March 2011 - authhub-commits - Fedora mailing-lists

[AuthHub/krb5-1-8: 91/111] ticket: 6750 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 256fde166deb74b2b40a5afdaa14729624430aa8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:48 2010 +0000 ticket: 6750 version_fixed: 1.8.3 status: resolved pull up r24176 from trunk ------------------------------------------------------------------------ r24176 | ghudson | 2010-07-07 16:52:06 -0400 (Wed, 07 Jul 2010) | 7 lines ticket: 6750 target_version: 1.8.3 tags: pullup Add a missing break in the parsing of krb5kdc's -P option. Reported by nalin(a)redhat.com. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24197 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/main.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/main.c b/src/kdc/main.c index 9d8022a..c739964 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -728,6 +728,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv) break; case 'P': pid_file = optarg; + break; case 'p': if (default_udp_ports) free(default_udp_ports);

1 0

[AuthHub/krb5-1-8: 90/111] ticket: 6745 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit c49301ae36e35d5ebf07798a82a805b982403144 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:44 2010 +0000 ticket: 6745 version_fixed: 1.8.3 status: resolved pull up r24139 from trunk ------------------------------------------------------------------------ r24139 | ghudson | 2010-06-21 11:18:37 -0400 (Mon, 21 Jun 2010) | 12 lines ticket: 6745 subject: Add correct error table when initializing gss-krb5 target_version: 1.8.3 tags: pullup gss_krb5int_lib_init was adding the generic GSS error table (again) instead of the krb5 error table, which could lead to crashes on library unload. This bug was introduced in krb5 1.7; the fix is also applicable there. Patch from Leonardo Chiquitto <leonardo.lists(a)gmail.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24196 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/gssapi_krb5.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c index 9e5ba76..0420085 100644 --- a/src/lib/gssapi/krb5/gssapi_krb5.c +++ b/src/lib/gssapi/krb5/gssapi_krb5.c @@ -740,7 +740,7 @@ int gss_krb5int_lib_init(void) printf("gss_krb5int_lib_init\n"); #endif - add_error_table(&et_ggss_error_table); + add_error_table(&et_k5g_error_table); #ifndef LEAN_CLIENT err = k5_mutex_finish_init(&gssint_krb5_keytab_lock);

1 0

[AuthHub/krb5-1-8: 89/111] ticket: 6744 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1898f9f52ae2c6897b9f6f61205aa9b5d9e0520e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:41 2010 +0000 ticket: 6744 version_fixed: 1.8.3 status: resolved pull up r24138 from trunk ------------------------------------------------------------------------ r24138 | tlyu | 2010-06-18 15:41:48 -0400 (Fri, 18 Jun 2010) | 13 lines ticket: 6744 subject: only test t_locate_kdc if known-good DNS name is present target_version: 1.8.3 tags: pullup Running "make check" while offline or on a firewalled network may result in failure in lib/krb5/os because the invocation of t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be reachable. Autodetect DNS utilities "dig" and "nslookup", and use them to check for existence of the known-good DNS name. Also parameterize the test so that the known-good DNS name can be overridden on the make command line. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24195 dc483132-0cff-0310-8789-dd5450dbe970 src/configure.in | 5 +++++ src/lib/krb5/os/Makefile.in | 26 ++++++++++++++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) --- diff --git a/src/configure.in b/src/configure.in index d4647cb..e353065 100644 --- a/src/configure.in +++ b/src/configure.in @@ -662,6 +662,11 @@ int main () { AC_MSG_RESULT($ac_cv_printf_positional) +# for t_locate_kdc test + +AC_PATH_PROG(DIG, dig, false) +AC_PATH_PROG(NSLOOKUP, nslookup, false) + # for kadmin AC_PROG_YACC diff --git a/src/lib/krb5/os/Makefile.in b/src/lib/krb5/os/Makefile.in index 6a1ffd1..4da3ebf 100644 --- a/src/lib/krb5/os/Makefile.in +++ b/src/lib/krb5/os/Makefile.in @@ -189,7 +189,9 @@ lclint-localaddr: localaddr.c $(LCLINT) $(LCLINTOPTS) $(CPPFLAGS) $(LOCALINCLUDES) $(DEFS) \ -DTEST $(srcdir)/localaddr.c -check-unix:: $(TEST_PROGS) +check-unix:: check-unix-stdconf check-unix-locate check-unix-antoln + +check-unix-stdconf:: t_std_conf KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ $(KRB5_RUN_ENV) $(VALGRIND) ./t_std_conf -d -s NEW.DEFAULT.REALM -d \ -k IGGY.ORG -k DEFAULT_REALM.TST \ @@ -198,17 +200,29 @@ check-unix:: $(TEST_PROGS) -r pgp.good.idea -r no_domain > test.out cmp test.out $(srcdir)/ref_std_conf.out $(RM) test.out - KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ - if test "$(OFFLINE)" != yes; then \ - $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc ATHENA.MIT.EDU; \ + +# The following can be overriden on the make command line if needed: +LOCREALM = ATHENA.MIT.EDU +SRVNAME = _kerberos._udp.athena.mit.edu. +DIGPAT = '^_kerberos.*srv' +NSPAT = '^_kerberos.*service' +DIG = @DIG@ +NSLOOKUP = @NSLOOKUP@ + +check-unix-locate:: t_locate_kdc + if [ "$(OFFLINE)" = no ] && \ + $(DIG) $(SRVNAME) srv | grep -i $(DIGPAT) || \ + $(NSLOOKUP) -q=srv $(SRVNAME) | grep -i $(NSPAT); then \ + KRB5_CONFIG=$(srcdir)/td_krb5.conf ; export KRB5_CONFIG ;\ + $(KRB5_RUN_ENV) $(VALGRIND) ./t_locate_kdc $(LOCREALM); \ else \ - echo SKIPPING t_locate_kdc TEST WHILE OFFLINE; \ + echo '*** WARNING: skipped t_locate_kdc test: known DNS name not found'; \ fi # # Do some aname-to-lname testing. # -check-unix:: +check-unix-antoln:: t_an_to_ln echo '[libdefaults]' > ./t_an.conf echo ' default_realm = r' >> ./t_an.conf echo '[realms]' >> ./t_an.conf

1 0

[AuthHub/krb5-1-8: 88/111] ticket: 6738 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 80833cb9e6d3f6a1d61b168af91c26c5f7a07178 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jul 20 22:28:35 2010 +0000 ticket: 6738 version_fixed: 1.8.3 status: resolved pull up r24137 from trunk ------------------------------------------------------------------------ r24137 | ghudson | 2010-06-14 16:46:27 -0400 (Mon, 14 Jun 2010) | 7 lines ticket: 6738 target_version: 1.8.3 tags: pullup In PKINIT, notice if DH_compute_key() returns a value less than the buffer size, and pad it on the left if so. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24194 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) --- diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c index d000466..af09d69 100644 --- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c @@ -2092,6 +2092,22 @@ cleanup: return retval; } +/* Call DH_compute_key() and ensure that we left-pad short results instead of + * leaving junk bytes at the end of the buffer. */ +static void +compute_dh(unsigned char *buf, int size, BIGNUM *server_pub_key, DH *dh) +{ + int len, pad; + + len = DH_compute_key(buf, server_pub_key, dh); + assert(len >= 0 && len <= size); + if (len < size) { + pad = size - len; + memmove(buf + pad, buf, len); + memset(buf, 0, pad); + } +} + krb5_error_code client_create_dh(krb5_context context, pkinit_plg_crypto_context plg_cryptoctx, @@ -2243,7 +2259,7 @@ client_process_dh(krb5_context context, if ((server_pub_key = ASN1_INTEGER_to_BN(pub_key, NULL)) == NULL) goto cleanup; - DH_compute_key(*client_key, server_pub_key, cryptoctx->dh); + compute_dh(*client_key, *client_key_len, server_pub_key, cryptoctx->dh); #ifdef DEBUG_DH print_pubkey(server_pub_key, "server's pub_key="); pkiDebug("client secret key (%d)= ", *client_key_len); @@ -2378,7 +2394,7 @@ server_process_dh(krb5_context context, *server_key_len = DH_size(dh_server); if ((*server_key = malloc(*server_key_len)) == NULL) goto cleanup; - DH_compute_key(*server_key, dh->pub_key, dh_server); + compute_dh(*server_key, *server_key_len, dh->pub_key, dh_server); #ifdef DEBUG_DH print_dh(dh_server, "client&server's DH params\n");

1 0

[AuthHub/krb5-1-8: 87/111] ticket: 6740 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 6cf770c1f98e5747e187481fe504ff7f29b32591 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:34 2010 +0000 ticket: 6740 version_fixed: 1.8.3 status: resolved pull up r24123 from trunk ------------------------------------------------------------------------ r24123 | ghudson | 2010-06-08 14:18:03 -0400 (Tue, 08 Jun 2010) | 11 lines ticket: 6740 subject: kadmin ktadd may display wrong name of default keytab target_version: 1.8.2 tags: pullup kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever it uses the default keytab, even if the default has been overridden (e.g. by KRB5_KTNAME). Use krb5_kt_get_name to get the correct name of the default cache instead of displaying the string we think was used to open it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24131 dc483132-0cff-0310-8789-dd5450dbe970 src/kadmin/cli/kadmin.h | 1 - src/kadmin/cli/keytab.c | 10 +++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) --- diff --git a/src/kadmin/cli/kadmin.h b/src/kadmin/cli/kadmin.h index 5c9decc..9f657a6 100644 --- a/src/kadmin/cli/kadmin.h +++ b/src/kadmin/cli/kadmin.h @@ -68,7 +68,6 @@ extern time_t get_date(char *); /* Yucky global variables */ extern krb5_context context; -extern char *krb5_defkeyname; extern char *whoami; extern void *handle; diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c index 8d14f86..1f81032 100644 --- a/src/kadmin/cli/keytab.c +++ b/src/kadmin/cli/keytab.c @@ -84,9 +84,7 @@ process_keytab(krb5_context my_context, char **keytab_str, char *name = *keytab_str; if (name == NULL) { - /* XXX krb5_defkeyname is an internal library global and - should go away */ - name = strdup(krb5_defkeyname); + name = malloc(BUFSIZ); if (!name) { com_err(whoami, ENOMEM, "while creating keytab name"); return 1; @@ -97,6 +95,12 @@ process_keytab(krb5_context my_context, char **keytab_str, free(name); return 1; } + code = krb5_kt_get_name(my_context, *keytab, name, BUFSIZ); + if (code != 0) { + com_err(whoami, code, "while getting keytab name"); + free(name); + return 1; + } } else { if (strchr(name, ':') != NULL) name = strdup(name);

1 0

[AuthHub/krb5-1-8: 86/111] ticket: 6739 version_fixed: 1.8.3 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 67952a359d7008eedfa7d488886048460732c853 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 21:14:26 2010 +0000 ticket: 6739 version_fixed: 1.8.3 status: resolved pull up r24120, r24121 from trunk ------------------------------------------------------------------------ r24120 | ghudson | 2010-06-08 12:14:24 -0400 (Tue, 08 Jun 2010) | 12 lines ticket: 6739 target_version: 1.8.2 tags: pullup Stop checking the current time against the context expiration time in the message wrap/unwrap functions in the krb5 GSS mech. Heimdal doesn't do it, and it generally results in poor app behavior when a ticket expires. In exchange, it doesn't provide much security benefit since it's not enforced across the board--for example, ssh sessions can persist beyond ticket expiration time since they don't use GSS to wrap payload data. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24130 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/k5seal.c | 9 +-------- src/lib/gssapi/krb5/k5sealiov.c | 12 ++---------- src/lib/gssapi/krb5/k5unseal.c | 11 ----------- src/lib/gssapi/krb5/k5unsealiov.c | 14 -------------- 4 files changed, 3 insertions(+), 43 deletions(-) --- diff --git a/src/lib/gssapi/krb5/k5seal.c b/src/lib/gssapi/krb5/k5seal.c index 51faaaa..18c83df 100644 --- a/src/lib/gssapi/krb5/k5seal.c +++ b/src/lib/gssapi/krb5/k5seal.c @@ -328,7 +328,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; output_message_buffer->length = 0; @@ -359,12 +358,6 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, } context = ctx->k5_context; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - save_error_info(*minor_status, context); - return(GSS_S_FAILURE); - } - switch (ctx->proto) { case 0: @@ -396,5 +389,5 @@ kg_seal(minor_status, context_handle, conf_req_flag, qop_req, *conf_state = conf_req_flag; *minor_status = 0; - return((ctx->krb_times.endtime < now)?GSS_S_CONTEXT_EXPIRED:GSS_S_COMPLETE); + return(GSS_S_COMPLETE); } diff --git a/src/lib/gssapi/krb5/k5sealiov.c b/src/lib/gssapi/krb5/k5sealiov.c index 9ff823e..c15e4e7 100644 --- a/src/lib/gssapi/krb5/k5sealiov.c +++ b/src/lib/gssapi/krb5/k5sealiov.c @@ -279,7 +279,6 @@ kg_seal_iov(OM_uint32 *minor_status, { krb5_gss_ctx_id_rec *ctx; krb5_error_code code; - krb5_timestamp now; krb5_context context; if (qop_req != 0) { @@ -298,19 +297,12 @@ kg_seal_iov(OM_uint32 *minor_status, return GSS_S_NO_CONTEXT; } - context = ctx->k5_context; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - save_error_info(*minor_status, context); - return GSS_S_FAILURE; - } - if (conf_req_flag && kg_integ_only_iov(iov, iov_count)) { /* may be more sensible to return an error here */ conf_req_flag = FALSE; } + context = ctx->k5_context; switch (ctx->proto) { case 0: code = make_seal_token_v1_iov(context, ctx, conf_req_flag, @@ -333,7 +325,7 @@ kg_seal_iov(OM_uint32 *minor_status, *minor_status = 0; - return (ctx->krb_times.endtime < now) ? GSS_S_CONTEXT_EXPIRED : GSS_S_COMPLETE; + return GSS_S_COMPLETE; } #define INIT_IOV_DATA(_iov) do { (_iov)->buffer.value = NULL; \ diff --git a/src/lib/gssapi/krb5/k5unseal.c b/src/lib/gssapi/krb5/k5unseal.c index b56cd2d..5fa52fe 100644 --- a/src/lib/gssapi/krb5/k5unseal.c +++ b/src/lib/gssapi/krb5/k5unseal.c @@ -79,7 +79,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, krb5_checksum md5cksum; krb5_data plaind; char *data_ptr; - krb5_timestamp now; unsigned char *plain; unsigned int cksum_len = 0; size_t plainlen; @@ -441,16 +440,6 @@ kg_unseal_v1(context, minor_status, ctx, ptr, bodysize, message_buffer, if (qop_state) *qop_state = GSS_C_QOP_DEFAULT; - if ((code = krb5_timeofday(context, &now))) { - *minor_status = code; - return(GSS_S_FAILURE); - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - return(GSS_S_CONTEXT_EXPIRED); - } - /* do sequencing checks */ if ((ctx->initiate && direction != 0xff) || diff --git a/src/lib/gssapi/krb5/k5unsealiov.c b/src/lib/gssapi/krb5/k5unsealiov.c index a489f0d..2be7b82 100644 --- a/src/lib/gssapi/krb5/k5unsealiov.c +++ b/src/lib/gssapi/krb5/k5unsealiov.c @@ -52,7 +52,6 @@ kg_unseal_v1_iov(krb5_context context, int signalg; krb5_checksum cksum; krb5_checksum md5cksum; - krb5_timestamp now; size_t cksum_len = 0; size_t conflen = 0; int direction; @@ -280,19 +279,6 @@ kg_unseal_v1_iov(krb5_context context, if (qop_state != NULL) *qop_state = GSS_C_QOP_DEFAULT; - code = krb5_timeofday(context, &now); - if (code != 0) { - *minor_status = code; - retval = GSS_S_FAILURE; - goto cleanup; - } - - if (now > ctx->krb_times.endtime) { - *minor_status = 0; - retval = GSS_S_CONTEXT_EXPIRED; - goto cleanup; - } - if ((ctx->initiate && direction != 0xff) || (!ctx->initiate && direction != 0)) { *minor_status = (OM_uint32)G_BAD_DIRECTION;

1 0

[AuthHub/krb5-1-8: 85/111] krb5-1.8.2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 7b6f4e1a0e819ed80c3e474a67f9371baa7ed1c0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:29:35 2010 +0000 krb5-1.8.2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24129 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index e8a08c0..72e202b 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 84/111] README and patchlevel for krb5-1.8.2
by sbose 15 Mar '11

15 Mar '11

commit 482967a673cede9d0140d8b5ead78a2e6397bdcb Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jun 10 18:14:11 2010 +0000 README and patchlevel for krb5-1.8.2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24127 dc483132-0cff-0310-8789-dd5450dbe970 README | 2 ++ src/patchlevel.h | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) --- diff --git a/README b/README index fddc00b..9310c2d 100644 --- a/README +++ b/README @@ -324,6 +324,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: Microsoft The National Aeronautics and Space Administration of the United States of America (NASA) + Network Appliance (NetApp) Nippon Telephone and Telegraph (NTT) Oracle Pennsylvania State University @@ -332,6 +333,7 @@ Past and present Sponsors of the MIT Kerberos Consortium: TeamF1, Inc. The University of Alaska The University of Michigan + The University of Pennsylvania Past and present members of the Kerberos Team at MIT: diff --git a/src/patchlevel.h b/src/patchlevel.h index f84a0c9..e8a08c0 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-final"

1 0

[AuthHub/krb5-1-8: 83/111] krb5-1.8.2-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 590e098f27a61cabc3b9ebd41dee5d15100bc6b3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 23:00:02 2010 +0000 krb5-1.8.2-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24114 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 44bc2d3..f84a0c9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 2 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-2-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 82/111] README and patchlevel.h for krb5-1.8.2-beta1
by sbose 15 Mar '11

15 Mar '11

commit d4bf438c50dd6c659f8cfea343e3893a58c6e9a9 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 22:55:45 2010 +0000 README and patchlevel.h for krb5-1.8.2-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24112 dc483132-0cff-0310-8789-dd5450dbe970 README | 34 +++++++++++++++++++++++++++++++++- src/patchlevel.h | 6 +++--- 2 files changed, 36 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 924710c..fddc00b 100644 --- a/README +++ b/README @@ -82,6 +82,35 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.2 +---------------------- + +This is primarily a bugfix release. + +* Fix vulnerabilities: + ** CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) + ** CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) + +* Allow numeric IPv6 addresses for configuring KDC locations. + +krb5-1.8.2 changes by ticket ID +------------------------------- + +6562 kinit not working if kdc is configured with numerical IPv6 address +6696 gss_accept_sec_context doesn't produce error tokens +6697 segfault caused by dlerror returning NULL +6698 kproplog displays incorrect iprop timestamps on 64-bit platforms +6702 CVE-2010-1320 KDC double free caused by ticket renewal + (MITKRB5-SA-2010-004) +6711 memory leak in process_tgs_req in r23724 +6718 Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP +6722 Error handling bug in krb5_init_creds_init() +6725 CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) +6726 SPNEGO doesn't interoperate with Windows 2000 +6730 kdc_tcp_ports not documented in kdc.conf.M +6734 FAST negotiation could erroneously succeed + Major changes in 1.8.1 ---------------------- @@ -362,6 +391,7 @@ reports, suggestions, and valuable resources: Brandon Allbery Russell Allbery + Brian Almeida Michael B Allen Derek Atkins David Bantz @@ -405,6 +435,7 @@ reports, suggestions, and valuable resources: Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg + Joel Johnson Mikkel Kruse Volker Lendecke Jan iankko Lieskovsky @@ -420,9 +451,9 @@ reports, suggestions, and valuable resources: Ezra Peisach W. Michael Petullo Mark Phalan - Xu Qiang Robert Relyea Martin Rex + Jason Rogers Guillaume Rousse Tom Shaw Peter Shoults @@ -437,6 +468,7 @@ reports, suggestions, and valuable resources: Simon Wilkinson Nicolas Williams Ross Wilper + Xu Qiang Hanz van Zijst The above is not an exhaustive list; many others have contributed in diff --git a/src/patchlevel.h b/src/patchlevel.h index 904d40a..44bc2d3 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 2 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-2-beta1"

1 0

[AuthHub/krb5-1-8: 81/111] ticket: 6734 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4ba8cb9423ae395ed48d896890e876f1247412d7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri May 28 18:41:45 2010 +0000 ticket: 6734 version_fixed: 1.8.2 status: resolved pull up r24102 from trunk ------------------------------------------------------------------------ r24102 | ghudson | 2010-05-24 22:44:45 -0400 (Mon, 24 May 2010) | 11 lines ticket: 6734 subject: FAST negotiation could erroneously succeed target_version: 1.8.2 tags: pullup When FAST negotiation is performed against an older KDC (rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set), krb5int_fast_verify_nego did not set the value of *fast_avail, causing stack garbage to be used in init_creds_step_reply. Initialize *fast_avail at the beginning of the function per coding practices. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24111 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 1ff2d67..e991261 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -572,6 +572,7 @@ krb5int_fast_verify_nego(krb5_context context, krb5_data scratch; krb5_boolean valid; + *fast_avail = FALSE; if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) { pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata, KRB5_ENCPADATA_REQ_ENC_PA_REP);

1 0

[AuthHub/krb5-1-8: 80/111] ticket: 6730 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a3ea5a28ebacb79a9a4e95b5b574a140d8bfc064 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:53 2010 +0000 ticket: 6730 version_fixed: 1.8.2 status: resolved pull up r24074 from trunk ------------------------------------------------------------------------ r24074 | tlyu | 2010-05-20 16:42:26 -0400 (Thu, 20 May 2010) | 11 lines ticket: 6730 subject: kdc_tcp_ports not documented in kdc.conf.M target_version: 1.8.2 tags: pullup The kdc.conf setting kdc_tcp_ports was not documented in kdc.conf.M, though it was documented in doc/admin.texinfo. Copy text from there for now. The setting defaults to an empty string at the moment, causing the KDC to not listen on TCP by default, confusing some users. Changing this behavior is a separate issue. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24077 dc483132-0cff-0310-8789-dd5450dbe970 src/config-files/kdc.conf.M | 22 +++++++++++++++++++++- 1 files changed, 21 insertions(+), 1 deletions(-) --- diff --git a/src/config-files/kdc.conf.M b/src/config-files/kdc.conf.M index 4d3576d..db7d5a6 100644 --- a/src/config-files/kdc.conf.M +++ b/src/config-files/kdc.conf.M @@ -53,7 +53,17 @@ This relation lists the ports which the Kerberos server should listen on, by default. This list is a comma separated list of integers. If this relation is not specified, the compiled-in default is usually port 88 and port 750. +.IP kdc_tcp_ports +This relation lists the ports on which the Kerberos server should +listen for TCP connections by default. This list is a comma separated +list of integers. +If this relation is not specified, the compiled-in default is not to +listen for TCP connections at all. +If you wish to change this (which we do not recommend, because the +current implementation has little protection against denial-of-service +attacks), the standard port number assigned for Kerberos TCP traffic +is port 88. .IP v4_mode This .B string @@ -201,6 +211,16 @@ as specified in the .I [kdcdefaults] section is used. +.IP kdc_tcp_ports +This +.B string +specifies the list of ports that the KDC is to listen to +for TCP requests for this realm. By default, the value of +.I kdc_tcp_ports +as specified in the +.I [kdcdefaults] +section is used. + .IP master_key_name This .B string

1 0

[AuthHub/krb5-1-8: 79/111] ticket: 6726 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0e6901440b641d196bbb816314fa63b113da6d99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 22:57:50 2010 +0000 ticket: 6726 version_fixed: 1.8.2 status: resolved pull up r24075 from trunk ------------------------------------------------------------------------ r24075 | tlyu | 2010-05-20 17:32:47 -0400 (Thu, 20 May 2010) | 8 lines ticket: 6726 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to detect and ignore a duplicate mechanism token sent in the mechListMIC field, such as sent by Windows 2000 Server. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24076 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 12 ++++++++++++ 1 files changed, 12 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index cda76d1..6c4ea0a 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3149,6 +3149,18 @@ get_negTokenResp(OM_uint32 *minor_status, *mechListMIC = get_input_token(&ptr, REMAIN); if (*mechListMIC == GSS_C_NO_BUFFER) return GSS_S_DEFECTIVE_TOKEN; + + /* Handle Windows 2000 duplicate response token */ + if (*responseToken && + ((*responseToken)->length == (*mechListMIC)->length) && + !memcmp((*responseToken)->value, (*mechListMIC)->value, + (*responseToken)->length)) { + OM_uint32 tmpmin; + + gss_release_buffer(&tmpmin, *mechListMIC); + free(*mechListMIC); + *mechListMIC = NULL; + } } return GSS_S_COMPLETE; #undef REMAIN

1 0

[AuthHub/krb5-1-8: 78/111] ticket: 6562 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 789fdf3068dbc35cd3a142ef9f02f7f576052f60 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu May 20 20:41:16 2010 +0000 ticket: 6562 version_fixed: 1.8.2 status: resolved pull up r24055 from trunk ------------------------------------------------------------------------ r24055 | ghudson | 2010-05-18 13:19:15 -0400 (Tue, 18 May 2010) | 6 lines ticket: 6562 When parsing a KDC or admin server string, allow the name or address to be enclosed in brackets so that IPv6 addresses can be represented. (IPv6 addresses contain colons, which look like port separators.) git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24073 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 14 ++++++---- src/lib/kadm5/alt_prof.c | 39 ++++++++++++++++++++++++----- src/lib/krb5/os/locate_kdc.c | 56 +++++++++++++++++------------------------ 3 files changed, 63 insertions(+), 46 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index 1ec4685..fbdc592 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -680,12 +680,14 @@ tags may be specified in the realm's subsection: @table @b @itemx kdc -The name of a host running a KDC for that realm. An optional port -number (separated from the hostname by a colon) may be included. For -your computer to be able to communicate with the KDC for each realm, -this tag must be given a value in each realm subsection in the -configuration file, or there must be DNS SRV records specifying the -KDCs (see @ref{Using DNS}). +The name or address of a host running a KDC for that realm. An optional +port number, separated from the hostname by a colon, may be included. +If the name or address contains colons (for example, if it is an IPv6 +address), enclose it in square brackets to distinguish the colon from a +port separator. For your computer to be able to communicate with the +KDC for each realm, this tag must be given a value in each realm +subsection in the configuration file, or there must be DNS SRV records +specifying the KDCs (see @ref{Using DNS}). @itemx master_kdc Identifies the master KDC(s). Currently, this tag is used in only one diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c index 5b967a0..7d28738 100644 --- a/src/lib/kadm5/alt_prof.c +++ b/src/lib/kadm5/alt_prof.c @@ -482,6 +482,36 @@ get_deltat_param(krb5_deltat *param_out, krb5_deltat param_in, } /* + * Parse out the port number from an admin_server setting. Modify server to + * contain just the hostname or address. If a port is given, set *port, and + * set the appropriate bit in *mask. + */ +static void +parse_admin_server_port(char *server, int *port, long *mask) +{ + char *end, *portstr; + + /* Allow the name or addr to be enclosed in brackets, for IPv6 addrs. */ + if (*server == '[' && (end = strchr(server + 1, ']')) != NULL) { + portstr = (*(end + 1) == ':') ? end + 2 : NULL; + /* Shift the bracketed name or address back into server. */ + memmove(server, server + 1, end - (server + 1)); + *(end - 1) = '\0'; + } else { + /* Terminate the name at the colon, if any. */ + end = server + strcspn(server, ":"); + portstr = (*end == ':') ? end + 1 : NULL; + *end = '\0'; + } + + /* If we found a port string, parse it and set the appropriate bit. */ + if (portstr) { + *port = atoi(portstr); + *mask |= KADM5_CONFIG_KADMIND_PORT; + } +} + +/* * Function: kadm5_get_config_params * * Purpose: Merge configuration parameters provided by the caller with @@ -581,13 +611,8 @@ krb5_error_code kadm5_get_config_params(context, use_kdc_config, NULL); if (params.mask & KADM5_CONFIG_ADMIN_SERVER) { - char *p; - p = strchr(params.admin_server, ':'); - if (p) { - params.kadmind_port = atoi(p+1); - params.mask |= KADM5_CONFIG_KADMIND_PORT; - *p = '\0'; - } + parse_admin_server_port(params.admin_server, &params.kadmind_port, + &params.mask); } /* Get the value for the database */ diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c index 0ecb2d9..d0134c1 100644 --- a/src/lib/krb5/os/locate_kdc.c +++ b/src/lib/krb5/os/locate_kdc.c @@ -374,19 +374,11 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, if (code == 0) { for (i=0; masterlist[i]; i++) { host = masterlist[i]; - - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - cp = strchr(host, ':'); - if (cp) - *cp = 0; + /* Strip off excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + *(cp + 1) = '\0'; + else + *(host + strcspn(host, " \t:")) = '\0'; } } } else { @@ -407,20 +399,13 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, host = hostlist[i]; Tprintf ("entry %d is '%s'\n", i, host); - /* - * Strip off excess whitespace - */ - cp = strchr(host, ' '); - if (cp) - *cp = 0; - cp = strchr(host, '\t'); - if (cp) - *cp = 0; - port = strchr(host, ':'); - if (port) { - *port = 0; - port++; - } + /* Find port number, and strip off any excess characters. */ + if (*host == '[' && (cp = strchr(host, ']'))) + cp = cp + 1; + else + cp = host + strcspn(host, " \t:"); + port = (*cp == ':') ? cp + 1 : NULL; + *cp = '\0'; ismaster = 0; if (masterlist) { @@ -454,15 +439,20 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm, p2 = sec_udpport; } + /* If the hostname was in brackets, strip those off now. */ + if (*host == '[' && (cp = strchr(host, ']'))) { + host++; + *cp = '\0'; + } + if (socktype != 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - socktype, family); + code = add_host_to_list(addrlist, host, p1, p2, socktype, family); else { - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_DGRAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_DGRAM, + family); if (code == 0) - code = add_host_to_list (addrlist, hostlist[i], p1, p2, - SOCK_STREAM, family); + code = add_host_to_list(addrlist, host, p1, p2, SOCK_STREAM, + family); } if (code) { Tprintf ("error %d (%s) returned from add_host_to_list\n", code,

1 0

[AuthHub/krb5-1-8: 77/111] ticket: 6725 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 3e3c54d3e2d1f98a3959df577c2f6797ee087050 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:54 2010 +0000 ticket: 6725 version_fixed: 1.8.2 status: resolved pull up r24056 from trunk ------------------------------------------------------------------------ r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines ticket: 6725 subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005) tags: pullup target_version: 1.8.2 Make krb5_gss_accept_sec_context() check for a null authenticator checksum pointer before attempting to dereference it. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24063 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/accept_sec_context.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c index ce3075f..6241055 100644 --- a/src/lib/gssapi/krb5/accept_sec_context.c +++ b/src/lib/gssapi/krb5/accept_sec_context.c @@ -607,6 +607,13 @@ kg_accept_krb5(minor_status, context_handle, } #endif + if (authdat->checksum == NULL) { + /* missing checksum counts as "inappropriate type" */ + code = KRB5KRB_AP_ERR_INAPP_CKSUM; + major_status = GSS_S_FAILURE; + goto fail; + } + if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) { /* Samba does not send 0x8003 GSS-API checksums */ krb5_boolean valid;

1 0

[AuthHub/krb5-1-8: 76/111] ticket: 6722 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 07ba1f811fff7147228f2e5e1189c82ba2ed0ca6 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:49 2010 +0000 ticket: 6722 version_fixed: 1.8.2 status: resolved pull up r24020 from trunk ------------------------------------------------------------------------ r24020 | ghudson | 2010-05-13 14:49:20 -0400 (Thu, 13 May 2010) | 8 lines ticket: 6722 subject: Error handling bug in krb5_init_creds_init() tags: pullup target_version: 1.8.2 Fix a bug in krb5_init_creds_init() where a freed context could be returned to the caller in certain error cases. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24062 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index b1b837d..41059af 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1489,14 +1489,15 @@ krb5_init_creds_init(krb5_context context, krb5_princ_type(context, ctx->request->client) = KRB5_NT_WELLKNOWN; } code = restart_init_creds_loop(context, ctx, NULL); + if (code) + goto cleanup; *pctx = ctx; + ctx = NULL; cleanup: - if (code != 0) - krb5_init_creds_free(context, ctx); - if (str != NULL) - free(str); + krb5_init_creds_free(context, ctx); + free(str); return code; }

1 0

[AuthHub/krb5-1-8: 75/111] ticket: 6718 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1bb245e6355bdd21c1db0afdfee446fd031833fe Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:46 2010 +0000 ticket: 6718 version_fixed: 1.8.2 status: resolved pull up r24002 from trunk ------------------------------------------------------------------------ r24002 | ghudson | 2010-05-10 18:23:57 -0400 (Mon, 10 May 2010) | 14 lines ticket: 6718 subject: Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP target_version: 1.8.2 tags: pullup In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine whether krbLoginFailedCount existed on the entry when it was retrieved. If it didn't exist, don't try to use LDAP_MOD_INCREMENT, and don't assert an old value when not using LDAP_MOD_INCREMENT. Also, create the krbLoginFailedCount attribute when creating new entries. This allows us to use LDAP_MOD_INCREMENT during the first failed login (if the server supports it), avoiding a race condition. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24061 dc483132-0cff-0310-8789-dd5450dbe970 src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 51 +++++++++++-------- 1 files changed, 29 insertions(+), 22 deletions(-) --- diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c index 220602a..7ad31da 100644 --- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c +++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c @@ -891,6 +891,16 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, if (st != 0) goto cleanup; } else if (entries->mask & KADM5_FAIL_AUTH_COUNT_INCREMENT) { + int attr_mask = 0; + krb5_boolean has_fail_count; + + /* Check if the krbLoginFailedCount attribute exists. (Through + * krb5 1.8.1, it wasn't set in new entries.) */ + st = krb5_get_attributes_mask(context, entries, &attr_mask); + if (st != 0) + goto cleanup; + has_fail_count = ((attr_mask & KDB_FAIL_AUTH_COUNT_ATTR) != 0); + /* * If the client library and server supports RFC 4525, * then use it to increment by one the value of the @@ -898,38 +908,35 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries, * (provided) old value by deleting it before adding. */ #ifdef LDAP_MOD_INCREMENT - if (ldap_server_handle->server_info->modify_increment) { + if (ldap_server_handle->server_info->modify_increment && + has_fail_count) { st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", LDAP_MOD_INCREMENT, 1); if (st != 0) goto cleanup; - } else + } else { #endif /* LDAP_MOD_INCREMENT */ - if (entries->fail_auth_count == 0) { - /* - * Unfortunately we have no way of distinguishing between - * an absent and a zero-valued attribute by the time we are - * called here. So, although this creates a race condition, - * it appears impossible to assert the old value as that - * would fail were the attribute absent. - */ - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_REPLACE, 1); - if (st != 0) - goto cleanup; - } else { - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + if (has_fail_count) { + st = krb5_add_int_mem_ldap_mod(&mods, + "krbLoginFailedCount", LDAP_MOD_DELETE, entries->fail_auth_count); if (st != 0) goto cleanup; - - st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", - LDAP_MOD_ADD, - entries->fail_auth_count + 1); - if (st != 0) - goto cleanup; } + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, + entries->fail_auth_count + 1); + if (st != 0) + goto cleanup; +#ifdef LDAP_MOD_INCREMENT + } +#endif + } else if (optype == ADD_PRINCIPAL) { + /* Initialize krbLoginFailedCount in new entries to help avoid a + * race during the first failed login. */ + st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount", + LDAP_MOD_ADD, 0); } if (entries->mask & KADM5_MAX_LIFE) {

1 0

[AuthHub/krb5-1-8: 74/111] ticket: 6711 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 394bd3cbad6abd1e8ba82f9e6b43acfceb4d0baf Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:43 2010 +0000 ticket: 6711 version_fixed: 1.8.2 status: resolved pull up r23959 from trunk ------------------------------------------------------------------------ r23959 | tlyu | 2010-04-30 17:10:55 -0400 (Fri, 30 Apr 2010) | 8 lines ticket: 6711 subject: memory leak in process_tgs_req in r23724 tags: pullup target_version: 1.8.2 Fix a KDC memory leak that was introduced by r23724 that could leak the decoded request. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24060 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index 76ca94a..29546bd 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -144,8 +144,10 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from, retval = decode_krb5_tgs_req(pkt, &request); if (retval) return retval; - if (request->msg_type != KRB5_TGS_REQ) + if (request->msg_type != KRB5_TGS_REQ) { + krb5_free_kdc_req(kdc_context, request); return KRB5_BADMSGTYPE; + } /* * setup_server_realm() sets up the global realm-specific data pointer.

1 0

[AuthHub/krb5-1-8: 73/111] ticket: 6698 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5eb9d5e188e468e516d295e69ae3d4c66980622c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:39 2010 +0000 ticket: 6698 version_fixed: 1.8.2 status: resolved pull up r23928 from trunk ------------------------------------------------------------------------ r23928 | tlyu | 2010-04-22 21:10:20 -0400 (Thu, 22 Apr 2010) | 10 lines ticket: 6698 target_version: 1.8.2 tags: pullup Adapted patch from Jason Rogers. It wasn't complete, so this commit fixes the other instances of the 64-bit problem. Also fix krb5_deltat_to_str(), which would previously always return an empty string. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24059 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/str_conv.c | 10 ---------- src/slave/kproplog.c | 37 ++++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 19 deletions(-) --- diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c index 1f2edcc..6ed6392 100644 --- a/src/lib/krb5/krb/str_conv.c +++ b/src/lib/krb5/krb/str_conv.c @@ -300,7 +300,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) * This will break if bytes are more than 8 bits. */ #define MAX_CHARS_FOR_INT_TYPE(TYPE) ((int) (2 + 2.408241 * sizeof (TYPE))) - char tmpbuf[MAX_CHARS_FOR_INT_TYPE(int) * 4 + 8]; days = (int) (deltat / (24*3600L)); dt = deltat % (24*3600L); @@ -309,7 +308,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) minutes = (int) (dt / 60); seconds = (int) (dt % 60); - memset (tmpbuf, 0, sizeof (tmpbuf)); if (days == 0) snprintf(buffer, buflen, "%d:%02d:%02d", hours, minutes, seconds); else if (hours || minutes || seconds) @@ -319,14 +317,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen) else snprintf(buffer, buflen, "%d %s", days, (days > 1) ? "days" : "day"); - if (tmpbuf[sizeof(tmpbuf)-1] != 0) - /* Something must be very wrong with my math above, or the - assumptions going into it... */ - abort (); - if (strlen (tmpbuf) > buflen) - return ENOMEM; - else - strncpy (buffer, tmpbuf, buflen); return 0; } diff --git a/src/slave/kproplog.c b/src/slave/kproplog.c index 0134631..0af30d9 100644 --- a/src/slave/kproplog.c +++ b/src/slave/kproplog.c @@ -74,20 +74,40 @@ print_flags(unsigned int flags) } } +/* ctime() for uint32_t* */ +static char * +ctime_uint32(uint32_t *time32) +{ + time_t tmp; + tmp = *time32; + return ctime(&tmp); +} + /* * Display time information. */ static void -print_time(unsigned int *timep) +print_time(uint32_t *timep) { if (*timep == 0L) printf("\t\t\tNone\n"); else { - time_t ltime = *timep; - printf("\t\t\t%s", ctime(&ltime)); + printf("\t\t\t%s", ctime_uint32(timep)); } } +static void +print_deltat(uint32_t *deltat) +{ + krb5_error_code ret; + static char buf[30]; + ret = krb5_deltat_to_string(*deltat, buf, sizeof(buf)); + if (ret) + printf("\t\t\t(error)\n"); + else + printf("\t\t\t%s\n", buf); +} + /* * Display string in hex primitive. */ @@ -251,13 +271,13 @@ print_attr(kdbe_val_t *val, int vverbose) case AT_MAX_LIFE: (void) printf(_("\t\tMaximum ticket life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_life); + print_deltat(&val->kdbe_val_t_u.av_max_life); } break; case AT_MAX_RENEW_LIFE: (void) printf(_("\t\tMaximum renewable life\n")); if (vverbose) { - print_time(&val->kdbe_val_t_u.av_max_renew_life); + print_deltat(&val->kdbe_val_t_u.av_max_renew_life); } break; case AT_EXP: @@ -447,7 +467,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, unsigned int verbose) (void) printf(_("\tUpdate time stamp : None\n")); else (void) printf(_("\tUpdate time stamp : %s"), - ctime((time_t *)&(indx_log->kdb_time.seconds))); + ctime_uint32(&indx_log->kdb_time.seconds)); (void) printf(_("\tAttributes changed : %d\n"), upd.kdb_update.kdbe_t_len); @@ -581,12 +601,11 @@ main(int argc, char **argv) (void) printf(_("\tFirst time stamp : None\n")); else { (void) printf(_("\tFirst time stamp : %s"), - ctime((time_t *) - &(ulog->kdb_first_time.seconds))); + ctime_uint32(&ulog->kdb_first_time.seconds)); } (void) printf(_("\tLast time stamp : %s\n"), - ctime((time_t *)&(ulog->kdb_last_time.seconds))); + ctime_uint32(&ulog->kdb_last_time.seconds)); } if ((!headeronly) && ulog->kdb_num) {

1 0

[AuthHub/krb5-1-8: 72/111] ticket: 6697 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 2c7245905ba456b2143587b7347e59dbda7ff2d8 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:36 2010 +0000 ticket: 6697 version_fixed: 1.8.2 status: resolved pull up r23929 from trunk ------------------------------------------------------------------------ r23929 | tlyu | 2010-04-22 21:30:48 -0400 (Thu, 22 Apr 2010) | 7 lines ticket: 6697 target_version: 1.8.2 tags: pullup Adapted patch from Arlene Berry to handle dlerror() returning a null pointer. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24058 dc483132-0cff-0310-8789-dd5450dbe970 src/util/support/plugins.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c index fa7b36e..4e92254 100644 --- a/src/util/support/plugins.c +++ b/src/util/support/plugins.c @@ -268,6 +268,8 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS); if (handle == NULL) { const char *e = dlerror(); + if (e == NULL) + e = "unknown failure"; Tprintf ("dlopen(%s): %s\n", filepath, e); err = ENOENT; /* XXX */ krb5int_set_error (ep, err, "%s", e); @@ -335,6 +337,8 @@ krb5int_get_plugin_sym (struct plugin_file_handle *h, sym = dlsym (h->dlhandle, csymname); if (sym == NULL) { const char *e = dlerror (); /* XXX copy and save away */ + if (e == NULL) + e = "unknown failure"; Tprintf ("dlsym(%s): %s\n", csymname, e); err = ENOENT; /* XXX */ krb5int_set_error(ep, err, "%s", e);

1 0

[AuthHub/krb5-1-8: 71/111] ticket: 6696 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e1886905c0a51473493a3a8348ee6075139a02ec Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed May 19 18:52:32 2010 +0000 ticket: 6696 version_fixed: 1.8.2 status: resolved pull up r23925 from trunk ------------------------------------------------------------------------ r23925 | tlyu | 2010-04-22 16:04:01 -0400 (Thu, 22 Apr 2010) | 8 lines ticket: 6696 target_version: 1.8.2 tags: pullup Apply patch from Arlene Berry to cease freeing error tokens output by accept_sec_context, allowing them to actually be sent to the initiator. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24057 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/g_accept_sec_context.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c index b4b1525..498bfc4 100644 --- a/src/lib/gssapi/mechglue/g_accept_sec_context.c +++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c @@ -356,9 +356,6 @@ error_out: free(union_ctx_id); } - if (output_token->length) - (void) gss_release_buffer(&temp_minor_status, output_token); - if (src_name) *src_name = GSS_C_NO_NAME;

1 0

[AuthHub/krb5-1-8: 70/111] ticket: 6702 version_fixed: 1.8.2 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 4c995cb142c4c089e67393865affb523f399cab0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Apr 20 22:37:22 2010 +0000 ticket: 6702 version_fixed: 1.8.2 status: resolved pull up r23912 from trunk ------------------------------------------------------------------------ r23912 | tlyu | 2010-04-20 17:12:10 -0400 (Tue, 20 Apr 2010) | 11 lines ticket: 6702 target_version: 1.8.2 tags: pullup Fix CVE-2010-1230 (MITKRB5-SA-2010-004) double-free in KDC triggered by ticket renewal. Add a test case. See also http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577490 Thanks to Joel Johnson and Brian Almeida for the reports. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23914 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 2 + src/tests/dejagnu/config/default.exp | 35 +++++++++++++++++++++++ src/tests/dejagnu/krb-standalone/standalone.exp | 4 ++ 3 files changed, 41 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index b2f0655..76ca94a 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -543,6 +543,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; clear(enc_tkt_reply.flags, TKT_FLG_INVALID); } @@ -554,6 +555,7 @@ tgt_again: to the caller */ ticket_reply = *(header_ticket); enc_tkt_reply = *(header_ticket->enc_part2); + enc_tkt_reply.authorization_data = NULL; old_life = enc_tkt_reply.times.endtime - enc_tkt_reply.times.starttime; diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp index 98a9a43..79afd09 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -2226,6 +2226,41 @@ proc kinit { name pass standalone } { return 1 } + +proc kinit_renew { name pass standalone } { + global REALMNAME + global KINIT + global spawn_id + + spawn $KINIT -5 -f $name@$REALMNAME + expect { + "Password for $name@$REALMNAME:" { + verbose "kinit started" + } + timeout { + fail "kinit" + return 0 + } + eof { + fail "kinit" + return 0 + } + } + send "$pass\r" + expect eof + if ![check_exit_status kinit] { + return 0 + } + + spawn $KINIT -R + expect eof + if ![check_exit_status "kinit_renew"] { + return 0 + } + + return 1 +} + # Retrieve a ticket using FAST armor proc kinit_fast { name pass standalone } { global REALMNAME diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp index c511798..dbaf95d 100644 --- a/src/tests/dejagnu/krb-standalone/standalone.exp +++ b/src/tests/dejagnu/krb-standalone/standalone.exp @@ -201,6 +201,10 @@ proc doit { } { return } + if ![kinit_renew krbtest/admin adminpass$KEY 1] { + return + } + # Make sure that klist can see the ticket. if ![do_klist "krbtest/admin@$REALMNAME" "krbtgt/$REALMNAME@$REALMNAME" "klist"] { return

1 0

[AuthHub/krb5-1-8: 69/111] krb5-1.8.1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit ddb381a3977a0d805d93f2d601ec356c96c3f1a3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:35:03 2010 +0000 krb5-1.8.1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23880 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 9be96cf..904d40a 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 68/111] README and patchlevel.h for krb5-1.8.1 final
by sbose 15 Mar '11

15 Mar '11

commit 382e1390ab63ddaa95c01643be2eff71eb995ace Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Apr 8 20:33:32 2010 +0000 README and patchlevel.h for krb5-1.8.1 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23878 dc483132-0cff-0310-8789-dd5450dbe970 README | 3 +++ src/patchlevel.h | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 13f20e3..924710c 100644 --- a/README +++ b/README @@ -400,16 +400,19 @@ reports, suggestions, and valuable resources: Ken Hornstein Henry B. Hotz Luke Howard + Jakub Hrozek Shumon Huque Jeffrey Hutzelman Wyllys Ingersoll Holger Isenberg Mikkel Kruse Volker Lendecke + Jan iankko Lieskovsky Ryan Lynch Franklyn Mendez Markus Moeller Paul Moore + Zbysek Mraz Edward Murrell Nikos Nikoleris Dmitri Pal diff --git a/src/patchlevel.h b/src/patchlevel.h index ab1b84f..9be96cf 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-final"

1 0

[AuthHub/krb5-1-8: 67/111] krb5-1.8.1-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 955b77f413f8291f4d75115ca1a91663a641931f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:54:21 2010 +0000 krb5-1.8.1-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23849 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 614b047..ab1b84f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011