[AuthHub/krb5-1-8: 21/111] ticket: 6648 version_fixed: 1.8 status: resolved
by sbose
commit 4ed993fa6302c21d5d8d65d8a30ebc4d548917dd
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Feb 8 20:55:17 2010 +0000
ticket: 6648
version_fixed: 1.8
status: resolved
pull up r23673 from trunk
------------------------------------------------------------------------
r23673 | tlyu | 2010-01-26 17:55:07 -0500 (Tue, 26 Jan 2010) | 9 lines
ticket: 6648
target_version: 1.8
tags: pullup
subject: define MIN() in lib/gssapi/krb5/prf.c
Apply patch from Doug Engert to define MIN(), which was causing prf.c
to fail compilation on Solaris. (The definition was probably leaking
from sys/param.h, included indirectly somehow.)
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23701 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/gssapi/krb5/prf.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/gssapi/krb5/prf.c b/src/lib/gssapi/krb5/prf.c
index f87c6b0..79e2d87 100644
--- a/src/lib/gssapi/krb5/prf.c
+++ b/src/lib/gssapi/krb5/prf.c
@@ -32,6 +32,10 @@
#include "gssapiP_krb5.h"
#include <stdarg.h>
+#ifndef MIN /* Usually found in <sys/param.h>. */
+#define MIN(_a,_b) ((_a)<(_b)?(_a):(_b))
+#endif
+
OM_uint32
krb5_gss_pseudo_random(OM_uint32 *minor_status,
gss_ctx_id_t context,
13 years, 1 month
[AuthHub/krb5-1-8: 20/111] ticket: 6599 version_fixed: 1.8 status: resolved
by sbose
commit dc5c665caf83f867b6188be7b4558b6a514bcf63
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Feb 8 20:55:12 2010 +0000
ticket: 6599
version_fixed: 1.8
status: resolved
pull up r23672 from trunk
------------------------------------------------------------------------
r23672 | tlyu | 2010-01-26 13:43:29 -0500 (Tue, 26 Jan 2010) | 6 lines
ticket: 6599
target_version: 1.8
tags: pullup
Apply patch from Arlene Berry to plug a memory leak.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23700 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/rd_req_dec.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
---
diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 49f07f7..3a9b9ee 100644
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -114,8 +114,10 @@ rd_req_decrypt_tkt_part(krb5_context context, const krb5_ap_req *req,
while ((code = krb5_kt_next_entry(context, keytab,
&ktent, &cursor)) == 0) {
- if (ktent.key.enctype != req->ticket->enc_part.enctype)
+ if (ktent.key.enctype != req->ticket->enc_part.enctype) {
+ (void) krb5_free_keytab_entry_contents(context, &ktent);
continue;
+ }
retval = krb5_decrypt_tkt_part(context, &ktent.key,
req->ticket);
13 years, 1 month
[AuthHub/krb5-1-8: 19/111] ticket: 6645 version_fixed: 1.8 status: resolved
by sbose
commit fd02470c0d23a645811d658082138a2452cf6049
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jan 21 22:49:07 2010 +0000
ticket: 6645
version_fixed: 1.8
status: resolved
pull up r23663 from trunk
------------------------------------------------------------------------
r23663 | ghudson | 2010-01-19 18:35:39 -0500 (Tue, 19 Jan 2010) | 9 lines
ticket: 6645
subject: Add krb5_allow_weak_crypto API
target_version: 1.8
tags: pullup
Add an API to allow apps to override the profile setting of
allow_weak_crypto, so that aklog can work with krb5 1.8 out of the box
until OpenAFS finishes migrating away from DES.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23665 dc483132-0cff-0310-8789-dd5450dbe970
src/include/krb5/krb5.hin | 5 +++++
src/lib/krb5/krb/Makefile.in | 1 +
src/lib/krb5/krb/allow_weak.c | 38 ++++++++++++++++++++++++++++++++++++++
src/lib/krb5/libkrb5.exports | 1 +
4 files changed, 45 insertions(+), 0 deletions(-)
---
diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
index 0941273..63b6971 100644
--- a/src/include/krb5/krb5.hin
+++ b/src/include/krb5/krb5.hin
@@ -2553,6 +2553,11 @@ krb5_pac_verify(krb5_context context, const krb5_pac pac,
krb5_timestamp authtime, krb5_const_principal principal,
const krb5_keyblock *server, const krb5_keyblock *privsvr);
+/* Allows the appplication to override the profile's allow_weak_crypto setting.
+ * Primarily for use by aklog. */
+krb5_error_code KRB5_CALLCONV
+krb5_allow_weak_crypto(krb5_context context, krb5_boolean enable);
+
#if TARGET_OS_MAC
# pragma pack(pop)
#endif
diff --git a/src/lib/krb5/krb/Makefile.in b/src/lib/krb5/krb/Makefile.in
index d7a4a2d..abab3f0 100644
--- a/src/lib/krb5/krb/Makefile.in
+++ b/src/lib/krb5/krb/Makefile.in
@@ -14,6 +14,7 @@ STLIBOBJS= \
addr_comp.o \
addr_order.o \
addr_srch.o \
+ allow_weak.o \
appdefault.o \
auth_con.o \
authdata.o \
diff --git a/src/lib/krb5/krb/allow_weak.c b/src/lib/krb5/krb/allow_weak.c
new file mode 100644
index 0000000..1290d1f
--- /dev/null
+++ b/src/lib/krb5/krb/allow_weak.c
@@ -0,0 +1,38 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ * lib/krb5/krb/allow_weak.c
+ *
+ * Copyright (C) 2010 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ *
+ * Implements krb5_allow_weak_crypto.
+ */
+
+#include "k5-int.h"
+
+krb5_error_code KRB5_CALLCONV
+krb5_allow_weak_crypto(krb5_context context, krb5_boolean enable)
+{
+ context->allow_weak_crypto = (enable != FALSE);
+ return 0;
+}
diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
index acfa2ea..8d1d9d3 100644
--- a/src/lib/krb5/libkrb5.exports
+++ b/src/lib/krb5/libkrb5.exports
@@ -108,6 +108,7 @@ krb5_524_convert_creds
krb5_address_compare
krb5_address_order
krb5_address_search
+krb5_allow_weak_crypto
krb5_aname_to_localname
krb5_anonymous_principal
krb5_anonymous_realm
13 years, 1 month
[AuthHub/krb5-1-8: 18/111] ticket: 6644 version_fixed: 1.8 status: resolved
by sbose
commit f3594c86fac6c6bf4e41a600c2d7e8f22180fc75
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jan 21 22:49:01 2010 +0000
ticket: 6644
version_fixed: 1.8
status: resolved
pull up r23662 from trunk
------------------------------------------------------------------------
r23662 | ghudson | 2010-01-19 13:44:57 -0500 (Tue, 19 Jan 2010) | 3 lines
ticket: 6644
subject: Change basename of libkadm5 libraries to avoid Heimdal conflict
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23664 dc483132-0cff-0310-8789-dd5450dbe970
src/config/pre.in | 8 ++++----
src/krb5-config.in | 4 ++--
src/lib/kadm5/clnt/Makefile.in | 7 ++++++-
...bkadm5clnt.exports => libkadm5clnt_mit.exports} | 0
src/lib/kadm5/srv/Makefile.in | 7 ++++++-
...libkadm5srv.exports => libkadm5srv_mit.exports} | 0
6 files changed, 18 insertions(+), 8 deletions(-)
---
diff --git a/src/config/pre.in b/src/config/pre.in
index 75204a3..db9b1cc 100644
--- a/src/config/pre.in
+++ b/src/config/pre.in
@@ -316,8 +316,8 @@ DEPLIBEXT=@DEPLIBEXT@
KDB5_PLUGIN_DEPLIBS = @KDB5_PLUGIN_DEPLIBS@
KDB5_PLUGIN_LIBS = @KDB5_PLUGIN_LIBS@
-KADMCLNT_DEPLIB = $(TOPLIBD)/libkadm5clnt$(DEPLIBEXT)
-KADMSRV_DEPLIB = $(TOPLIBD)/libkadm5srv$(DEPLIBEXT)
+KADMCLNT_DEPLIB = $(TOPLIBD)/libkadm5clnt_mit$(DEPLIBEXT)
+KADMSRV_DEPLIB = $(TOPLIBD)/libkadm5srv_mit$(DEPLIBEXT)
KDB5_DEPLIB = $(TOPLIBD)/libkdb5$(DEPLIBEXT)
GSSRPC_DEPLIB = $(TOPLIBD)/libgssrpc$(DEPLIBEXT)
GSS_DEPLIB = $(TOPLIBD)/libgssapi_krb5$(DEPLIBEXT)
@@ -385,8 +385,8 @@ GSS_LIBS = $(GSS_KRB5_LIB)
GSSRPC_LIBS = -lgssrpc $(GSS_LIBS)
KADM_COMM_LIBS = $(GSSRPC_LIBS)
# need fixing if ever used on Mac OS X!
-KADMSRV_LIBS = -lkadm5srv $(HESIOD_LIBS) $(KDB5_LIBS) $(KADM_COMM_LIBS)
-KADMCLNT_LIBS = -lkadm5clnt $(KADM_COMM_LIBS)
+KADMSRV_LIBS = -lkadm5srv_mit $(HESIOD_LIBS) $(KDB5_LIBS) $(KADM_COMM_LIBS)
+KADMCLNT_LIBS = -lkadm5clnt_mit $(KADM_COMM_LIBS)
# libutil for NetBSD, et al. for openpty(), etc.
UTIL_LIB = @UTIL_LIB@
diff --git a/src/krb5-config.in b/src/krb5-config.in
index 1952ccb..8435d02 100755
--- a/src/krb5-config.in
+++ b/src/krb5-config.in
@@ -194,12 +194,12 @@ if test -n "$do_libs"; then
fi
if test $library = 'kadm_server'; then
- lib_flags="$lib_flags -lkadm5srv -lkdb5 $KDB5_DB_LIB"
+ lib_flags="$lib_flags -lkadm5srv_mit -lkdb5 $KDB5_DB_LIB"
library=kadm_common
fi
if test $library = 'kadm_client'; then
- lib_flags="$lib_flags -lkadm5clnt"
+ lib_flags="$lib_flags -lkadm5clnt_mit"
library=kadm_common
fi
diff --git a/src/lib/kadm5/clnt/Makefile.in b/src/lib/kadm5/clnt/Makefile.in
index aceb949..f6a11b4 100644
--- a/src/lib/kadm5/clnt/Makefile.in
+++ b/src/lib/kadm5/clnt/Makefile.in
@@ -3,7 +3,7 @@ BUILDTOP=$(REL)..$(S)..$(S)..
LOCALINCLUDES = -I$(BUILDTOP)/include/kadm5
DEFS=
-LIBBASE=kadm5clnt
+LIBBASE=kadm5clnt_mit
LIBMAJOR=7
LIBMINOR=0
STOBJLISTS=../OBJS.ST OBJS.ST
@@ -70,6 +70,11 @@ clean-unix:: clean-liblinks clean-libs clean-libobjs
install:: install-libs
+install-unix::
+ $(RM) $(DESTDIR)$(KRB5_LIBDIR)/libkadm5clnt$(DEPLIBEXT)
+ (cd $(DESTDIR)$(KRB5_LIBDIR) && $(LN_S) lib$(LIBBASE)$(DEPLIBEXT) \
+ libkadm5clnt$(DEPLIBEXT))
+
depend:: includes
@lib_frag@
diff --git a/src/lib/kadm5/clnt/libkadm5clnt.exports b/src/lib/kadm5/clnt/libkadm5clnt_mit.exports
similarity index 100%
rename from src/lib/kadm5/clnt/libkadm5clnt.exports
rename to src/lib/kadm5/clnt/libkadm5clnt_mit.exports
diff --git a/src/lib/kadm5/srv/Makefile.in b/src/lib/kadm5/srv/Makefile.in
index e813830..9e8b26f 100644
--- a/src/lib/kadm5/srv/Makefile.in
+++ b/src/lib/kadm5/srv/Makefile.in
@@ -9,7 +9,7 @@ DEFS=
##DOSBUILDTOP = ..\..\..
##DOSLIBNAME = libkadm5srv.lib
-LIBBASE=kadm5srv
+LIBBASE=kadm5srv_mit
LIBMAJOR=7
LIBMINOR=0
STOBJLISTS=../OBJS.ST OBJS.ST
@@ -87,6 +87,11 @@ clean-unix:: clean-liblinks clean-libs clean-libobjs
install:: install-libs
+install-unix::
+ $(RM) $(DESTDIR)$(KRB5_LIBDIR)/libkadm5srv$(DEPLIBEXT)
+ (cd $(DESTDIR)$(KRB5_LIBDIR) && $(LN_S) lib$(LIBBASE)$(DEPLIBEXT) \
+ libkadm5srv$(DEPLIBEXT))
+
depend:: includes
@lib_frag@
diff --git a/src/lib/kadm5/srv/libkadm5srv.exports b/src/lib/kadm5/srv/libkadm5srv_mit.exports
similarity index 100%
rename from src/lib/kadm5/srv/libkadm5srv.exports
rename to src/lib/kadm5/srv/libkadm5srv_mit.exports
13 years, 1 month
[AuthHub/krb5-1-8: 17/111] ticket: 6642 target_version: 1.8 version_fixed: 1.8 tags: pullup subject: Add test program for decry
by sbose
commit b5c3d59a2f3ba7f36dcbf9cf5abc31372c3f2d02
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jan 14 19:27:33 2010 +0000
ticket: 6642
target_version: 1.8
version_fixed: 1.8
tags: pullup
subject: Add test program for decryption of overly short buffers
status: resolved
Pull up r23652 from trunk.
Test case for integer underflow in AES and RC4 decryption.
[MITKRB5-SA-2009-004, CVE-2009-4212] krb5-1.8 branch isn't vulnerable,
but include this test anyway.
------------------------------------------------------------------------
r23652 | ghudson | 2010-01-12 16:59:58 -0500 (Tue, 12 Jan 2010) | 2 lines
Add test program for decryption of overly short buffers.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23660 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/crypto_tests/Makefile.in | 11 ++-
src/lib/crypto/crypto_tests/t_short.c | 126 +++++++++++++++++++++++++++++++
2 files changed, 135 insertions(+), 2 deletions(-)
---
diff --git a/src/lib/crypto/crypto_tests/Makefile.in b/src/lib/crypto/crypto_tests/Makefile.in
index fde5a73..c92cc7e 100644
--- a/src/lib/crypto/crypto_tests/Makefile.in
+++ b/src/lib/crypto/crypto_tests/Makefile.in
@@ -27,6 +27,7 @@ EXTRADEPSRCS=\
$(srcdir)/t_crc.c \
$(srcdir)/t_mddriver.c \
$(srcdir)/t_kperf.c \
+ $(srcdir)/t_short.c \
$(srcdir)/ytest.c
##DOSBUILDTOP = ..\..\..
@@ -44,7 +45,7 @@ check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac \
t_cksum4 t_cksum5 \
aes-test \
t_mddriver4 t_mddriver \
- t_crc t_cts
+ t_crc t_cts t_short
$(RUN_SETUP) $(VALGRIND) ./t_nfold
$(RUN_SETUP) $(VALGRIND) ./t_encrypt
$(RUN_SETUP) $(VALGRIND) ./t_prng <$(srcdir)/t_prng.seed >t_prng.output && \
@@ -62,6 +63,7 @@ check-unix:: t_nfold t_encrypt t_prf t_prng t_hmac \
cmp vt.txt $(srcdir)/expect-vt.txt
$(RUN_SETUP) $(VALGRIND) $(C)t_mddriver4 -x
$(RUN_SETUP) $(VALGRIND) $(C)t_mddriver -x
+ $(RUN_SETUP) $(VALGRIND) ./t_short
@@ -96,6 +98,10 @@ vectors$(EXEEXT): vectors.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB)
$(CC_LINK) -o $@ t_cts.$(OBJEXT) \
$(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+t_short$(EXEEXT): t_short.$(OBJEXT) $(CRYPTO_DEPLIB) $(SUPPORT_DEPLIB)
+ $(CC_LINK) -o $@ t_short.$(OBJEXT) \
+ $(K5CRYPTO_LIB) $(COM_ERR_LIB) $(SUPPORT_LIB)
+
t_cksum4.o: $(srcdir)/t_cksum.c
$(CC) -DMD=4 $(ALL_CFLAGS) -o t_cksum4.o -c $(srcdir)/t_cksum.c
@@ -139,7 +145,8 @@ clean::
t_cksum.o t_cksum \
t_crc.o t_crc t_cts.o t_cts \
t_mddriver4.o t_mddriver4 t_mddriver.o t_mddriver \
- t_cksum4 t_cksum4.o t_cksum5 t_cksum5.o t_kperf.o t_kperf \
+ t_cksum4 t_cksum4.o t_cksum5 t_cksum5.o \
+ t_kperf.o t_kperf t_short t_short.o \
t_mddriver$(EXEEXT) $(OUTPRE)t_mddriver.$(OBJEXT)
-$(RM) t_prng.output
diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c
new file mode 100644
index 0000000..9ddfd5e
--- /dev/null
+++ b/src/lib/crypto/crypto_tests/t_short.c
@@ -0,0 +1,126 @@
+/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ * lib/crypto/crypto_tests/t_short.c
+ *
+ * Copyright (C) 2009 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ * require a specific license from the United States Government.
+ * It is the responsibility of any person or organization contemplating
+ * export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission. Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose. It is provided "as is" without express
+ * or implied warranty.
+ *
+ * Tests the outcome of decrypting overly short tokens. This program can be
+ * run under a tool like valgrind to detect bad memory accesses; when run
+ * normally by the test suite, it verifies that each operation returns
+ * KRB5_BAD_MSIZE.
+ */
+
+#include "k5-int.h"
+
+krb5_enctype interesting_enctypes[] = {
+ ENCTYPE_DES_CBC_CRC,
+ ENCTYPE_DES_CBC_MD4,
+ ENCTYPE_DES_CBC_MD5,
+ ENCTYPE_DES3_CBC_SHA1,
+ ENCTYPE_ARCFOUR_HMAC,
+ ENCTYPE_ARCFOUR_HMAC_EXP,
+ ENCTYPE_AES256_CTS_HMAC_SHA1_96,
+ ENCTYPE_AES128_CTS_HMAC_SHA1_96,
+ 0
+};
+
+/* Abort if an operation unexpectedly fails. */
+static void
+x(krb5_error_code code)
+{
+ if (code != 0)
+ abort();
+}
+
+/* Abort if a decrypt operation doesn't have the expected result. */
+static void
+check_decrypt_result(krb5_error_code code, size_t len, size_t min_len)
+{
+ if (len < min_len) {
+ /* Undersized tokens should always result in BAD_MSIZE. */
+ if (code != KRB5_BAD_MSIZE)
+ abort();
+ } else {
+ /* Min-size tokens should succeed or fail the integrity check. */
+ if (code != 0 && code != KRB5KRB_AP_ERR_BAD_INTEGRITY)
+ abort();
+ }
+}
+
+static void
+test_enctype(krb5_enctype enctype)
+{
+ krb5_error_code ret;
+ krb5_keyblock keyblock;
+ krb5_enc_data input;
+ krb5_data output;
+ krb5_crypto_iov iov[2];
+ unsigned int dummy;
+ size_t min_len, len;
+
+ printf("Testing enctype %d\n", (int) enctype);
+ x(krb5_c_encrypt_length(NULL, enctype, 0, &min_len));
+ x(krb5_c_make_random_key(NULL, enctype, &keyblock));
+ input.enctype = enctype;
+
+ /* Try each length up to the minimum length. */
+ for (len = 0; len <= min_len; len++) {
+ input.ciphertext.data = calloc(len, 1);
+ input.ciphertext.length = len;
+ output.data = calloc(len, 1);
+ output.length = len;
+
+ /* Attempt a normal decryption. */
+ ret = krb5_c_decrypt(NULL, &keyblock, 0, NULL, &input, &output);
+ check_decrypt_result(ret, len, min_len);
+
+ if (krb5_c_crypto_length(NULL, enctype, KRB5_CRYPTO_TYPE_HEADER,
+ &dummy) == 0) {
+ /* Attempt an IOV stream decryption. */
+ iov[0].flags = KRB5_CRYPTO_TYPE_STREAM;
+ iov[0].data = input.ciphertext;
+ iov[1].flags = KRB5_CRYPTO_TYPE_DATA;
+ iov[1].data.data = NULL;
+ iov[1].data.length = 0;
+ ret = krb5_c_decrypt_iov(NULL, &keyblock, 0, NULL, iov, 2);
+ check_decrypt_result(ret, len, min_len);
+ }
+
+ free(input.ciphertext.data);
+ free(output.data);
+ }
+}
+
+int
+main(int argc, char **argv)
+{
+ int i;
+ krb5_data notrandom;
+
+ notrandom.data = "notrandom";
+ notrandom.length = 9;
+ krb5_c_random_seed(NULL, ¬random);
+ for (i = 0; interesting_enctypes[i]; i++)
+ test_enctype(interesting_enctypes[i]);
+ return 0;
+}
13 years, 1 month
[AuthHub/krb5-1-8: 16/111] ticket: 6640 version_fixed: 1.8 status: resolved
by sbose
commit adc86a8e5b83d5dabe9f8a27903ae1908b4dd28d
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jan 14 18:51:13 2010 +0000
ticket: 6640
version_fixed: 1.8
status: resolved
pull up r23657 from trunk
------------------------------------------------------------------------
r23657 | ghudson | 2010-01-14 11:09:24 -0500 (Thu, 14 Jan 2010) | 9 lines
ticket: 6640
subject: Make history key exempt from permitted_enctypes
tags: pullup
target_version: 1.8
In kdb_init_hist, just use the first key entry in the kadmin/history
entry. This makes the history key work even if the enctype is
disallowed by allow_weak_crypto=false or other configuration.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23659 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/kadm5/srv/server_kdb.c | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
---
diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c
index 1e98a8e..e1ffca2 100644
--- a/src/lib/kadm5/srv/server_kdb.c
+++ b/src/lib/kadm5/srv/server_kdb.c
@@ -136,7 +136,6 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r)
{
int ret = 0;
char *realm, *hist_name;
- krb5_key_data *key_data;
krb5_key_salt_tuple ks[1];
krb5_keyblock *tmp_mkey;
@@ -205,10 +204,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r)
}
- ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1,
- &key_data);
- if (ret)
- goto done;
+ if (hist_db.n_key_data <= 0) {
+ krb5_set_error_message(handle->context, KRB5_KDB_NO_MATCHING_KEY,
+ "History entry contains no key data");
+ return KRB5_KDB_NO_MATCHING_KEY;
+ }
ret = krb5_dbe_find_mkey(handle->context, master_keylist, &hist_db,
&tmp_mkey);
@@ -216,11 +216,11 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r)
goto done;
ret = krb5_dbekd_decrypt_key_data(handle->context, tmp_mkey,
- key_data, &hist_key, NULL);
+ &hist_db.key_data[0], &hist_key, NULL);
if (ret)
goto done;
- hist_kvno = key_data->key_data_kvno;
+ hist_kvno = hist_db.key_data[0].key_data_kvno;
done:
free(hist_name);
13 years, 1 month
[AuthHub/krb5-1-8: 15/111] ticket: 6546 status: resolved version_fixed: 1.8
by sbose
commit 709b20016425f337eda1b79627a8e4d5e9470f13
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Thu Jan 14 18:51:09 2010 +0000
ticket: 6546
status: resolved
version_fixed: 1.8
pull up r23607 from trunk
------------------------------------------------------------------------
r23607 | ghudson | 2010-01-07 15:57:02 -0500 (Thu, 07 Jan 2010) | 7 lines
ticket: 6546
status: open
When retrieving the kadmin/history key, accept any enctype, as the
current master key enctype may not match the one the KDB was created
with.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23658 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/kadm5/srv/server_kdb.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c
index 4b1d05d..1e98a8e 100644
--- a/src/lib/kadm5/srv/server_kdb.c
+++ b/src/lib/kadm5/srv/server_kdb.c
@@ -205,8 +205,8 @@ krb5_error_code kdb_init_hist(kadm5_server_handle_t handle, char *r)
}
- ret = krb5_dbe_find_enctype(handle->context, &hist_db,
- handle->params.enctype, -1, -1, &key_data);
+ ret = krb5_dbe_find_enctype(handle->context, &hist_db, -1, -1, -1,
+ &key_data);
if (ret)
goto done;
13 years, 1 month
[AuthHub/krb5-1-8: 14/111] ticket: 6632 version_fixed: 1.8 status: resolved
by sbose
commit c1b27b30951a86ff1101cc39ebaeed931aa9c3f7
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jan 12 05:03:49 2010 +0000
ticket: 6632
version_fixed: 1.8
status: resolved
pull up r23628 from trunk
------------------------------------------------------------------------
r23628 | ghudson | 2010-01-11 20:05:37 -0500 (Mon, 11 Jan 2010) | 9 lines
ticket: 6632
subject: Simplify and fix FAST check for keyed checksum type
target_version: 1.8
tags: pullup
Use krb5_c_is_keyed_checksum to detect unkeyed checksums when handling
FAST requests. The old check was broken for 1.8 because
krb5_c_verify_checksum got pickier about invalid keyblocks.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23649 dc483132-0cff-0310-8789-dd5450dbe970
src/kdc/fast_util.c | 19 ++++---------------
1 files changed, 4 insertions(+), 15 deletions(-)
---
diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
index e6503cf..06b1e2b 100644
--- a/src/kdc/fast_util.c
+++ b/src/kdc/fast_util.c
@@ -133,6 +133,7 @@ kdc_find_fast(krb5_kdc_req **requestptr,
krb5_fast_req * fast_req = NULL;
krb5_kdc_req *request = *requestptr;
krb5_fast_armored_req *fast_armored_req = NULL;
+ krb5_checksum *cksum;
krb5_boolean cksum_valid;
krb5_keyblock empty_keyblock;
@@ -191,11 +192,11 @@ kdc_find_fast(krb5_kdc_req **requestptr,
if (plaintext.data)
free(plaintext.data);
}
+ cksum = &fast_armored_req->req_checksum;
if (retval == 0)
retval = krb5_c_verify_checksum(kdc_context, state->armor_key,
KRB5_KEYUSAGE_FAST_REQ_CHKSUM,
- checksummed_data,
- &fast_armored_req->req_checksum,
+ checksummed_data, cksum,
&cksum_valid);
if (retval == 0 && !cksum_valid) {
retval = KRB5KRB_AP_ERR_MODIFIED;
@@ -203,19 +204,7 @@ kdc_find_fast(krb5_kdc_req **requestptr,
"FAST req_checksum invalid; request modified");
}
if (retval == 0) {
- krb5_error_code ret;
- /*
- * We need to confirm that a keyed checksum is used for the
- * fast_req checksum. In April 2009, the best way to do this is
- * to try verifying the checksum with a keyblock with an zero
- * length; if it succeeds, then an unkeyed checksum is used.
- */
- ret = krb5_c_verify_checksum(kdc_context, &empty_keyblock,
- KRB5_KEYUSAGE_FAST_REQ_CHKSUM,
- checksummed_data,
- &fast_armored_req->req_checksum,
- &cksum_valid);
- if (ret == 0) {
+ if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) {
retval = KRB5KDC_ERR_POLICY;
krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY,
"Unkeyed checksum used in fast_req");
13 years, 1 month
[AuthHub/krb5-1-8: 13/111] ticket: 6633 version_fixed: 1.8 status: resolved
by sbose
commit e06b4c4a1427ed08db4a25c3fc49c8db85b26833
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Tue Jan 12 05:03:44 2010 +0000
ticket: 6633
version_fixed: 1.8
status: resolved
pull up r23629 from trunk
------------------------------------------------------------------------
r23629 | ghudson | 2010-01-11 20:07:48 -0500 (Mon, 11 Jan 2010) | 9 lines
ticket: 6633
subject: Use keyed checksum type for DES FAST
target_version: 1.7
tags: pullup
DES enctypes have unkeyed mandatory-to-implement checksums. Since
FAST requires a keyed checksum, we must pick something else in that
case.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23648 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/fast.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 2791651..2ebbdcf 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -238,6 +238,9 @@ krb5int_fast_prep_req(krb5_context context,
if (retval == 0)
retval = krb5int_c_mandatory_cksumtype(context, state->armor_key->enctype,
&cksumtype);
+ /* DES enctypes have unkeyed mandatory checksums; need a keyed one. */
+ if (retval == 0 && !krb5_c_is_keyed_cksum(cksumtype))
+ cksumtype = CKSUMTYPE_RSA_MD5_DES;
if (retval ==0)
retval = krb5_c_make_checksum(context, cksumtype, state->armor_key,
KRB5_KEYUSAGE_FAST_REQ_CHKSUM, to_be_checksummed,
13 years, 1 month
[AuthHub/krb5-1-8: 12/111] ticket: 6630 version_fixed: 1.8 status: resolved
by sbose
commit 3d1efb1769795c25ae205e6f5a6e0ca94b00a32f
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Mon Jan 11 21:44:18 2010 +0000
ticket: 6630
version_fixed: 1.8
status: resolved
pull up r23622 from trunk
------------------------------------------------------------------------
r23622 | epeisach | 2010-01-09 11:02:13 -0500 (Sat, 09 Jan 2010) | 8 lines
subject: krb5int_pbkdf2_hmac_sha1 fails to set enctype on keyblock
ticket: 6630
tags: pullup
krb5int_pbkdf2_hmac_sha1 fails to set enctype on a termporary keyblock
- resulting in valgrind picking up on a conditional branch w/ unset
value. Initialize value.
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23627 dc483132-0cff-0310-8789-dd5450dbe970
src/lib/crypto/builtin/pbkdf2.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/crypto/builtin/pbkdf2.c b/src/lib/crypto/builtin/pbkdf2.c
index 7ee07f0..31de329 100644
--- a/src/lib/crypto/builtin/pbkdf2.c
+++ b/src/lib/crypto/builtin/pbkdf2.c
@@ -259,6 +259,7 @@ krb5int_pbkdf2_hmac_sha1(const krb5_data *out, unsigned long count,
keyblock.length = pass->length;
keyblock.contents = (krb5_octet *) pass->data;
}
+ keyblock.enctype = ENCTYPE_NULL;
err = krb5_k_create_key(NULL, &keyblock, &key);
if (err)
13 years, 1 month