ipv4+ipv6 messages can trip up KDC replay detection

The replay lookaside cache includes the sending address, but the krb5
library replay cache does not.  So, if the same message arrives from
two different source addresses, it is considered a replay by the KDC.
If the client isn't receiving the replies for some reason, and the
client has multiple addresses it uses to contact different addresses
on the KDC (and trying to reach the KDC via both IPv4 and IPv6 is an
obvious such case), this can cause errors to be returned by the KDC.

* replay.c (krb5_kdc_replay_ent): Remove "addrs" field.
(MATCH): Don't check it.
(kdc_check_lookaside, kdc_insert_lookaside): Remove "from" argument.
* kdc_util.h (kdc_check_lookaside, kdc_insert_lookaside): Update decls.
* dispatch.c (dispatch): Update calls.

ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@17970 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index 0432661d765fec49c64097e6694b6aae2eb57744..84cfe39ac52f554e6ded32b31196f3be8fc789e5 100644 (file)
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -49,7 +49,7 @@ dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response)
 
 #ifndef NOCACHE
     /* try the replay lookaside buffer */
-    if (kdc_check_lookaside(pkt, from, response)) {
+    if (kdc_check_lookaside(pkt, response)) {
        /* a hit! */
        const char *name = 0;
        char buf[46];
@@ -108,7 +108,7 @@ dispatch(krb5_data *pkt, const krb5_fulladdr *from, krb5_data **response)
 #ifndef NOCACHE
     /* put the response into the lookaside buffer */
     if (!retval)
-       kdc_insert_lookaside(pkt, from, *response);
+       kdc_insert_lookaside(pkt, *response);
 #endif
 
     return retval;

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index cd7a6ef75b0be631b2b1dc301ad2657829ab1bab..b15d5d79c37fcbf9593e0fbe8e35a800105008f9 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -156,10 +156,8 @@ krb5_error_code return_padata
               krb5_key_data *client_key, krb5_keyblock *encrypting_key);
     
 /* replay.c */
-krb5_boolean kdc_check_lookaside (krb5_data *, const krb5_fulladdr *,
-                                           krb5_data **);
-void kdc_insert_lookaside (krb5_data *, const krb5_fulladdr *,
-                                    krb5_data *);
+krb5_boolean kdc_check_lookaside (krb5_data *, krb5_data **);
+void kdc_insert_lookaside (krb5_data *, krb5_data *);
 void kdc_free_lookaside(krb5_context);
 
 /* which way to convert key? */

diff --git a/src/kdc/replay.c b/src/kdc/replay.c
index 736abb73b251f3600e46ef36e587de6e9150037a..e6c48a4eadd2ab7c93f16307cc5eef4b95eb2c6f 100644 (file)
--- a/src/kdc/replay.c
+++ b/src/kdc/replay.c
@@ -41,7 +41,6 @@ typedef struct _krb5_kdc_replay_ent {
     time_t db_age;
     krb5_data *req_packet;
     krb5_data *reply_packet;
-    krb5_address *addr;                /* XXX should these not be pointers? */
 } krb5_kdc_replay_ent;
 
 static krb5_kdc_replay_ent root_ptr = {0};
@@ -58,10 +57,6 @@ static int num_entries = 0;
 #define MATCH(ptr) (((ptr)->req_packet->length == inpkt->length) &&    \
                    !memcmp((ptr)->req_packet->data, inpkt->data,       \
                            inpkt->length) &&                           \
-                   ((ptr)->addr->length == from->address->length) &&   \
-                   !memcmp((ptr)->addr->contents,                      \
-                           from->address->contents,                    \
-                           from->address->length)&&                    \
                    ((ptr)->db_age == db_age))
 /* XXX
    Todo:  quench the size of the queue...
@@ -71,8 +66,7 @@ static int num_entries = 0;
    FALSE if the caller should do the work */
 
 krb5_boolean
-kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
-                   krb5_data **outpkt)
+kdc_check_lookaside(krb5_data *inpkt, krb5_data **outpkt)
 {
     krb5_int32 timenow;
     register krb5_kdc_replay_ent *eptr, *last, *hold;
@@ -107,7 +101,6 @@ kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
                max_hits_per_entry = max(max_hits_per_entry, eptr->num_hits);
                krb5_free_data(kdc_context, eptr->req_packet);
                krb5_free_data(kdc_context, eptr->reply_packet);
-               krb5_free_address(kdc_context, eptr->addr);
                hold = eptr;
                last->next = eptr->next;
                eptr = last;
@@ -125,8 +118,7 @@ kdc_check_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
    already there, and can fail softly due to other weird errors. */
 
 void
-kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
-                    krb5_data *outpkt)
+kdc_insert_lookaside(krb5_data *inpkt, krb5_data *outpkt)
 {
     register krb5_kdc_replay_ent *eptr;    
     krb5_int32 timenow;
@@ -156,12 +148,6 @@ kdc_insert_lookaside(krb5_data *inpkt, const krb5_fulladdr *from,
        free(eptr);
        return;
     }
-    if (krb5_copy_addr(kdc_context, from->address, &eptr->addr)) {
-       krb5_free_data(kdc_context, eptr->req_packet);
-       krb5_free_data(kdc_context, eptr->reply_packet);
-       free(eptr);
-       return;
-    }
     eptr->next = root_ptr.next;
     root_ptr.next = eptr;
     num_entries++;
@@ -178,7 +164,6 @@ kdc_free_lookaside(krb5_context kcontext)
             eptr; eptr = eptr->next) {
                krb5_free_data(kcontext, eptr->req_packet);
                krb5_free_data(kcontext, eptr->reply_packet);
-               krb5_free_address(kcontext, eptr->addr);
                hold = eptr;
                last->next = eptr->next;
                eptr = last;