040 +/* Map cross-realm principals */ +#define KRB5_KDB_FLAG_MAP_PRINCIPALS 0x00000080 +/* Protocol transition */ +#define KRB5_KDB_FLAG_PROTOCOL_TRANSITION 0x00000100 +/* Constrained delegation */ +#define KRB5_KDB_FLAG_CONSTRAINED_DELEGATION 0x00000200 +/* User-to-user */ +#define KRB5_KDB_FLAG_USER_TO_USER 0x00000800 +/* Cross-realm */ +#define KRB5_KDB_FLAG_CROSS_REALM 0x00001000 + +#define KRB5_KDB_FLAGS_S4U ( KRB5_KDB_FLAG_PROTOCOL_TRANSITION | \ + KRB5_KDB_FLAG_CONSTRAINED_DELEGATION ) + #if !defined(_WIN32) /* @@ -200,6 +226,13 @@ typedef struct __krb5_key_salt_tuple { #define KRB5_TL_ACTKVNO 0x0009 #define KRB5_TL_MKEY_AUX 0x000a +#define KRB5_TL_PAC_LOGON_INFO 0x0100 /* NDR encoded validation info */ +#define KRB5_TL_SERVER_REFERRAL 0x0200 /* ASN.1 encoded ServerReferralInfo */ +#define KRB5_TL_SVR_REFERRAL_DATA 0x0300 /* ASN.1 encoded PA-SVR-REFERRAL-DATA */ +#define KRB5_TL_CONSTRAINED_DELEGATION_ACL 0x0400 /* Each entry is a permitted SPN */ +#define KRB5_TL_LM_KEY 0x0500 /* LM OWF */ +#define KRB5_TL_X509_SUBJECT_ISSUER_NAME 0x0600 /* <I>IssuerDN<S>SubjectDN */ + /* version number for KRB5_TL_ACTKVNO data */ #define KRB5_TL_ACTKVNO_VER 1 @@ -283,6 +316,95 @@ extern char *krb5_mkey_pwd_prompt2; #define KRB5_DB_LOCKMODE_DONTBLOCK 0x0004 #define KRB5_DB_LOCKMODE_PERMANENT 0x0008 +/* db_invoke methods */ +#define KRB5_KDB_METHOD_SIGN_AUTH_DATA 0x00000010 +#define KRB5_KDB_METHOD_CHECK_TRANSITED_REALMS 0x00000020 +#define KRB5_KDB_METHOD_CHECK_POLICY_AS 0x00000030 +#define KRB5_KDB_METHOD_CHECK_POLICY_TGS 0x00000040 +#define KRB5_KDB_METHOD_AUDIT_AS 0x00000050 +#define KRB5_KDB_METHOD_AUDIT_TGS 0x00000060 +#define KRB5_KDB_METHOD_REFRESH_POLICY 0x00000070 +#define KRB5_KDB_METHOD_CHECK_ALLOWED_TO_DELEGATE 0x00000080 + +typedef struct _kdb_sign_auth_data_req { + krb5_magic magic; + unsigned int flags; /* KRB5_KDB flags */ + krb5_const_principal client_princ; /* Client name used in ticket */ + krb5_db_entry *client; /* DB entry for client principal */ + krb5_db_entry *server; /* DB entry for server principal */ + krb5_db_entry *krbtgt; /* DB entry for ticket granting service principal */ + krb5_keyblock *client_key; /* Reply key, valid for AS-REQ only */ + krb5_keyblock *server_key; /* Key used to generate server signature */ + krb5_timestamp authtime; /* Authtime of TGT */ + krb5_authdata **auth_data; /* Authorization data from TGT */ + krb5_keyblock *session_key; /* Reply session key */ + krb5_keyblock *krbtgt_key; /* Key used to decrypt TGT, valid for TGS-REQ only */ +} kdb_sign_auth_data_req; + +typedef struct _kdb_sign_auth_data_rep { + krb5_magic magic; + krb5_authdata **auth_data; /* Signed authorization data */ +} kdb_sign_auth_data_rep; + +typedef struct _kdb_check_transited_realms_req { + krb5_magic magic; + const krb5_data *tr_contents; + const krb5_data *client_realm; + const krb5_data *server_realm; +} kdb_check_transited_realms_req; + +typedef struct _kdb_check_policy_as_req { + krb5_magic magic; + krb5_kdc_req *request; + krb5_db_entry *client; + krb5_db_entry *server; + krb5_timestamp kdc_time; +} kdb_check_policy_as_req; + +typedef struct _kdb_check_policy_as_rep { + krb5_magic magic; + const char *status; + krb5_data e_data; +} kdb_check_policy_as_rep; + +typedef struct _kdb_check_policy_tgs_req { + krb5_magic magic; + krb5_kdc_req *request; + krb5_db_entry *server; + krb5_ticket *ticket; +} kdb_check_policy_tgs_req; + +typedef struct _kdb_check_policy_tgs_rep { + krb5_magic magic; + const char *status; + krb5_data e_data; +} kdb_check_policy_tgs_rep; + +typedef struct _kdb_audit_as_req { + krb5_magic magic; + krb5_kdc_req *request; + krb5_db_entry *client; + krb5_db_entry *server; + krb5_timestamp authtime; + krb5_error_code error_code; +} kdb_audit_as_req; + +typedef struct _kdb_audit_tgs_req { + krb5_magic magic; + krb5_kdc_req *request; + krb5_const_principal client; + krb5_db_entry *server; + krb5_timestamp authtime; + krb5_error_code error_code; +} kdb_audit_tgs_req; + +typedef struct _kdb_check_allowed_to_delegate_req { + krb5_magic magic; + const krb5_db_entry *server; + krb5_const_principal proxy; + krb5_const_principal client; +} kdb_check_allowed_to_delegate_req; + /* libkdb.spec */ krb5_error_code krb5_db_setup_lib_handle(krb5_context kcontext); krb5_error_code krb5_db_open( krb5_context kcontext, char **db_args, int mode ); @@ -303,6 +425,12 @@ krb5_error_code krb5_db_get_principal ( krb5_context kcontext, krb5_db_entry *entries, int *nentries, krb5_boolean *more ); +krb5_error_code krb5_db_get_principal_ext ( krb5_context kcontext, + krb5_const_principal search_for, + unsigned int flags, + krb5_db_entry *entries, + int *nentries, + krb5_boolean *more ); krb5_error_code krb5_db_free_principal ( krb5_context kcontext, krb5_db_entry *entry, int count ); @@ -546,6 +674,11 @@ krb5_db_get_key_data_kvno( krb5_context context, int count, krb5_key_data * data); +krb5_error_code krb5_db_invoke ( krb5_context kcontext, + unsigned int method, + const krb5_data *req, + krb5_data *rep ); + /* default functions. Should not be directly called */ /* diff --git a/src/kdc/deps b/src/kdc/deps index bfda83d..bd3b4e0 100644 --- a/src/kdc/deps +++ b/src/kdc/deps @@ -9,11 +9,11 @@ $(OUTPRE)dispatch.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - dispatch.c extern.h kdc_util.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h dispatch.c extern.h \ + kdc_util.h $(OUTPRE)do_as_req.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm.h \ @@ -22,11 +22,10 @@ $(OUTPRE)do_as_req.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h do_as_req.c extern.h \ - kdc_util.h policy.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + do_as_req.c extern.h kdc_util.h policy.h $(OUTPRE)do_tgs_req.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm_proto.h \ @@ -34,11 +33,11 @@ $(OUTPRE)do_tgs_req.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - do_tgs_req.c extern.h kdc_util.h policy.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h do_tgs_req.c extern.h \ + kdc_util.h policy.h $(OUTPRE)fast_util.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -46,11 +45,10 @@ $(OUTPRE)fast_util.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h fast_util.c \ - kdc_util.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h fast_util.c kdc_util.h $(OUTPRE)kdc_util.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm.h \ @@ -59,11 +57,10 @@ $(OUTPRE)kdc_util.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h kdc_util.c \ - kdc_util.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h kdc_util.c kdc_util.h $(OUTPRE)kdc_preauth.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../include/krb5/preauth_plugin.h \ @@ -72,11 +69,10 @@ $(OUTPRE)kdc_preauth.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h kdc_preauth.c \ - kdc_util.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h kdc_preauth.c kdc_util.h $(OUTPRE)main.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm.h \ @@ -85,11 +81,11 @@ $(OUTPRE)main.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/kdb_kt.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - extern.h kdc5_err.h kdc_util.h main.c + $(top_srcdir)/include/kdb_kt.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h extern.h kdc5_err.h \ + kdc_util.h main.c $(OUTPRE)network.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm_proto.h \ @@ -99,11 +95,10 @@ $(OUTPRE)network.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h kdc5_err.h \ - kdc_util.h network.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h kdc5_err.h kdc_util.h network.c $(OUTPRE)policy.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -111,11 +106,10 @@ $(OUTPRE)policy.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h kdc_util.h \ - policy.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h kdc_util.h policy.c $(OUTPRE)extern.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -134,11 +128,10 @@ $(OUTPRE)replay.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h extern.h kdc_util.h \ - replay.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + extern.h kdc_util.h replay.c $(OUTPRE)kdc_authdata.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/adm_proto.h \ @@ -146,8 +139,8 @@ $(OUTPRE)kdc_authdata.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - extern.h kdc_authdata.c kdc_util.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h extern.h kdc_authdata.c \ + kdc_util.h diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h index bd576e9..96e29d9 100644 --- a/src/kdc/kdc_util.h +++ b/src/kdc/kdc_util.h @@ -32,7 +32,6 @@ #define __KRB5_KDC_UTIL__ #include "kdb.h" -#include "kdb_ext.h" typedef struct _krb5_fulladdr { krb5_address * address; diff --git a/src/lib/crypto/crypto_tests/deps b/src/lib/crypto/crypto_tests/deps index 65076fe..f30df12 100644 --- a/src/lib/crypto/crypto_tests/deps +++ b/src/lib/crypto/crypto_tests/deps @@ -137,6 +137,16 @@ $(OUTPRE)t_kperf.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ $(top_srcdir)/include/socket-utils.h t_kperf.c +$(OUTPRE)t_short.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ + $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ + $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h t_short.c $(OUTPRE)ytest.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(srcdir)/../builtin/sha1/shs.h \ diff --git a/src/lib/kdb/deps b/src/lib/kdb/deps index 2e3baaf..0e332fb 100644 --- a/src/lib/kdb/deps +++ b/src/lib/kdb/deps @@ -15,11 +15,11 @@ kdb5.so kdb5.po $(OUTPRE)kdb5.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/kdb_log.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - adb_err.h kdb5.c kdb5.h kdb5int.h + $(top_srcdir)/include/kdb_log.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h adb_err.h kdb5.c \ + kdb5.h kdb5int.h encrypt_key.so encrypt_key.po $(OUTPRE)encrypt_key.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -107,11 +107,11 @@ kdb_log.so kdb_log.po $(OUTPRE)kdb_log.$(OBJEXT): $(BUILDTOP)/include/autoconf.h $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/kdb_log.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - kdb5.h kdb5int.h kdb_log.c + $(top_srcdir)/include/kdb_log.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h kdb5.h kdb5int.h \ + kdb_log.c keytab.so keytab.po $(OUTPRE)keytab.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ diff --git a/src/lib/kdb/kdb5.h b/src/lib/kdb/kdb5.h index eb9e15c..c1265e7 100644 --- a/src/lib/kdb/kdb5.h +++ b/src/lib/kdb/kdb5.h @@ -11,7 +11,6 @@ #include <utime.h> #include <k5-int.h> #include "kdb.h" -#include "kdb_ext.h" #define KRB5_DB_GET_DB_CONTEXT(kcontext) (((kdb5_dal_handle*) (kcontext)->dal_handle)->db_context) #define KRB5_DB_GET_PROFILE(kcontext) ((kcontext)->profile) diff --git a/src/lib/krb5/krb/deps b/src/lib/krb5/krb/deps index 5b342eb..0267483 100644 --- a/src/lib/krb5/krb/deps +++ b/src/lib/krb5/krb/deps @@ -63,10 +63,45 @@ authdata.so authdata.po $(OUTPRE)authdata.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ + $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h auth_con.h authdata.c \ + authdata.h int-proto.h +authdata_exp.so authdata_exp.po $(OUTPRE)authdata_exp.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ + $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ + $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ + $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ + $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ + authdata_exp.c int-proto.h +authdata_enc.so authdata_enc.po $(OUTPRE)authdata_enc.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ + $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ + $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ + $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + authdata_enc.c +authdata_dec.so authdata_dec.po $(OUTPRE)authdata_dec.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ + $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ + $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ + $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - auth_con.h authdata.c authdata.h int-proto.h + authdata_dec.c int-proto.h bld_pr_ext.so bld_pr_ext.po $(OUTPRE)bld_pr_ext.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -155,7 +190,7 @@ copy_auth.so copy_auth.po $(OUTPRE)copy_auth.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - copy_auth.c + copy_auth.c int-proto.h copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -166,7 +201,7 @@ copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - copy_athctr.c + auth_con.h copy_athctr.c copy_cksum.so copy_cksum.po $(OUTPRE)copy_cksum.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -342,17 +377,6 @@ fast.so fast.po $(OUTPRE)fast.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ $(top_srcdir)/include/socket-utils.h fast.c fast.h \ int-proto.h -free_rtree.so free_rtree.po $(OUTPRE)free_rtree.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - free_rtree.c fwd_tgt.so fwd_tgt.po $(OUTPRE)fwd_tgt.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -645,6 +669,17 @@ pac.so pac.po $(OUTPRE)pac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ authdata.h pac.c +pac_sign.so pac_sign.po $(OUTPRE)pac_sign.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ + $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ + $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ + $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ + $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h authdata.h pac_sign.c parse.so parse.po $(OUTPRE)parse.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -687,6 +722,17 @@ preauth2.so preauth2.po $(OUTPRE)preauth2.$(OBJEXT): \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ fast.h int-proto.h preauth2.c +gic_opt_set_pa.so gic_opt_set_pa.po $(OUTPRE)gic_opt_set_pa.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ + $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ + $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ + $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + gic_opt_set_pa.c int-proto.h princ_comp.so princ_comp.po $(OUTPRE)princ_comp.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -759,10 +805,11 @@ rd_req_dec.so rd_req_dec.po $(OUTPRE)rd_req_dec.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - auth_con.h authdata.h int-proto.h rd_req_dec.c + $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ + int-proto.h rd_req_dec.c rd_safe.so rd_safe.po $(OUTPRE)rd_safe.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -991,7 +1038,7 @@ valid_times.so valid_times.po $(OUTPRE)valid_times.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - valid_times.c + int-proto.h valid_times.c vfy_increds.so vfy_increds.po $(OUTPRE)vfy_increds.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/lib/krb5/os/deps b/src/lib/krb5/os/deps index 8c13f1f..947bf07 100644 --- a/src/lib/krb5/os/deps +++ b/src/lib/krb5/os/deps @@ -101,17 +101,6 @@ free_krbhs.so free_krbhs.po $(OUTPRE)free_krbhs.$(OBJEXT): \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ free_krbhs.c -free_hstrl.so free_hstrl.po $(OUTPRE)free_hstrl.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - free_hstrl.c full_ipadr.so full_ipadr.po $(OUTPRE)full_ipadr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/plugins/authdata/greet_server/greet_auth.c b/src/plugins/authdata/greet_server/greet_auth.c index 0048af4..578a4ab 100644 --- a/src/plugins/authdata/greet_server/greet_auth.c +++ b/src/plugins/authdata/greet_server/greet_auth.c @@ -32,7 +32,6 @@ #include <k5-int.h> #include <krb5/authdata_plugin.h> #include <kdb.h> -#include <kdb_ext.h> static krb5_error_code greet_init(krb5_context ctx, void **blob) diff --git a/src/plugins/kdb/db2/deps b/src/plugins/kdb/db2/deps index 8d80027..6314813 100644 --- a/src/plugins/kdb/db2/deps +++ b/src/plugins/kdb/db2/deps @@ -42,11 +42,10 @@ kdb_db2.so kdb_db2.po $(OUTPRE)kdb_db2.$(OBJEXT): $(BUILDTOP)/include/autoconf.h $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h kdb_db2.c kdb_db2.h \ - kdb_xdr.h policy_db.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + kdb_db2.c kdb_db2.h kdb_xdr.h policy_db.h kdb_ext.so kdb_ext.po $(OUTPRE)kdb_ext.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -56,11 +55,11 @@ kdb_ext.so kdb_ext.po $(OUTPRE)kdb_ext.$(OBJEXT): $(BUILDTOP)/include/autoconf.h $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - kdb_db2.h kdb_ext.c policy_db.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h kdb_db2.h kdb_ext.c \ + policy_db.h pol_xdr.so pol_xdr.po $(OUTPRE)pol_xdr.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/lib/kdb/adb_err.h \ @@ -81,11 +80,10 @@ db2_exp.so db2_exp.po $(OUTPRE)db2_exp.$(OBJEXT): $(BUILDTOP)/include/autoconf.h $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h db2_exp.c kdb_db2.h \ - kdb_xdr.h policy_db.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + db2_exp.c kdb_db2.h kdb_xdr.h policy_db.h lockout.so lockout.po $(OUTPRE)lockout.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/admin_internal.h \ diff --git a/src/plugins/kdb/db2/kdb_ext.c b/src/plugins/kdb/db2/kdb_ext.c index d000e42..f75767d 100644 --- a/src/plugins/kdb/db2/kdb_ext.c +++ b/src/plugins/kdb/db2/kdb_ext.c @@ -32,7 +32,6 @@ #include "kdb.h" #include <stdio.h> #include <errno.h> -#include <kdb_ext.h> #include "kdb_db2.h" static krb5_error_code diff --git a/src/plugins/kdb/ldap/deps b/src/plugins/kdb/ldap/deps index 5d1b6b4..ff98951 100644 --- a/src/plugins/kdb/ldap/deps +++ b/src/plugins/kdb/ldap/deps @@ -4,15 +4,15 @@ ldap_exp.so ldap_exp.po $(OUTPRE)ldap_exp.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ + $(COM_ERR_DEPS) $(srcdir)/../../../lib/kdb/kdb5.h $(srcdir)/libkdb_ldap/kdb_ldap.h \ + $(srcdir)/libkdb_ldap/ldap_krbcontainer.h $(srcdir)/libkdb_ldap/ldap_principal.h \ + $(srcdir)/libkdb_ldap/ldap_pwd_policy.h $(srcdir)/libkdb_ldap/ldap_realm.h \ + $(srcdir)/libkdb_ldap/ldap_tkt_policy.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h $(srcdir)/libkdb_ldap/kdb_ldap.h \ - $(srcdir)/libkdb_ldap/ldap_krbcontainer.h $(srcdir)/libkdb_ldap/ldap_principal.h \ - $(srcdir)/libkdb_ldap/ldap_pwd_policy.h $(srcdir)/libkdb_ldap/ldap_realm.h \ - $(srcdir)/libkdb_ldap/ldap_tkt_policy.h ldap_exp.c + ldap_exp.c diff --git a/src/plugins/kdb/ldap/libkdb_ldap/deps b/src/plugins/kdb/ldap/libkdb_ldap/deps index 1754dd7..9eb8da5 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/deps +++ b/src/plugins/kdb/ldap/libkdb_ldap/deps @@ -16,12 +16,12 @@ kdb_ldap.so kdb_ldap.po $(OUTPRE)kdb_ldap.$(OBJEXT): \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ - kdb_ldap.c kdb_ldap.h ldap_err.h ldap_krbcontainer.h \ - ldap_misc.h ldap_realm.h ldap_services.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.c kdb_ldap.h \ + ldap_err.h ldap_krbcontainer.h ldap_misc.h ldap_realm.h \ + ldap_services.h kdb_ldap_conn.so kdb_ldap_conn.po $(OUTPRE)kdb_ldap_conn.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -29,13 +29,13 @@ kdb_ldap_conn.so kdb_ldap_conn.po $(OUTPRE)kdb_ldap_conn.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h kdb_ldap_conn.c \ - ldap_handle.h ldap_krbcontainer.h ldap_main.h ldap_misc.h \ - ldap_realm.h ldap_service_stash.h ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h kdb_ldap_conn.c ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_service_stash.h \ + ldap_services.h ldap_realm.so ldap_realm.po $(OUTPRE)ldap_realm.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -43,14 +43,13 @@ ldap_realm.so ldap_realm.po $(OUTPRE)ldap_realm.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_principal.h \ - ldap_pwd_policy.h ldap_realm.c ldap_realm.h ldap_services.h \ - ldap_tkt_policy.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_principal.h ldap_pwd_policy.h \ + ldap_realm.c ldap_realm.h ldap_services.h ldap_tkt_policy.h ldap_create.so ldap_create.po $(OUTPRE)ldap_create.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -58,13 +57,13 @@ ldap_create.so ldap_create.po $(OUTPRE)ldap_create.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_create.c ldap_err.h \ - ldap_handle.h ldap_krbcontainer.h ldap_main.h ldap_misc.h \ - ldap_principal.h ldap_realm.h ldap_services.h ldap_tkt_policy.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_create.c ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_principal.h ldap_realm.h \ + ldap_services.h ldap_tkt_policy.h ldap_krbcontainer.so ldap_krbcontainer.po $(OUTPRE)ldap_krbcontainer.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -72,34 +71,34 @@ ldap_krbcontainer.so ldap_krbcontainer.po $(OUTPRE)ldap_krbcontainer.$(OBJEXT): $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.c ldap_krbcontainer.h ldap_main.h \ - ldap_misc.h ldap_realm.h ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.c \ + ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_realm.h \ + ldap_services.h ldap_principal.so ldap_principal.po $(OUTPRE)ldap_principal.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h $(top_srcdir)/include/gssrpc/auth_gss.h \ - $(top_srcdir)/include/gssrpc/auth_unix.h $(top_srcdir)/include/gssrpc/clnt.h \ - $(top_srcdir)/include/gssrpc/rename.h $(top_srcdir)/include/gssrpc/rpc.h \ - $(top_srcdir)/include/gssrpc/rpc_msg.h $(top_srcdir)/include/gssrpc/svc.h \ - $(top_srcdir)/include/gssrpc/svc_auth.h $(top_srcdir)/include/gssrpc/xdr.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ + $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ + $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ + $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ + $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ + $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_principal.c \ - ldap_principal.h ldap_realm.h ldap_services.h ldap_tkt_policy.h \ - princ_xdr.h + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h \ + ldap_handle.h ldap_krbcontainer.h ldap_main.h ldap_misc.h \ + ldap_principal.c ldap_principal.h ldap_realm.h ldap_services.h \ + ldap_tkt_policy.h princ_xdr.h ldap_principal2.so ldap_principal2.po $(OUTPRE)ldap_principal2.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ @@ -115,14 +114,13 @@ ldap_principal2.so ldap_principal2.po $(OUTPRE)ldap_principal2.$(OBJEXT): \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ - kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ - ldap_main.h ldap_misc.h ldap_principal.h ldap_principal2.c \ - ldap_pwd_policy.h ldap_realm.h ldap_services.h ldap_tkt_policy.h \ - princ_xdr.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h \ + ldap_handle.h ldap_krbcontainer.h ldap_main.h ldap_misc.h \ + ldap_principal.h ldap_principal2.c ldap_pwd_policy.h \ + ldap_realm.h ldap_services.h ldap_tkt_policy.h princ_xdr.h ldap_pwd_policy.so ldap_pwd_policy.po $(OUTPRE)ldap_pwd_policy.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -130,34 +128,34 @@ ldap_pwd_policy.so ldap_pwd_policy.po $(OUTPRE)ldap_pwd_policy.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_pwd_policy.c \ - ldap_pwd_policy.h ldap_realm.h ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_pwd_policy.c ldap_pwd_policy.h \ + ldap_realm.h ldap_services.h ldap_misc.so ldap_misc.po $(OUTPRE)ldap_misc.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h $(top_srcdir)/include/gssrpc/auth_gss.h \ - $(top_srcdir)/include/gssrpc/auth_unix.h $(top_srcdir)/include/gssrpc/clnt.h \ - $(top_srcdir)/include/gssrpc/rename.h $(top_srcdir)/include/gssrpc/rpc.h \ - $(top_srcdir)/include/gssrpc/rpc_msg.h $(top_srcdir)/include/gssrpc/svc.h \ - $(top_srcdir)/include/gssrpc/svc_auth.h $(top_srcdir)/include/gssrpc/xdr.h \ - $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ + $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ + $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ + $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ + $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ + $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_misc.c ldap_misc.h ldap_principal.h \ - ldap_pwd_policy.h ldap_realm.h ldap_services.h ldap_tkt_policy.h \ - princ_xdr.h + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h \ + ldap_handle.h ldap_krbcontainer.h ldap_misc.c ldap_misc.h \ + ldap_principal.h ldap_pwd_policy.h ldap_realm.h ldap_services.h \ + ldap_tkt_policy.h princ_xdr.h ldap_handle.so ldap_handle.po $(OUTPRE)ldap_handle.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -165,13 +163,12 @@ ldap_handle.so ldap_handle.po $(OUTPRE)ldap_handle.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_handle.c ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_realm.h \ - ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_handle.c ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_services.h ldap_tkt_policy.so ldap_tkt_policy.po $(OUTPRE)ldap_tkt_policy.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -179,13 +176,13 @@ ldap_tkt_policy.so ldap_tkt_policy.po $(OUTPRE)ldap_tkt_policy.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_realm.h \ - ldap_services.h ldap_tkt_policy.c ldap_tkt_policy.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_services.h \ + ldap_tkt_policy.c ldap_tkt_policy.h ldap_services.so ldap_services.po $(OUTPRE)ldap_services.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -193,13 +190,13 @@ ldap_services.so ldap_services.po $(OUTPRE)ldap_services.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_realm.h \ - ldap_services.c ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_services.c \ + ldap_services.h ldap_service_rights.so ldap_service_rights.po $(OUTPRE)ldap_service_rights.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -207,13 +204,13 @@ ldap_service_rights.so ldap_service_rights.po $(OUTPRE)ldap_service_rights.$(OBJ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_err.h ldap_handle.h \ - ldap_krbcontainer.h ldap_main.h ldap_misc.h ldap_realm.h \ - ldap_service_rights.c ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_err.h ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_service_rights.c \ + ldap_services.h princ_xdr.so princ_xdr.po $(OUTPRE)princ_xdr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ $(BUILDTOP)/include/gssrpc/types.h $(BUILDTOP)/include/kadm5/admin.h \ @@ -229,12 +226,12 @@ princ_xdr.so princ_xdr.po $(OUTPRE)princ_xdr.$(OBJEXT): \ $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ - $(top_srcdir)/include/kdb_ext.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ - kdb_ldap.h ldap_krbcontainer.h ldap_principal.h ldap_realm.h \ - ldap_tkt_policy.h princ_xdr.c princ_xdr.h + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_krbcontainer.h \ + ldap_principal.h ldap_realm.h ldap_tkt_policy.h princ_xdr.c \ + princ_xdr.h ldap_fetch_mkey.so ldap_fetch_mkey.po $(OUTPRE)ldap_fetch_mkey.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -242,13 +239,12 @@ ldap_fetch_mkey.so ldap_fetch_mkey.po $(OUTPRE)ldap_fetch_mkey.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_fetch_mkey.c \ - ldap_handle.h ldap_krbcontainer.h ldap_main.h ldap_misc.h \ - ldap_realm.h ldap_services.h + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_fetch_mkey.c ldap_handle.h ldap_krbcontainer.h \ + ldap_main.h ldap_misc.h ldap_realm.h ldap_services.h ldap_service_stash.so ldap_service_stash.po $(OUTPRE)ldap_service_stash.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -256,13 +252,25 @@ ldap_service_stash.so ldap_service_stash.po $(OUTPRE)ldap_service_stash.$(OBJEXT $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/kdb.h $(top_srcdir)/include/kdb_ext.h \ + $(top_srcdir)/include/kdb.h $(top_srcdir)/include/krb5.h \ + $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ + $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ + $(top_srcdir)/include/socket-utils.h $(top_srcdir)/lib/kdb/kdb5.h \ + kdb_ldap.h ldap_handle.h ldap_krbcontainer.h ldap_main.h \ + ldap_misc.h ldap_realm.h ldap_service_stash.c ldap_service_stash.h \ + ldap_services.h +kdb_ext.so kdb_ext.po $(OUTPRE)kdb_ext.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ + $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ + $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_handle.h ldap_krbcontainer.h \ - ldap_main.h ldap_misc.h ldap_realm.h ldap_service_stash.c \ - ldap_service_stash.h ldap_services.h + $(top_srcdir)/lib/kdb/kdb5.h kdb_ext.c kdb_ldap.h ldap_krbcontainer.h \ + ldap_realm.h kdb_xdr.so kdb_xdr.po $(OUTPRE)kdb_xdr.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -277,3 +285,24 @@ kdb_xdr.so kdb_xdr.po $(OUTPRE)kdb_xdr.$(OBJEXT): $(BUILDTOP)/include/autoconf.h ldap_err.so ldap_err.po $(OUTPRE)ldap_err.$(OBJEXT): \ $(BUILDTOP)/include/krb5/krb5.h $(COM_ERR_DEPS) $(top_srcdir)/include/krb5.h \ ldap_err.c ldap_err.h +lockout.so lockout.po $(OUTPRE)lockout.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ + $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssrpc/types.h \ + $(BUILDTOP)/include/kadm5/admin.h $(BUILDTOP)/include/kadm5/chpass_util_strings.h \ + $(BUILDTOP)/include/kadm5/kadm_err.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(top_srcdir)/include/gssrpc/auth.h \ + $(top_srcdir)/include/gssrpc/auth_gss.h $(top_srcdir)/include/gssrpc/auth_unix.h \ + $(top_srcdir)/include/gssrpc/clnt.h $(top_srcdir)/include/gssrpc/rename.h \ + $(top_srcdir)/include/gssrpc/rpc.h $(top_srcdir)/include/gssrpc/rpc_msg.h \ + $(top_srcdir)/include/gssrpc/svc.h $(top_srcdir)/include/gssrpc/svc_auth.h \ + $(top_srcdir)/include/gssrpc/xdr.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-err.h $(top_srcdir)/include/k5-gmt_mktime.h \ + $(top_srcdir)/include/k5-int-pkinit.h $(top_srcdir)/include/k5-int.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-plugin.h \ + $(top_srcdir)/include/k5-thread.h $(top_srcdir)/include/kdb.h \ + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + $(top_srcdir)/lib/kdb/kdb5.h kdb_ldap.h ldap_krbcontainer.h \ + ldap_principal.h ldap_pwd_policy.h ldap_realm.h ldap_tkt_policy.h \ + lockout.c princ_xdr.h diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c index d443f8d..cc8e50a 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ext.c @@ -32,7 +32,6 @@ #include "kdb.h" #include <stdio.h> #include <errno.h> -#include <kdb_ext.h> #include "kdb_ldap.h" static krb5_error_code diff --git a/src/util/ss/deps b/src/util/ss/deps index 7ad73c5..c71d18c 100644 --- a/src/util/ss/deps +++ b/src/util/ss/deps @@ -63,7 +63,7 @@ utils.so utils.po $(OUTPRE)utils.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ ss_internal.h utils.c options.so options.po $(OUTPRE)options.$(OBJEXT): $(BUILDTOP)/include/ss/ss_err.h \ $(COM_ERR_DEPS) copyright.h options.c ss.h -cmd_tbl.lex.o: cmd_tbl.lex.c ct.tab.h +cmd_tbl.lex.o: cmd_tbl.lex.c ct.tab.o: $(BUILDTOP)/include/ss/ss_err.h $(COM_ERR_DEPS) \ ct.tab.c ss.h ss_err.so ss_err.po $(OUTPRE)ss_err.$(OBJEXT): $(COM_ERR_DEPS) \

1 0

[AuthHub/krb5-1-8: 21/111] ticket: 6648 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4ed993fa6302c21d5d8d65d8a30ebc4d548917dd Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:17 2010 +0000 ticket: 6648 version_fixed: 1.8 status: resolved pull up r23673 from trunk ------------------------------------------------------------------------ r23673 | tlyu | 2010-01-26 17:55:07 -0500 (Tue, 26 Jan 2010) | 9 lines ticket: 6648 target_version: 1.8 tags: pullup subject: define MIN() in lib/gssapi/krb5/prf.c Apply patch from Doug Engert to define MIN(), which was causing prf.c to fail compilation on Solaris. (The definition was probably leaking from sys/param.h, included indirectly somehow.) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23701 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/prf.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/krb5/prf.c b/src/lib/gssapi/krb5/prf.c index f87c6b0..79e2d87 100644 --- a/src/lib/gssapi/krb5/prf.c +++ b/src/lib/gssapi/krb5/prf.c @@ -32,6 +32,10 @@ #include "gssapiP_krb5.h" #include <stdarg.h> +#ifndef MIN /* Usually found in <sys/param.h>. */ +#define MIN(_a,_b) ((_a)<(_b)?(_a):(_b)) +#endif + OM_uint32 krb5_gss_pseudo_random(OM_uint32 *minor_status, gss_ctx_id_t context,

1 0

[AuthHub/krb5-1-8: 20/111] ticket: 6599 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit dc5c665caf83f867b6188be7b4558b6a514bcf63 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Feb 8 20:55:12 2010 +0000 ticket: 6599 version_fixed: 1.8 status: resolved pull up r23672 from trunk ------------------------------------------------------------------------ r23672 | tlyu | 2010-01-26 13:43:29 -0500 (Tue, 26 Jan 2010) | 6 lines ticket: 6599 target_version: 1.8 tags: pullup Apply patch from Arlene Berry to plug a memory leak. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23700 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/rd_req_dec.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) --- diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c index 49f07f7..3a9b9ee 100644 --- a/src/lib/krb5/krb/rd_req_dec.c +++ b/src/lib/krb5/krb/rd_req_dec.c @@ -114,8 +114,10 @@ rd_req_decrypt_tkt_part(krb5_context context, const krb5_ap_req *req, while ((code = krb5_kt_next_entry(context, keytab, &ktent, &cursor)) == 0) { - if (ktent.key.enctype != req->ticket->enc_part.enctype) + if (ktent.key.enctype != req->ticket->enc_part.enctype) { + (void) krb5_free_keytab_entry_contents(context, &ktent); continue; + } retval = krb5_decrypt_tkt_part(context, &ktent.key, req->ticket);

1 0

[AuthHub/krb5-1-8: 19/111] ticket: 6645 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit fd02470c0d23a645811d658082138a2452cf6049 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 21 22:49:07 2010 +0000 ticket: 6645 version_fixed: 1.8 status: resolved pull up r23663 from trunk ------------------------------------------------------------------------ r23663 | ghudson | 2010-01-19 18:35:39 -0500 (Tue, 19 Jan 2010) | 9 lines ticket: 6645 subject: Add krb5_allow_weak_crypto API target_version: 1.8 tags: pullup Add an API to allow apps to override the profile setting of allow_weak_crypto, so that aklog can work with krb5 1.8 out of the box until OpenAFS finishes migrating away from DES. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23665 dc483132-0cff-0310-8789-dd5450dbe970 src/include/krb5/krb5.hin | 5 +++++ src/lib/krb5/krb/Makefile.in | 1 + src/lib/krb5/krb/allow_weak.c | 38 ++++++++++++++++++++++++++++++++++++++ src/lib/krb5/libkrb5.exports | 1 + 4 files changed, 45 insertions(+), 0 deletions(-) --- diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index 0941273..63b6971 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -2553,6 +2553,11 @@ krb5_pac_verify(krb5_context context, const krb5_pac pac, krb5_timestamp authtime, krb5_const_principal principal, const krb5_keyblock *server, const krb5_keyblock *privsvr); +/* Allows the appplication to override the profile's allow_weak_crypto setting. + * Primarily for use by aklog. */ +krb5_error_code KRB5_CALLCONV +krb5_allow_weak_crypto(krb5_context context, krb5_boolean enable); + #if TARGET_OS_MAC # pragma pack(pop) #endif diff --git a/src/lib/krb5/krb/Makefile.in b/src/lib/krb5/krb/Makefile.in index d7a4a2d..abab3f0 100644 --- a/src/lib/krb5/krb/Makefile.in +++ b/src/lib/krb5/krb/Makefile.in @@ -14,6 +14,7 @@ STLIBOBJS= \ addr_comp.o \ addr_order.o \ addr_srch.o \ + allow_weak.o \ appdefault.o \ auth_con.o \ authdata.o \ diff --git a/src/lib/krb5/krb/allow_weak.c b/src/lib/krb5/krb/allow_weak.c new file mode 100644 index 0000000..1290d1f --- /dev/null +++ b/src/lib/krb5/krb/allow_weak.c @@ -0,0 +1,38 @@ +/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +/* + * lib/krb5/krb/allow_weak.c + * + * Copyright (C) 2010 by the Massachusetts Institute of Technology. + * All rights reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * + * Implements krb5_allow_weak_crypto. + */ + +#include "k5-int.h" + +krb5_error_code KRB5_CALLCONV +krb5_allow_weak_crypto(krb5_context context, krb5_boolean enable) +{ + context->allow_weak_crypto = (enable != FALSE); + return 0; +} diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports index acfa2ea..8d1d9d3 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -108,6 +108,7 @@ krb5_524_convert_creds krb5_address_compare krb5_address_order krb5_address_search +krb5_allow_weak_crypto krb5_aname_to_localname krb5_anonymous_principal krb5_anonymous_realm

1 0

[AuthHub/krb5-1-8: 18/111] ticket: 6644 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit f3594c86fac6c6bf4e41a600c2d7e8f22180fc75 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 21 22:49:01 2010 +0000 ticket: 6644 version_fixed: 1.8 status: resolved pull up r23662 from trunk ------------------------------------------------------------------------ r23662 | ghudson | 2010-01-19 13:44:57 -0500 (Tue, 19 Jan 2010) | 3 lines ticket: 6644 subject: Change basename of libkadm5 libraries to avoid Heimdal conflict git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23664 dc483132-0cff-0310-8789-dd5450dbe970 src/config/pre.in | 8 ++++---- src/krb5-config.in | 4 ++-- src/lib/kadm5/clnt/Makefile.in | 7 ++++++- ...bkadm5clnt.exports => libkadm5clnt_mit.exports} | 0 src/lib/kadm5/srv/Makefile.in | 7 ++++++- ...libkadm5srv.exports => libkadm5srv_mit.exports} | 0 6 files changed, 18 insertions(+), 8 deletions(-) --- diff --git a/src/config/pre.in b/src/config/pre.in index 75204a3..db9b1cc 100644 --- a/src/config/pre.in +++ b/src/config/pre.in @@ -316,8 +316,8 @@ DEPLIBEXT=@DEPLIBEXT@ KDB5_PLUGIN_DEPLIBS = @KDB5_PLUGIN_DEPLIBS@ KDB5_PLUGIN_LIBS = @KDB5_PLUGIN_LIBS@ -KADMCLNT_DEPLIB = $(TOPLIBD)/libkadm5clnt$(DEPLIBEXT) -KADMSRV_DEPLIB = $(TOPLIBD)/libkadm5srv$(DEPLIBEXT) +KADMCLNT_DEPLIB = $(TOPLIBD)/libkadm5clnt_mit$(DEPLIBEXT) +KADMSRV_DEPLIB = $(TOPLIBD)/libkadm5srv_mit$(DEPLIBEXT) KDB5_DEPLIB = $(TOPLIBD)/libkdb5$(DEPLIBEXT) GSSRPC_DEPLIB = $(TOPLIBD)/libgssrpc$(DEPLIBEXT) GSS_DEPLIB = $(TOPLIBD)/libgssapi_krb5$(DEPLIBEXT) @@ -385,8 +385,8 @@ GSS_LIBS = $(GSS_KRB5_LIB) GSSRPC_LIBS = -lgssrpc $(GSS_LIBS) KADM_COMM_LIBS = $(GSSRPC_LIBS) # need fixing if ever used on Mac OS X! -KADMSRV_LIBS = -lkadm5srv $(HESIOD_LIBS) $(KDB5_LIBS) $(KADM_COMM_LIBS) -KADMCLNT_LIBS = -lkadm5clnt $(KADM_COMM_LIBS) +KADMSRV_LIBS = -lkadm5srv_mit $(HESIOD_LIBS) $(KDB5_LIBS) $(KADM_COMM_LIBS) +KADMCLNT_LIBS = -lkadm5clnt_mit $(KADM_COMM_LIBS) # libutil for NetBSD, et al. for openpty(), etc. UTIL_LIB = @UTIL_LIB@ diff --git a/src/krb5-config.in b/src/krb5-config.in index 1952ccb..8435d02 100755 --- a/src/krb5-config.in +++ b/src/krb5-config.in @@ -194,12 +194,12 @@ if test -n "$do_libs"; then fi if test $library = 'kadm_server'; then - lib_flags="$lib_flags -lkadm5srv -lkdb5 $KDB5_DB_LIB" + lib_flags="$lib_flags -lkadm5srv_mit -lkdb5 $KDB5_DB_LIB" library=kadm_common fi if test $library = 'kadm_client'; then - lib_flags="$lib_flags -lkadm5clnt" + lib_flags="$lib_flags -lkadm5clnt_mit" library=kadm_common fi diff --git a/src/lib/kadm5/clnt/Makefile.in b/src/lib/kadm5/clnt/Makefile.in index aceb949..f6a11b4 100644 --- a/src/lib/kadm5/clnt/Makefile.in +++ b/src/lib/kadm5/clnt/Makefile.in @@ -3,7 +3,7 @@ BUILDTOP=$(REL)..$(S)..$(S).. LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5 DEFS= -LIBBASE=kadm5clnt +LIBBASE=kadm5clnt_mit LIBMAJOR=7 LIBMINOR=0 STOBJLISTS=../OBJS.ST OBJS.ST @@ -70,6 +70,11 @@ clean-unix:: clean-liblinks clean-libs clean-libobjs install:: install-libs +install-unix:: + $(RM) $(DESTDIR)$(KRB5_LIBDIR)/libkadm5clnt$(DEPLIBEXT) + (cd $(DESTDIR)$(KRB5_LIBDIR) && $(LN_S) lib$(LIBBASE)$(DEPLIBEXT) \ + libkadm5clnt$(DEPLIBEXT)) + depend:: includes @lib_frag@ diff --git a/src/lib/kadm5/clnt/libkadm5clnt.exports b/src/lib/kadm5/clnt/libkadm5clnt_mit.exports similarity index 100% rename from src/lib/kadm5/clnt/libkadm5clnt.exports rename to src/lib/kadm5/clnt/libkadm5clnt_mit.exports diff --git a/src/lib/kadm5/srv/Makefile.in b/src/lib/kadm5/srv/Makefile.in index e813830..9e8b26f 100644 --- a/src/lib/kadm5/srv/Makefile.in +++ b/src/lib/kadm5/srv/Makefile.in @@ -9,7 +9,7 @@ DEFS= ##DOSBUILDTOP = ..\..\.. ##DOSLIBNAME = libkadm5srv.lib -LIBBASE=kadm5srv +LIBBASE=kadm5srv_mit LIBMAJOR=7 LIBMINOR=0 STOBJLISTS=../OBJS.ST OBJS.ST @@ -87,6 +87,11 @@ clean-unix:: clean-liblinks clean-libs clean-libobjs install:: install-libs +install-unix:: + $(RM) $(DESTDIR)$(KRB5_LIBDIR)/libkadm5srv$(DEPLIBEXT) + (cd $(DESTDIR)$(KRB5_LIBDIR) && $(LN_S) lib$(LIBBASE)$(DEPLIBEXT) \ + libkadm5srv$(DEPLIBEXT)) + depend:: includes @lib_frag@ diff --git a/src/lib/kadm5/srv/libkadm5srv.exports b/src/lib/kadm5/srv/libkadm5srv_mit.exports similarity index 100% rename from src/lib/kadm5/srv/libkadm5srv.exports rename to src/lib/kadm5/srv/libkadm5srv_mit.exports

1 0

[AuthHub/krb5-1-8: 17/111] ticket: 6642 target_version: 1.8 version_fixed: 1.8 tags: pullup subject: Add test program for decry
by sbose 15 Mar '11

15 Mar '11

commit b5c3d59a2f3ba7f36dcbf9cf5abc31372c3f2d02 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 14 19:27:33 2010 +0000 ticket: 6642 target_version: 1.8 version_fixed: 1.8 tags: pullup subject: Add test program for decryption of overly short buffers status: resolved Pull up r23652 from trunk. Test case for integer underflow in AES and RC4 decryption. [MITKRB5-SA-2009-004, CVE-2009-4212] krb5-1.8 branch isn't vulnerable, but include this test anyway. ------------------------------------------------------------------------ r23652 | ghudson | 2010-01-12 16:59:58 -0500 (Tue, 12 Jan 2010) | 2 lines Add test program for decryption of overly short buffers. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23660 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/crypto_tests/Makefile.in | 11 ++- src/lib/crypto/crypto_tests/t_short.c | 126 +++++++++++++++++++++++++++++++ 2 files changed, 135 insertions(+), 2 deletions(-) --- diff --git a/src/lib/crypto/crypto_tests/Makefile.in b/src/lib/crypto/crypto_tests/Makefile.in index fde5a73..c92cc7e 100644 --- a/src/lib/crypto/crypto_tests/Makefile.in +++ b/src/lib/crypto/crypto_tests/Makefile.in @@ -27,6 +27,7 @@ EXTRADEPSRCS=\ $(srcdir)/t_crc.c \ $(srcdir)/t_mddriver.c \ $(srcdir)/t_kperf.c \ + $(srcdir)/t_short.c \ $(srcdir)/ytest.c ##DOSBUILDTOP = ..\..\.. @@ -44,7 +45,7 @@ check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac \ t_cksum4 t_cksum5 \ aes-test \ t_mddriver4 t_mddriver \ - t_crc t_cts + t_crc t_cts t_short $(RUN_SETUP) $(VALGRIND) ./t_nfold $(RUN_SETUP) $(VALGRIND) ./t_encrypt $(RUN_SETUP) $(VALGRIND) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \ @@ -62,6 +63,7 @@ check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac \ cmp vt.txt $(srcdir)/expect-vt.txt $(RUN_SETUP) $(VALGRIND) $(C)t_mddriver4 -x $(RUN_SETUP) $(VALGRIND) $(C)t_mddriver -x + $(RUN_SETUP) $(VALGRIND) ./t_short @@ -96,6 +98,10 @@ vectors$(EXEEXT): vectors.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB) $(CC_LINK) -o $@ t_cts.$(OBJEXT) \ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) +t_short$(EXEEXT): t_short.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB) + $(CC_LINK) -o $@ t_short.$(OBJEXT) \ + $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB) + t_cksum4.o: $(srcdir)/t_cksum.c $(CC) -DMD=4 $(ALL_CFLAGS) -o t_cksum4.o -c $(srcdir)/t_cksum.c @@ -139,7 +145,8 @@ clean:: t_cksum.o t_cksum \ t_crc.o t_crc t_cts.o t_cts \ t_mddriver4.o t_mddriver4 t_mddriver.o t_mddriver \ - t_cksum4 t_cksum4.o t_cksum5 t_cksum5.o t_kperf.o t_kperf \ + t_cksum4 t_cksum4.o t_cksum5 t_cksum5.o \ + t_kperf.o t_kperf t_short t_short.o \ t_mddriver$(EXEEXT) $(OUTPRE)t_mddriver.$(OBJEXT) -$(RM) t_prng.output diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c new file mode 100644 index 0000000..9ddfd5e --- /dev/null +++ b/src/lib/crypto/crypto_tests/t_short.c @@ -0,0 +1,126 @@ +/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ +/* + * lib/crypto/crypto_tests/t_short.c + * + * Copyright (C) 2009 by the Massachusetts Institute of Technology. + * All rights reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * Tests the outcome of decrypting overly short tokens. This program can be + * run under a tool like valgrind to detect bad memory accesses; when run + * normally by the test suite, it verifies that each operation returns + * KRB5_BAD_MSIZE. + */ + +#include "k5-int.h" + +krb5_enctype interesting_enctypes[] = { + ENCTYPE_DES_CBC_CRC, + ENCTYPE_DES_CBC_MD4, + ENCTYPE_DES_CBC_MD5, + ENCTYPE_DES3_CBC_SHA1, + ENCTYPE_ARCFOUR_HMAC, + ENCTYPE_ARCFOUR_HMAC_EXP, + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, + 0 +}; + +/* Abort if an operation unexpectedly fails. */ +static void +x(krb5_error_code code) +{ + if (code != 0) + abort(); +} + +/* Abort if a decrypt operation doesn't have the expected result. */ +static void +check_decrypt_result(krb5_error_code code, size_t len, size_t min_len) +{ + if (len < min_len) { + /* Undersized tokens should always result in BAD_MSIZE. */ + if (code != KRB5_BAD_MSIZE) + abort(); + } else { + /* Min-size tokens should succeed or fail the integrity check. */ + if (code != 0 && code != KRB5KRB_AP_ERR_BAD_INTEGRITY) + abort(); + } +} + +static void +test_enctype(krb5_enctype enctype) +{ + krb5_error_code ret; + krb5_keyblock keyblock; + krb5_enc_data input; + krb5_data output; + krb5_crypto_iov iov[2]; + unsigned int dummy; + size_t min_len, len; + + printf("Testing enctype %d\n", (int) enctype); + x(krb5_c_encrypt_length(NULL, enctype, 0, &min_len)); + x(krb5_c_make_random_key(NULL, enctype, &keyblock)); + input.enctype = enctype; + + /* Try each length up to the minimum length. */ + for (len = 0; len <= min_len; len++) { + input.ciphertext.data = calloc(len, 1); + input.ciphertext.length = len; + output.data = calloc(len, 1); + output.length = len; + + /* Attempt a normal decryption. */ + ret = krb5_c_decrypt(NULL, &keyblock, 0, NULL, &input, &output); + check_decrypt_result(ret, len, min_len); + + if (krb5_c_crypto_length(NULL, enctype, KRB5_CRYPTO_TYPE_HEADER, + &dummy) == 0) { + /* Attempt an IOV stream decryption. */ + iov[0].flags = KRB5_CRYPTO_TYPE_STREAM; + iov[0].data = input.ciphertext; + iov[1].flags = KRB5_CRYPTO_TYPE_DATA; + iov[1].data.data = NULL; + iov[1].data.length = 0; + ret = krb5_c_decrypt_iov(NULL, &keyblock, 0, NULL, iov, 2); + check_decrypt_result(ret, len, min_len); + } + + free(input.ciphertext.data); + free(output.data); + } +} + +int +main(int argc, char **argv) +{ + int i; + krb5_data notrandom; + + notrandom.data = "notrandom"; + notrandom.length = 9; + krb5_c_random_seed(NULL, &notrandom); + for (i = 0; interesting_enctypes[i]; i++) + test_enctype(interesting_enctypes[i]); + return 0; +}

1 0

[AuthHub/krb5-1-8: 16/111] ticket: 6640 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit adc86a8e5b83d5dabe9f8a27903ae1908b4dd28d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 14 18:51:13 2010 +0000 ticket: 6640 version_fixed: 1.8 status: resolved pull up r23657 from trunk ------------------------------------------------------------------------ r23657 | ghudson | 2010-01-14 11:09:24 -0500 (Thu, 14 Jan 2010) | 9 lines ticket: 6640 subject: Make history key exempt from permitted_enctypes tags: pullup target_version: 1.8 In kdb_init_hist, just use the first key entry in the kadmin/history entry. This makes the history key work even if the enctype is disallowed by allow_weak_crypto=false or other configuration. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23659 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/server_kdb.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) --- diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c index 1e98a8e..e1ffca2 100644 --- a/src/lib/kadm5/srv/server_kdb.c +++ b/src/lib/kadm5/srv/server_kdb.c @@ -136,7 +136,6 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) { int ret = 0; char *realm, *hist_name; - krb5_key_data *key_data; krb5_key_salt_tuple ks[1]; krb5_keyblock *tmp_mkey; @@ -205,10 +204,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) } - ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1, - &key_data); - if (ret) - goto done; + if (hist_db.n_key_data <= 0) { + krb5_set_error_message(handle->context, KRB5_KDB_NO_MATCHING_KEY, + "History entry contains no key data"); + return KRB5_KDB_NO_MATCHING_KEY; + } ret = krb5_dbe_find_mkey(handle->context, master_keylist, &hist_db, &tmp_mkey); @@ -216,11 +216,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) goto done; ret = krb5_dbekd_decrypt_key_data(handle->context, tmp_mkey, - key_data, &hist_key, NULL); + &hist_db.key_data[0], &hist_key, NULL); if (ret) goto done; - hist_kvno = key_data->key_data_kvno; + hist_kvno = hist_db.key_data[0].key_data_kvno; done: free(hist_name);

1 0

[AuthHub/krb5-1-8: 15/111] ticket: 6546 status: resolved version_fixed: 1.8
by sbose 15 Mar '11

15 Mar '11

commit 709b20016425f337eda1b79627a8e4d5e9470f13 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 14 18:51:09 2010 +0000 ticket: 6546 status: resolved version_fixed: 1.8 pull up r23607 from trunk ------------------------------------------------------------------------ r23607 | ghudson | 2010-01-07 15:57:02 -0500 (Thu, 07 Jan 2010) | 7 lines ticket: 6546 status: open When retrieving the kadmin/history key, accept any enctype, as the current master key enctype may not match the one the KDB was created with. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23658 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/server_kdb.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c index 4b1d05d..1e98a8e 100644 --- a/src/lib/kadm5/srv/server_kdb.c +++ b/src/lib/kadm5/srv/server_kdb.c @@ -205,8 +205,8 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) } - ret = krb5_dbe_find_enctype(handle->context, &hist_db, - handle->params.enctype, -1, -1, &key_data); + ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1, + &key_data); if (ret) goto done;

1 0

[AuthHub/krb5-1-8: 14/111] ticket: 6632 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit c1b27b30951a86ff1101cc39ebaeed931aa9c3f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 12 05:03:49 2010 +0000 ticket: 6632 version_fixed: 1.8 status: resolved pull up r23628 from trunk ------------------------------------------------------------------------ r23628 | ghudson | 2010-01-11 20:05:37 -0500 (Mon, 11 Jan 2010) | 9 lines ticket: 6632 subject: Simplify and fix FAST check for keyed checksum type target_version: 1.8 tags: pullup Use krb5_c_is_keyed_checksum to detect unkeyed checksums when handling FAST requests. The old check was broken for 1.8 because krb5_c_verify_checksum got pickier about invalid keyblocks. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23649 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/fast_util.c | 19 ++++--------------- 1 files changed, 4 insertions(+), 15 deletions(-) --- diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index e6503cf..06b1e2b 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -133,6 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, krb5_fast_req * fast_req = NULL; krb5_kdc_req *request = *requestptr; krb5_fast_armored_req *fast_armored_req = NULL; + krb5_checksum *cksum; krb5_boolean cksum_valid; krb5_keyblock empty_keyblock; @@ -191,11 +192,11 @@ kdc_find_fast(krb5_kdc_req **requestptr, if (plaintext.data) free(plaintext.data); } + cksum = &fast_armored_req->req_checksum; if (retval == 0) retval = krb5_c_verify_checksum(kdc_context, state->armor_key, KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, + checksummed_data, cksum, &cksum_valid); if (retval == 0 && !cksum_valid) { retval = KRB5KRB_AP_ERR_MODIFIED; @@ -203,19 +204,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, "FAST req_checksum invalid; request modified"); } if (retval == 0) { - krb5_error_code ret; - /* - * We need to confirm that a keyed checksum is used for the - * fast_req checksum. In April 2009, the best way to do this is - * to try verifying the checksum with a keyblock with an zero - * length; if it succeeds, then an unkeyed checksum is used. - */ - ret = krb5_c_verify_checksum(kdc_context, &empty_keyblock, - KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, - &cksum_valid); - if (ret == 0) { + if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) { retval = KRB5KDC_ERR_POLICY; krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY, "Unkeyed checksum used in fast_req");

1 0

[AuthHub/krb5-1-8: 13/111] ticket: 6633 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e06b4c4a1427ed08db4a25c3fc49c8db85b26833 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 12 05:03:44 2010 +0000 ticket: 6633 version_fixed: 1.8 status: resolved pull up r23629 from trunk ------------------------------------------------------------------------ r23629 | ghudson | 2010-01-11 20:07:48 -0500 (Mon, 11 Jan 2010) | 9 lines ticket: 6633 subject: Use keyed checksum type for DES FAST target_version: 1.7 tags: pullup DES enctypes have unkeyed mandatory-to-implement checksums. Since FAST requires a keyed checksum, we must pick something else in that case. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23648 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 2791651..2ebbdcf 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -238,6 +238,9 @@ krb5int_fast_prep_req(krb5_context context, if (retval == 0) retval = krb5int_c_mandatory_cksumtype(context, state->armor_key->enctype, &cksumtype); + /* DES enctypes have unkeyed mandatory checksums; need a keyed one. */ + if (retval == 0 && !krb5_c_is_keyed_cksum(cksumtype)) + cksumtype = CKSUMTYPE_RSA_MD5_DES; if (retval ==0) retval = krb5_c_make_checksum(context, cksumtype, state->armor_key, KRB5_KEYUSAGE_FAST_REQ_CHKSUM, to_be_checksummed,

1 0

[AuthHub/krb5-1-8: 12/111] ticket: 6630 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 3d1efb1769795c25ae205e6f5a6e0ca94b00a32f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Jan 11 21:44:18 2010 +0000 ticket: 6630 version_fixed: 1.8 status: resolved pull up r23622 from trunk ------------------------------------------------------------------------ r23622 | epeisach | 2010-01-09 11:02:13 -0500 (Sat, 09 Jan 2010) | 8 lines subject: krb5int_pbkdf2_hmac_sha1 fails to set enctype on keyblock ticket: 6630 tags: pullup krb5int_pbkdf2_hmac_sha1 fails to set enctype on a termporary keyblock - resulting in valgrind picking up on a conditional branch w/ unset value. Initialize value. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23627 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/builtin/pbkdf2.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/builtin/pbkdf2.c b/src/lib/crypto/builtin/pbkdf2.c index 7ee07f0..31de329 100644 --- a/src/lib/crypto/builtin/pbkdf2.c +++ b/src/lib/crypto/builtin/pbkdf2.c @@ -259,6 +259,7 @@ krb5int_pbkdf2_hmac_sha1(const krb5_data *out, unsigned long count, keyblock.length = pass->length; keyblock.contents = (krb5_octet *) pass->data; } + keyblock.enctype = ENCTYPE_NULL; err = krb5_k_create_key(NULL, &keyblock, &key); if (err)

1 0

[AuthHub/krb5-1-8: 11/111] ticket: 6629 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 79a270363856a18c14073a2e777f8b6a4377410c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Jan 11 21:44:13 2010 +0000 ticket: 6629 version_fixed: 1.8 status: resolved pull up r23608 from trunk ------------------------------------------------------------------------ r23608 | epeisach | 2010-01-07 20:51:19 -0500 (Thu, 07 Jan 2010) | 23 lines subject: krb5int_derive_key results in cache with uninitialized values krb5int_derive_key creates a temporary keyblock to add to the derived cache. krb5_k_free_key will iterate over the derived keys and for ones with cache will lookup the enctype for the key_cleanup handler. Unfortunatly, there isn't a keyblock init function that does not allocate the keyblock - as I suspect this problem will appear in other places. The valgrind log of this problem is: ==7281== Conditional jump or move depends on uninitialised value(s) ==7281== at 0x40E9AE8: find_enctype (etypes.h:81) ==7281== by 0x40E9C96: krb5_k_free_key (key.c:91) ==7281== by 0x40E9C52: krb5_k_free_key (key.c:86) ==7281== by 0x40EBB00: krb5_c_prf (prf.c:87) ==7281== by 0x40E7B1B: prf_plus (cf2.c:77) ==7281== by 0x40E7CE6: krb5_c_fx_cf2_simple (cf2.c:125) ==7281== by 0x804899C: main (t_cf2.c:70) ==7281== with memory leaks. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23626 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/dk/derive.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/dk/derive.c b/src/lib/crypto/krb/dk/derive.c index 384a5e4..5fd8876 100644 --- a/src/lib/crypto/krb/dk/derive.c +++ b/src/lib/crypto/krb/dk/derive.c @@ -183,6 +183,10 @@ krb5int_derive_key(const struct krb5_enc_provider *enc, /* Derive into a temporary keyblock. */ keyblock.length = enc->keylength; keyblock.contents = malloc(keyblock.length); + /* Set the enctype as the krb5_k_free_key will iterate over list + or derived keys and invoke krb5_k_free_key which will lookup + the enctype for key_cleanup handler */ + keyblock.enctype = inkey->keyblock.enctype; if (keyblock.contents == NULL) return ENOMEM; ret = krb5int_derive_keyblock(enc, inkey, &keyblock, in_constant);

1 0

[AuthHub/krb5-1-8: 10/111] ticket: 6628 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit b9f9860dfea5b1a958f2ceaf8c2a28cc563b8d99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:18 2010 +0000 ticket: 6628 version_fixed: 1.8 status: resolved pull up r23612 from trunk ------------------------------------------------------------------------ r23612 | epeisach | 2010-01-08 09:54:04 -0500 (Fri, 08 Jan 2010) | 7 lines ticket: 6628 subject: krb5int_dk_string_to_key fails to set enctype tags: pullup Failure to set the enctype before invoking krb5_k_create_key results in potential memory leak. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23621 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/dk/stringtokey.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/dk/stringtokey.c b/src/lib/crypto/krb/dk/stringtokey.c index 9a49187..4c7206c 100644 --- a/src/lib/crypto/krb/dk/stringtokey.c +++ b/src/lib/crypto/krb/dk/stringtokey.c @@ -72,6 +72,7 @@ krb5int_dk_string_to_key(const struct krb5_keytypes *ktp, indata.data = (char *) foldstring; foldkeyblock.length = keylength; foldkeyblock.contents = foldkeydata; + foldkeyblock.enctype = ktp->etype; ret = enc->make_key(&indata, &foldkeyblock); if (ret != 0)

1 0

[AuthHub/krb5-1-8: 9/111] ticket: 6627 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit b0f769f982bc7b94f6dcc57df0fcc3cd85f1dd5b Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:15 2010 +0000 ticket: 6627 version_fixed: 1.8 status: resolved pull up r23611 from trunk ------------------------------------------------------------------------ r23611 | epeisach | 2010-01-07 22:43:37 -0500 (Thu, 07 Jan 2010) | 7 lines subject: Set enctype in crypto_tests to prevent memory leaks ticket: 6627 tags: pullup The key caching is causing memory leaks if enctype is not set as the enctype specific cleanup handlers are not called. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23620 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/crypto_tests/aes-test.c | 14 ++++++++------ src/lib/crypto/crypto_tests/t_cts.c | 16 +++++----------- 2 files changed, 13 insertions(+), 17 deletions(-) --- diff --git a/src/lib/crypto/crypto_tests/aes-test.c b/src/lib/crypto/crypto_tests/aes-test.c index 714d08e..4c0618a 100644 --- a/src/lib/crypto/crypto_tests/aes-test.c +++ b/src/lib/crypto/crypto_tests/aes-test.c @@ -74,11 +74,12 @@ static void set_bit(char *ptr, int bitnum) } /* Variable-Key tests */ -static void vk_test_1(int len) +static void vk_test_1(int len, krb5_enctype etype) { int i; enc_key.length = len; + enc_key.enctype = etype; printf("\nKEYSIZE=%d\n\n", len * 8); memset(plain, 0, sizeof(plain)); hexdump("PT", plain, 16); @@ -94,16 +95,17 @@ static void vk_test_1(int len) } static void vk_test() { - vk_test_1(16); - vk_test_1(32); + vk_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vk_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); } /* Variable-Text tests */ -static void vt_test_1(int len) +static void vt_test_1(int len, krb5_enctype etype) { int i; enc_key.length = len; + enc_key.enctype = etype; printf("\nKEYSIZE=%d\n\n", len * 8); memset(key, 0, len); hexdump("KEY", key, len); @@ -119,8 +121,8 @@ static void vt_test_1(int len) } static void vt_test() { - vt_test_1(16); - vt_test_1(32); + vt_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vt_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); } diff --git a/src/lib/crypto/crypto_tests/t_cts.c b/src/lib/crypto/crypto_tests/t_cts.c index 9f7b5e7..da697bd 100644 --- a/src/lib/crypto/crypto_tests/t_cts.c +++ b/src/lib/crypto/crypto_tests/t_cts.c @@ -43,6 +43,7 @@ const char *whoami; +#if 0 static void printhex (size_t len, const char *p) { while (len--) @@ -54,19 +55,14 @@ static void printstringhex (const char *p) { printhex (strlen (p), p); } static void printdata (krb5_data *d) { printhex (d->length, d->data); } static void printkey (krb5_keyblock *k) { printhex (k->length, k->contents); } +#endif #define JURISIC "Juri\305\241i\304\207" /* hi Miro */ #define ESZETT "\303\237" #define GCLEF "\360\235\204\236" /* outside BMP, woo hoo! */ -static void -keyToData (krb5_keyblock *k, krb5_data *d) -{ - d->length = k->length; - d->data = k->contents; -} - +#if 0 static void check_error (int r, int line) { if (r != 0) { @@ -76,10 +72,7 @@ check_error (int r, int line) { } } #define CHECK check_error(r, __LINE__) - -extern struct krb5_enc_provider krb5int_enc_des3; -struct krb5_enc_provider *enc = &krb5int_enc_des3; -extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256; +#endif static void printd (const char *descr, krb5_data *d) { int i, j; @@ -133,6 +126,7 @@ static void test_cts() deciv.data = decivbuf; keyblock.contents = aeskey; keyblock.length = 16; + keyblock.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; err = krb5_k_create_key(NULL, &keyblock, &key); if (err) {

1 0

[AuthHub/krb5-1-8: 8/111] ticket: 6626 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 8d23b6a2a343abb25eef3085accff29793f87938 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:12 2010 +0000 ticket: 6626 version_fixed: 1.8 status: resolved pull up r23610 from trunk ------------------------------------------------------------------------ r23610 | ghudson | 2010-01-07 21:43:21 -0500 (Thu, 07 Jan 2010) | 10 lines ticket: 6626 subject: Restore interoperability with 1.6 addprinc -randkey tags: pullup target_version: 1.8 The arcfour string-to-key operation in krb5 1.7 (or later) disagrees with the dummy password used by the addprinc -randkey operation in krb5 1.6's kadmin client, because it's not valid UTF-8. Recognize the 1.6 dummy password and use a random password instead. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23619 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/svr_principal.c | 28 ++++++++++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) --- diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index a58c798..2f2faaa 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -186,6 +186,32 @@ static void cleanup_key_data(context, count, data) krb5_db_free(context, data); } +/* + * Set *passptr to NULL if the request looks like the first part of a krb5 1.6 + * addprinc -randkey operation. The krb5 1.6 dummy password for these requests + * was invalid UTF-8, which runs afoul of the arcfour string-to-key. + */ +static void +check_1_6_dummy(kadm5_principal_ent_t entry, long mask, + int n_ks_tuple, krb5_key_salt_tuple *ks_tuple, char **passptr) +{ + int i; + char *password = *passptr; + + /* Old-style randkey operations disallowed tickets to start. */ + if (!(mask & KADM5_ATTRIBUTES) || + !(entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)) + return; + + /* The 1.6 dummy password was the octets 1..255. */ + for (i = 0; (unsigned char) password[i] == i + 1; i++); + if (password[i] != '\0' || i != 255) + return; + + /* This will make the caller use a random password instead. */ + *passptr = NULL; +} + kadm5_ret_t kadm5_create_principal(void *server_handle, kadm5_principal_ent_t entry, long mask, @@ -215,6 +241,8 @@ kadm5_create_principal_3(void *server_handle, krb5_clear_error_message(handle->context); + check_1_6_dummy(entry, mask, n_ks_tuple, ks_tuple, &password); + /* * Argument sanity checking, and opening up the DB */

1 0

[AuthHub/krb5-1-8: 7/111] ticket: 6625 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 38c4051ec35c7748c58e073dca7f5872e9ea04af Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:09 2010 +0000 ticket: 6625 version_fixed: 1.8 status: resolved pull up r23609 from trunk ------------------------------------------------------------------------ r23609 | epeisach | 2010-01-07 21:12:24 -0500 (Thu, 07 Jan 2010) | 23 lines subject: yarrow code does not initialize keyblock enctype and uses unitialized value ticket: 6625 tags: pullup The yarrow code uses a keyblock that is partially initialized. This results in krb5_k_free_key trying to look up the enctype to call the free handler. One of the valgrind reports: (there are several paths) ==26701== Conditional jump or move depends on uninitialised value(s) ==26701== at 0x40E9AF0: find_enctype (etypes.h:81) ==26701== by 0x40E9C9E: krb5_k_free_key (key.c:91) ==26701== by 0x40D641A: krb5int_yarrow_cipher_init (ycipher.c:49) ==26701== by 0x40D593A: yarrow_gate_locked (yarrow.c:578) ==26701== by 0x40D5349: krb5int_yarrow_output_Block (yarrow.c:423) ==26701== by 0x40D581B: yarrow_output_locked (yarrow.c:553) ==26701== by 0x40D5667: krb5int_yarrow_output (yarrow.c:513) ==26701== by 0x40EBD2D: krb5_c_random_make_octets (prng.c:112) ==26701== by 0x40D4119: krb5int_old_encrypt (old_aead.c:97) ==26701== by 0x40E9696: krb5_k_encrypt_iov (encrypt_iov.c:42) ==26701== by 0x8049554: main (t_encrypt.c:206) ==26701== git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23618 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/yarrow/ycipher.c | 1 + src/lib/crypto/krb/yarrow/ycipher.h | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/yarrow/ycipher.c b/src/lib/crypto/krb/yarrow/ycipher.c index 71b89b0..7222d94 100644 --- a/src/lib/crypto/krb/yarrow/ycipher.c +++ b/src/lib/crypto/krb/yarrow/ycipher.c @@ -50,6 +50,7 @@ krb5int_yarrow_cipher_init(CIPHER_CTX *ctx, unsigned const char * key) ctx->key = NULL; keyblock.contents = malloc(keylength); keyblock.length = keylength; + keyblock.enctype = yarrow_enc_type; if (keyblock.contents == NULL) return (YARROW_NOMEM); randombits.data = (char *) key; diff --git a/src/lib/crypto/krb/yarrow/ycipher.h b/src/lib/crypto/krb/yarrow/ycipher.h index 21151bd..4d7dc9d 100644 --- a/src/lib/crypto/krb/yarrow/ycipher.h +++ b/src/lib/crypto/krb/yarrow/ycipher.h @@ -18,6 +18,7 @@ typedef struct */ #define yarrow_enc_provider krb5int_enc_aes256 +#define yarrow_enc_type ENCTYPE_AES256_CTS_HMAC_SHA1_96 #define CIPHER_BLOCK_SIZE 16 #define CIPHER_KEY_SIZE 32

1 0

[AuthHub/krb5-1-8: 6/111] ticket: 6624 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 59a2662206d6d49007f4a242ab1f2e25fd5b3960 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:05 2010 +0000 ticket: 6624 version_fixed: 1.8 status: resolved pull up r23602, r23604, r23605 from trunk ------------------------------------------------------------------------ r23605 | hartmans | 2010-01-07 13:35:15 -0500 (Thu, 07 Jan 2010) | 4 lines ticket: 6624 Revert change to Makefile.in that ended up not being needed ------------------------------------------------------------------------ r23604 | hartmans | 2010-01-07 13:32:20 -0500 (Thu, 07 Jan 2010) | 10 lines Subject: automated tests for anonymous pkinit ticket: 6624 target_version: 1.8 tags: pullup Implement tests for anonymous pkinit. A certificate and private key are checked in; these tests will stop working in 2023. Note that r23602 needs to be pulled up before this ticket. ------------------------------------------------------------------------ r23602 | ghudson | 2010-01-07 12:26:58 -0500 (Thu, 07 Jan 2010) | 4 lines Make preauth_module_dir override, rather than supplement, the built-in path list, to avoid problems with running the same preauth module twice. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23617 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/kdc_preauth.c | 41 +++++----------------- src/lib/krb5/krb/preauth2.c | 43 +++++----------------- src/tests/dejagnu/config/default.exp | 22 ++++++++++++ src/tests/dejagnu/krb-standalone/standalone.exp | 11 ++++++ src/tests/dejagnu/pkinit-certs/ca.pem | 29 +++++++++++++++ src/tests/dejagnu/pkinit-certs/kdc.pem | 25 +++++++++++++ src/tests/dejagnu/pkinit-certs/privkey.pem | 27 ++++++++++++++ 7 files changed, 133 insertions(+), 65 deletions(-) --- diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c index 18052cf..c5dfb1f 100644 --- a/src/kdc/kdc_preauth.c +++ b/src/kdc/kdc_preauth.c @@ -391,45 +391,22 @@ static struct plugin_dir_handle preauth_plugins; /* Open plugin directories for preauth modules. */ static krb5_error_code -open_preauth_plugin_dirs(krb5_context kcontext) +open_preauth_plugin_dirs(krb5_context ctx) { static const char *path[] = { KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL, }; char **profpath = NULL; - const char **plugindirs = NULL; - size_t nprofdirs, nobjdirs; - krb5_error_code retval; - - /* Fetch the list of paths specified in the profile, if any. */ - retval = profile_get_values(kcontext->profile, path, &profpath); - if (retval != 0 && retval != PROF_NO_RELATION) - return retval; - - /* Count the number of profile dirs. */ - nprofdirs = 0; - if (profpath) { - while (profpath[nprofdirs] != NULL) - nprofdirs++; - } - - nobjdirs = sizeof(objdirs) / sizeof(*objdirs); - plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval); - if (retval != 0) - goto cleanup; - - /* Concatenate the profile and hardcoded directory lists. */ - if (profpath) - memcpy(plugindirs, profpath, nprofdirs * sizeof(char *)); - memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *)); - - retval = krb5int_open_plugin_dirs(plugindirs, NULL, &preauth_plugins, - &kcontext->err); - -cleanup: + const char **dirs; + krb5_error_code ret; + + ret = profile_get_values(ctx->profile, path, &profpath); + if (ret != 0 && ret != PROF_NO_RELATION) + return ret; + dirs = (profpath != NULL) ? (const char **) profpath : objdirs; + ret = krb5int_open_plugin_dirs(dirs, NULL, &preauth_plugins, &ctx->err); profile_free_list(profpath); - free(plugindirs); - return retval; + return ret; } krb5_error_code diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c index d1d2827..cf99a29 100644 --- a/src/lib/krb5/krb/preauth2.c +++ b/src/lib/krb5/krb/preauth2.c @@ -72,46 +72,23 @@ typedef struct _pa_types_t { /* Open plugin directories for preauth modules. */ static krb5_error_code -open_preauth_plugin_dirs(krb5_context kcontext) +open_preauth_plugin_dirs(krb5_context ctx) { static const char *path[] = { KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL, }; char **profpath = NULL; - const char **plugindirs = NULL; - size_t nprofdirs, nobjdirs; - krb5_error_code retval; - - /* Fetch the list of paths specified in the profile, if any. */ - retval = profile_get_values(kcontext->profile, path, &profpath); - if (retval != 0 && retval != PROF_NO_RELATION) - return retval; - - /* Count the number of profile dirs. */ - nprofdirs = 0; - if (profpath) { - while (profpath[nprofdirs] != NULL) - nprofdirs++; - } - - nobjdirs = sizeof(objdirs) / sizeof(*objdirs); - plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval); - if (retval != 0) - goto cleanup; - - /* Concatenate the profile and hardcoded directory lists. */ - if (profpath) - memcpy(plugindirs, profpath, nprofdirs * sizeof(char *)); - memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *)); - - retval = krb5int_open_plugin_dirs(plugindirs, NULL, - &kcontext->preauth_plugins, - &kcontext->err); + const char **dirs; + krb5_error_code ret; -cleanup: + ret = profile_get_values(ctx->profile, path, &profpath); + if (ret != 0 && ret != PROF_NO_RELATION) + return ret; + dirs = (profpath != NULL) ? (const char **) profpath : objdirs; + ret = krb5int_open_plugin_dirs(dirs, NULL, &ctx->preauth_plugins, + &ctx->err); profile_free_list(profpath); - free(plugindirs); - return retval; + return ret; } /* Create the per-krb5_context context. This means loading the modules diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp index 8e540b3..98a9a43 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -960,7 +960,9 @@ proc setup_krb5_conf { {type client} } { global portbase global KRB5_DB_MODULE_DIR global KRB5_PA_MODULE_DIR + global srcdir + set pkinit_certs [findfile "[pwd]/$srcdir/pkinit-certs" "[pwd]/$srcdir/pkinit-certs" "$srcdir/pkinit-certs"] # Create a krb5.conf file. if { ![file exists $tmppwd/krb5.$type.conf] \ || $last_passname_conf != $multipass_name } { @@ -973,6 +975,7 @@ proc setup_krb5_conf { {type client} } { } else { puts $conffile " allow_weak_crypto = true" } + puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem" if [info exists default_tgs_enctypes($type)] { puts $conffile \ " default_tgs_enctypes = $default_tgs_enctypes($type)" @@ -1000,6 +1003,8 @@ proc setup_krb5_conf { {type client} } { # failures. If we were running the client and KDC on different # hosts, this would be okay.... #puts $conffile " kdc = $hostname:[expr 6 + $portbase]" + puts $conffile " pkinit_identity = FILE:$pkinit_certs/kdc.pem,$pkinit_certs/privkey.pem" + puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem" puts $conffile " kdc = $hostname:[expr 1 + $portbase]" puts $conffile " admin_server = $hostname:[expr 4 + $portbase]" puts $conffile " kpasswd_server = $hostname:[expr 5 + $portbase]" @@ -2257,6 +2262,23 @@ proc kinit_fast { name pass standalone } { return 1 } +proc kinit_anonymous { name } { + global REALMNAME + global KINIT + global spawn_id + + # Use kinit to get a ticket. + # + spawn $KINIT -5 -f -n $name@$REALMNAME + expect eof + if ![check_exit_status kinit] { + fail "kinit anonymous" + } + + pass "kinit anonymous" + return 1 +} + proc kinit_kt { name keytab standalone testname } { global REALMNAME global KINIT diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp index 068495f..c511798 100644 --- a/src/tests/dejagnu/krb-standalone/standalone.exp +++ b/src/tests/dejagnu/krb-standalone/standalone.exp @@ -138,6 +138,8 @@ proc doit { } { global KRBIV global portbase global mode + global tmppwd + global KRB5_PA_MODULE_DIR setup_kerberos_env kdc @@ -224,6 +226,15 @@ proc doit { } { # Double check that the ticket was destroyed. if ![do_klist_err "klist after destroy"] { return } + if ![add_random_key WELLKNOWN/ANONYMOUS 0] { + return + } + + # If we have anonymous then test it + if [file exists "$tmppwd/../../../util/fakedest$KRB5_PA_MODULE_DIR/pkinit.so" ] { + kinit_anonymous "WELLKNOWN/ANONYMOUS" + } + if ![add_random_key foo/bar 1] { return } diff --git a/src/tests/dejagnu/pkinit-certs/ca.pem b/src/tests/dejagnu/pkinit-certs/ca.pem new file mode 100644 index 0000000..55fe02c --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/ca.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE5TCCA82gAwIBAgIJANsFDWp1HgAaMA0GCSqGSIb3DQEBBQUAMIGnMQswCQYD +VQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJp +ZGdlMQwwCgYDVQQKEwNNSVQxKTAnBgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJi +ZXJvcyB0ZXN0IENBMTMwMQYDVQQDFCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8g +bm90IHVzZSBvdGhlcndpc2UwHhcNMTAwMTA2MTQ1MTI3WhcNMjMwOTE1MTQ1MTI3 +WjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNV +BAcTCUNhbWJyaWRnZTEMMAoGA1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQ +a2luaXQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3Vp +dGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn +ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K +ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7 +5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc +5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW +riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4IBEDCCAQwwHQYDVR0O +BBYEFFn82RUKgTvkFn0cgwyCQpNeWCxYMIHcBgNVHSMEgdQwgdGAFFn82RUKgTvk +Fn0cgwyCQpNeWCxYoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFz +c2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMQwwCgYDVQQKEwNNSVQxKTAn +BgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQD +FCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCCQDb +BQ1qdR4AGjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBVL2Q6Xubs +gm881cAy6esku17/BSTZur7hCLHTGof1ZKNcCXALjmwNYNC3tl6owqpX8CSdBdsD +Bw/Vs9p3mqnaVEoZc8uW8zS6LoAQbcqiYdQHdEXMh3ec8uvAfmdlQsIsm5Ux8q8L +NM6bKnUOqOFOHme+RC4FGOLb8JqnnuQdwyIZaUyQP6hXbw4zyDphfgo1ZlZn20xh +I555kPfAZKEi/d3WY0oN4k+sfCs9tWRNjmqZfKkH1OqRpjCFGG0b0vY77MFRMuPz +YtN2iD3plgla7KkUMljp9th/Z8Ok79uA1TNLYKzoBjlAX0vToxfa8rrSNo1dHFKT +e5Tj7+29DE4I +-----END CERTIFICATE----- diff --git a/src/tests/dejagnu/pkinit-certs/kdc.pem b/src/tests/dejagnu/pkinit-certs/kdc.pem new file mode 100644 index 0000000..5575ab5 --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/kdc.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEMjCCAxqgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBpzELMAkGA1UEBhMCVVMx +FjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcTCUNhbWJyaWRnZTEMMAoG +A1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQa2luaXQgS2VyYmVyb3MgdGVz +dCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug +b3RoZXJ3aXNlMB4XDTEwMDEwNjE0NTgwOFoXDTIzMDkxNTE0NTgwOFowSjELMAkG +A1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxFTATBgNVBAoTDEtSQlRF +U1QuQ09NIDEMMAoGA1UECxMDS0RDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB +CgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmnZejPSKdN +MyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6KueerevR3 +pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY75NbXGIE4 +88iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc5dBSqBwV +cjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOWriIRmsqq +81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4HEMIHBMAkGA1UdEwQCMAAwCwYD +VR0PBAQDAgPoMBIGA1UdJQQLMAkGBysGAQUCAwUwHQYDVR0OBBYEFFn82RUKgTvk +Fn0cgwyCQpNeWCxYMB8GA1UdIwQYMBaAFFn82RUKgTvkFn0cgwyCQpNeWCxYMAkG +A1UdEgQCMAAwSAYDVR0RBEEwP6A9BgYrBgEFAgKgMzAxoA0bC0tSQlRFU1QuQ09N +oSAwHqADAgEBoRcwFRsGa3JidGd0GwtLUkJURVNULkNPTTANBgkqhkiG9w0BAQUF +AAOCAQEAP0byILHLWPyGlv/1HN34DfIpLdVkgGar2yceMtZ2v/7UjeA5PlZc8DFM +20bTq/vIN0eWDTPLI57e+MzQTMxs2UHsic4su0m5DG0cvQTsBXRK51CW/qUF+4n0 +qSEORULiDF6LNoo8akoLukNBhzBh+aqYt4aB46hhsmDmNZTDP1CXsNGHQI9/L52l +oqpUGx8tBpKIFos95PSajXrQn2u66rSMMi4aawitM2igurHPDMbC+XvEYMtXpOS5 +3PEzXEYiSV3TWLTzIE9ytswHeZyHCbp7XHx0LVZFxzqtIe4qmwJJOGhlbH21Izr4 +feF5h5e2ZrOVREY4cKkJmJhEwsqBVA== +-----END CERTIFICATE----- diff --git a/src/tests/dejagnu/pkinit-certs/privkey.pem b/src/tests/dejagnu/pkinit-certs/privkey.pem new file mode 100644 index 0000000..1825dec --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/privkey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn +ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K +ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7 +5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc +5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW +riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABAoIBAQCSMh5Tu9S2yUwM +dEZmZiGxhuf+anAZZAOjqT4QeLI/Fmu3yBNM7rq+p7JrAabyp6pOq46EsXXyWtWS +SB742wWUk2quGMNVQAj0TAJyhNgGstr+XJu8k8BBPnlycobhF0lP/oH+uQifl0KR +iSoWLjEG5JTOoXs/UAD6nQMBDDhv9TweEwSyIY9jq1J5Q3wVXm/Nr/FJ/8O53guJ +/TQeo6dtdx6x2+oxKkeWinfxmy2nSoEZd0eb3WUNPZswijO7QgSJolOo83VNqFcn +lj8hYT41zUM4chple8kGnuSV4ql4a1w/52dSTLKJbgukIqvxeDtKNost344eQqkS +Lwcc+NO5AoGBAM0bR8TmFlbP4RJAEOOilXTYgP6Ttd1r1mRXGi3DRPyv4EWGT7WW +MmBHsqU6Mqz+fcoD/AIy1BBdenhaYrrwyCSvitJpoHPjqzOJDX33wUcrnYeincQ3 +PVzpF41O45vTmm692DSJ8t/uR8DhGpCzf/kxuA9ixvdKgMPgBHYeb5zlAoGBAMSY +KZvgwbtlRR25CGaUgOCHtW76puaPcyxEeCbJEKkJO1vZDAf8vi1zXOM4e/gorKHm +349ZrBQfFCrvtZG//KvI12MpjBs0Z/ijSCwS4EkYJaSH+Hm+1ygLdArwWEFkNncL +qQ+Wme1OUoDiAAxRiBKUxUF/pAQqn7X+0MGa2th3AoGBAJ8kRaFu7XJaRUZF01Ts +d4571kqxDXFKFMUyGCvd0Q9G33rSZdJ9QYUW3HP7HgrAQ5WVVdnW2lgAT+BGMUjf +PkvIsKvmLQr+YX3RH1jX/W1dWBM/h64RNll6uj14Mn5bxv2Z68GIL5y0Y5QylMwl +mmwdubSmbb6+Xf6dOJj1sKBJAoGBAJwP0tAMHp6daL2Mmk+cSaZz9KJx1bYnYB1f +CSZ47IHTc0yZQ0S/7VR1ROKXf0njOA+aEBRi8ghTF5ZyDefyySixWdI9NByQgIzP +Sca7AVLlGVTAH4694VzHosngO59FZzsfhYh7XBwW1cW8Ip+kxWlCskgphFFOaNR3 +wM5AGMRHAoGAJELs9VYPRJd7h4dPUa2RqfVPlYkcMwvoLYykY0wE5mjoNaJkQbUr +W5aKhidh4h48fImt2rpB6OYSofYC4yu3VDEr/Kl2nSb8UPE5qEd1pvmdkHSxMNkh +M2diIqot6s2v20lE/6UCqLXonlquRK1MAlyfPw9yZHP9meCvlBsYZXc= +-----END RSA PRIVATE KEY-----

1 0

[AuthHub/krb5-1-8: 5/111] ticket: 6623 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 7b0b25e873f9760e13a32864fb58a04409f2e917 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:02 2010 +0000 ticket: 6623 version_fixed: 1.8 status: resolved pull up r23603 from trunk ------------------------------------------------------------------------ r23603 | hartmans | 2010-01-07 13:32:15 -0500 (Thu, 07 Jan 2010) | 7 lines subject: Always treat anonymous as preauth required ticket: 6623 target_version: 1.8 tags: pullup Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication. The anonymous draft depends on a pre-auth exchange to invoke pkinit. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23616 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_as_req.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 55493ba..83d3101 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -407,6 +407,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, goto errout; } enc_tkt_reply.client = request->client; + setflag(client.attributes, KRB5_KDB_REQUIRES_PRE_AUTH); } /* * Check the preauthentication if it is there.

1 0

[AuthHub/krb5-1-8: 4/111] ticket: 6622 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 304150c43c968b8023e1d65d3d7a28dff2b07f2e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:42:59 2010 +0000 ticket: 6622 version_fixed: 1.8 status: resolved pull up r23597, r23599 from trunk ------------------------------------------------------------------------ r23599 | ghudson | 2010-01-06 18:44:04 -0500 (Wed, 06 Jan 2010) | 4 lines Make krb5_dbe_def_search_enctype more consistent about when it returns KRB5_KDB_NO_PERMITTED_KEY. Now it will return that error if it sees any non-permitted enctypes which match the search criteria. ------------------------------------------------------------------------ r23597 | ghudson | 2010-01-06 18:14:14 -0500 (Wed, 06 Jan 2010) | 8 lines ticket: 6622 target_version: 1.8 tags: pullup Don't return KRB5_KDB_NO_PERMITTED_KEY from krb5_dbe_def_search_enctype if we previously returned results (i.e. if *start > 0). git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23615 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kdb/kdb_default.c | 49 +++++++++++++++++++++----------------------- 1 files changed, 23 insertions(+), 26 deletions(-) --- diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c index ea24d36..4a4cf87 100644 --- a/src/lib/kdb/kdb_default.c +++ b/src/lib/kdb/kdb_default.c @@ -61,6 +61,7 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap) int maxkvno; krb5_key_data *datap; krb5_error_code ret; + krb5_boolean saw_non_permitted = FALSE; ret = 0; if (kvno == -1 && stype == -1 && ktype == -1) @@ -88,42 +89,38 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap) db_stype = KRB5_KDB_SALTTYPE_NORMAL; } - /* - * Filter out non-permitted enctypes. - */ - if (!krb5_is_permitted_enctype(kcontext, - dbentp->key_data[i].key_data_type[0])) { - ret = KRB5_KDB_NO_PERMITTED_KEY; - continue; - } - - + /* Match this entry against the arguments. */ if (ktype != -1) { if ((ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype, dbentp->key_data[i].key_data_type[0], &similar))) return(ret); + if (!similar) + continue; } + if (stype >= 0 && db_stype != stype) + continue; + if (kvno >= 0 && dbentp->key_data[i].key_data_kvno != kvno) + continue; - if (((ktype == -1) || similar) && - ((db_stype == stype) || (stype < 0))) { - if (kvno >= 0) { - if (kvno == dbentp->key_data[i].key_data_kvno) { - datap = &dbentp->key_data[i]; - idx = i; - maxkvno = kvno; - break; - } - } else { - if (dbentp->key_data[i].key_data_kvno > maxkvno) { - maxkvno = dbentp->key_data[i].key_data_kvno; - datap = &dbentp->key_data[i]; - idx = i; - } - } + /* Filter out non-permitted enctypes. */ + if (!krb5_is_permitted_enctype(kcontext, + dbentp->key_data[i].key_data_type[0])) { + saw_non_permitted = TRUE; + continue; + } + + if (dbentp->key_data[i].key_data_kvno > maxkvno) { + maxkvno = dbentp->key_data[i].key_data_kvno; + datap = &dbentp->key_data[i]; + idx = i; } } + /* If we scanned the whole set of keys and matched only non-permitted + * enctypes, indicate that. */ + if (maxkvno < 0 && *start == 0 && saw_non_permitted) + ret = KRB5_KDB_NO_PERMITTED_KEY; if (maxkvno < 0) return ret ? ret : KRB5_KDB_NO_MATCHING_KEY; *kdatap = datap;

1 0

[AuthHub/krb5-1-8: 3/111] krb5-1.8-alpha1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 8d3f352360f44456dd8e0cf8b27bb02d0002226b Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Jan 6 23:11:52 2010 +0000 krb5-1.8-alpha1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23596 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index c538abc..1b2a0c6 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "alpha1" +#define KRB5_RELTAIL "alpha1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-alpha1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 2/111] README, patchlevel, etc. for krb5-1.8-alpha1
by sbose 15 Mar '11

15 Mar '11

commit 4d08f5da33a352f3361b9518d598c90ca8065d56 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Jan 6 22:58:45 2010 +0000 README, patchlevel, etc. for krb5-1.8-alpha1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23594 dc483132-0cff-0310-8789-dd5450dbe970 README | 103 +++++++++++++++++++++++++++++++++++++++++++++++ doc/definitions.texinfo | 4 +- src/patchlevel.h | 4 +- 3 files changed, 107 insertions(+), 4 deletions(-) --- diff --git a/README b/README index a05bc9f..c1eabc5 100644 --- a/README +++ b/README @@ -71,9 +71,112 @@ beginning with krb5-1.8. Major changes in 1.8 -------------------- +The krb5-1.8 release contains a large number of changes, featuring +improvements in the following broad areas: + +* Code quality +* Modularity +* Performance +* End-user experience +* Administrator experience +* Protocol evolution + +Code quality: + +* Move toward test-driven development -- new features have test code, + or at least written testing procedures. + +* Increase conformance to coding style + + + "The great reindent" + + + Selective refactoring + +Modularity: + +* Crypto modularity -- vendors can more easily substitute their own + crypto implementations, which might be hardware-accelerated or + validated to FIPS 140, for the builtin crypto implementation that + has historically shipped as part of MIT Kerberos. Currently, only + an OpenSSL provider is included, but others are possible. + +* Move toward improved KDB interface + +* Improved API for verifying and interrogating authorization data + +Performance: + +* Investigate and remedy repeatedly-reported performance bottlenecks. + +* Encryption performance -- new crypto API with opaque key structures, + to allow for optimizations such as caching of derived keys + +End-user experience: + +* Reduce DNS dependence by implementing an interface that allows + client library to track whether a KDC supports service principal + referrals. + +Administrator experience: + +* Disable DES by default -- this reduces security exposure from using + an increasingly insecure cipher. + +* More versatile crypto configuration, to simplify migration away from + DES -- new configuration syntax to allow inclusion and exclusion of + specific algorithms relative to a default set. + +* Account lockout for repeated login failures -- mitigates online + password guessing attacks, and helps with some enterprise regulatory + compliance. + +Protocol evolution: + +* FAST enhancements -- preauthentication framework enhancements + +* Microsoft Services for User (S4U) compatibility: S4U2Self, also + known as "protocol transition", allows for service to ask a KDC for + a ticket to themselves on behalf of a client authenticated via a + different means; S4U2Proxy allows a service to ask a KDC for a + ticket to another service on behalf of a client. + +* Anonymous PKINIT -- allows the use of public-key cryptography to + anonymously authenticate to a realm + krb5-1.8 changes by ticket ID ----------------------------- +5468 delete kadmin v1 support +6206 new API for storing extra per-principal data in ccache +6434 krb5_cc_resolve() will crash if a null name param is provided +6454 Make krb5_mkt_resolve error handling work +6510 Restore limited support for static linking +6539 Enctype list configuration enhancements +6547 Modify kadm5 initializers to accept krb5 contexts +6563 Implement s4u extensions +6564 s4u extensions integration broke test suite... +6565 HP-UX IA64 wrong endian +6572 Implement GSS naming extensions and authdata verification +6576 Implement new APIs to allow improved crypto performance +6577 Account lockout for repeated login failures +6578 Heimdal DB bridge plugin for KDC back end +6580 Constrained delegation without PAC support +6582 Memory leak in _kadm5_init_any introduced with ipropd +6583 Unbundle applications into separate repository +6586 libkrb5 support for non-blocking AS requests +6590 allow testing even if name->addr->name mapping doesn't work +6591 fix slow behavior on Mac OS X with link-local addresses +6593 Remove dependency on /bin/csh in test suite +6595 FAST (preauth framework) negotiation +6597 Add GSS extensions to store credentials, generate random bits +6605 PKINIT client should validate SAN for TGS, not service principal +6606 allow testing when offline +6607 anonymous PKINIT +6616 Fix spelling and hyphen errors in man pages +6618 Support optional creation of PID files for krb5kdc and kadmind +6620 kdc_supported_enctypes does nothing; eradicate mentions thereof +6621 disable weak crypto by default + Copyright and Other Legal Notices --------------------------------- diff --git a/doc/definitions.texinfo b/doc/definitions.texinfo index 2db0add..9032a9d 100644 --- a/doc/definitions.texinfo +++ b/doc/definitions.texinfo @@ -19,8 +19,8 @@ @set RANDOMUSER johndoe @set RANDOMUSER1 jennifer @set RANDOMUSER2 david -@set RELEASE 1.6 -@set PREVRELEASE 1.5 +@set RELEASE 1.8 +@set PREVRELEASE 1.7 @set INSTALLDIR /usr/@value{LCPRODUCT} @set PREVINSTALLDIR @value{INSTALLDIR} @set ROOTDIR /usr/local diff --git a/src/patchlevel.h b/src/patchlevel.h index e1b179e..c538abc 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "prerelease" +#define KRB5_RELTAIL "alpha1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-alpha1"

1 0

[AuthHub/krb5-1-8: 1/111] branch for krb5-1.8
by sbose 15 Mar '11

15 Mar '11

commit 1c52dc1d1093bf7fde473f555b656a56de20addc Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 5 04:38:21 2010 +0000 branch for krb5-1.8 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23588 dc483132-0cff-0310-8789-dd5450dbe970

1 0

[AuthHub] (111 commits) Created branch krb5-1-8
by sbose 15 Mar '11

15 Mar '11

The branch 'krb5-1-8' was created. Summary of new commits: 1c52dc1... branch for krb5-1.8 4d08f5d... README, patchlevel, etc. for krb5-1.8-alpha1 8d3f352... krb5-1.8-alpha1-postrelease 304150c... ticket: 6622 version_fixed: 1.8 status: resolved 7b0b25e... ticket: 6623 version_fixed: 1.8 status: resolved 59a2662... ticket: 6624 version_fixed: 1.8 status: resolved 38c4051... ticket: 6625 version_fixed: 1.8 status: resolved 8d23b6a... ticket: 6626 version_fixed: 1.8 status: resolved b0f769f... ticket: 6627 version_fixed: 1.8 status: resolved b9f9860... ticket: 6628 version_fixed: 1.8 status: resolved 79a2703... ticket: 6629 version_fixed: 1.8 status: resolved 3d1efb1... ticket: 6630 version_fixed: 1.8 status: resolved e06b4c4... ticket: 6633 version_fixed: 1.8 status: resolved c1b27b3... ticket: 6632 version_fixed: 1.8 status: resolved 709b200... ticket: 6546 status: resolved version_fixed: 1.8 adc86a8... ticket: 6640 version_fixed: 1.8 status: resolved b5c3d59... ticket: 6642 target_version: 1.8 version_fixed: 1.8 tags: p f3594c8... ticket: 6644 version_fixed: 1.8 status: resolved fd02470... ticket: 6645 version_fixed: 1.8 status: resolved dc5c665... ticket: 6599 version_fixed: 1.8 status: resolved 4ed993f... ticket: 6648 version_fixed: 1.8 status: resolved d324a7b... ticket: 6649 version_fixed: 1.8 status: resolved 56890d8... ticket: 6651 version_fixed: 1.8 status: resolved 12ff01a... ticket: 6653 version_fixed: 1.8 status: resolved dbc4603... ticket: 6654 version_fixed: 1.8 status: resolved dd692be... ticket: 6598 version_fixed: 1.8 status: resolved 1a60faa... ticket: 6600 version_fixed: 1.8 status: resolved 7dc2424... ticket: 6655 version_fixed: 1.8 status: resolved 28e503d... ticket: 6601 version_fixed: 1.8 status: resolved 829f78a... ticket: 6643 version_fixed: 1.8 status: resolved 83aa7f0... ticket: 6652 version_fixed: 1.8 status: resolved 460b23c... ticket: 6656 version_fixed: 1.8 status: resolved 583ecbe... ticket: 6657 version_fixed: 1.8 status: resolved d630aaa... ticket: 6658 version_fixed: 1.8 status: resolved 41d6311... ticket: 6660 version_fixed: 1.8 status: resolved 1d5f5b4... ticket: 6662 version_fixed: 1.8 status: resolved e0f0d4a... ticket: 6663 version_fixed: 1.8 status: resolved cea94b6... README and patchlevel.h for krb5-1.8-beta1 a4e3eb5... krb5-1.8-beta1-postrelease b12b92d... ticket: 6665 version_fixed: 1.8 status: resolved 6f7d2a9... ticket: 6659 version_fixed: 1.8 status: resolved 0a70aed... ticket: 6603 version_fixed: 1.8 status: resolved 1f1506d... ticket: 6669 version_fixed: 1.8 status: resolved b34189e... README and patchlevel.h for krb5-1.8-beta2 e75e264... krb5-1.8-beta2-postrelease 0c1ad19... README and patchlevel.h for krb5-1.8 final 206926d... krb5-1.8-postrelease a4b7b5f... Use KRB5_CONF_ macros instead of strings in source for prof aab50b5... Revert KRB5_CONF_ macro change intended for trunk. 407a20d... ticket: 6661 version_fixed: 1.8.1 status: resolved 5d0be00... ticket: 6668 version_fixed: 1.8.1 status: resolved 1a098ad... ticket: 6674 status: resolved version_fixed: 1.8.1 a602ced... ticket: 6676 version_fixed: 1.8.1 status: resolved 0b25fb7... ticket: 6685 version_fixed: 1.8.1 status: resolved 26ef9e9... ticket: 6681 version_fixed: 1.8.1 status: resolved efdfcf9... ticket: 6683 version_fixed: 1.8.1 status: resolved a7c94a2... ticket: 6680 version_fixed: 1.8.1 status: resolved 1ac3f3b... ticket: 6687 version_fixed: 1.8.1 62ec2df... ticket: 6689 version_fixed: 1.8.1 status: resolved 1bc3fac... ticket: 6690 version_fixed: 1.8.1 status: resolved 8bb942e... ticket: 6678 version_fixed: 1.8.1 status: resolved f366db0... README and patchlevel for krb5-1.8.1-beta1 130f11f... krb5-1.8.1-beta1-postrelease 6924331... ticket: 6693 version_fixed: 1.8.1 status: resolved d2065da... make depend 2790f09... README and patchlevel for krb5-1.8.1-beta2 955b77f... krb5-1.8.1-beta2-postrelease 382e139... README and patchlevel.h for krb5-1.8.1 final ddb381a... krb5-1.8.1-postrelease 4c995cb... ticket: 6702 version_fixed: 1.8.2 status: resolved e188690... ticket: 6696 version_fixed: 1.8.2 status: resolved 2c72459... ticket: 6697 version_fixed: 1.8.2 status: resolved 5eb9d5e... ticket: 6698 version_fixed: 1.8.2 status: resolved 394bd3c... ticket: 6711 version_fixed: 1.8.2 status: resolved 1bb245e... ticket: 6718 version_fixed: 1.8.2 status: resolved 07ba1f8... ticket: 6722 version_fixed: 1.8.2 status: resolved 3e3c54d... ticket: 6725 version_fixed: 1.8.2 status: resolved 789fdf3... ticket: 6562 version_fixed: 1.8.2 status: resolved 0e69014... ticket: 6726 version_fixed: 1.8.2 status: resolved a3ea5a2... ticket: 6730 version_fixed: 1.8.2 status: resolved 4ba8cb9... ticket: 6734 version_fixed: 1.8.2 status: resolved d4bf438... README and patchlevel.h for krb5-1.8.2-beta1 590e098... krb5-1.8.2-beta1-postrelease 482967a... README and patchlevel for krb5-1.8.2 7b6f4e1... krb5-1.8.2-postrelease 67952a3... ticket: 6739 version_fixed: 1.8.3 status: resolved 6cf770c... ticket: 6740 version_fixed: 1.8.3 status: resolved 80833cb... ticket: 6738 version_fixed: 1.8.3 status: resolved 1898f9f... ticket: 6744 version_fixed: 1.8.3 status: resolved c49301a... ticket: 6745 version_fixed: 1.8.3 status: resolved 256fde1... ticket: 6750 version_fixed: 1.8.3 status: resolved 6695b01... ticket: 6751 version_fixed: 1.8.3 status: resolved 2c30cfb... ticket: 6345 version_fixed: 1.8.3 status: resolved da8ec1f... README and patchlevel.h for krb5-1.8.3-beta1 b1ea0d4... krb5-1.8.3-beta1-postrelease ac31a7e... README for krb5-1.8.3 final c8395df... krb5-1.8.3-postrelease 5b05af5... ticket: 6797 status: resolved version_fixed: 1.8.4 2699991... ticket: 6798 version_fixed: 1.8.4 1b6087d... ticket: 6701 version_fixed: 1.8.4 target_version: 1.8.4 sta 30d4bec... ticket: 6764 target_version: 1.8.4 version_fixed: 1.8.4 sta 493baf7... ticket: 6768 version_fixed: 1.8.4 target_version: 1.8.4 sta 7c4d337... ticket: 6790 target_version: 1.8.4 version_fixed: 1.8.4 sta ad7ed77... ticket: 6833 subject: SA-2010-007 Checksum vulnerabilities 3b06975... ticket: 6843 subject: handle MS PACs that lack server check 565165e... ticket: 6861 subject: kpropd denial of service [MITKRB5-SA- 036e43c... ticket: 6862 subject: KDC denial of service attacks [MITKRB 3c3c3d9... ticket: 6853 version_fixed: 1.8.4 status: resolved 55daf2c... make depend 54001a5... Add OTP related ASN.1 code 1e26146... Add Yubikey pre-authentication

1 0

[AuthHub] Created branch master
by sbose 15 Mar '11

15 Mar '11

The branch 'master' was created pointing to: f5f1719... Add Yubikey pre-authentication

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011