March 2011 - authhub-commits - Fedora mailing-lists

[AuthHub/krb5-1-8: 66/111] README and patchlevel for krb5-1.8.1-beta2
by sbose 15 Mar '11

15 Mar '11

commit 2790f09141fd6e0921d7a66ae18feaa2fbac7879 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:52:51 2010 +0000 README and patchlevel for krb5-1.8.1-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23847 dc483132-0cff-0310-8789-dd5450dbe970 README | 1 + src/patchlevel.h | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) --- diff --git a/README b/README index 95cc02b..13f20e3 100644 --- a/README +++ b/README @@ -111,6 +111,7 @@ krb5-1.8.1 changes by ticket ID 6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX 6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO +6693 Fix backwards flag output in krb5_init_creds_step() Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index e50b21f..614b047 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta2"

1 0

[AuthHub/krb5-1-8: 65/111] make depend
by sbose 15 Mar '11

15 Mar '11

commit d2065da320f8ae3eb4169fd5664391011cd26511 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:11 2010 +0000 make depend git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23846 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/mechglue/deps | 8 ++++ src/lib/krb5/krb/deps | 74 ++++------------------------------------- src/util/ss/deps | 2 +- 3 files changed, 17 insertions(+), 67 deletions(-) --- diff --git a/src/lib/gssapi/mechglue/deps b/src/lib/gssapi/mechglue/deps index 39ea22c..950c5cf 100644 --- a/src/lib/gssapi/mechglue/deps +++ b/src/lib/gssapi/mechglue/deps @@ -358,6 +358,14 @@ g_set_name_attr.so g_set_name_attr.po $(OUTPRE)g_set_name_attr.$(OBJEXT): \ $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ ../generic/gssapi_err_generic.h g_set_name_attr.c mechglue.h \ mglueP.h +g_set_neg_mechs.so g_set_neg_mechs.po $(OUTPRE)g_set_neg_mechs.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/gssapi/gssapi.h \ + $(BUILDTOP)/include/gssapi/gssapi_ext.h $(COM_ERR_DEPS) \ + $(srcdir)/../generic/gssapiP_generic.h $(srcdir)/../generic/gssapi_ext.h \ + $(srcdir)/../generic/gssapi_generic.h $(top_srcdir)/include/k5-buf.h \ + $(top_srcdir)/include/k5-platform.h $(top_srcdir)/include/k5-thread.h \ + ../generic/gssapi_err_generic.h g_set_neg_mechs.c mechglue.h \ + mglueP.h g_sign.so g_sign.po $(OUTPRE)g_sign.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/gssapi/gssapi.h $(BUILDTOP)/include/gssapi/gssapi_ext.h \ $(COM_ERR_DEPS) $(srcdir)/../generic/gssapiP_generic.h \ diff --git a/src/lib/krb5/krb/deps b/src/lib/krb5/krb/deps index 0267483..fa1d550 100644 --- a/src/lib/krb5/krb/deps +++ b/src/lib/krb5/krb/deps @@ -63,45 +63,10 @@ authdata.so authdata.po $(OUTPRE)authdata.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.c \ - authdata.h int-proto.h -authdata_exp.so authdata_exp.po $(OUTPRE)authdata_exp.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - authdata_exp.c int-proto.h -authdata_enc.so authdata_enc.po $(OUTPRE)authdata_enc.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_enc.c -authdata_dec.so authdata_dec.po $(OUTPRE)authdata_dec.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - authdata_dec.c int-proto.h + auth_con.h authdata.c authdata.h int-proto.h bld_pr_ext.so bld_pr_ext.po $(OUTPRE)bld_pr_ext.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -190,7 +155,7 @@ copy_auth.so copy_auth.po $(OUTPRE)copy_auth.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - copy_auth.c int-proto.h + copy_auth.c copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -201,7 +166,7 @@ copy_athctr.so copy_athctr.po $(OUTPRE)copy_athctr.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - auth_con.h copy_athctr.c + copy_athctr.c copy_cksum.so copy_cksum.po $(OUTPRE)copy_cksum.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -669,17 +634,6 @@ pac.so pac.po $(OUTPRE)pac.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ authdata.h pac.c -pac_sign.so pac_sign.po $(OUTPRE)pac_sign.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h authdata.h pac_sign.c parse.so parse.po $(OUTPRE)parse.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -722,17 +676,6 @@ preauth2.so preauth2.po $(OUTPRE)preauth2.$(OBJEXT): \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ fast.h int-proto.h preauth2.c -gic_opt_set_pa.so gic_opt_set_pa.po $(OUTPRE)gic_opt_set_pa.$(OBJEXT): \ - $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ - $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ - $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h $(top_srcdir)/include/k5-err.h \ - $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ - $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ - $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ - $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ - $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - gic_opt_set_pa.c int-proto.h princ_comp.so princ_comp.po $(OUTPRE)princ_comp.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ @@ -805,11 +748,10 @@ rd_req_dec.so rd_req_dec.po $(OUTPRE)rd_req_dec.$(OBJEXT): \ $(top_srcdir)/include/k5-gmt_mktime.h $(top_srcdir)/include/k5-int-pkinit.h \ $(top_srcdir)/include/k5-int.h $(top_srcdir)/include/k5-platform.h \ $(top_srcdir)/include/k5-plugin.h $(top_srcdir)/include/k5-thread.h \ - $(top_srcdir)/include/k5-utf8.h $(top_srcdir)/include/krb5.h \ - $(top_srcdir)/include/krb5/authdata_plugin.h $(top_srcdir)/include/krb5/locate_plugin.h \ - $(top_srcdir)/include/krb5/preauth_plugin.h $(top_srcdir)/include/port-sockets.h \ - $(top_srcdir)/include/socket-utils.h auth_con.h authdata.h \ - int-proto.h rd_req_dec.c + $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ + $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ + $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ + auth_con.h authdata.h int-proto.h rd_req_dec.c rd_safe.so rd_safe.po $(OUTPRE)rd_safe.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ $(BUILDTOP)/include/krb5/krb5.h $(BUILDTOP)/include/osconf.h \ $(BUILDTOP)/include/profile.h $(COM_ERR_DEPS) $(top_srcdir)/include/k5-buf.h \ @@ -1038,7 +980,7 @@ valid_times.so valid_times.po $(OUTPRE)valid_times.$(OBJEXT): \ $(top_srcdir)/include/krb5.h $(top_srcdir)/include/krb5/authdata_plugin.h \ $(top_srcdir)/include/krb5/locate_plugin.h $(top_srcdir)/include/krb5/preauth_plugin.h \ $(top_srcdir)/include/port-sockets.h $(top_srcdir)/include/socket-utils.h \ - int-proto.h valid_times.c + valid_times.c vfy_increds.so vfy_increds.po $(OUTPRE)vfy_increds.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/util/ss/deps b/src/util/ss/deps index c71d18c..7ad73c5 100644 --- a/src/util/ss/deps +++ b/src/util/ss/deps @@ -63,7 +63,7 @@ utils.so utils.po $(OUTPRE)utils.$(OBJEXT): $(BUILDTOP)/include/autoconf.h \ ss_internal.h utils.c options.so options.po $(OUTPRE)options.$(OBJEXT): $(BUILDTOP)/include/ss/ss_err.h \ $(COM_ERR_DEPS) copyright.h options.c ss.h -cmd_tbl.lex.o: cmd_tbl.lex.c +cmd_tbl.lex.o: cmd_tbl.lex.c ct.tab.h ct.tab.o: $(BUILDTOP)/include/ss/ss_err.h $(COM_ERR_DEPS) \ ct.tab.c ss.h ss_err.so ss_err.po $(OUTPRE)ss_err.$(OBJEXT): $(COM_ERR_DEPS) \

1 0

[AuthHub/krb5-1-8: 64/111] ticket: 6693 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 692433183006b8cb5f0d8b5b3014614822a4881f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 30 01:51:04 2010 +0000 ticket: 6693 version_fixed: 1.8.1 status: resolved pull up r23844 from trunk ------------------------------------------------------------------------ r23844 | ghudson | 2010-03-29 18:08:21 -0400 (Mon, 29 Mar 2010) | 9 lines ticket: 6693 subject: Fix backwards flag output in krb5_init_creds_step() tags: pullup target_version: 1.8.1 krb5_init_creds_step() is taken from Heimdal, which sets *flags to 1 for "continue" and 0 for "stop". Unfortunately, we got it backwards in 1.8; fix it for 1.8.1. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23845 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/get_in_tkt.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c index ab92ee1..b1b837d 100644 --- a/src/lib/krb5/krb/get_in_tkt.c +++ b/src/lib/krb5/krb/get_in_tkt.c @@ -1083,7 +1083,7 @@ init_creds_get(krb5_context context, &flags); if (code == KRB5KRB_ERR_RESPONSE_TOO_BIG && !tcp_only) tcp_only = 1; - else if (code != 0 || (flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE)) + else if (code != 0 || (flags & 1) == 0) break; krb5_free_data_contents(context, &reply); @@ -2065,7 +2065,7 @@ cleanup: } } - *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE); + *flags = (ctx->flags & KRB5_INIT_CREDS_STEP_FLAG_COMPLETE) ? 0 : 1; return code; }

1 0

[AuthHub/krb5-1-8: 63/111] krb5-1.8.1-beta1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 130f11fcd3ece80c87bcd178c44a8f14d7827333 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 23:00:08 2010 +0000 krb5-1.8.1-beta1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23841 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 99f2abe..e50b21f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 1 -#define KRB5_RELTAIL "beta1" +#define KRB5_RELTAIL "beta1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-1-beta1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 62/111] README and patchlevel for krb5-1.8.1-beta1
by sbose 15 Mar '11

15 Mar '11

commit f366db0fcb5e66d6710d5582d6670c438961414d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Sun Mar 28 22:47:01 2010 +0000 README and patchlevel for krb5-1.8.1-beta1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23839 dc483132-0cff-0310-8789-dd5450dbe970 README | 30 ++++++++++++++++++++++++++++++ src/patchlevel.h | 6 +++--- 2 files changed, 33 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 8063109..95cc02b 100644 --- a/README +++ b/README @@ -82,6 +82,36 @@ additional measures include: crypto * easier kadmin history key changes +Major changes in 1.8.1 +---------------------- + +This is primarily a bugfix release. + +* MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + +* Support IPv6 in kpasswd client. + +* Fix an authorization data type number assignment that conflicted + with an undocumented Microsoft usage. + +krb5-1.8.1 changes by ticket ID +------------------------------- + +6661 [RFE] properly support IPv6 in kpasswd +6668 Two problems in kadm5_get_principal mask handling +6674 memory leak in SPNEGO +6676 Ignore improperly encoded signedpath AD elements +6678 use of freed memory in gss_import_sec_context error path +6680 the "ticket_lifetime" setting isn't documented +6681 krb5_get_init_creds_password() can crash with NULL options and + expired keys +6683 kpasswd doesn't guess the client principal name correctly + without a ccache +6685 handle NT_SRV_INST in service principal referrals +6687 Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 +6689 krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX +6690 MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO + Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index aadebb9..99f2abe 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -52,7 +52,7 @@ */ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 -#define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "postrelease" +#define KRB5_PATCHLEVEL 1 +#define KRB5_RELTAIL "beta1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-1-beta1"

1 0

[AuthHub/krb5-1-8: 61/111] ticket: 6678 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 8bb942e3e1307fd4ebcbeda896097c9ac14ee404 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 22:31:00 2010 +0000 ticket: 6678 version_fixed: 1.8.1 status: resolved pull up r23834 from trunk ------------------------------------------------------------------------ r23834 | tlyu | 2010-03-23 15:00:13 -0700 (Tue, 23 Mar 2010) | 7 lines ticket: 6678 target_version: 1.8.1 tags: pullup Apply patch from Arlene Berry to not use freed memory in gss_import_sec_context in some error paths. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23835 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/krb5/import_sec_context.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) --- diff --git a/src/lib/gssapi/krb5/import_sec_context.c b/src/lib/gssapi/krb5/import_sec_context.c index d4ef1e3..30ec230 100644 --- a/src/lib/gssapi/krb5/import_sec_context.c +++ b/src/lib/gssapi/krb5/import_sec_context.c @@ -106,12 +106,13 @@ krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle) ibp = (krb5_octet *) interprocess_token->value; blen = (size_t) interprocess_token->length; kret = kg_ctx_internalize(context, (krb5_pointer *) &ctx, &ibp, &blen); - krb5_free_context(context); if (kret) { *minor_status = (OM_uint32) kret; save_error_info(*minor_status, context); + krb5_free_context(context); return(GSS_S_FAILURE); } + krb5_free_context(context); /* intern the context handle */ if (! kg_save_ctx_id((gss_ctx_id_t) ctx)) {

1 0

[AuthHub/krb5-1-8: 60/111] ticket: 6690 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1bc3fac4b3a8c0255551e7d063cd6e7f3c195e4a Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 19:08:53 2010 +0000 ticket: 6690 version_fixed: 1.8.1 status: resolved pull up r23832 from trunk ------------------------------------------------------------------------ r23832 | tlyu | 2010-03-23 11:53:52 -0700 (Tue, 23 Mar 2010) | 8 lines ticket: 6690 target_version: 1.8.1 tags: pullup subject: MITKRB5-SA-2010-002 CVE-2010-0628 denial of service in SPNEGO The SPNEGO implementation in krb5-1.7 and later could crash due to assertion failure when receiving some sorts of invalid GSS-API tokens. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23833 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 38 ++++++++++++++-------------------- 1 files changed, 16 insertions(+), 22 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 7a3ff24..cda76d1 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -1576,7 +1576,7 @@ spnego_gss_accept_sec_context( spnego_gss_ctx_id_t sc = NULL; spnego_gss_cred_id_t spcred = NULL; OM_uint32 mechstat = GSS_S_FAILURE; - int sendTokenInit = 0; + int sendTokenInit = 0, tmpret; mechtok_in = mic_in = mic_out = GSS_C_NO_BUFFER; @@ -1609,7 +1609,6 @@ spnego_gss_accept_sec_context( if (delegated_cred_handle != NULL) *delegated_cred_handle = GSS_C_NO_CREDENTIAL; if (input_token->length == 0) { - sendTokenInit = 1; ret = acc_ctx_hints(minor_status, context_handle, spcred, &mic_out, @@ -1617,6 +1616,7 @@ spnego_gss_accept_sec_context( &return_token); if (ret != GSS_S_COMPLETE) goto cleanup; + sendTokenInit = 1; ret = GSS_S_CONTINUE_NEEDED; } else { /* Can set negState to REQUEST_MIC */ @@ -1664,27 +1664,21 @@ spnego_gss_accept_sec_context( &negState, &return_token); } cleanup: - if (return_token != NO_TOKEN_SEND && return_token != CHECK_MIC) { - /* For acceptor-sends-first send a tokenInit */ - int tmpret; - + if (return_token == INIT_TOKEN_SEND && sendTokenInit) { assert(sc != NULL); - - if (sendTokenInit) { - tmpret = make_spnego_tokenInit_msg(sc, - 1, - mic_out, - 0, - GSS_C_NO_BUFFER, - return_token, - output_token); - } else { - tmpret = make_spnego_tokenTarg_msg(negState, - sc ? sc->internal_mech : GSS_C_NO_OID, - &mechtok_out, mic_out, - return_token, - output_token); - } + tmpret = make_spnego_tokenInit_msg(sc, 1, mic_out, 0, + GSS_C_NO_BUFFER, + return_token, output_token); + if (tmpret < 0) + ret = GSS_S_FAILURE; + } else if (return_token != NO_TOKEN_SEND && + return_token != CHECK_MIC) { + tmpret = make_spnego_tokenTarg_msg(negState, + sc ? sc->internal_mech : + GSS_C_NO_OID, + &mechtok_out, mic_out, + return_token, + output_token); if (tmpret < 0) ret = GSS_S_FAILURE; }

1 0

[AuthHub/krb5-1-8: 59/111] ticket: 6689 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 62ec2dfcd29db5b1180bce0cbbaa71e23d0bcbb0 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 07:21:04 2010 +0000 ticket: 6689 version_fixed: 1.8.1 status: resolved pull up r23829 from trunk ------------------------------------------------------------------------ r23829 | tlyu | 2010-03-22 23:09:02 -0700 (Mon, 22 Mar 2010) | 10 lines ticket: 6689 target_version: 1.8.1 tags: pullup subject: krb5_typed_data not castable to krb5_pa_data on 64-bit MacOSX Move krb5_typed_data to krb5.hin from k5-int-pkinit.h because krb5int_fast_process_error was assuming that it was safe to cast it to krb5_pa_data. It's not safe to do the cast on 64-bit MacOSX because krb5.hin uses #pragma pack on that platform. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23830 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int-pkinit.h | 11 ----------- src/include/krb5/krb5.hin | 13 +++++++++++++ 2 files changed, 13 insertions(+), 11 deletions(-) --- diff --git a/src/include/k5-int-pkinit.h b/src/include/k5-int-pkinit.h index 8dcbd5d..0c5ab0e 100644 --- a/src/include/k5-int-pkinit.h +++ b/src/include/k5-int-pkinit.h @@ -101,17 +101,6 @@ typedef struct _krb5_trusted_ca { } u; } krb5_trusted_ca; -/* typed data */ -/* The FAST error handling logic currently assumes that this structure and krb5_pa_data * can be safely cast to each other - * if this structure changes, that code needs to be updated to copy. - */ -typedef struct _krb5_typed_data { - krb5_magic magic; - krb5_int32 type; - unsigned int length; - krb5_octet *data; -} krb5_typed_data; - /* PA-PK-AS-REQ (Draft 9 -- PA TYPE 14) */ typedef struct _krb5_pa_pk_as_req_draft9 { krb5_octet_data signedAuthPack; diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index 875d14a..d9f3ba8 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -1184,6 +1184,19 @@ typedef struct _krb5_pa_data { krb5_octet *contents; } krb5_pa_data; +/* typed data */ +/* + * The FAST error handling logic currently assumes that this structure and + * krb5_pa_data * can be safely cast to each other if this structure changes, + * that code needs to be updated to copy. + */ +typedef struct _krb5_typed_data { + krb5_magic magic; + krb5_int32 type; + unsigned int length; + krb5_octet *data; +} krb5_typed_data; + typedef struct _krb5_kdc_req { krb5_magic magic; krb5_msgtype msg_type; /* AS_REQ or TGS_REQ? */

1 0

[AuthHub/krb5-1-8: 58/111] ticket: 6687 version_fixed: 1.8.1
by sbose 15 Mar '11

15 Mar '11

commit 1ac3f3b36515b7f0ea50585cb5d661f76cea2e15 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:29 2010 +0000 ticket: 6687 version_fixed: 1.8.1 pull up r23821 from trunk ------------------------------------------------------------------------ r23821 | ghudson | 2010-03-19 20:50:06 -0700 (Fri, 19 Mar 2010) | 17 lines ticket: 6687 subject: Change KRB5_AUTHDATA_SIGNTICKET from 142 to 512 target_version: 1.8.1 tags: pullup KRB5_AUTHDATA_SIGNTICKET, originally a Heimdal authorization data type, was used to implement PAC-less constrained delegation in krb5 1.8. Unfortunately, it was found that Microsoft was using 142 for other purposes, which could result in a ticket issued by an MIT or Heimdal KDC being rejected by a Windows Server 2008 R2 application server. Because KRB5_AUTHDATA_SIGNTICKET is only used to communicate among a realm's KDCs, it is relatively easy to change the number, so MIT and Heimdal are both migrating to a new number. This change will cause a transitional interoperability issue when a realm mixes MIT krb5 1.8 (or Heimdal 1.3.1) KDCs with MIT krb5 1.8.1 (or Heimdal 1.3.2) KDCs, but only for constrained delegation evidence tickets. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23828 dc483132-0cff-0310-8789-dd5450dbe970 src/include/krb5/krb5.hin | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin index 63b6971..875d14a 100644 --- a/src/include/krb5/krb5.hin +++ b/src/include/krb5/krb5.hin @@ -1066,7 +1066,7 @@ krb5_verify_checksum(krb5_context context, krb5_cksumtype ctype, #define KRB5_AUTHDATA_SESAME 65 #define KRB5_AUTHDATA_WIN2K_PAC 128 #define KRB5_AUTHDATA_ETYPE_NEGOTIATION 129 /* RFC 4537 */ -#define KRB5_AUTHDATA_SIGNTICKET 142 +#define KRB5_AUTHDATA_SIGNTICKET 512 /* formerly 142 in krb5 1.8 */ #define KRB5_AUTHDATA_FX_ARMOR 71 /* password change constants */

1 0

[AuthHub/krb5-1-8: 57/111] ticket: 6680 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a7c94a2d49da51e0325089219c9d72366e113b12 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:22 2010 +0000 ticket: 6680 version_fixed: 1.8.1 status: resolved pull up r23820 from trunk ------------------------------------------------------------------------ r23820 | ghudson | 2010-03-19 09:17:05 -0700 (Fri, 19 Mar 2010) | 7 lines ticket: 6680 target_version: 1.8.1 tags: pullup Document the ticket_lifetime libdefaults setting (which was added in r16656, #2656). Based on a patch from nalin(a)redhat.com. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23827 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 12 +++++------- src/config-files/krb5.conf.M | 4 ++++ 2 files changed, 9 insertions(+), 7 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index 5e80af3..1ec4685 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -516,13 +516,6 @@ DCE do not support the default cache as created by this version of Kerberos. Use a value of 1 on DCE 1.0.3a systems, and a value of 2 on DCE 1.1 systems. The default value is @value{DefaultCcacheType}. -@ignore -@itemx tkt_lifetime -The default lifetime of a ticket. The default is -@value{DefaultTktLifetime}. This is currently not supported by the -code. -@end ignore - @itemx dns_lookup_kdc Indicate whether DNS SRV records should be used to locate the KDCs and other servers for a realm, if they are not listed in the information for @@ -583,6 +576,11 @@ If this flag is set, then an attempt to get initial credentials will fail if the client machine does not have a keytab. The default for the flag is @value{DefaultVerifyApReqNofail}. +@itemx ticket_lifetime +The value of this tag is the default lifetime for +initial tickets. The default value for the tag is +@value{DefaultTktLifetime}. + @itemx renew_lifetime The value of this tag is the default renewable lifetime for initial tickets. The default value for the tag is diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M index 9778e81..412156b 100644 --- a/src/config-files/krb5.conf.M +++ b/src/config-files/krb5.conf.M @@ -220,6 +220,10 @@ If this flag is set, then an attempt to get initial credentials will fail if the client machine does not have a keytab. The default for the flag is false. +.IP ticket_lifetime +The value of this tag is the default lifetime for initial tickets. The +default value for the tag is 1 day (1d). + .IP renew_lifetime The value of this tag is the default renewable lifetime for initial tickets. The default value for the tag is 0.

1 0

[AuthHub/krb5-1-8: 56/111] ticket: 6683 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit efdfcf9efe69feaca6144e02d7a6e770ab4e7c6f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:15 2010 +0000 ticket: 6683 version_fixed: 1.8.1 status: resolved pull up r23819 from trunk ------------------------------------------------------------------------ r23819 | ghudson | 2010-03-18 10:37:31 -0700 (Thu, 18 Mar 2010) | 7 lines ticket: 6683 target_version: 1.8.1 tags: pullup Fix the kpasswd fallback from the ccache principal name to the username in the case where the ccache doesn't exist. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23826 dc483132-0cff-0310-8789-dd5450dbe970 src/clients/kpasswd/kpasswd.c | 18 +++++++++++------- 1 files changed, 11 insertions(+), 7 deletions(-) --- diff --git a/src/clients/kpasswd/kpasswd.c b/src/clients/kpasswd/kpasswd.c index 6bc0668..c79f2c8 100644 --- a/src/clients/kpasswd/kpasswd.c +++ b/src/clients/kpasswd/kpasswd.c @@ -47,7 +47,7 @@ int main(int argc, char *argv[]) { krb5_error_code ret; krb5_context context; - krb5_principal princ; + krb5_principal princ = NULL; char *pname; krb5_ccache ccache; krb5_get_init_creds_opt *opts = NULL; @@ -84,23 +84,27 @@ int main(int argc, char *argv[]) com_err(argv[0], ret, "parsing client name"); exit(1); } - } else if ((ret = krb5_cc_default(context, &ccache)) != KRB5_CC_NOTFOUND) { - if (ret) { + } else { + ret = krb5_cc_default(context, &ccache); + if (ret != 0) { com_err(argv[0], ret, "opening default ccache"); exit(1); } - if ((ret = krb5_cc_get_principal(context, ccache, &princ))) { + ret = krb5_cc_get_principal(context, ccache, &princ); + if (ret != 0 && ret != KRB5_CC_NOTFOUND && ret != KRB5_FCC_NOFILE) { com_err(argv[0], ret, "getting principal from ccache"); exit(1); } - if ((ret = krb5_cc_close(context, ccache))) { + ret = krb5_cc_close(context, ccache); + if (ret != 0) { com_err(argv[0], ret, "closing ccache"); exit(1); } - } else { - get_name_from_passwd_file(argv[0], context, &princ); + + if (princ == NULL) + get_name_from_passwd_file(argv[0], context, &princ); } if ((ret = krb5_get_init_creds_opt_alloc(context, &opts))) {

1 0

[AuthHub/krb5-1-8: 55/111] ticket: 6681 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 26ef9e92afc87efffb643024a39ecfcbd20bd28e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:07 2010 +0000 ticket: 6681 version_fixed: 1.8.1 status: resolved pull up r23815 from trunk ------------------------------------------------------------------------ r23815 | ghudson | 2010-03-17 14:10:10 -0700 (Wed, 17 Mar 2010) | 7 lines ticket: 6681 target_version: 1.8.1 tags: pullup When checking for KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT, don't dereference options if it's NULL. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23825 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/gic_pwd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) --- diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c index cadd7ad..7b43727 100644 --- a/src/lib/krb5/krb/gic_pwd.c +++ b/src/lib/krb5/krb/gic_pwd.c @@ -218,7 +218,7 @@ krb5_get_init_creds_password(krb5_context context, * to prompt. Prompting is only disabled if the option has been set * and the value has been set to false. */ - if (!(options->flags & KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT)) + if (options && !(options->flags & KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT)) goto cleanup; /* ok, we have an expired password. Give the user a few chances

1 0

[AuthHub/krb5-1-8: 54/111] ticket: 6685 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0b25fb78017c54a4f2feaa51a063ad62a2f7b114 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 23 01:58:00 2010 +0000 ticket: 6685 version_fixed: 1.8.1 status: resolved pull up r23810 from trunk ------------------------------------------------------------------------ r23810 | tlyu | 2010-03-16 12:14:33 -0700 (Tue, 16 Mar 2010) | 8 lines ticket: 6685 target_version: 1.8.1 subject: handle NT_SRV_INST in service principal referrals Handle NT_SRV_INST in service principal cross-realm referrals, as Windows apparently uses that instead of NT_SRV_HST for at least some service principals. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23824 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_tgs_req.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index f808276..b2f0655 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -1215,6 +1215,7 @@ prep_reprocess_req(krb5_kdc_req *request, krb5_principal *krbtgt_princ) strlcpy(comp1_str,comp1->data,comp1->length+1); if ((krb5_princ_type(kdc_context, request->server) == KRB5_NT_SRV_HST || + krb5_princ_type(kdc_context, request->server) == KRB5_NT_SRV_INST || (krb5_princ_type(kdc_context, request->server) == KRB5_NT_UNKNOWN && kdc_active_realm->realm_host_based_services != NULL && (krb5_match_config_pattern(kdc_active_realm->realm_host_based_services,

1 0

[AuthHub/krb5-1-8: 53/111] ticket: 6676 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit a602ced730c88d6b4c0459c9712302fce2a4990c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:52 2010 +0000 ticket: 6676 version_fixed: 1.8.1 status: resolved pull up r23766 from trunk ------------------------------------------------------------------------ r23766 | ghudson | 2010-03-05 12:45:46 -0500 (Fri, 05 Mar 2010) | 10 lines ticket: 6676 subject: Ignore improperly encoded signedpath AD elements target_version: 1.8.1 tags: pullup We have some reason to believe Microsoft and Heimdal are both using the authdata value 142 for different purposes, leading to failures in verify_ad_signedpath(). For better interoperability, treat such tickets as unsigned, rather than invalid. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23809 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/kdc_authdata.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) --- diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c index 5097558..b5de64d 100644 --- a/src/kdc/kdc_authdata.c +++ b/src/kdc/kdc_authdata.c @@ -934,8 +934,12 @@ verify_ad_signedpath(krb5_context context, enc_sp.length = sp_authdata[0]->length; code = decode_krb5_ad_signedpath(&enc_sp, &sp); - if (code != 0) + if (code != 0) { + /* Treat an invalid signedpath authdata element as a missing one, since + * we believe MS is using the same number for something else. */ + code = 0; goto cleanup; + } code = verify_ad_signedpath_checksum(context, krbtgt,

1 0

[AuthHub/krb5-1-8: 52/111] ticket: 6674 status: resolved version_fixed: 1.8.1
by sbose 15 Mar '11

15 Mar '11

commit 1a098ade60d44f7f69a4a99996724201582007e5 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:49 2010 +0000 ticket: 6674 status: resolved version_fixed: 1.8.1 pull up r23772 from trunk ------------------------------------------------------------------------ r23772 | ghudson | 2010-03-05 15:35:26 -0500 (Fri, 05 Mar 2010) | 7 lines ticket: 6674 target_version: 1.8.1 tags: pullup Release the internal_name field of a SPNEGO context if it has not been claimed for a caller argument. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23808 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index cb286bc..7a3ff24 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -1693,6 +1693,7 @@ cleanup: if (sc->internal_name != GSS_C_NO_NAME && src_name != NULL) { *src_name = sc->internal_name; + sc->internal_name = GSS_C_NO_NAME; } release_spnego_ctx(&sc); } else if (ret != GSS_S_CONTINUE_NEEDED) { @@ -2578,6 +2579,8 @@ release_spnego_ctx(spnego_gss_ctx_id_t *ctx) (void) generic_gss_release_oid(&minor_stat, &context->internal_mech); + (void) gss_release_name(&minor_stat, &context->internal_name); + if (context->optionStr != NULL) { free(context->optionStr); context->optionStr = NULL;

1 0

[AuthHub/krb5-1-8: 51/111] ticket: 6668 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 5d0be00079af34e0442a11c2a1bb19c031a4f9c1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:46 2010 +0000 ticket: 6668 version_fixed: 1.8.1 status: resolved pull up r23749 from trunk ------------------------------------------------------------------------ r23749 | ghudson | 2010-02-24 13:57:08 -0500 (Wed, 24 Feb 2010) | 9 lines ticket: 6668 subject: Two problems in kadm5_get_principal mask handling target_version: 1.8 tags: pullup KADM5_MOD_NAME was being applied to entry->principal instead of entry->mod_name. KADM5_MKVNO was not being applied to entry->mkvno. Patch from Marcus Watts <mdw(a)umich.edu>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23807 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/svr_principal.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index 3cb3b6b..469a8e8 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -858,8 +858,8 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (! (mask & KADM5_MOD_TIME)) entry->mod_date = 0; if (! (mask & KADM5_MOD_NAME)) { - krb5_free_principal(handle->context, entry->principal); - entry->principal = NULL; + krb5_free_principal(handle->context, entry->mod_name); + entry->mod_name = NULL; } } @@ -871,10 +871,12 @@ kadm5_get_principal(void *server_handle, krb5_principal principal, if (kdb.key_data[i].key_data_kvno > entry->kvno) entry->kvno = kdb.key_data[i].key_data_kvno; - ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, - &entry->mkvno); - if (ret) - goto done; + if (mask & KADM5_MKVNO) { + ret = krb5_dbe_get_mkvno(handle->context, &kdb, master_keylist, + &entry->mkvno); + if (ret) + goto done; + } if (mask & KADM5_MAX_RLIFE) entry->max_renewable_life = kdb.max_renewable_life;

1 0

[AuthHub/krb5-1-8: 50/111] ticket: 6661 version_fixed: 1.8.1 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 407a20de4e615b612a53538c7bc78ad6ced498d4 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Mar 15 23:50:40 2010 +0000 ticket: 6661 version_fixed: 1.8.1 status: resolved pull up r23767 from trunk ------------------------------------------------------------------------ r23767 | ghudson | 2010-03-05 14:19:42 -0500 (Fri, 05 Mar 2010) | 7 lines ticket: 6661 target_version: 1.8.1 tags: pullup Add IPv6 support to changepw.c (reverting r21004 since it is no longer necessary). Patch from Submit Bose <sbose(a)redhat.com>. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23806 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/os/changepw.c | 33 ++++++++++++++++++++++++++------- 1 files changed, 26 insertions(+), 7 deletions(-) --- diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c index 46bb828..7cab0d6 100644 --- a/src/lib/krb5/os/changepw.c +++ b/src/lib/krb5/os/changepw.c @@ -65,20 +65,23 @@ locate_kpasswd(krb5_context context, const krb5_data *realm, int sockType = (useTcp ? SOCK_STREAM : SOCK_DGRAM); code = krb5int_locate_server (context, realm, addrlist, - locate_service_kpasswd, sockType, AF_INET); + locate_service_kpasswd, sockType, AF_UNSPEC); if (code == KRB5_REALM_CANT_RESOLVE || code == KRB5_REALM_UNKNOWN) { code = krb5int_locate_server (context, realm, addrlist, locate_service_kadmin, SOCK_STREAM, - AF_INET); + AF_UNSPEC); if (!code) { /* Success with admin_server but now we need to change the port number to use DEFAULT_KPASSWD_PORT and the socktype. */ size_t i; for (i=0; i<addrlist->naddrs; i++) { struct addrinfo *a = addrlist->addrs[i].ai; + krb5_ui_2 kpasswd_port = htons(DEFAULT_KPASSWD_PORT); if (a->ai_family == AF_INET) - sa2sin (a->ai_addr)->sin_port = htons(DEFAULT_KPASSWD_PORT); + sa2sin (a->ai_addr)->sin_port = kpasswd_port; + if (a->ai_family == AF_INET6) + sa2sin6 (a->ai_addr)->sin6_port = kpasswd_port; if (sockType != SOCK_STREAM) a->ai_socktype = sockType; } @@ -131,10 +134,16 @@ kpasswd_sendto_msg_callback(struct conn_state *conn, /* some brain-dead OS's don't return useful information from * the getsockname call. Namely, windows and solaris. */ - if (ss2sin(&local_addr)->sin_addr.s_addr != 0) { + if (local_addr.ss_family == AF_INET && + ss2sin(&local_addr)->sin_addr.s_addr != 0) { local_kaddr.addrtype = ADDRTYPE_INET; local_kaddr.length = sizeof(ss2sin(&local_addr)->sin_addr); local_kaddr.contents = (krb5_octet *) &ss2sin(&local_addr)->sin_addr; + } else if (local_addr.ss_family == AF_INET6 && + ss2sin6(&local_addr)->sin6_addr.s6_addr != 0) { + local_kaddr.addrtype = ADDRTYPE_INET6; + local_kaddr.length = sizeof(ss2sin6(&local_addr)->sin6_addr); + local_kaddr.contents = (krb5_octet *) &ss2sin6(&local_addr)->sin6_addr; } else { krb5_address **addrs; @@ -278,9 +287,19 @@ change_set_password(krb5_context context, break; } - remote_kaddr.addrtype = ADDRTYPE_INET; - remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); - remote_kaddr.contents = (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + if (remote_addr.ss_family == AF_INET) { + remote_kaddr.addrtype = ADDRTYPE_INET; + remote_kaddr.length = sizeof(ss2sin(&remote_addr)->sin_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin(&remote_addr)->sin_addr; + } else if (remote_addr.ss_family == AF_INET6) { + remote_kaddr.addrtype = ADDRTYPE_INET6; + remote_kaddr.length = sizeof(ss2sin6(&remote_addr)->sin6_addr); + remote_kaddr.contents = + (krb5_octet *) &ss2sin6(&remote_addr)->sin6_addr; + } else { + break; + } if ((code = krb5_auth_con_setaddrs(callback_ctx.context, callback_ctx.auth_context,

1 0

[AuthHub/krb5-1-8: 49/111] Revert KRB5_CONF_ macro change intended for trunk.
by sbose 15 Mar '11

15 Mar '11

commit aab50b5b7c039979c80ddc7639e4e5687effe0f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 20:33:05 2010 +0000 Revert KRB5_CONF_ macro change intended for trunk. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23797 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++----- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 6 insertions(+), 8 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index fa0fc29..43b780e 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" -#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,7 +206,6 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -228,21 +227,20 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" -#define KRB5_CONF_LOGGING "logging" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index b43a96f..384e7a8 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = KRB5_CONF_LOGGING; + logging_profent[0] = "logging"; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = KRB5_CONF_LOGGING; - logging_defent[1] = KRB5_CONF_DEFAULT; + logging_defent[0] = "logging"; + logging_defent[1] = "default"; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 48/111] Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "loggi
by sbose 15 Mar '11

15 Mar '11

commit a4b7b5f3407f922e66c675efd90c21feab2fcca7 Author: tsitkova <tsitkova@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Mar 10 15:59:30 2010 +0000 Use KRB5_CONF_ macros instead of strings in source for profile config arguments "default" and "logging" git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23795 dc483132-0cff-0310-8789-dd5450dbe970 src/include/k5-int.h | 8 +++++--- src/lib/kadm5/logger.c | 6 +++--- 2 files changed, 8 insertions(+), 6 deletions(-) --- diff --git a/src/include/k5-int.h b/src/include/k5-int.h index 43b780e..fa0fc29 100644 --- a/src/include/k5-int.h +++ b/src/include/k5-int.h @@ -194,8 +194,8 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DATABASE_NAME "database_name" #define KRB5_CONF_DB_MODULE_DIR "db_module_dir" #define KRB5_CONF_DB_MODULES "db_modules" -#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_DEFAULT_REALM "default_realm" +#define KRB5_CONF_DEFAULT "default" #define KRB5_CONF_DEFAULT_DOMAIN "default_domain" #define KRB5_CONF_DEFAULT_TKT_ENCTYPES "default_tkt_enctypes" #define KRB5_CONF_DEFAULT_TGS_ENCTYPES "default_tgs_enctypes" @@ -206,6 +206,7 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_DNS_LOOKUP_KDC "dns_lookup_kdc" #define KRB5_CONF_DNS_LOOKUP_REALM "dns_lookup_realm" #define KRB5_CONF_DNS_FALLBACK "dns_fallback" +#define KRB5_CONF_DOMAIN_REALM "domain_realm" #define KRB5_CONF_EXTRA_ADDRESSES "extra_addresses" #define KRB5_CONF_FORWARDABLE "forwardable" #define KRB5_CONF_HOST_BASED_SERVICES "host_based_services" @@ -227,20 +228,21 @@ typedef INT64_TYPE krb5_int64; #define KRB5_CONF_KEY_STASH_FILE "key_stash_file" #define KRB5_CONF_KPASSWD_PORT "kpasswd_port" #define KRB5_CONF_KPASSWD_SERVER "kpasswd_server" -#define KRB5_CONF_LIBDEFAULTS "libdefaults" #define KRB5_CONF_LDAP_KDC_DN "ldap_kdc_dn" #define KRB5_CONF_LDAP_KADMIN_DN "ldap_kadmind_dn" #define KRB5_CONF_LDAP_SERVICE_PASSWORD_FILE "ldap_service_password_file" #define KRB5_CONF_LDAP_ROOT_CERTIFICATE_FILE "ldap_root_certificate_file" #define KRB5_CONF_LDAP_SERVERS "ldap_servers" #define KRB5_CONF_LDAP_CONNS_PER_SERVER "ldap_conns_per_server" -#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" +#define KRB5_CONF_LIBDEFAULTS "libdefaults" +#define KRB5_CONF_LOGGING "logging" #define KRB5_CONF_MASTER_KEY_NAME "master_key_name" #define KRB5_CONF_MASTER_KEY_TYPE "master_key_type" #define KRB5_CONF_MASTER_KDC "master_kdc" #define KRB5_CONF_MAX_LIFE "max_life" #define KRB5_CONF_MAX_RENEWABLE_LIFE "max_renewable_life" #define KRB5_CONF_NOADDRESSES "noaddresses" +#define KRB5_CONF_NO_HOST_REFERRAL "no_host_referral" #define KRB5_CONF_PERMITTED_ENCTYPES "permitted_enctypes" #define KRB5_CONF_PREAUTH_MODULE_DIR "preauth_module_dir" #define KRB5_CONF_PREFERRED_PREAUTH_TYPES "preferred_preauth_types" diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c index 384e7a8..b43a96f 100644 --- a/src/lib/kadm5/logger.c +++ b/src/lib/kadm5/logger.c @@ -373,11 +373,11 @@ krb5_klog_init(krb5_context kcontext, char *ename, char *whoami, krb5_boolean do * Look up [logging]-><ename> in the profile. If that doesn't * succeed, then look for [logging]->default. */ - logging_profent[0] = "logging"; + logging_profent[0] = KRB5_CONF_LOGGING; logging_profent[1] = ename; logging_profent[2] = (char *) NULL; - logging_defent[0] = "logging"; - logging_defent[1] = "default"; + logging_defent[0] = KRB5_CONF_LOGGING; + logging_defent[1] = KRB5_CONF_DEFAULT; logging_defent[2] = (char *) NULL; logging_specs = (char **) NULL; ngood = 0;

1 0

[AuthHub/krb5-1-8: 47/111] krb5-1.8-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 206926d82fc23d4a4036e1e111bd556b4073a63f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:21:06 2010 +0000 krb5-1.8-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23762 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 2a5126f..aadebb9 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -/* #undef KRB5_RELTAIL */ +#define KRB5_RELTAIL "postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-final" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 46/111] README and patchlevel.h for krb5-1.8 final
by sbose 15 Mar '11

15 Mar '11

commit 0c1ad197fd4a5e4ea06d4d57ddce7dca9e0a84f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Mar 2 18:13:43 2010 +0000 README and patchlevel.h for krb5-1.8 final git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23760 dc483132-0cff-0310-8789-dd5450dbe970 README | 8 +++++++- src/patchlevel.h | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) --- diff --git a/README b/README index 1135b8f..8063109 100644 --- a/README +++ b/README @@ -74,7 +74,13 @@ krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration variable that enables "weak" enctypes, which now defaults to "false" beginning with krb5-1.8. The krb5-1.8 release includes additional -measures to ease the transition away from single-DES. +measures to ease the transition away from single-DES. These +additional measures include: + +* enctype config enhancements (so you can do "DEFAULT +des", etc.) +* new API to allow applications (e.g. AFS) to explicitly reenable weak + crypto +* easier kadmin history key changes Major changes in 1.8 -------------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index c151756..2a5126f 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2-postrelease" +/* #undef KRB5_RELTAIL */ /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-final"

1 0

[AuthHub/krb5-1-8: 45/111] krb5-1.8-beta2-postrelease
by sbose 15 Mar '11

15 Mar '11

commit e75e264f1b2bc9271256904533a31aa53c8edc03 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:29 2010 +0000 krb5-1.8-beta2-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23755 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index 1dd918e..c151756 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta2" +#define KRB5_RELTAIL "beta2-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-beta2" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 44/111] README and patchlevel.h for krb5-1.8-beta2
by sbose 15 Mar '11

15 Mar '11

commit b34189eb4d7899db3a17b402e09636ad135d2cf3 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 21:28:22 2010 +0000 README and patchlevel.h for krb5-1.8-beta2 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23754 dc483132-0cff-0310-8789-dd5450dbe970 README | 15 +++++++++++++-- src/patchlevel.h | 4 ++-- 2 files changed, 15 insertions(+), 4 deletions(-) --- diff --git a/README b/README index 26e516b..1135b8f 100644 --- a/README +++ b/README @@ -64,6 +64,11 @@ and logging in as "guest" with password "guest". DES transition -------------- +The krb5-1.8 release disables single-DES cryptosystems by default. As +a result, you may need to add the libdefaults setting +"allow_weak_crypto = true" to communicate with existing Kerberos +infrastructures if they do not support stronger ciphers. + The Data Encryption Standard (DES) is widely recognized as weak. The krb5-1.7 release contains measures to encourage sites to migrate away from using single-DES cryptosystems. Among these is a configuration @@ -192,6 +197,7 @@ krb5-1.8 changes by ticket ID 6599 memory leak in krb5_rd_req_decrypt_tkt_part 6600 gss_inquire_context cannot handle no target name from mechanism 6601 gsssspi_set_cred_option cannot handle mech specific option +6603 issues with SPNEGO 6605 PKINIT client should validate SAN for TGS, not service principal 6606 allow testing when offline 6607 anonymous PKINIT @@ -202,7 +208,8 @@ krb5-1.8 changes by ticket ID 6622 kinit_fast fails if weak enctype is among client principal keys 6623 Always treat anonymous as preauth required 6624 automated tests for anonymous pkinit -6625 yarrow code does not initialize keyblock enctype and uses unitialized value +6625 yarrow code does not initialize keyblock enctype and uses + unitialized value 6626 Restore interoperability with 1.6 addprinc -randkey 6627 Set enctype in crypto_tests to prevent memory leaks 6628 krb5int_dk_string_to_key fails to set enctype @@ -217,7 +224,8 @@ krb5-1.8 changes by ticket ID 6645 Add krb5_allow_weak_crypto API 6648 define MIN() in lib/gssapi/krb5/prf.c 6649 Get rid of kdb_ext.h and allow out-of-tree KDB plugins -6651 Handle migration from pre-1.7 databases with master key kvno != 1 (1.8 pullup) +6651 Handle migration from pre-1.7 databases with master key + kvno != 1 (1.8 pullup) 6652 Make decryption of master key list more robust 6653 set_default_enctype_var should filter not reject weak enctypes 6654 Fix greet_server build @@ -225,9 +233,12 @@ krb5-1.8 changes by ticket ID 6656 krb5int_fast_free_state segfaults if state is null 6657 enc_padata can include empty sequence 6658 Implement gss_set_neg_mechs +6659 Additional memory leaks in kdc 6660 Minimal support for updating history key 6662 MITKRB5-SA-2010-001 CVE-2010-0283 KDC denial of service 6663 update mkrel to deal with changed source layout +6665 Fix cipher state chaining in OpenSSL back end +6669 doc updates for allow_weak_crypto Acknowledgements ---------------- diff --git a/src/patchlevel.h b/src/patchlevel.h index 7b8dc9f..1dd918e 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "beta1-postrelease" +#define KRB5_RELTAIL "beta2" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-beta2"

1 0

[AuthHub/krb5-1-8: 43/111] ticket: 6669 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 1f1506d37300ac8ed3100641702135355e929fe1 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Feb 25 20:14:21 2010 +0000 ticket: 6669 version_fixed: 1.8 status: resolved pull up r23750 from trunk ------------------------------------------------------------------------ r23750 | tlyu | 2010-02-25 15:09:45 -0500 (Thu, 25 Feb 2010) | 7 lines ticket: 6669 target_version: 1.8 tags: pullup subject: doc updates for allow_weak_crypto Update documentation to be more helpful about allow_weak_crypto. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23751 dc483132-0cff-0310-8789-dd5450dbe970 doc/admin.texinfo | 7 +++++-- src/config-files/krb5.conf.M | 8 ++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) --- diff --git a/doc/admin.texinfo b/doc/admin.texinfo index b7c87ac..5e80af3 100644 --- a/doc/admin.texinfo +++ b/doc/admin.texinfo @@ -456,8 +456,11 @@ key encryption. The default value for this tag is @itemx allow_weak_crypto If this is set to 0 (for false), then weak encryption types will be filtered out of the previous three lists (as noted in @ref{Supported -Encryption Types}). The default value for this tag is true, but that -default may change in the future. +Encryption Types}). The default value for this tag is false, which +may cause authentication failures in existing Kerberos infrastructures +that do not support strong crypto. Users in affected environments +should set this tag to true until their infrastructure adopts stronger +ciphers. @itemx clockskew Sets the maximum allowable amount of clockskew in seconds that the diff --git a/src/config-files/krb5.conf.M b/src/config-files/krb5.conf.M index b60836f..9778e81 100644 --- a/src/config-files/krb5.conf.M +++ b/src/config-files/krb5.conf.M @@ -128,6 +128,14 @@ types that should be requested by the client, in the same format. This relation identifies the permitted list of session key encryption types. +.IP allow_weak_crypto +If this is set to 0 (for false), then weak encryption types will be +filtered out of the previous three lists. The default value for this +tag is false, which may cause authentication failures in existing +Kerberos infrastructures that do not support strong crypto. Users in +affected environments should set this tag to true until their +infrastructure adopts stronger ciphers. + .IP clockskew This relation sets the maximum allowable amount of clockskew in seconds that the library will tolerate before assuming that a Kerberos message

1 0

[AuthHub/krb5-1-8: 42/111] ticket: 6603 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 0a70aed9791deab5ece6b173f4c116091328f835 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Feb 23 00:25:58 2010 +0000 ticket: 6603 version_fixed: 1.8 status: resolved pull up r23742 from trunk ------------------------------------------------------------------------ r23742 | ghudson | 2010-02-21 23:52:30 -0500 (Sun, 21 Feb 2010) | 24 lines ticket: 6603 target_version: 1.8 tags: pullup Fix two unrelated problems in SPNEGO which don't crop up with the krb5 mechanism. 1. The third call to spnego_init_accept_context uses faulty logic to determine if the exchange is complete, preventing a third mech token from being sent to the acceptor if no MIC exchange is required. Follow the logic used in the second call (in init_ctx_nego), which is correct. 2. If the acceptor selects a mech other than the optimistic mech, it sets sc->mic_reqd to 1 whether or not the selected mech supports MICs (which isn't known until the mech completes). Most code outside of handle_mic checks sc->mic_reqd along with (sc->ctx_flags & GSS_C_INTEG_FLAG), but the code in acc_ctx_call_acc neglected to do so, so it could improperly delegate responsibility for deciding when the negotiation was finished to handle_mic--which never gets called if (sc->ctx_flags & GSS_C_INTEG_FLAG) is false. Fix acc_ctx_call_acc to check sc->ctx_flags so that mechs which don't support integrity protection can complete if they are selected non-optimistically. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23748 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/gssapi/spnego/spnego_mech.c | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-) --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 60fadd5..cb286bc 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -448,8 +448,9 @@ create_spnego_ctx(void) } /* - * Both initiator and acceptor call here to verify and/or create - * mechListMIC, and to consistency-check the MIC state. + * Both initiator and acceptor call here to verify and/or create mechListMIC, + * and to consistency-check the MIC state. handle_mic is invoked only if the + * negotiated mech has completed and supports MICs. */ static OM_uint32 handle_mic(OM_uint32 *minor_status, gss_buffer_t mic_in, @@ -658,18 +659,20 @@ init_ctx_cont(OM_uint32 *minor_status, gss_ctx_id_t *ctx, gss_buffer_t buf, supportedMech, responseToken, mechListMIC, negState, tokflag); - } else if (!sc->mech_complete && - *responseToken == GSS_C_NO_BUFFER) { - /* - * mech not finished and mech token missing - */ + } else if ((!sc->mech_complete && *responseToken == GSS_C_NO_BUFFER) || + (sc->mech_complete && *responseToken != GSS_C_NO_BUFFER)) { + /* Missing or spurious token from acceptor. */ ret = GSS_S_DEFECTIVE_TOKEN; - } else if (sc->mic_reqd && - (sc->ctx_flags & GSS_C_INTEG_FLAG)) { + } else if (!sc->mech_complete || + (sc->mic_reqd && + (sc->ctx_flags & GSS_C_INTEG_FLAG))) { + /* Not obviously done; we may decide we're done later in + * init_ctx_call_init or handle_mic. */ *negState = ACCEPT_INCOMPLETE; *tokflag = CONT_TOKEN_SEND; ret = GSS_S_CONTINUE_NEEDED; } else { + /* mech finished on last pass and no MIC required, so done. */ *negState = ACCEPT_COMPLETE; *tokflag = NO_TOKEN_SEND; ret = GSS_S_COMPLETE; @@ -1535,10 +1538,13 @@ acc_ctx_call_acc(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc, if (ret_flags != NULL) *ret_flags = sc->ctx_flags; - if (!sc->mic_reqd) { + if (!sc->mic_reqd || + !(sc->ctx_flags & GSS_C_INTEG_FLAG)) { + /* No MIC exchange required, so we're done. */ *negState = ACCEPT_COMPLETE; ret = GSS_S_COMPLETE; } else { + /* handle_mic will decide if we're done. */ ret = GSS_S_CONTINUE_NEEDED; } } else if (ret != GSS_S_CONTINUE_NEEDED) {

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011