Ben Kaduk [Fri, 21 Sep 2012 17:01:06 +0000 (13:01 -0400)]
Remove kerbsrc.win
It has been unloved and broken repeatedly for many years, requiring
updating of several variables whenever new directories are added
and similar tedia. It was originally intended to avoid the need
for Unix utilities on Windows, but Microsoft provides the Utilities
and SDK for UNIX-based Applications which is enough rope to do a
native build.
Leave behind a warning message to anyone who does try to build the
target.
Clean up some now-unused infrastructure in the build system.
Ben Kaduk [Fri, 21 Sep 2012 15:13:32 +0000 (11:13 -0400)]
Remove kerbsrc-nt
NT is long-gone; we don't need to keep a special-case error message
around telling people not to use it.
Clean out the unneeded code from the Makefile.in
Ben Kaduk [Thu, 20 Sep 2012 22:03:54 +0000 (18:03 -0400)]
Remove kerbsrc83
It's been a long time since systems were limited to 8.3 format
for file names. No one should be thinking to try and build this
target, and if they do, we don't need a custom error message anymore.
Clean out the unneeded code from the Makefile.in.
Ben Kaduk [Thu, 20 Sep 2012 18:03:20 +0000 (14:03 -0400)]
Do not add empty dir to the include search list
windows/leashdll/include contains only a krb4 directory.
We have a dubious need for the latter through AFSroutines.c,
but the former can be eliminated.
Ben Kaduk [Wed, 19 Sep 2012 16:13:30 +0000 (12:13 -0400)]
Update windows/README
The build instructions have changed somewhat, as have the requirements
for a build environment.
The default behavior for KRB5_CONFIG and KRB5CCNAME has also changed.
Attempt to remove mention of overly specific Windows versions that
are now quite old when the behavior persists in newer versions of Windows.
Document the usage of DNS by default and the reduced need for a large
krb5.ini file.
Talk a little more about the LSA cache.
Unlike most GSS test programs, t_s4u2proxy_krb5 uses a cleanup
handler, so we have to be careful to initialize everything we clean
up--particularly service2_name, which is initialized after a possible
goto. Also, remember to release acceptor_name.
krb5_rc_recover_or_initialize is not a public function, but is now
used by the krb5 mechanism when importing a credential. Mark it as
PRIVATE GSSAPI in the export list.
It might have been safe to access the krb5 verifier cred without a
lock before constrained delegation, but it is less likely to be safe
now that we might access both the initiator and acceptor parts of the
cred. Hold a lock on the cred for the full accept_sec_context
operation.
If the verifier cred handle is of type GSS_C_BOTH, we need to resolve
the initiator part of it in order to create a s4u2proxy delegated
credential handle. (If it's of type GSS_C_ACCEPT, kg_resolve_cred
won't do anything beyond locking and validating the credential.)
Ben Kaduk [Tue, 18 Sep 2012 21:53:18 +0000 (17:53 -0400)]
Remove NSIS installs when upgrading to 64-bit
The NSIS installer appears to have only ever existed as a 32-bit
software. As such, unconditionally check the 32-bit registry tree
for an uninstall string; the architecture of the current package
being installed is not relevant to what was previously installed.
Get rid of gssint_get_mechanisms, gssint_mech_to_oid, and
gssint_oid_to_mech, which constructed a list of mechanism names and
mapped between mech names and OIDs. These functions were only used by
gss_inquire_mechs_for_name, which now uses gss_indicate_mechs instead.
Use gss_indicate_mechs instead of gssint_get_mechanisms and
gssint_mech_to_oid to iterate over the list of mechanism OIDs. Use a
static helper to determine whether a mech supports a name type,
avoiding most of the work done in the for loop. Use a cleanup
handler. Don't leave partial results in the output parameter on
error.
Simo Sorce [Tue, 14 Aug 2012 13:14:15 +0000 (15:14 +0200)]
Avoid leaks on gss_accept_sec_context errors
Failure handling during the postprocessing of
mech->gss_accept_sec_context was inconsistent. In one case we delete
the output token but leave the partly-constructed context present in
*context_handle (violating RFC 2744 if this is the first call); in
other cases we leave the output token in the caller's buffer but do
destroy the partly-constructed context. Make this more consistent by
always destroying the output token and partly-constructed context.
(RFC 2744 prefers, but does not require, leaving the
partly-constructed context present on error if it was present on
entry. At the moment we are ignoring that preference.)
[ghudson@mit.edu: Rewrote commit message with more details]
Tom Yu [Fri, 14 Sep 2012 17:55:36 +0000 (13:55 -0400)]
Avoid multiply defining OIDs in tests/gssapi
Declarations of gss_OID_desc mech_krb5, etc. in tests/gssapi/common.h
can result in multiple definitions when the test programs are linked.
Prefix the declarations with "extern" to prevent this.
Factor out some common functions used by multiple test programs. Use
a common argument format for importing names (p:princname,
h:hostbasedname, or u:username) and adjust the Python tests to match
it. Use more consistent conventions in test programs and fix some
coding style issues. Normalize how the test programs are built.
Ben Kaduk [Wed, 12 Sep 2012 18:17:59 +0000 (14:17 -0400)]
Improve LEASHAUTOINIT description
This installer option determines whether the -autoinit argument
is passed to the MIT Kerberos executable.
On startup, if this argument is passed, and if there are no tickets
in the default cache, and if no useful tickets can be imported from
the LSA cache, MIT Kerberos will open the get ticket dialog and prompt
for a password; this option does not appear to have any other effect.
Nicolas Williams [Wed, 12 Sep 2012 16:36:54 +0000 (11:36 -0500)]
Fix lock inconsistency in ctx_unlock()
The lock inconsistency fixed here is quite possibly the same as
described in https://bugzilla.redhat.com/show_bug.cgi?id=586032 .
The problem is that ctx_unlock() fails to unlock the principal DB if
it fails to unlock the policy DB, and this happens when ctx_lock()
fails to lock the policy DB (likely because the caller is racing
against a kdb5_util load, which will be using a "permanent" lock,
meaning that the lock file will be unlinked after acquiring the
lock). The fix is to perform both unlock operations *then* handle
any errors that either or both might have returned.
Additionally, we don't really need or want to use non-blocking locks,
and we certainly don't want to sleep(1) in krb5kdc (possibly several
times, as there was a loop over this) when either of the principal or
policy DB is locked. Some callers still request non-blocking locks,
and ctx_lock() still honors this.
Nicolas Williams [Wed, 12 Sep 2012 02:37:53 +0000 (21:37 -0500)]
Use blocking locks in krb5kdc and libkadm5srv
We don't really need or want to use non-blocking locks, and we certainly
don't want to sleep(1) in krb5kdc (possibly several times, as there was
a loop over this) when either of the principal or policy DB is locked.
Some callers still request non-blocking locks, and ctx_lock() still
honors this.
Nicolas Williams [Wed, 12 Sep 2012 02:32:28 +0000 (21:32 -0500)]
Map CANTLOCK_DB to SVC_UNAVAILABLE in krb5kdc
The KDC should not return KRB5KRB_ERR_GENERIC (KRB_ERR_GENERIC) when the
KDB plugin returns KRB5_KDB_CANTLOCK_DB: it should return
KRB5KDC_ERR_SVC_UNAVAILABLE (KDC_ERR_SVC_UNAVAILABLE) instead. This
allows clients to immediately fallback onto other KDCs.
When we switch to using blocking locks in the db2 KDB backend we'll very
rarely hit this code path, perhaps only when racing against a kdb5_util load.
Other KDB backends might still return KRB5_KDB_CANTLOCK_DB often enough that
this change is desirable.
Ben Kaduk [Wed, 12 Sep 2012 15:35:04 +0000 (11:35 -0400)]
Unregister error message key on library unload
Revision fcdd2de1 added the K5_KEY_GSS_KRB5_ERROR_MESSAGE key, and
registered it in the gssapi library initialization routine, but
did not unregister it in the libary finalization routine.
When the library is unloaded and reloaded in the same process,
this leads to an assertion failure, since we check that
destructors_set[keynum] is zero (no destructor set) when registering
a key in util/support/threads.c.
Unregister the key on library cleanup to resolve the error.
Greg Hudson [Sun, 19 Aug 2012 03:40:29 +0000 (23:40 -0400)]
Introduce gss_export_cred and gss_import_cred
Add gss_export_cred and gss_import_cred mechglue functions to
serialize and unserialize GSSAPI credential handles. Mechanism
implementations and tests will follow.
If a caller sets a responder, it will be invoked after preauth modules
have had a chance to review their incoming padata but before they produce
outgoing padata. The responder will be presented a set of questions with
optional challenges. The responder should then answer all questions it knows
how to handle. Both the answers and the challenges are printable UTF-8 and
may contain encoded, structured data specific to the question asked.
Add two new callbacks and one optional method to the clpreauth
interface. The new method (prep_questions) allows modules to ask questions
by setting them in the responder context using one of the new callbacks
(ask_responder_question). The other new callback (get_responder_answer) is
used by the process method to read the answers to the questions asked.
Since zapfree(str, strlen(str)) won't work for possibly-null values of
str, add a helper zapfreestr() which only calls strlen() if the string
value is non-null.
The file 'checkbox blank.png' is unneeded and contains a space in the
name, unnecessarily interfering with running find | xargs over the
source tree. Remove it.
When the rules from util/k5ev/Makefile.in were moved to
util/verto/Makefile.in, the rule to make rename.h was broken on
non-gmake makes because the definition of SED wasn't carried over.
Define it now.
For the test-vectors target in tests/asn.1, add ASN.1 modules from RFC
4556 and draft-ietf-krb-wg-pkinit-alg-agility-06.txt, and output test
encodings for PrincipalName, KRB5PrincipalName, OtherInfo, and
PkinitSuppPubInfo. In the alg-agility module, AuthPack and DHRepInfo
are renamed, as asn1c otherwise rejects them as conflicting with the
RFC 4556 definitions.
The upstream libverto depends on dynamic loading and in particular on
dladdr(), which is not universal. To avoid this dependency, stub out
support for module loading (by replacing module.c) and instead
integrate the k5ev module directly into the bundled verto library.
This change removes the need to link, include, and invoke libverto
differently depending on whether we're using the bundled library; we
can always just link with -lverto and call verto_default().
We already define EV_USE_REALTIME to 0 to avoid the use of
clock_gettime() (to avoid depending on librt). But in some build
environments libev can detect support for a monotonic clock, which
also results in using clock_gettime(). Define EV_USE_MONOTONIC to 0
as well to prevent this.
Ben Kaduk [Fri, 31 Aug 2012 17:41:26 +0000 (13:41 -0400)]
Use separate components for shortcuts
Since the Start Menu and Desktop are different folders, we should
use different components for the shortcuts in those folders, given
that components operate at directory granularity.
Take the opportunity to use the newer style for installing shortcuts
and registry keys, and make the names more descriptive.
Increment the buildlevel to ensure new files are installed.
ticket: 7348 (new)
subject: Use more meaningfully named registry keys for shortcuts
queue: kfw
target_version: 1.10.4
tags: pullup
Nate Rosenblum [Wed, 29 Aug 2012 18:16:11 +0000 (11:16 -0700)]
Support kdc_timesync offsets in memory ccache
When using v4 file credentials caches, client clock skew offsets
obtained when running with the kdc_timesync option set are persisted in
the ccache. This allows the offsets to be used across separate contexts,
e.g. when obtaining credentials using krb5 interfaces and subsequently
importing those credentials for use in gssapi. This patch adds similar
support for memory credentials caches.
Ben Kaduk [Thu, 23 Aug 2012 16:38:57 +0000 (12:38 -0400)]
Do not emit debug printfs under NODEBUG
These printfs spew to the console when command-line utilities
such as 'klist' and 'aklog' are run, reducing usability.
These printfs can also cause application hangs.
On a multiprocessor machine, when PuTTY and the ccapiserver are
running on different CPUs, PuTTY appears to deadlock with three
concurrent threads inside cci_debug_printf().
Kevin Wasserman [Tue, 21 Aug 2012 15:44:46 +0000 (11:44 -0400)]
Fix KfW thread-local storage allocation issues
Allocate thread-local storage on demand; don't rely on
the DLL_THREAD_ATTACH case in DllMain() since pre-existing
threads will never execute that code.
Ben Kaduk [Thu, 16 Aug 2012 20:03:48 +0000 (16:03 -0400)]
Kill running processes on upgrades/uninstalls
The InstallValidate action of the windows installer will bring up
a dialog informing us that some currently running processes must
be terminated before installation may proceed, and offers to do so,
but does not actually kill the processes. We have our own code to
kill running processes which did not execute, for two reasons:
it was sequenced after InstallValidate, and we did not have a current
list of processes to look for.
Add the right processes to look for and kill, and use our own
process-killing code since it actually works.
Ben Kaduk [Wed, 15 Aug 2012 18:50:42 +0000 (14:50 -0400)]
Make finding 32-bit libs easier
Our 64-bit installer provides 32-bit libraries as well as 64-bit
libraries, but not all 32-bit applications (e.g., PuTTY, Pidgin)
are able to locate them in C:\Program Files\MIT\Kerberos .
Including an InstallDir key under the Wow6432Node tree lets them
work out-of-the-box; while here set all the registry keys in this
component in the compatibility tree, for consistency.
Ben Kaduk [Mon, 13 Aug 2012 22:01:47 +0000 (18:01 -0400)]
Upgrade 64-bit KfW installations
We use separate UpgradeCodes for 32- and 64-bit installers, so
we must check for both of them when seeing if we are upgrading an
old/existing installation.
Ben Kaduk [Mon, 13 Aug 2012 19:03:45 +0000 (15:03 -0400)]
Upgrade from KfW betas, too
Instead of using 3.9.9 as a conditional for the maximum version to
upgrade from, just use the current version.
This seems to pick up beta tags properly (so we can upgrade
from, e.g., beta 6 to beta 7 using the installer's upgrade tools),
and is future-proof.
Note that a 64-bit installer will not pick up an existing 32-bit
install (or vice versa), but there does not seem to be infrastructure
to deal with this situation easily.
Also, "downgrading" by running an older installer with a newer version
already installed will cause both versions to be simultaneously
installed; only do this if you know what you're doing.
Benjamin Kaduk [Tue, 31 Jul 2012 20:12:27 +0000 (16:12 -0400)]
Avoid a crash when attempting to change password
In some cases we could keep stack garbage in a local pointer
variable until the cleanup at the end of the function wherein
krb5_free_context() would choke on the invalid non-NULL value.
Initialize to zero to avoid the issue (should be written as NULL
but stick to the prevailing style).
Benjamin Kaduk [Mon, 30 Jul 2012 20:50:55 +0000 (16:50 -0400)]
Rename old krb5.ini files away
We want to always use a new krb5.ini (and our search order guarantees
that we will), but users might be confused if there is still a file
named krb5.ini in the old location which is now non-functional.
However, it is rude to unconditionally delete the old file which may
potentially be the only copy a user has of their local changes.
Instead, rename the old file to a non-functioning name that indicates
it is no longer being used, so that it may be consulted if needed.
Only attempt the rename if we found an existing krb5.ini, and ignore errors
since this is not a critical part of the installation.
Kevin Wasserman [Mon, 30 Jul 2012 20:30:34 +0000 (16:30 -0400)]
Fix renew_until check for auto-renewal
This was completely wrong, but only caused a severe problem on 64 bit
builds. On 32 bit builds the result was effectively always 'success',
so it would always attempt to renew even if there was not sufficient time
left in the renewable lifetime. This did not have much observable
adverse effect. But on 64 bit builds it always failed and so never
attempted renewal.
Kevin Wasserman [Mon, 30 Jul 2012 13:46:24 +0000 (09:46 -0400)]
Always install krb5.ini in KfW 4.0 installer
Pre-existing krb5.ini files from old kfw versions will be overridden
due to the new search path, but not removed. This is the desired behavior
since old krb5.ini files are far more likely to cause problems than to
contain useful data.
Kevin Wasserman [Fri, 27 Jul 2012 20:41:06 +0000 (16:41 -0400)]
CCAPI client rpc fixes
On Windows XP, cci_os_ipc_thread_init() causes additional threads to be
spawned immediately, which results in a vicious cycle until Windows
resources are exhausted. Instead, defer thread_init() until it is really
needed.
Also, use the MSDN-recommended defaults for RPC calls instead of random
constants.
Kevin Wasserman [Wed, 18 Jul 2012 21:32:31 +0000 (17:32 -0400)]
Call CWinAppEx::InitInstance()
Without this, AfxGlobalsAddRef() is never called, so AfxGlobalsRelease()
does nothing, causing many leaks and a crash on exit in GdiplusShutdown()
on Vista.
Kevin Wasserman [Tue, 17 Jul 2012 17:51:46 +0000 (13:51 -0400)]
Use cc_user_set_default_name to 'make default'
In addition to calling krb5_cc_switch(), use
krb5int_cc_user_set_default_name() in CLeashView::OnMakeDefault()
to set the default ccache for all processes for the current user.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
ticket: 7303 (new)
queue: kfw
subject: 'Make default' should apply to all processes of the user
target_version: 1.10.4
tags: pullup
Kevin Wasserman [Sat, 5 May 2012 14:53:44 +0000 (10:53 -0400)]
Help updates for kfw 4.0
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
[kaduk@mit.edu: Squash commits, a couple of grammar fixes, and also turn
a few instances of "Leash" into "MIT Kerberos". Trim trailing whitespace
and other whitespace tweaks to pass the commit hooks.]
projects / thirdparty / krb5.git / log
