March 2011 - authhub-commits - Fedora mailing-lists

[AuthHub/krb5-1-8: 16/111] ticket: 6640 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit adc86a8e5b83d5dabe9f8a27903ae1908b4dd28d Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 14 18:51:13 2010 +0000 ticket: 6640 version_fixed: 1.8 status: resolved pull up r23657 from trunk ------------------------------------------------------------------------ r23657 | ghudson | 2010-01-14 11:09:24 -0500 (Thu, 14 Jan 2010) | 9 lines ticket: 6640 subject: Make history key exempt from permitted_enctypes tags: pullup target_version: 1.8 In kdb_init_hist, just use the first key entry in the kadmin/history entry. This makes the history key work even if the enctype is disallowed by allow_weak_crypto=false or other configuration. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23659 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/server_kdb.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) --- diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c index 1e98a8e..e1ffca2 100644 --- a/src/lib/kadm5/srv/server_kdb.c +++ b/src/lib/kadm5/srv/server_kdb.c @@ -136,7 +136,6 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) { int ret = 0; char *realm, *hist_name; - krb5_key_data *key_data; krb5_key_salt_tuple ks[1]; krb5_keyblock *tmp_mkey; @@ -205,10 +204,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) } - ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1, - &key_data); - if (ret) - goto done; + if (hist_db.n_key_data <= 0) { + krb5_set_error_message(handle->context, KRB5_KDB_NO_MATCHING_KEY, + "History entry contains no key data"); + return KRB5_KDB_NO_MATCHING_KEY; + } ret = krb5_dbe_find_mkey(handle->context, master_keylist, &hist_db, &tmp_mkey); @@ -216,11 +216,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) goto done; ret = krb5_dbekd_decrypt_key_data(handle->context, tmp_mkey, - key_data, &hist_key, NULL); + &hist_db.key_data[0], &hist_key, NULL); if (ret) goto done; - hist_kvno = key_data->key_data_kvno; + hist_kvno = hist_db.key_data[0].key_data_kvno; done: free(hist_name);

1 0

[AuthHub/krb5-1-8: 15/111] ticket: 6546 status: resolved version_fixed: 1.8
by sbose 15 Mar '11

15 Mar '11

commit 709b20016425f337eda1b79627a8e4d5e9470f13 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Thu Jan 14 18:51:09 2010 +0000 ticket: 6546 status: resolved version_fixed: 1.8 pull up r23607 from trunk ------------------------------------------------------------------------ r23607 | ghudson | 2010-01-07 15:57:02 -0500 (Thu, 07 Jan 2010) | 7 lines ticket: 6546 status: open When retrieving the kadmin/history key, accept any enctype, as the current master key enctype may not match the one the KDB was created with. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23658 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/server_kdb.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c index 4b1d05d..1e98a8e 100644 --- a/src/lib/kadm5/srv/server_kdb.c +++ b/src/lib/kadm5/srv/server_kdb.c @@ -205,8 +205,8 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r) } - ret = krb5_dbe_find_enctype(handle->context, &hist_db, - handle->params.enctype, -1, -1, &key_data); + ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1, + &key_data); if (ret) goto done;

1 0

[AuthHub/krb5-1-8: 14/111] ticket: 6632 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit c1b27b30951a86ff1101cc39ebaeed931aa9c3f7 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 12 05:03:49 2010 +0000 ticket: 6632 version_fixed: 1.8 status: resolved pull up r23628 from trunk ------------------------------------------------------------------------ r23628 | ghudson | 2010-01-11 20:05:37 -0500 (Mon, 11 Jan 2010) | 9 lines ticket: 6632 subject: Simplify and fix FAST check for keyed checksum type target_version: 1.8 tags: pullup Use krb5_c_is_keyed_checksum to detect unkeyed checksums when handling FAST requests. The old check was broken for 1.8 because krb5_c_verify_checksum got pickier about invalid keyblocks. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23649 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/fast_util.c | 19 ++++--------------- 1 files changed, 4 insertions(+), 15 deletions(-) --- diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index e6503cf..06b1e2b 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -133,6 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, krb5_fast_req * fast_req = NULL; krb5_kdc_req *request = *requestptr; krb5_fast_armored_req *fast_armored_req = NULL; + krb5_checksum *cksum; krb5_boolean cksum_valid; krb5_keyblock empty_keyblock; @@ -191,11 +192,11 @@ kdc_find_fast(krb5_kdc_req **requestptr, if (plaintext.data) free(plaintext.data); } + cksum = &fast_armored_req->req_checksum; if (retval == 0) retval = krb5_c_verify_checksum(kdc_context, state->armor_key, KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, + checksummed_data, cksum, &cksum_valid); if (retval == 0 && !cksum_valid) { retval = KRB5KRB_AP_ERR_MODIFIED; @@ -203,19 +204,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, "FAST req_checksum invalid; request modified"); } if (retval == 0) { - krb5_error_code ret; - /* - * We need to confirm that a keyed checksum is used for the - * fast_req checksum. In April 2009, the best way to do this is - * to try verifying the checksum with a keyblock with an zero - * length; if it succeeds, then an unkeyed checksum is used. - */ - ret = krb5_c_verify_checksum(kdc_context, &empty_keyblock, - KRB5_KEYUSAGE_FAST_REQ_CHKSUM, - checksummed_data, - &fast_armored_req->req_checksum, - &cksum_valid); - if (ret == 0) { + if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) { retval = KRB5KDC_ERR_POLICY; krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY, "Unkeyed checksum used in fast_req");

1 0

[AuthHub/krb5-1-8: 13/111] ticket: 6633 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit e06b4c4a1427ed08db4a25c3fc49c8db85b26833 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 12 05:03:44 2010 +0000 ticket: 6633 version_fixed: 1.8 status: resolved pull up r23629 from trunk ------------------------------------------------------------------------ r23629 | ghudson | 2010-01-11 20:07:48 -0500 (Mon, 11 Jan 2010) | 9 lines ticket: 6633 subject: Use keyed checksum type for DES FAST target_version: 1.7 tags: pullup DES enctypes have unkeyed mandatory-to-implement checksums. Since FAST requires a keyed checksum, we must pick something else in that case. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23648 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/krb5/krb/fast.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) --- diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c index 2791651..2ebbdcf 100644 --- a/src/lib/krb5/krb/fast.c +++ b/src/lib/krb5/krb/fast.c @@ -238,6 +238,9 @@ krb5int_fast_prep_req(krb5_context context, if (retval == 0) retval = krb5int_c_mandatory_cksumtype(context, state->armor_key->enctype, &cksumtype); + /* DES enctypes have unkeyed mandatory checksums; need a keyed one. */ + if (retval == 0 && !krb5_c_is_keyed_cksum(cksumtype)) + cksumtype = CKSUMTYPE_RSA_MD5_DES; if (retval ==0) retval = krb5_c_make_checksum(context, cksumtype, state->armor_key, KRB5_KEYUSAGE_FAST_REQ_CHKSUM, to_be_checksummed,

1 0

[AuthHub/krb5-1-8: 12/111] ticket: 6630 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 3d1efb1769795c25ae205e6f5a6e0ca94b00a32f Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Jan 11 21:44:18 2010 +0000 ticket: 6630 version_fixed: 1.8 status: resolved pull up r23622 from trunk ------------------------------------------------------------------------ r23622 | epeisach | 2010-01-09 11:02:13 -0500 (Sat, 09 Jan 2010) | 8 lines subject: krb5int_pbkdf2_hmac_sha1 fails to set enctype on keyblock ticket: 6630 tags: pullup krb5int_pbkdf2_hmac_sha1 fails to set enctype on a termporary keyblock - resulting in valgrind picking up on a conditional branch w/ unset value. Initialize value. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23627 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/builtin/pbkdf2.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/builtin/pbkdf2.c b/src/lib/crypto/builtin/pbkdf2.c index 7ee07f0..31de329 100644 --- a/src/lib/crypto/builtin/pbkdf2.c +++ b/src/lib/crypto/builtin/pbkdf2.c @@ -259,6 +259,7 @@ krb5int_pbkdf2_hmac_sha1(const krb5_data *out, unsigned long count, keyblock.length = pass->length; keyblock.contents = (krb5_octet *) pass->data; } + keyblock.enctype = ENCTYPE_NULL; err = krb5_k_create_key(NULL, &keyblock, &key); if (err)

1 0

[AuthHub/krb5-1-8: 11/111] ticket: 6629 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 79a270363856a18c14073a2e777f8b6a4377410c Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Mon Jan 11 21:44:13 2010 +0000 ticket: 6629 version_fixed: 1.8 status: resolved pull up r23608 from trunk ------------------------------------------------------------------------ r23608 | epeisach | 2010-01-07 20:51:19 -0500 (Thu, 07 Jan 2010) | 23 lines subject: krb5int_derive_key results in cache with uninitialized values krb5int_derive_key creates a temporary keyblock to add to the derived cache. krb5_k_free_key will iterate over the derived keys and for ones with cache will lookup the enctype for the key_cleanup handler. Unfortunatly, there isn't a keyblock init function that does not allocate the keyblock - as I suspect this problem will appear in other places. The valgrind log of this problem is: ==7281== Conditional jump or move depends on uninitialised value(s) ==7281== at 0x40E9AE8: find_enctype (etypes.h:81) ==7281== by 0x40E9C96: krb5_k_free_key (key.c:91) ==7281== by 0x40E9C52: krb5_k_free_key (key.c:86) ==7281== by 0x40EBB00: krb5_c_prf (prf.c:87) ==7281== by 0x40E7B1B: prf_plus (cf2.c:77) ==7281== by 0x40E7CE6: krb5_c_fx_cf2_simple (cf2.c:125) ==7281== by 0x804899C: main (t_cf2.c:70) ==7281== with memory leaks. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23626 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/dk/derive.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/dk/derive.c b/src/lib/crypto/krb/dk/derive.c index 384a5e4..5fd8876 100644 --- a/src/lib/crypto/krb/dk/derive.c +++ b/src/lib/crypto/krb/dk/derive.c @@ -183,6 +183,10 @@ krb5int_derive_key(const struct krb5_enc_provider *enc, /* Derive into a temporary keyblock. */ keyblock.length = enc->keylength; keyblock.contents = malloc(keyblock.length); + /* Set the enctype as the krb5_k_free_key will iterate over list + or derived keys and invoke krb5_k_free_key which will lookup + the enctype for key_cleanup handler */ + keyblock.enctype = inkey->keyblock.enctype; if (keyblock.contents == NULL) return ENOMEM; ret = krb5int_derive_keyblock(enc, inkey, &keyblock, in_constant);

1 0

[AuthHub/krb5-1-8: 10/111] ticket: 6628 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit b9f9860dfea5b1a958f2ceaf8c2a28cc563b8d99 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:18 2010 +0000 ticket: 6628 version_fixed: 1.8 status: resolved pull up r23612 from trunk ------------------------------------------------------------------------ r23612 | epeisach | 2010-01-08 09:54:04 -0500 (Fri, 08 Jan 2010) | 7 lines ticket: 6628 subject: krb5int_dk_string_to_key fails to set enctype tags: pullup Failure to set the enctype before invoking krb5_k_create_key results in potential memory leak. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23621 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/dk/stringtokey.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/dk/stringtokey.c b/src/lib/crypto/krb/dk/stringtokey.c index 9a49187..4c7206c 100644 --- a/src/lib/crypto/krb/dk/stringtokey.c +++ b/src/lib/crypto/krb/dk/stringtokey.c @@ -72,6 +72,7 @@ krb5int_dk_string_to_key(const struct krb5_keytypes *ktp, indata.data = (char *) foldstring; foldkeyblock.length = keylength; foldkeyblock.contents = foldkeydata; + foldkeyblock.enctype = ktp->etype; ret = enc->make_key(&indata, &foldkeyblock); if (ret != 0)

1 0

[AuthHub/krb5-1-8: 9/111] ticket: 6627 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit b0f769f982bc7b94f6dcc57df0fcc3cd85f1dd5b Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:15 2010 +0000 ticket: 6627 version_fixed: 1.8 status: resolved pull up r23611 from trunk ------------------------------------------------------------------------ r23611 | epeisach | 2010-01-07 22:43:37 -0500 (Thu, 07 Jan 2010) | 7 lines subject: Set enctype in crypto_tests to prevent memory leaks ticket: 6627 tags: pullup The key caching is causing memory leaks if enctype is not set as the enctype specific cleanup handlers are not called. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23620 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/crypto_tests/aes-test.c | 14 ++++++++------ src/lib/crypto/crypto_tests/t_cts.c | 16 +++++----------- 2 files changed, 13 insertions(+), 17 deletions(-) --- diff --git a/src/lib/crypto/crypto_tests/aes-test.c b/src/lib/crypto/crypto_tests/aes-test.c index 714d08e..4c0618a 100644 --- a/src/lib/crypto/crypto_tests/aes-test.c +++ b/src/lib/crypto/crypto_tests/aes-test.c @@ -74,11 +74,12 @@ static void set_bit(char *ptr, int bitnum) } /* Variable-Key tests */ -static void vk_test_1(int len) +static void vk_test_1(int len, krb5_enctype etype) { int i; enc_key.length = len; + enc_key.enctype = etype; printf("\nKEYSIZE=%d\n\n", len * 8); memset(plain, 0, sizeof(plain)); hexdump("PT", plain, 16); @@ -94,16 +95,17 @@ static void vk_test_1(int len) } static void vk_test() { - vk_test_1(16); - vk_test_1(32); + vk_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vk_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); } /* Variable-Text tests */ -static void vt_test_1(int len) +static void vt_test_1(int len, krb5_enctype etype) { int i; enc_key.length = len; + enc_key.enctype = etype; printf("\nKEYSIZE=%d\n\n", len * 8); memset(key, 0, len); hexdump("KEY", key, len); @@ -119,8 +121,8 @@ static void vt_test_1(int len) } static void vt_test() { - vt_test_1(16); - vt_test_1(32); + vt_test_1(16, ENCTYPE_AES128_CTS_HMAC_SHA1_96); + vt_test_1(32, ENCTYPE_AES256_CTS_HMAC_SHA1_96); } diff --git a/src/lib/crypto/crypto_tests/t_cts.c b/src/lib/crypto/crypto_tests/t_cts.c index 9f7b5e7..da697bd 100644 --- a/src/lib/crypto/crypto_tests/t_cts.c +++ b/src/lib/crypto/crypto_tests/t_cts.c @@ -43,6 +43,7 @@ const char *whoami; +#if 0 static void printhex (size_t len, const char *p) { while (len--) @@ -54,19 +55,14 @@ static void printstringhex (const char *p) { printhex (strlen (p), p); } static void printdata (krb5_data *d) { printhex (d->length, d->data); } static void printkey (krb5_keyblock *k) { printhex (k->length, k->contents); } +#endif #define JURISIC "Juri\305\241i\304\207" /* hi Miro */ #define ESZETT "\303\237" #define GCLEF "\360\235\204\236" /* outside BMP, woo hoo! */ -static void -keyToData (krb5_keyblock *k, krb5_data *d) -{ - d->length = k->length; - d->data = k->contents; -} - +#if 0 static void check_error (int r, int line) { if (r != 0) { @@ -76,10 +72,7 @@ check_error (int r, int line) { } } #define CHECK check_error(r, __LINE__) - -extern struct krb5_enc_provider krb5int_enc_des3; -struct krb5_enc_provider *enc = &krb5int_enc_des3; -extern struct krb5_enc_provider krb5int_enc_aes128, krb5int_enc_aes256; +#endif static void printd (const char *descr, krb5_data *d) { int i, j; @@ -133,6 +126,7 @@ static void test_cts() deciv.data = decivbuf; keyblock.contents = aeskey; keyblock.length = 16; + keyblock.enctype = ENCTYPE_AES128_CTS_HMAC_SHA1_96; err = krb5_k_create_key(NULL, &keyblock, &key); if (err) {

1 0

[AuthHub/krb5-1-8: 8/111] ticket: 6626 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 8d23b6a2a343abb25eef3085accff29793f87938 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:12 2010 +0000 ticket: 6626 version_fixed: 1.8 status: resolved pull up r23610 from trunk ------------------------------------------------------------------------ r23610 | ghudson | 2010-01-07 21:43:21 -0500 (Thu, 07 Jan 2010) | 10 lines ticket: 6626 subject: Restore interoperability with 1.6 addprinc -randkey tags: pullup target_version: 1.8 The arcfour string-to-key operation in krb5 1.7 (or later) disagrees with the dummy password used by the addprinc -randkey operation in krb5 1.6's kadmin client, because it's not valid UTF-8. Recognize the 1.6 dummy password and use a random password instead. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23619 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kadm5/srv/svr_principal.c | 28 ++++++++++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) --- diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c index a58c798..2f2faaa 100644 --- a/src/lib/kadm5/srv/svr_principal.c +++ b/src/lib/kadm5/srv/svr_principal.c @@ -186,6 +186,32 @@ static void cleanup_key_data(context, count, data) krb5_db_free(context, data); } +/* + * Set *passptr to NULL if the request looks like the first part of a krb5 1.6 + * addprinc -randkey operation. The krb5 1.6 dummy password for these requests + * was invalid UTF-8, which runs afoul of the arcfour string-to-key. + */ +static void +check_1_6_dummy(kadm5_principal_ent_t entry, long mask, + int n_ks_tuple, krb5_key_salt_tuple *ks_tuple, char **passptr) +{ + int i; + char *password = *passptr; + + /* Old-style randkey operations disallowed tickets to start. */ + if (!(mask & KADM5_ATTRIBUTES) || + !(entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX)) + return; + + /* The 1.6 dummy password was the octets 1..255. */ + for (i = 0; (unsigned char) password[i] == i + 1; i++); + if (password[i] != '\0' || i != 255) + return; + + /* This will make the caller use a random password instead. */ + *passptr = NULL; +} + kadm5_ret_t kadm5_create_principal(void *server_handle, kadm5_principal_ent_t entry, long mask, @@ -215,6 +241,8 @@ kadm5_create_principal_3(void *server_handle, krb5_clear_error_message(handle->context); + check_1_6_dummy(entry, mask, n_ks_tuple, ks_tuple, &password); + /* * Argument sanity checking, and opening up the DB */

1 0

[AuthHub/krb5-1-8: 7/111] ticket: 6625 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 38c4051ec35c7748c58e073dca7f5872e9ea04af Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:09 2010 +0000 ticket: 6625 version_fixed: 1.8 status: resolved pull up r23609 from trunk ------------------------------------------------------------------------ r23609 | epeisach | 2010-01-07 21:12:24 -0500 (Thu, 07 Jan 2010) | 23 lines subject: yarrow code does not initialize keyblock enctype and uses unitialized value ticket: 6625 tags: pullup The yarrow code uses a keyblock that is partially initialized. This results in krb5_k_free_key trying to look up the enctype to call the free handler. One of the valgrind reports: (there are several paths) ==26701== Conditional jump or move depends on uninitialised value(s) ==26701== at 0x40E9AF0: find_enctype (etypes.h:81) ==26701== by 0x40E9C9E: krb5_k_free_key (key.c:91) ==26701== by 0x40D641A: krb5int_yarrow_cipher_init (ycipher.c:49) ==26701== by 0x40D593A: yarrow_gate_locked (yarrow.c:578) ==26701== by 0x40D5349: krb5int_yarrow_output_Block (yarrow.c:423) ==26701== by 0x40D581B: yarrow_output_locked (yarrow.c:553) ==26701== by 0x40D5667: krb5int_yarrow_output (yarrow.c:513) ==26701== by 0x40EBD2D: krb5_c_random_make_octets (prng.c:112) ==26701== by 0x40D4119: krb5int_old_encrypt (old_aead.c:97) ==26701== by 0x40E9696: krb5_k_encrypt_iov (encrypt_iov.c:42) ==26701== by 0x8049554: main (t_encrypt.c:206) ==26701== git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23618 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/crypto/krb/yarrow/ycipher.c | 1 + src/lib/crypto/krb/yarrow/ycipher.h | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) --- diff --git a/src/lib/crypto/krb/yarrow/ycipher.c b/src/lib/crypto/krb/yarrow/ycipher.c index 71b89b0..7222d94 100644 --- a/src/lib/crypto/krb/yarrow/ycipher.c +++ b/src/lib/crypto/krb/yarrow/ycipher.c @@ -50,6 +50,7 @@ krb5int_yarrow_cipher_init(CIPHER_CTX *ctx, unsigned const char * key) ctx->key = NULL; keyblock.contents = malloc(keylength); keyblock.length = keylength; + keyblock.enctype = yarrow_enc_type; if (keyblock.contents == NULL) return (YARROW_NOMEM); randombits.data = (char *) key; diff --git a/src/lib/crypto/krb/yarrow/ycipher.h b/src/lib/crypto/krb/yarrow/ycipher.h index 21151bd..4d7dc9d 100644 --- a/src/lib/crypto/krb/yarrow/ycipher.h +++ b/src/lib/crypto/krb/yarrow/ycipher.h @@ -18,6 +18,7 @@ typedef struct */ #define yarrow_enc_provider krb5int_enc_aes256 +#define yarrow_enc_type ENCTYPE_AES256_CTS_HMAC_SHA1_96 #define CIPHER_BLOCK_SIZE 16 #define CIPHER_KEY_SIZE 32

1 0

[AuthHub/krb5-1-8: 6/111] ticket: 6624 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 59a2662206d6d49007f4a242ab1f2e25fd5b3960 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:05 2010 +0000 ticket: 6624 version_fixed: 1.8 status: resolved pull up r23602, r23604, r23605 from trunk ------------------------------------------------------------------------ r23605 | hartmans | 2010-01-07 13:35:15 -0500 (Thu, 07 Jan 2010) | 4 lines ticket: 6624 Revert change to Makefile.in that ended up not being needed ------------------------------------------------------------------------ r23604 | hartmans | 2010-01-07 13:32:20 -0500 (Thu, 07 Jan 2010) | 10 lines Subject: automated tests for anonymous pkinit ticket: 6624 target_version: 1.8 tags: pullup Implement tests for anonymous pkinit. A certificate and private key are checked in; these tests will stop working in 2023. Note that r23602 needs to be pulled up before this ticket. ------------------------------------------------------------------------ r23602 | ghudson | 2010-01-07 12:26:58 -0500 (Thu, 07 Jan 2010) | 4 lines Make preauth_module_dir override, rather than supplement, the built-in path list, to avoid problems with running the same preauth module twice. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23617 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/kdc_preauth.c | 41 +++++----------------- src/lib/krb5/krb/preauth2.c | 43 +++++----------------- src/tests/dejagnu/config/default.exp | 22 ++++++++++++ src/tests/dejagnu/krb-standalone/standalone.exp | 11 ++++++ src/tests/dejagnu/pkinit-certs/ca.pem | 29 +++++++++++++++ src/tests/dejagnu/pkinit-certs/kdc.pem | 25 +++++++++++++ src/tests/dejagnu/pkinit-certs/privkey.pem | 27 ++++++++++++++ 7 files changed, 133 insertions(+), 65 deletions(-) --- diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c index 18052cf..c5dfb1f 100644 --- a/src/kdc/kdc_preauth.c +++ b/src/kdc/kdc_preauth.c @@ -391,45 +391,22 @@ static struct plugin_dir_handle preauth_plugins; /* Open plugin directories for preauth modules. */ static krb5_error_code -open_preauth_plugin_dirs(krb5_context kcontext) +open_preauth_plugin_dirs(krb5_context ctx) { static const char *path[] = { KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL, }; char **profpath = NULL; - const char **plugindirs = NULL; - size_t nprofdirs, nobjdirs; - krb5_error_code retval; - - /* Fetch the list of paths specified in the profile, if any. */ - retval = profile_get_values(kcontext->profile, path, &profpath); - if (retval != 0 && retval != PROF_NO_RELATION) - return retval; - - /* Count the number of profile dirs. */ - nprofdirs = 0; - if (profpath) { - while (profpath[nprofdirs] != NULL) - nprofdirs++; - } - - nobjdirs = sizeof(objdirs) / sizeof(*objdirs); - plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval); - if (retval != 0) - goto cleanup; - - /* Concatenate the profile and hardcoded directory lists. */ - if (profpath) - memcpy(plugindirs, profpath, nprofdirs * sizeof(char *)); - memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *)); - - retval = krb5int_open_plugin_dirs(plugindirs, NULL, &preauth_plugins, - &kcontext->err); - -cleanup: + const char **dirs; + krb5_error_code ret; + + ret = profile_get_values(ctx->profile, path, &profpath); + if (ret != 0 && ret != PROF_NO_RELATION) + return ret; + dirs = (profpath != NULL) ? (const char **) profpath : objdirs; + ret = krb5int_open_plugin_dirs(dirs, NULL, &preauth_plugins, &ctx->err); profile_free_list(profpath); - free(plugindirs); - return retval; + return ret; } krb5_error_code diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c index d1d2827..cf99a29 100644 --- a/src/lib/krb5/krb/preauth2.c +++ b/src/lib/krb5/krb/preauth2.c @@ -72,46 +72,23 @@ typedef struct _pa_types_t { /* Open plugin directories for preauth modules. */ static krb5_error_code -open_preauth_plugin_dirs(krb5_context kcontext) +open_preauth_plugin_dirs(krb5_context ctx) { static const char *path[] = { KRB5_CONF_LIBDEFAULTS, KRB5_CONF_PREAUTH_MODULE_DIR, NULL, }; char **profpath = NULL; - const char **plugindirs = NULL; - size_t nprofdirs, nobjdirs; - krb5_error_code retval; - - /* Fetch the list of paths specified in the profile, if any. */ - retval = profile_get_values(kcontext->profile, path, &profpath); - if (retval != 0 && retval != PROF_NO_RELATION) - return retval; - - /* Count the number of profile dirs. */ - nprofdirs = 0; - if (profpath) { - while (profpath[nprofdirs] != NULL) - nprofdirs++; - } - - nobjdirs = sizeof(objdirs) / sizeof(*objdirs); - plugindirs = k5alloc((nprofdirs + nobjdirs) * sizeof(char *), &retval); - if (retval != 0) - goto cleanup; - - /* Concatenate the profile and hardcoded directory lists. */ - if (profpath) - memcpy(plugindirs, profpath, nprofdirs * sizeof(char *)); - memcpy(plugindirs + nprofdirs, objdirs, nobjdirs * sizeof(char *)); - - retval = krb5int_open_plugin_dirs(plugindirs, NULL, - &kcontext->preauth_plugins, - &kcontext->err); + const char **dirs; + krb5_error_code ret; -cleanup: + ret = profile_get_values(ctx->profile, path, &profpath); + if (ret != 0 && ret != PROF_NO_RELATION) + return ret; + dirs = (profpath != NULL) ? (const char **) profpath : objdirs; + ret = krb5int_open_plugin_dirs(dirs, NULL, &ctx->preauth_plugins, + &ctx->err); profile_free_list(profpath); - free(plugindirs); - return retval; + return ret; } /* Create the per-krb5_context context. This means loading the modules diff --git a/src/tests/dejagnu/config/default.exp b/src/tests/dejagnu/config/default.exp index 8e540b3..98a9a43 100644 --- a/src/tests/dejagnu/config/default.exp +++ b/src/tests/dejagnu/config/default.exp @@ -960,7 +960,9 @@ proc setup_krb5_conf { {type client} } { global portbase global KRB5_DB_MODULE_DIR global KRB5_PA_MODULE_DIR + global srcdir + set pkinit_certs [findfile "[pwd]/$srcdir/pkinit-certs" "[pwd]/$srcdir/pkinit-certs" "$srcdir/pkinit-certs"] # Create a krb5.conf file. if { ![file exists $tmppwd/krb5.$type.conf] \ || $last_passname_conf != $multipass_name } { @@ -973,6 +975,7 @@ proc setup_krb5_conf { {type client} } { } else { puts $conffile " allow_weak_crypto = true" } + puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem" if [info exists default_tgs_enctypes($type)] { puts $conffile \ " default_tgs_enctypes = $default_tgs_enctypes($type)" @@ -1000,6 +1003,8 @@ proc setup_krb5_conf { {type client} } { # failures. If we were running the client and KDC on different # hosts, this would be okay.... #puts $conffile " kdc = $hostname:[expr 6 + $portbase]" + puts $conffile " pkinit_identity = FILE:$pkinit_certs/kdc.pem,$pkinit_certs/privkey.pem" + puts $conffile " pkinit_anchors = FILE:$pkinit_certs/ca.pem" puts $conffile " kdc = $hostname:[expr 1 + $portbase]" puts $conffile " admin_server = $hostname:[expr 4 + $portbase]" puts $conffile " kpasswd_server = $hostname:[expr 5 + $portbase]" @@ -2257,6 +2262,23 @@ proc kinit_fast { name pass standalone } { return 1 } +proc kinit_anonymous { name } { + global REALMNAME + global KINIT + global spawn_id + + # Use kinit to get a ticket. + # + spawn $KINIT -5 -f -n $name@$REALMNAME + expect eof + if ![check_exit_status kinit] { + fail "kinit anonymous" + } + + pass "kinit anonymous" + return 1 +} + proc kinit_kt { name keytab standalone testname } { global REALMNAME global KINIT diff --git a/src/tests/dejagnu/krb-standalone/standalone.exp b/src/tests/dejagnu/krb-standalone/standalone.exp index 068495f..c511798 100644 --- a/src/tests/dejagnu/krb-standalone/standalone.exp +++ b/src/tests/dejagnu/krb-standalone/standalone.exp @@ -138,6 +138,8 @@ proc doit { } { global KRBIV global portbase global mode + global tmppwd + global KRB5_PA_MODULE_DIR setup_kerberos_env kdc @@ -224,6 +226,15 @@ proc doit { } { # Double check that the ticket was destroyed. if ![do_klist_err "klist after destroy"] { return } + if ![add_random_key WELLKNOWN/ANONYMOUS 0] { + return + } + + # If we have anonymous then test it + if [file exists "$tmppwd/../../../util/fakedest$KRB5_PA_MODULE_DIR/pkinit.so" ] { + kinit_anonymous "WELLKNOWN/ANONYMOUS" + } + if ![add_random_key foo/bar 1] { return } diff --git a/src/tests/dejagnu/pkinit-certs/ca.pem b/src/tests/dejagnu/pkinit-certs/ca.pem new file mode 100644 index 0000000..55fe02c --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/ca.pem @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIE5TCCA82gAwIBAgIJANsFDWp1HgAaMA0GCSqGSIb3DQEBBQUAMIGnMQswCQYD +VQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJp +ZGdlMQwwCgYDVQQKEwNNSVQxKTAnBgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJi +ZXJvcyB0ZXN0IENBMTMwMQYDVQQDFCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8g +bm90IHVzZSBvdGhlcndpc2UwHhcNMTAwMTA2MTQ1MTI3WhcNMjMwOTE1MTQ1MTI3 +WjCBpzELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNV +BAcTCUNhbWJyaWRnZTEMMAoGA1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQ +a2luaXQgS2VyYmVyb3MgdGVzdCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3Vp +dGUgQ0E7IGRvIG5vdCB1c2Ugb3RoZXJ3aXNlMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn +ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K +ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7 +5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc +5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW +riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4IBEDCCAQwwHQYDVR0O +BBYEFFn82RUKgTvkFn0cgwyCQpNeWCxYMIHcBgNVHSMEgdQwgdGAFFn82RUKgTvk +Fn0cgwyCQpNeWCxYoYGtpIGqMIGnMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFz +c2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMQwwCgYDVQQKEwNNSVQxKTAn +BgNVBAsTIEluc2VjdXJlIFBraW5pdCBLZXJiZXJvcyB0ZXN0IENBMTMwMQYDVQQD +FCpwa2luaXQgdGVzdCBzdWl0ZSBDQTsgZG8gbm90IHVzZSBvdGhlcndpc2WCCQDb +BQ1qdR4AGjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBVL2Q6Xubs +gm881cAy6esku17/BSTZur7hCLHTGof1ZKNcCXALjmwNYNC3tl6owqpX8CSdBdsD +Bw/Vs9p3mqnaVEoZc8uW8zS6LoAQbcqiYdQHdEXMh3ec8uvAfmdlQsIsm5Ux8q8L +NM6bKnUOqOFOHme+RC4FGOLb8JqnnuQdwyIZaUyQP6hXbw4zyDphfgo1ZlZn20xh +I555kPfAZKEi/d3WY0oN4k+sfCs9tWRNjmqZfKkH1OqRpjCFGG0b0vY77MFRMuPz +YtN2iD3plgla7KkUMljp9th/Z8Ok79uA1TNLYKzoBjlAX0vToxfa8rrSNo1dHFKT +e5Tj7+29DE4I +-----END CERTIFICATE----- diff --git a/src/tests/dejagnu/pkinit-certs/kdc.pem b/src/tests/dejagnu/pkinit-certs/kdc.pem new file mode 100644 index 0000000..5575ab5 --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/kdc.pem @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEMjCCAxqgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBpzELMAkGA1UEBhMCVVMx +FjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNVBAcTCUNhbWJyaWRnZTEMMAoG +A1UEChMDTUlUMSkwJwYDVQQLEyBJbnNlY3VyZSBQa2luaXQgS2VyYmVyb3MgdGVz +dCBDQTEzMDEGA1UEAxQqcGtpbml0IHRlc3Qgc3VpdGUgQ0E7IGRvIG5vdCB1c2Ug +b3RoZXJ3aXNlMB4XDTEwMDEwNjE0NTgwOFoXDTIzMDkxNTE0NTgwOFowSjELMAkG +A1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxFTATBgNVBAoTDEtSQlRF +U1QuQ09NIDEMMAoGA1UECxMDS0RDMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB +CgKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmnZejPSKdN +MyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6KueerevR3 +pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY75NbXGIE4 +88iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc5dBSqBwV +cjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOWriIRmsqq +81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABo4HEMIHBMAkGA1UdEwQCMAAwCwYD +VR0PBAQDAgPoMBIGA1UdJQQLMAkGBysGAQUCAwUwHQYDVR0OBBYEFFn82RUKgTvk +Fn0cgwyCQpNeWCxYMB8GA1UdIwQYMBaAFFn82RUKgTvkFn0cgwyCQpNeWCxYMAkG +A1UdEgQCMAAwSAYDVR0RBEEwP6A9BgYrBgEFAgKgMzAxoA0bC0tSQlRFU1QuQ09N +oSAwHqADAgEBoRcwFRsGa3JidGd0GwtLUkJURVNULkNPTTANBgkqhkiG9w0BAQUF +AAOCAQEAP0byILHLWPyGlv/1HN34DfIpLdVkgGar2yceMtZ2v/7UjeA5PlZc8DFM +20bTq/vIN0eWDTPLI57e+MzQTMxs2UHsic4su0m5DG0cvQTsBXRK51CW/qUF+4n0 +qSEORULiDF6LNoo8akoLukNBhzBh+aqYt4aB46hhsmDmNZTDP1CXsNGHQI9/L52l +oqpUGx8tBpKIFos95PSajXrQn2u66rSMMi4aawitM2igurHPDMbC+XvEYMtXpOS5 +3PEzXEYiSV3TWLTzIE9ytswHeZyHCbp7XHx0LVZFxzqtIe4qmwJJOGhlbH21Izr4 +feF5h5e2ZrOVREY4cKkJmJhEwsqBVA== +-----END CERTIFICATE----- diff --git a/src/tests/dejagnu/pkinit-certs/privkey.pem b/src/tests/dejagnu/pkinit-certs/privkey.pem new file mode 100644 index 0000000..1825dec --- /dev/null +++ b/src/tests/dejagnu/pkinit-certs/privkey.pem @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEAnYLMe58ny00MgskJP7tZ3PIQRpQkXGLJZKI0HfntCRbIuvmn +ZejPSKdNMyejzRIyjdw1FDJUAnpXYcic3TD5817G5H63UrllAGuy+lhQWNzE6c6K +ueerevR3pMaqHXonaflVasUu5e2AAWVnFbz4x04uLlQejqPwm5sR1xTeLUnVfSY7 +5NbXGIE488iDV0wW8nqGoVWn/TsRd+7KuQUIkJpt8+V6Jk6hPIcPqe6h7mXNGsgc +5dBSqBwVcjU9DbeT4xxxEmgQdLt7qdNwV1ZPLQnTQpogNrT5uf3oSbOTsyM02GOW +riIRmsqq81sfMrpviTRRDwoqTUEhoCSor0UmcwIDAQABAoIBAQCSMh5Tu9S2yUwM +dEZmZiGxhuf+anAZZAOjqT4QeLI/Fmu3yBNM7rq+p7JrAabyp6pOq46EsXXyWtWS +SB742wWUk2quGMNVQAj0TAJyhNgGstr+XJu8k8BBPnlycobhF0lP/oH+uQifl0KR +iSoWLjEG5JTOoXs/UAD6nQMBDDhv9TweEwSyIY9jq1J5Q3wVXm/Nr/FJ/8O53guJ +/TQeo6dtdx6x2+oxKkeWinfxmy2nSoEZd0eb3WUNPZswijO7QgSJolOo83VNqFcn +lj8hYT41zUM4chple8kGnuSV4ql4a1w/52dSTLKJbgukIqvxeDtKNost344eQqkS +Lwcc+NO5AoGBAM0bR8TmFlbP4RJAEOOilXTYgP6Ttd1r1mRXGi3DRPyv4EWGT7WW +MmBHsqU6Mqz+fcoD/AIy1BBdenhaYrrwyCSvitJpoHPjqzOJDX33wUcrnYeincQ3 +PVzpF41O45vTmm692DSJ8t/uR8DhGpCzf/kxuA9ixvdKgMPgBHYeb5zlAoGBAMSY +KZvgwbtlRR25CGaUgOCHtW76puaPcyxEeCbJEKkJO1vZDAf8vi1zXOM4e/gorKHm +349ZrBQfFCrvtZG//KvI12MpjBs0Z/ijSCwS4EkYJaSH+Hm+1ygLdArwWEFkNncL +qQ+Wme1OUoDiAAxRiBKUxUF/pAQqn7X+0MGa2th3AoGBAJ8kRaFu7XJaRUZF01Ts +d4571kqxDXFKFMUyGCvd0Q9G33rSZdJ9QYUW3HP7HgrAQ5WVVdnW2lgAT+BGMUjf +PkvIsKvmLQr+YX3RH1jX/W1dWBM/h64RNll6uj14Mn5bxv2Z68GIL5y0Y5QylMwl +mmwdubSmbb6+Xf6dOJj1sKBJAoGBAJwP0tAMHp6daL2Mmk+cSaZz9KJx1bYnYB1f +CSZ47IHTc0yZQ0S/7VR1ROKXf0njOA+aEBRi8ghTF5ZyDefyySixWdI9NByQgIzP +Sca7AVLlGVTAH4694VzHosngO59FZzsfhYh7XBwW1cW8Ip+kxWlCskgphFFOaNR3 +wM5AGMRHAoGAJELs9VYPRJd7h4dPUa2RqfVPlYkcMwvoLYykY0wE5mjoNaJkQbUr +W5aKhidh4h48fImt2rpB6OYSofYC4yu3VDEr/Kl2nSb8UPE5qEd1pvmdkHSxMNkh +M2diIqot6s2v20lE/6UCqLXonlquRK1MAlyfPw9yZHP9meCvlBsYZXc= +-----END RSA PRIVATE KEY-----

1 0

[AuthHub/krb5-1-8: 5/111] ticket: 6623 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 7b0b25e873f9760e13a32864fb58a04409f2e917 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:43:02 2010 +0000 ticket: 6623 version_fixed: 1.8 status: resolved pull up r23603 from trunk ------------------------------------------------------------------------ r23603 | hartmans | 2010-01-07 13:32:15 -0500 (Thu, 07 Jan 2010) | 7 lines subject: Always treat anonymous as preauth required ticket: 6623 target_version: 1.8 tags: pullup Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication. The anonymous draft depends on a pre-auth exchange to invoke pkinit. git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23616 dc483132-0cff-0310-8789-dd5450dbe970 src/kdc/do_as_req.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) --- diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 55493ba..83d3101 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -407,6 +407,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, goto errout; } enc_tkt_reply.client = request->client; + setflag(client.attributes, KRB5_KDB_REQUIRES_PRE_AUTH); } /* * Check the preauthentication if it is there.

1 0

[AuthHub/krb5-1-8: 4/111] ticket: 6622 version_fixed: 1.8 status: resolved
by sbose 15 Mar '11

15 Mar '11

commit 304150c43c968b8023e1d65d3d7a28dff2b07f2e Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Fri Jan 8 23:42:59 2010 +0000 ticket: 6622 version_fixed: 1.8 status: resolved pull up r23597, r23599 from trunk ------------------------------------------------------------------------ r23599 | ghudson | 2010-01-06 18:44:04 -0500 (Wed, 06 Jan 2010) | 4 lines Make krb5_dbe_def_search_enctype more consistent about when it returns KRB5_KDB_NO_PERMITTED_KEY. Now it will return that error if it sees any non-permitted enctypes which match the search criteria. ------------------------------------------------------------------------ r23597 | ghudson | 2010-01-06 18:14:14 -0500 (Wed, 06 Jan 2010) | 8 lines ticket: 6622 target_version: 1.8 tags: pullup Don't return KRB5_KDB_NO_PERMITTED_KEY from krb5_dbe_def_search_enctype if we previously returned results (i.e. if *start > 0). git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23615 dc483132-0cff-0310-8789-dd5450dbe970 src/lib/kdb/kdb_default.c | 49 +++++++++++++++++++++----------------------- 1 files changed, 23 insertions(+), 26 deletions(-) --- diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c index ea24d36..4a4cf87 100644 --- a/src/lib/kdb/kdb_default.c +++ b/src/lib/kdb/kdb_default.c @@ -61,6 +61,7 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap) int maxkvno; krb5_key_data *datap; krb5_error_code ret; + krb5_boolean saw_non_permitted = FALSE; ret = 0; if (kvno == -1 && stype == -1 && ktype == -1) @@ -88,42 +89,38 @@ krb5_dbe_def_search_enctype(kcontext, dbentp, start, ktype, stype, kvno, kdatap) db_stype = KRB5_KDB_SALTTYPE_NORMAL; } - /* - * Filter out non-permitted enctypes. - */ - if (!krb5_is_permitted_enctype(kcontext, - dbentp->key_data[i].key_data_type[0])) { - ret = KRB5_KDB_NO_PERMITTED_KEY; - continue; - } - - + /* Match this entry against the arguments. */ if (ktype != -1) { if ((ret = krb5_c_enctype_compare(kcontext, (krb5_enctype) ktype, dbentp->key_data[i].key_data_type[0], &similar))) return(ret); + if (!similar) + continue; } + if (stype >= 0 && db_stype != stype) + continue; + if (kvno >= 0 && dbentp->key_data[i].key_data_kvno != kvno) + continue; - if (((ktype == -1) || similar) && - ((db_stype == stype) || (stype < 0))) { - if (kvno >= 0) { - if (kvno == dbentp->key_data[i].key_data_kvno) { - datap = &dbentp->key_data[i]; - idx = i; - maxkvno = kvno; - break; - } - } else { - if (dbentp->key_data[i].key_data_kvno > maxkvno) { - maxkvno = dbentp->key_data[i].key_data_kvno; - datap = &dbentp->key_data[i]; - idx = i; - } - } + /* Filter out non-permitted enctypes. */ + if (!krb5_is_permitted_enctype(kcontext, + dbentp->key_data[i].key_data_type[0])) { + saw_non_permitted = TRUE; + continue; + } + + if (dbentp->key_data[i].key_data_kvno > maxkvno) { + maxkvno = dbentp->key_data[i].key_data_kvno; + datap = &dbentp->key_data[i]; + idx = i; } } + /* If we scanned the whole set of keys and matched only non-permitted + * enctypes, indicate that. */ + if (maxkvno < 0 && *start == 0 && saw_non_permitted) + ret = KRB5_KDB_NO_PERMITTED_KEY; if (maxkvno < 0) return ret ? ret : KRB5_KDB_NO_MATCHING_KEY; *kdatap = datap;

1 0

[AuthHub/krb5-1-8: 3/111] krb5-1.8-alpha1-postrelease
by sbose 15 Mar '11

15 Mar '11

commit 8d3f352360f44456dd8e0cf8b27bb02d0002226b Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Jan 6 23:11:52 2010 +0000 krb5-1.8-alpha1-postrelease git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23596 dc483132-0cff-0310-8789-dd5450dbe970 src/patchlevel.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) --- diff --git a/src/patchlevel.h b/src/patchlevel.h index c538abc..1b2a0c6 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "alpha1" +#define KRB5_RELTAIL "alpha1-postrelease" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "tags/krb5-1-8-alpha1" +#define KRB5_RELTAG "branches/krb5-1-8"

1 0

[AuthHub/krb5-1-8: 2/111] README, patchlevel, etc. for krb5-1.8-alpha1
by sbose 15 Mar '11

15 Mar '11

commit 4d08f5da33a352f3361b9518d598c90ca8065d56 Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Wed Jan 6 22:58:45 2010 +0000 README, patchlevel, etc. for krb5-1.8-alpha1 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23594 dc483132-0cff-0310-8789-dd5450dbe970 README | 103 +++++++++++++++++++++++++++++++++++++++++++++++ doc/definitions.texinfo | 4 +- src/patchlevel.h | 4 +- 3 files changed, 107 insertions(+), 4 deletions(-) --- diff --git a/README b/README index a05bc9f..c1eabc5 100644 --- a/README +++ b/README @@ -71,9 +71,112 @@ beginning with krb5-1.8. Major changes in 1.8 -------------------- +The krb5-1.8 release contains a large number of changes, featuring +improvements in the following broad areas: + +* Code quality +* Modularity +* Performance +* End-user experience +* Administrator experience +* Protocol evolution + +Code quality: + +* Move toward test-driven development -- new features have test code, + or at least written testing procedures. + +* Increase conformance to coding style + + + "The great reindent" + + + Selective refactoring + +Modularity: + +* Crypto modularity -- vendors can more easily substitute their own + crypto implementations, which might be hardware-accelerated or + validated to FIPS 140, for the builtin crypto implementation that + has historically shipped as part of MIT Kerberos. Currently, only + an OpenSSL provider is included, but others are possible. + +* Move toward improved KDB interface + +* Improved API for verifying and interrogating authorization data + +Performance: + +* Investigate and remedy repeatedly-reported performance bottlenecks. + +* Encryption performance -- new crypto API with opaque key structures, + to allow for optimizations such as caching of derived keys + +End-user experience: + +* Reduce DNS dependence by implementing an interface that allows + client library to track whether a KDC supports service principal + referrals. + +Administrator experience: + +* Disable DES by default -- this reduces security exposure from using + an increasingly insecure cipher. + +* More versatile crypto configuration, to simplify migration away from + DES -- new configuration syntax to allow inclusion and exclusion of + specific algorithms relative to a default set. + +* Account lockout for repeated login failures -- mitigates online + password guessing attacks, and helps with some enterprise regulatory + compliance. + +Protocol evolution: + +* FAST enhancements -- preauthentication framework enhancements + +* Microsoft Services for User (S4U) compatibility: S4U2Self, also + known as "protocol transition", allows for service to ask a KDC for + a ticket to themselves on behalf of a client authenticated via a + different means; S4U2Proxy allows a service to ask a KDC for a + ticket to another service on behalf of a client. + +* Anonymous PKINIT -- allows the use of public-key cryptography to + anonymously authenticate to a realm + krb5-1.8 changes by ticket ID ----------------------------- +5468 delete kadmin v1 support +6206 new API for storing extra per-principal data in ccache +6434 krb5_cc_resolve() will crash if a null name param is provided +6454 Make krb5_mkt_resolve error handling work +6510 Restore limited support for static linking +6539 Enctype list configuration enhancements +6547 Modify kadm5 initializers to accept krb5 contexts +6563 Implement s4u extensions +6564 s4u extensions integration broke test suite... +6565 HP-UX IA64 wrong endian +6572 Implement GSS naming extensions and authdata verification +6576 Implement new APIs to allow improved crypto performance +6577 Account lockout for repeated login failures +6578 Heimdal DB bridge plugin for KDC back end +6580 Constrained delegation without PAC support +6582 Memory leak in _kadm5_init_any introduced with ipropd +6583 Unbundle applications into separate repository +6586 libkrb5 support for non-blocking AS requests +6590 allow testing even if name->addr->name mapping doesn't work +6591 fix slow behavior on Mac OS X with link-local addresses +6593 Remove dependency on /bin/csh in test suite +6595 FAST (preauth framework) negotiation +6597 Add GSS extensions to store credentials, generate random bits +6605 PKINIT client should validate SAN for TGS, not service principal +6606 allow testing when offline +6607 anonymous PKINIT +6616 Fix spelling and hyphen errors in man pages +6618 Support optional creation of PID files for krb5kdc and kadmind +6620 kdc_supported_enctypes does nothing; eradicate mentions thereof +6621 disable weak crypto by default + Copyright and Other Legal Notices --------------------------------- diff --git a/doc/definitions.texinfo b/doc/definitions.texinfo index 2db0add..9032a9d 100644 --- a/doc/definitions.texinfo +++ b/doc/definitions.texinfo @@ -19,8 +19,8 @@ @set RANDOMUSER johndoe @set RANDOMUSER1 jennifer @set RANDOMUSER2 david -@set RELEASE 1.6 -@set PREVRELEASE 1.5 +@set RELEASE 1.8 +@set PREVRELEASE 1.7 @set INSTALLDIR /usr/@value{LCPRODUCT} @set PREVINSTALLDIR @value{INSTALLDIR} @set ROOTDIR /usr/local diff --git a/src/patchlevel.h b/src/patchlevel.h index e1b179e..c538abc 100644 --- a/src/patchlevel.h +++ b/src/patchlevel.h @@ -53,6 +53,6 @@ #define KRB5_MAJOR_RELEASE 1 #define KRB5_MINOR_RELEASE 8 #define KRB5_PATCHLEVEL 0 -#define KRB5_RELTAIL "prerelease" +#define KRB5_RELTAIL "alpha1" /* #undef KRB5_RELDATE */ -#define KRB5_RELTAG "branches/krb5-1-8" +#define KRB5_RELTAG "tags/krb5-1-8-alpha1"

1 0

[AuthHub/krb5-1-8: 1/111] branch for krb5-1.8
by sbose 15 Mar '11

15 Mar '11

commit 1c52dc1d1093bf7fde473f555b656a56de20addc Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970> Date: Tue Jan 5 04:38:21 2010 +0000 branch for krb5-1.8 git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23588 dc483132-0cff-0310-8789-dd5450dbe970

1 0

[AuthHub] (111 commits) Created branch krb5-1-8
by sbose 15 Mar '11

15 Mar '11

The branch 'krb5-1-8' was created. Summary of new commits: 1c52dc1... branch for krb5-1.8 4d08f5d... README, patchlevel, etc. for krb5-1.8-alpha1 8d3f352... krb5-1.8-alpha1-postrelease 304150c... ticket: 6622 version_fixed: 1.8 status: resolved 7b0b25e... ticket: 6623 version_fixed: 1.8 status: resolved 59a2662... ticket: 6624 version_fixed: 1.8 status: resolved 38c4051... ticket: 6625 version_fixed: 1.8 status: resolved 8d23b6a... ticket: 6626 version_fixed: 1.8 status: resolved b0f769f... ticket: 6627 version_fixed: 1.8 status: resolved b9f9860... ticket: 6628 version_fixed: 1.8 status: resolved 79a2703... ticket: 6629 version_fixed: 1.8 status: resolved 3d1efb1... ticket: 6630 version_fixed: 1.8 status: resolved e06b4c4... ticket: 6633 version_fixed: 1.8 status: resolved c1b27b3... ticket: 6632 version_fixed: 1.8 status: resolved 709b200... ticket: 6546 status: resolved version_fixed: 1.8 adc86a8... ticket: 6640 version_fixed: 1.8 status: resolved b5c3d59... ticket: 6642 target_version: 1.8 version_fixed: 1.8 tags: p f3594c8... ticket: 6644 version_fixed: 1.8 status: resolved fd02470... ticket: 6645 version_fixed: 1.8 status: resolved dc5c665... ticket: 6599 version_fixed: 1.8 status: resolved 4ed993f... ticket: 6648 version_fixed: 1.8 status: resolved d324a7b... ticket: 6649 version_fixed: 1.8 status: resolved 56890d8... ticket: 6651 version_fixed: 1.8 status: resolved 12ff01a... ticket: 6653 version_fixed: 1.8 status: resolved dbc4603... ticket: 6654 version_fixed: 1.8 status: resolved dd692be... ticket: 6598 version_fixed: 1.8 status: resolved 1a60faa... ticket: 6600 version_fixed: 1.8 status: resolved 7dc2424... ticket: 6655 version_fixed: 1.8 status: resolved 28e503d... ticket: 6601 version_fixed: 1.8 status: resolved 829f78a... ticket: 6643 version_fixed: 1.8 status: resolved 83aa7f0... ticket: 6652 version_fixed: 1.8 status: resolved 460b23c... ticket: 6656 version_fixed: 1.8 status: resolved 583ecbe... ticket: 6657 version_fixed: 1.8 status: resolved d630aaa... ticket: 6658 version_fixed: 1.8 status: resolved 41d6311... ticket: 6660 version_fixed: 1.8 status: resolved 1d5f5b4... ticket: 6662 version_fixed: 1.8 status: resolved e0f0d4a... ticket: 6663 version_fixed: 1.8 status: resolved cea94b6... README and patchlevel.h for krb5-1.8-beta1 a4e3eb5... krb5-1.8-beta1-postrelease b12b92d... ticket: 6665 version_fixed: 1.8 status: resolved 6f7d2a9... ticket: 6659 version_fixed: 1.8 status: resolved 0a70aed... ticket: 6603 version_fixed: 1.8 status: resolved 1f1506d... ticket: 6669 version_fixed: 1.8 status: resolved b34189e... README and patchlevel.h for krb5-1.8-beta2 e75e264... krb5-1.8-beta2-postrelease 0c1ad19... README and patchlevel.h for krb5-1.8 final 206926d... krb5-1.8-postrelease a4b7b5f... Use KRB5_CONF_ macros instead of strings in source for prof aab50b5... Revert KRB5_CONF_ macro change intended for trunk. 407a20d... ticket: 6661 version_fixed: 1.8.1 status: resolved 5d0be00... ticket: 6668 version_fixed: 1.8.1 status: resolved 1a098ad... ticket: 6674 status: resolved version_fixed: 1.8.1 a602ced... ticket: 6676 version_fixed: 1.8.1 status: resolved 0b25fb7... ticket: 6685 version_fixed: 1.8.1 status: resolved 26ef9e9... ticket: 6681 version_fixed: 1.8.1 status: resolved efdfcf9... ticket: 6683 version_fixed: 1.8.1 status: resolved a7c94a2... ticket: 6680 version_fixed: 1.8.1 status: resolved 1ac3f3b... ticket: 6687 version_fixed: 1.8.1 62ec2df... ticket: 6689 version_fixed: 1.8.1 status: resolved 1bc3fac... ticket: 6690 version_fixed: 1.8.1 status: resolved 8bb942e... ticket: 6678 version_fixed: 1.8.1 status: resolved f366db0... README and patchlevel for krb5-1.8.1-beta1 130f11f... krb5-1.8.1-beta1-postrelease 6924331... ticket: 6693 version_fixed: 1.8.1 status: resolved d2065da... make depend 2790f09... README and patchlevel for krb5-1.8.1-beta2 955b77f... krb5-1.8.1-beta2-postrelease 382e139... README and patchlevel.h for krb5-1.8.1 final ddb381a... krb5-1.8.1-postrelease 4c995cb... ticket: 6702 version_fixed: 1.8.2 status: resolved e188690... ticket: 6696 version_fixed: 1.8.2 status: resolved 2c72459... ticket: 6697 version_fixed: 1.8.2 status: resolved 5eb9d5e... ticket: 6698 version_fixed: 1.8.2 status: resolved 394bd3c... ticket: 6711 version_fixed: 1.8.2 status: resolved 1bb245e... ticket: 6718 version_fixed: 1.8.2 status: resolved 07ba1f8... ticket: 6722 version_fixed: 1.8.2 status: resolved 3e3c54d... ticket: 6725 version_fixed: 1.8.2 status: resolved 789fdf3... ticket: 6562 version_fixed: 1.8.2 status: resolved 0e69014... ticket: 6726 version_fixed: 1.8.2 status: resolved a3ea5a2... ticket: 6730 version_fixed: 1.8.2 status: resolved 4ba8cb9... ticket: 6734 version_fixed: 1.8.2 status: resolved d4bf438... README and patchlevel.h for krb5-1.8.2-beta1 590e098... krb5-1.8.2-beta1-postrelease 482967a... README and patchlevel for krb5-1.8.2 7b6f4e1... krb5-1.8.2-postrelease 67952a3... ticket: 6739 version_fixed: 1.8.3 status: resolved 6cf770c... ticket: 6740 version_fixed: 1.8.3 status: resolved 80833cb... ticket: 6738 version_fixed: 1.8.3 status: resolved 1898f9f... ticket: 6744 version_fixed: 1.8.3 status: resolved c49301a... ticket: 6745 version_fixed: 1.8.3 status: resolved 256fde1... ticket: 6750 version_fixed: 1.8.3 status: resolved 6695b01... ticket: 6751 version_fixed: 1.8.3 status: resolved 2c30cfb... ticket: 6345 version_fixed: 1.8.3 status: resolved da8ec1f... README and patchlevel.h for krb5-1.8.3-beta1 b1ea0d4... krb5-1.8.3-beta1-postrelease ac31a7e... README for krb5-1.8.3 final c8395df... krb5-1.8.3-postrelease 5b05af5... ticket: 6797 status: resolved version_fixed: 1.8.4 2699991... ticket: 6798 version_fixed: 1.8.4 1b6087d... ticket: 6701 version_fixed: 1.8.4 target_version: 1.8.4 sta 30d4bec... ticket: 6764 target_version: 1.8.4 version_fixed: 1.8.4 sta 493baf7... ticket: 6768 version_fixed: 1.8.4 target_version: 1.8.4 sta 7c4d337... ticket: 6790 target_version: 1.8.4 version_fixed: 1.8.4 sta ad7ed77... ticket: 6833 subject: SA-2010-007 Checksum vulnerabilities 3b06975... ticket: 6843 subject: handle MS PACs that lack server check 565165e... ticket: 6861 subject: kpropd denial of service [MITKRB5-SA- 036e43c... ticket: 6862 subject: KDC denial of service attacks [MITKRB 3c3c3d9... ticket: 6853 version_fixed: 1.8.4 status: resolved 55daf2c... make depend 54001a5... Add OTP related ASN.1 code 1e26146... Add Yubikey pre-authentication

1 0

[AuthHub] Created branch master
by sbose 15 Mar '11

15 Mar '11

The branch 'master' was created pointing to: f5f1719... Add Yubikey pre-authentication

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

authhub-commits March 2011