[AuthHub/krb5-1-8: 81/111] ticket: 6734 version_fixed: 1.8.2 status: resolved
by sbose
commit 4ba8cb9423ae395ed48d896890e876f1247412d7
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri May 28 18:41:45 2010 +0000
ticket: 6734
version_fixed: 1.8.2
status: resolved
pull up r24102 from trunk
------------------------------------------------------------------------
r24102 | ghudson | 2010-05-24 22:44:45 -0400 (Mon, 24 May 2010) | 11 lines
ticket: 6734
subject: FAST negotiation could erroneously succeed
target_version: 1.8.2
tags: pullup
When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply. Initialize
*fast_avail at the beginning of the function per coding practices.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24111 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/fast.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 1ff2d67..e991261 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -572,6 +572,7 @@ krb5int_fast_verify_nego(krb5_context context,
krb5_data scratch;
krb5_boolean valid;
+ *fast_avail = FALSE;
if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) {
pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata,
KRB5_ENCPADATA_REQ_ENC_PA_REP);
13 years, 1 month
[AuthHub/krb5-1-8: 80/111] ticket: 6730 version_fixed: 1.8.2 status: resolved
by sbose
commit a3ea5a28ebacb79a9a4e95b5b574a140d8bfc064
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu May 20 22:57:53 2010 +0000
ticket: 6730
version_fixed: 1.8.2
status: resolved
pull up r24074 from trunk
------------------------------------------------------------------------
r24074 | tlyu | 2010-05-20 16:42:26 -0400 (Thu, 20 May 2010) | 11 lines
ticket: 6730
subject: kdc_tcp_ports not documented in kdc.conf.M
target_version: 1.8.2
tags: pullup
The kdc.conf setting kdc_tcp_ports was not documented in kdc.conf.M,
though it was documented in doc/admin.texinfo. Copy text from there
for now. The setting defaults to an empty string at the moment,
causing the KDC to not listen on TCP by default, confusing some users.
Changing this behavior is a separate issue.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24077 dc483132-0cff-0310-8789-dd5450dbe970
src/config-files/kdc.conf.M | 22 +++++++++++++++++++++-
1 files changed, 21 insertions(+), 1 deletions(-)
---
diff --git a/src/config-files/kdc.conf.M b/src/config-files/kdc.conf.M
index 4d3576d..db7d5a6 100644
--- a/src/config-files/kdc.conf.M
+++ b/src/config-files/kdc.conf.M
@@ -53,7 +53,17 @@ This relation lists the ports which the Kerberos server should listen
on, by default. This list is a comma separated list of integers. If
this relation is not specified, the compiled-in default is usually
port 88 and port 750.
+.IP kdc_tcp_ports
+This relation lists the ports on which the Kerberos server should
+listen for TCP connections by default. This list is a comma separated
+list of integers.
+If this relation is not specified, the compiled-in default is not to
+listen for TCP connections at all.
+If you wish to change this (which we do not recommend, because the
+current implementation has little protection against denial-of-service
+attacks), the standard port number assigned for Kerberos TCP traffic
+is port 88.
.IP v4_mode
This
.B string
@@ -201,6 +211,16 @@ as specified in the
.I [kdcdefaults]
section is used.
+.IP kdc_tcp_ports
+This
+.B string
+specifies the list of ports that the KDC is to listen to
+for TCP requests for this realm. By default, the value of
+.I kdc_tcp_ports
+as specified in the
+.I [kdcdefaults]
+section is used.
+
.IP master_key_name
This
.B string
13 years, 1 month
[AuthHub/krb5-1-8: 79/111] ticket: 6726 version_fixed: 1.8.2 status: resolved
by sbose
commit 0e6901440b641d196bbb816314fa63b113da6d99
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu May 20 22:57:50 2010 +0000
ticket: 6726
version_fixed: 1.8.2
status: resolved
pull up r24075 from trunk
------------------------------------------------------------------------
r24075 | tlyu | 2010-05-20 17:32:47 -0400 (Thu, 20 May 2010) | 8 lines
ticket: 6726
target_version: 1.8.2
tags: pullup
Apply patch from Arlene Berry to detect and ignore a duplicate
mechanism token sent in the mechListMIC field, such as sent by Windows
2000 Server.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24076 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/spnego/spnego_mech.c | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index cda76d1..6c4ea0a 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3149,6 +3149,18 @@ get_negTokenResp(OM_uint32 *minor_status,
*mechListMIC = get_input_token(&ptr, REMAIN);
if (*mechListMIC == GSS_C_NO_BUFFER)
return GSS_S_DEFECTIVE_TOKEN;
+
+ /* Handle Windows 2000 duplicate response token */
+ if (*responseToken &&
+ ((*responseToken)->length == (*mechListMIC)->length) &&
+ !memcmp((*responseToken)->value, (*mechListMIC)->value,
+ (*responseToken)->length)) {
+ OM_uint32 tmpmin;
+
+ gss_release_buffer(&tmpmin, *mechListMIC);
+ free(*mechListMIC);
+ *mechListMIC = NULL;
+ }
}
return GSS_S_COMPLETE;
#undef REMAIN
13 years, 1 month
[AuthHub/krb5-1-8: 78/111] ticket: 6562 version_fixed: 1.8.2 status: resolved
by sbose
commit 789fdf3068dbc35cd3a142ef9f02f7f576052f60
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu May 20 20:41:16 2010 +0000
ticket: 6562
version_fixed: 1.8.2
status: resolved
pull up r24055 from trunk
------------------------------------------------------------------------
r24055 | ghudson | 2010-05-18 13:19:15 -0400 (Tue, 18 May 2010) | 6 lines
ticket: 6562
When parsing a KDC or admin server string, allow the name or address
to be enclosed in brackets so that IPv6 addresses can be represented.
(IPv6 addresses contain colons, which look like port separators.)
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24073 dc483132-0cff-0310-8789-dd5450dbe970
doc/admin.texinfo | 14 ++++++----
src/lib/kadm5/alt_prof.c | 39 ++++++++++++++++++++++++-----
src/lib/krb5/os/locate_kdc.c | 56 +++++++++++++++++------------------------
3 files changed, 63 insertions(+), 46 deletions(-)
---
diff --git a/doc/admin.texinfo b/doc/admin.texinfo
index 1ec4685..fbdc592 100644
--- a/doc/admin.texinfo
+++ b/doc/admin.texinfo
@@ -680,12 +680,14 @@ tags may be specified in the realm's subsection:
@table @b
@itemx kdc
-The name of a host running a KDC for that realm. An optional port
-number (separated from the hostname by a colon) may be included. For
-your computer to be able to communicate with the KDC for each realm,
-this tag must be given a value in each realm subsection in the
-configuration file, or there must be DNS SRV records specifying the
-KDCs (see @ref{Using DNS}).
+The name or address of a host running a KDC for that realm. An optional
+port number, separated from the hostname by a colon, may be included.
+If the name or address contains colons (for example, if it is an IPv6
+address), enclose it in square brackets to distinguish the colon from a
+port separator. For your computer to be able to communicate with the
+KDC for each realm, this tag must be given a value in each realm
+subsection in the configuration file, or there must be DNS SRV records
+specifying the KDCs (see @ref{Using DNS}).
@itemx master_kdc
Identifies the master KDC(s). Currently, this tag is used in only one
diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c
index 5b967a0..7d28738 100644
--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
@@ -482,6 +482,36 @@ get_deltat_param(krb5_deltat *param_out, krb5_deltat param_in,
}
/*
+ * Parse out the port number from an admin_server setting. Modify server to
+ * contain just the hostname or address. If a port is given, set *port, and
+ * set the appropriate bit in *mask.
+ */
+static void
+parse_admin_server_port(char *server, int *port, long *mask)
+{
+ char *end, *portstr;
+
+ /* Allow the name or addr to be enclosed in brackets, for IPv6 addrs. */
+ if (*server == '[' && (end = strchr(server + 1, ']')) != NULL) {
+ portstr = (*(end + 1) == ':') ? end + 2 : NULL;
+ /* Shift the bracketed name or address back into server. */
+ memmove(server, server + 1, end - (server + 1));
+ *(end - 1) = '\0';
+ } else {
+ /* Terminate the name at the colon, if any. */
+ end = server + strcspn(server, ":");
+ portstr = (*end == ':') ? end + 1 : NULL;
+ *end = '\0';
+ }
+
+ /* If we found a port string, parse it and set the appropriate bit. */
+ if (portstr) {
+ *port = atoi(portstr);
+ *mask |= KADM5_CONFIG_KADMIND_PORT;
+ }
+}
+
+/*
* Function: kadm5_get_config_params
*
* Purpose: Merge configuration parameters provided by the caller with
@@ -581,13 +611,8 @@ krb5_error_code kadm5_get_config_params(context, use_kdc_config,
NULL);
if (params.mask & KADM5_CONFIG_ADMIN_SERVER) {
- char *p;
- p = strchr(params.admin_server, ':');
- if (p) {
- params.kadmind_port = atoi(p+1);
- params.mask |= KADM5_CONFIG_KADMIND_PORT;
- *p = '\0';
- }
+ parse_admin_server_port(params.admin_server, ¶ms.kadmind_port,
+ ¶ms.mask);
}
/* Get the value for the database */
diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
index 0ecb2d9..d0134c1 100644
--- a/src/lib/krb5/os/locate_kdc.c
+++ b/src/lib/krb5/os/locate_kdc.c
@@ -374,19 +374,11 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm,
if (code == 0) {
for (i=0; masterlist[i]; i++) {
host = masterlist[i];
-
- /*
- * Strip off excess whitespace
- */
- cp = strchr(host, ' ');
- if (cp)
- *cp = 0;
- cp = strchr(host, '\t');
- if (cp)
- *cp = 0;
- cp = strchr(host, ':');
- if (cp)
- *cp = 0;
+ /* Strip off excess characters. */
+ if (*host == '[' && (cp = strchr(host, ']')))
+ *(cp + 1) = '\0';
+ else
+ *(host + strcspn(host, " \t:")) = '\0';
}
}
} else {
@@ -407,20 +399,13 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm,
host = hostlist[i];
Tprintf ("entry %d is '%s'\n", i, host);
- /*
- * Strip off excess whitespace
- */
- cp = strchr(host, ' ');
- if (cp)
- *cp = 0;
- cp = strchr(host, '\t');
- if (cp)
- *cp = 0;
- port = strchr(host, ':');
- if (port) {
- *port = 0;
- port++;
- }
+ /* Find port number, and strip off any excess characters. */
+ if (*host == '[' && (cp = strchr(host, ']')))
+ cp = cp + 1;
+ else
+ cp = host + strcspn(host, " \t:");
+ port = (*cp == ':') ? cp + 1 : NULL;
+ *cp = '\0';
ismaster = 0;
if (masterlist) {
@@ -454,15 +439,20 @@ krb5_locate_srv_conf_1(krb5_context context, const krb5_data *realm,
p2 = sec_udpport;
}
+ /* If the hostname was in brackets, strip those off now. */
+ if (*host == '[' && (cp = strchr(host, ']'))) {
+ host++;
+ *cp = '\0';
+ }
+
if (socktype != 0)
- code = add_host_to_list (addrlist, hostlist[i], p1, p2,
- socktype, family);
+ code = add_host_to_list(addrlist, host, p1, p2, socktype, family);
else {
- code = add_host_to_list (addrlist, hostlist[i], p1, p2,
- SOCK_DGRAM, family);
+ code = add_host_to_list(addrlist, host, p1, p2, SOCK_DGRAM,
+ family);
if (code == 0)
- code = add_host_to_list (addrlist, hostlist[i], p1, p2,
- SOCK_STREAM, family);
+ code = add_host_to_list(addrlist, host, p1, p2, SOCK_STREAM,
+ family);
}
if (code) {
Tprintf ("error %d (%s) returned from add_host_to_list\n", code,
13 years, 1 month
[AuthHub/krb5-1-8: 77/111] ticket: 6725 version_fixed: 1.8.2 status: resolved
by sbose
commit 3e3c54d3e2d1f98a3959df577c2f6797ee087050
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:54 2010 +0000
ticket: 6725
version_fixed: 1.8.2
status: resolved
pull up r24056 from trunk
------------------------------------------------------------------------
r24056 | tlyu | 2010-05-19 14:09:37 -0400 (Wed, 19 May 2010) | 8 lines
ticket: 6725
subject: CVE-2010-1321 GSS-API lib null pointer deref (MITKRB5-SA-2010-005)
tags: pullup
target_version: 1.8.2
Make krb5_gss_accept_sec_context() check for a null authenticator
checksum pointer before attempting to dereference it.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24063 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/krb5/accept_sec_context.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index ce3075f..6241055 100644
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -607,6 +607,13 @@ kg_accept_krb5(minor_status, context_handle,
}
#endif
+ if (authdat->checksum == NULL) {
+ /* missing checksum counts as "inappropriate type" */
+ code = KRB5KRB_AP_ERR_INAPP_CKSUM;
+ major_status = GSS_S_FAILURE;
+ goto fail;
+ }
+
if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
/* Samba does not send 0x8003 GSS-API checksums */
krb5_boolean valid;
13 years, 1 month
[AuthHub/krb5-1-8: 76/111] ticket: 6722 version_fixed: 1.8.2 status: resolved
by sbose
commit 07ba1f811fff7147228f2e5e1189c82ba2ed0ca6
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:49 2010 +0000
ticket: 6722
version_fixed: 1.8.2
status: resolved
pull up r24020 from trunk
------------------------------------------------------------------------
r24020 | ghudson | 2010-05-13 14:49:20 -0400 (Thu, 13 May 2010) | 8 lines
ticket: 6722
subject: Error handling bug in krb5_init_creds_init()
tags: pullup
target_version: 1.8.2
Fix a bug in krb5_init_creds_init() where a freed context could be
returned to the caller in certain error cases.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24062 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/get_in_tkt.c | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)
---
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index b1b837d..41059af 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -1489,14 +1489,15 @@ krb5_init_creds_init(krb5_context context,
krb5_princ_type(context, ctx->request->client) = KRB5_NT_WELLKNOWN;
}
code = restart_init_creds_loop(context, ctx, NULL);
+ if (code)
+ goto cleanup;
*pctx = ctx;
+ ctx = NULL;
cleanup:
- if (code != 0)
- krb5_init_creds_free(context, ctx);
- if (str != NULL)
- free(str);
+ krb5_init_creds_free(context, ctx);
+ free(str);
return code;
}
13 years, 1 month
[AuthHub/krb5-1-8: 75/111] ticket: 6718 version_fixed: 1.8.2 status: resolved
by sbose
commit 1bb245e6355bdd21c1db0afdfee446fd031833fe
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:46 2010 +0000
ticket: 6718
version_fixed: 1.8.2
status: resolved
pull up r24002 from trunk
------------------------------------------------------------------------
r24002 | ghudson | 2010-05-10 18:23:57 -0400 (Mon, 10 May 2010) | 14 lines
ticket: 6718
subject: Make KADM5_FAIL_AUTH_COUNT_INCREMENT more robust with LDAP
target_version: 1.8.2
tags: pullup
In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine
whether krbLoginFailedCount existed on the entry when it was
retrieved. If it didn't exist, don't try to use LDAP_MOD_INCREMENT,
and don't assert an old value when not using LDAP_MOD_INCREMENT.
Also, create the krbLoginFailedCount attribute when creating new
entries. This allows us to use LDAP_MOD_INCREMENT during the first
failed login (if the server supports it), avoiding a race condition.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24061 dc483132-0cff-0310-8789-dd5450dbe970
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 51 +++++++++++--------
1 files changed, 29 insertions(+), 22 deletions(-)
---
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 220602a..7ad31da 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -891,6 +891,16 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries,
if (st != 0)
goto cleanup;
} else if (entries->mask & KADM5_FAIL_AUTH_COUNT_INCREMENT) {
+ int attr_mask = 0;
+ krb5_boolean has_fail_count;
+
+ /* Check if the krbLoginFailedCount attribute exists. (Through
+ * krb5 1.8.1, it wasn't set in new entries.) */
+ st = krb5_get_attributes_mask(context, entries, &attr_mask);
+ if (st != 0)
+ goto cleanup;
+ has_fail_count = ((attr_mask & KDB_FAIL_AUTH_COUNT_ATTR) != 0);
+
/*
* If the client library and server supports RFC 4525,
* then use it to increment by one the value of the
@@ -898,38 +908,35 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entries,
* (provided) old value by deleting it before adding.
*/
#ifdef LDAP_MOD_INCREMENT
- if (ldap_server_handle->server_info->modify_increment) {
+ if (ldap_server_handle->server_info->modify_increment &&
+ has_fail_count) {
st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
LDAP_MOD_INCREMENT, 1);
if (st != 0)
goto cleanup;
- } else
+ } else {
#endif /* LDAP_MOD_INCREMENT */
- if (entries->fail_auth_count == 0) {
- /*
- * Unfortunately we have no way of distinguishing between
- * an absent and a zero-valued attribute by the time we are
- * called here. So, although this creates a race condition,
- * it appears impossible to assert the old value as that
- * would fail were the attribute absent.
- */
- st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
- LDAP_MOD_REPLACE, 1);
- if (st != 0)
- goto cleanup;
- } else {
- st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
+ if (has_fail_count) {
+ st = krb5_add_int_mem_ldap_mod(&mods,
+ "krbLoginFailedCount",
LDAP_MOD_DELETE,
entries->fail_auth_count);
if (st != 0)
goto cleanup;
-
- st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
- LDAP_MOD_ADD,
- entries->fail_auth_count + 1);
- if (st != 0)
- goto cleanup;
}
+ st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
+ LDAP_MOD_ADD,
+ entries->fail_auth_count + 1);
+ if (st != 0)
+ goto cleanup;
+#ifdef LDAP_MOD_INCREMENT
+ }
+#endif
+ } else if (optype == ADD_PRINCIPAL) {
+ /* Initialize krbLoginFailedCount in new entries to help avoid a
+ * race during the first failed login. */
+ st = krb5_add_int_mem_ldap_mod(&mods, "krbLoginFailedCount",
+ LDAP_MOD_ADD, 0);
}
if (entries->mask & KADM5_MAX_LIFE) {
13 years, 1 month
[AuthHub/krb5-1-8: 74/111] ticket: 6711 version_fixed: 1.8.2 status: resolved
by sbose
commit 394bd3cbad6abd1e8ba82f9e6b43acfceb4d0baf
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:43 2010 +0000
ticket: 6711
version_fixed: 1.8.2
status: resolved
pull up r23959 from trunk
------------------------------------------------------------------------
r23959 | tlyu | 2010-04-30 17:10:55 -0400 (Fri, 30 Apr 2010) | 8 lines
ticket: 6711
subject: memory leak in process_tgs_req in r23724
tags: pullup
target_version: 1.8.2
Fix a KDC memory leak that was introduced by r23724 that could leak
the decoded request.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24060 dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/do_tgs_req.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
---
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 76ca94a..29546bd 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -144,8 +144,10 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from,
retval = decode_krb5_tgs_req(pkt, &request);
if (retval)
return retval;
- if (request->msg_type != KRB5_TGS_REQ)
+ if (request->msg_type != KRB5_TGS_REQ) {
+ krb5_free_kdc_req(kdc_context, request);
return KRB5_BADMSGTYPE;
+ }
/*
* setup_server_realm() sets up the global realm-specific data pointer.
13 years, 1 month
[AuthHub/krb5-1-8: 73/111] ticket: 6698 version_fixed: 1.8.2 status: resolved
by sbose
commit 5eb9d5e188e468e516d295e69ae3d4c66980622c
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:39 2010 +0000
ticket: 6698
version_fixed: 1.8.2
status: resolved
pull up r23928 from trunk
------------------------------------------------------------------------
r23928 | tlyu | 2010-04-22 21:10:20 -0400 (Thu, 22 Apr 2010) | 10 lines
ticket: 6698
target_version: 1.8.2
tags: pullup
Adapted patch from Jason Rogers. It wasn't complete, so this commit
fixes the other instances of the 64-bit problem.
Also fix krb5_deltat_to_str(), which would previously always return an
empty string.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24059 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/str_conv.c | 10 ----------
src/slave/kproplog.c | 37 ++++++++++++++++++++++++++++---------
2 files changed, 28 insertions(+), 19 deletions(-)
---
diff --git a/src/lib/krb5/krb/str_conv.c b/src/lib/krb5/krb/str_conv.c
index 1f2edcc..6ed6392 100644
--- a/src/lib/krb5/krb/str_conv.c
+++ b/src/lib/krb5/krb/str_conv.c
@@ -300,7 +300,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen)
* This will break if bytes are more than 8 bits.
*/
#define MAX_CHARS_FOR_INT_TYPE(TYPE) ((int) (2 + 2.408241 * sizeof (TYPE)))
- char tmpbuf[MAX_CHARS_FOR_INT_TYPE(int) * 4 + 8];
days = (int) (deltat / (24*3600L));
dt = deltat % (24*3600L);
@@ -309,7 +308,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen)
minutes = (int) (dt / 60);
seconds = (int) (dt % 60);
- memset (tmpbuf, 0, sizeof (tmpbuf));
if (days == 0)
snprintf(buffer, buflen, "%d:%02d:%02d", hours, minutes, seconds);
else if (hours || minutes || seconds)
@@ -319,14 +317,6 @@ krb5_deltat_to_string(krb5_deltat deltat, char *buffer, size_t buflen)
else
snprintf(buffer, buflen, "%d %s", days,
(days > 1) ? "days" : "day");
- if (tmpbuf[sizeof(tmpbuf)-1] != 0)
- /* Something must be very wrong with my math above, or the
- assumptions going into it... */
- abort ();
- if (strlen (tmpbuf) > buflen)
- return ENOMEM;
- else
- strncpy (buffer, tmpbuf, buflen);
return 0;
}
diff --git a/src/slave/kproplog.c b/src/slave/kproplog.c
index 0134631..0af30d9 100644
--- a/src/slave/kproplog.c
+++ b/src/slave/kproplog.c
@@ -74,20 +74,40 @@ print_flags(unsigned int flags)
}
}
+/* ctime() for uint32_t* */
+static char *
+ctime_uint32(uint32_t *time32)
+{
+ time_t tmp;
+ tmp = *time32;
+ return ctime(&tmp);
+}
+
/*
* Display time information.
*/
static void
-print_time(unsigned int *timep)
+print_time(uint32_t *timep)
{
if (*timep == 0L)
printf("\t\t\tNone\n");
else {
- time_t ltime = *timep;
- printf("\t\t\t%s", ctime(<ime));
+ printf("\t\t\t%s", ctime_uint32(timep));
}
}
+static void
+print_deltat(uint32_t *deltat)
+{
+ krb5_error_code ret;
+ static char buf[30];
+ ret = krb5_deltat_to_string(*deltat, buf, sizeof(buf));
+ if (ret)
+ printf("\t\t\t(error)\n");
+ else
+ printf("\t\t\t%s\n", buf);
+}
+
/*
* Display string in hex primitive.
*/
@@ -251,13 +271,13 @@ print_attr(kdbe_val_t *val, int vverbose)
case AT_MAX_LIFE:
(void) printf(_("\t\tMaximum ticket life\n"));
if (vverbose) {
- print_time(&val->kdbe_val_t_u.av_max_life);
+ print_deltat(&val->kdbe_val_t_u.av_max_life);
}
break;
case AT_MAX_RENEW_LIFE:
(void) printf(_("\t\tMaximum renewable life\n"));
if (vverbose) {
- print_time(&val->kdbe_val_t_u.av_max_renew_life);
+ print_deltat(&val->kdbe_val_t_u.av_max_renew_life);
}
break;
case AT_EXP:
@@ -447,7 +467,7 @@ print_update(kdb_hlog_t *ulog, uint32_t entry, unsigned int verbose)
(void) printf(_("\tUpdate time stamp : None\n"));
else
(void) printf(_("\tUpdate time stamp : %s"),
- ctime((time_t *)&(indx_log->kdb_time.seconds)));
+ ctime_uint32(&indx_log->kdb_time.seconds));
(void) printf(_("\tAttributes changed : %d\n"),
upd.kdb_update.kdbe_t_len);
@@ -581,12 +601,11 @@ main(int argc, char **argv)
(void) printf(_("\tFirst time stamp : None\n"));
else {
(void) printf(_("\tFirst time stamp : %s"),
- ctime((time_t *)
- &(ulog->kdb_first_time.seconds)));
+ ctime_uint32(&ulog->kdb_first_time.seconds));
}
(void) printf(_("\tLast time stamp : %s\n"),
- ctime((time_t *)&(ulog->kdb_last_time.seconds)));
+ ctime_uint32(&ulog->kdb_last_time.seconds));
}
if ((!headeronly) && ulog->kdb_num) {
13 years, 1 month
[AuthHub/krb5-1-8: 72/111] ticket: 6697 version_fixed: 1.8.2 status: resolved
by sbose
commit 2c7245905ba456b2143587b7347e59dbda7ff2d8
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Wed May 19 18:52:36 2010 +0000
ticket: 6697
version_fixed: 1.8.2
status: resolved
pull up r23929 from trunk
------------------------------------------------------------------------
r23929 | tlyu | 2010-04-22 21:30:48 -0400 (Thu, 22 Apr 2010) | 7 lines
ticket: 6697
target_version: 1.8.2
tags: pullup
Adapted patch from Arlene Berry to handle dlerror() returning a null
pointer.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24058 dc483132-0cff-0310-8789-dd5450dbe970
src/util/support/plugins.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
---
diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c
index fa7b36e..4e92254 100644
--- a/src/util/support/plugins.c
+++ b/src/util/support/plugins.c
@@ -268,6 +268,8 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct
handle = dlopen(filepath, PLUGIN_DLOPEN_FLAGS);
if (handle == NULL) {
const char *e = dlerror();
+ if (e == NULL)
+ e = "unknown failure";
Tprintf ("dlopen(%s): %s\n", filepath, e);
err = ENOENT; /* XXX */
krb5int_set_error (ep, err, "%s", e);
@@ -335,6 +337,8 @@ krb5int_get_plugin_sym (struct plugin_file_handle *h,
sym = dlsym (h->dlhandle, csymname);
if (sym == NULL) {
const char *e = dlerror (); /* XXX copy and save away */
+ if (e == NULL)
+ e = "unknown failure";
Tprintf ("dlsym(%s): %s\n", csymname, e);
err = ENOENT; /* XXX */
krb5int_set_error(ep, err, "%s", e);
13 years, 1 month