Greg Hudson [Tue, 5 Oct 2010 14:53:09 +0000 (14:53 +0000)]
Propagate modprinc -unlock from master to slave KDCs
Create a new tl-data type to hold the time of the last administrative
unlock, and factor it into decisions about account lockout. Since
tl-data values are propagated from master to slave, this will cause
modprinc -unlock operations to reach slave KDCs on the next
propagation.
Zhanna Tsitkov [Tue, 5 Oct 2010 03:18:22 +0000 (03:18 +0000)]
Improves prng code modularity. Introduces fortuna-like prng that can be used in lieu of yarrow.
Yarrow stays the default prng while fortuna may be engaged during configuration by using "--with-prng-alg=fortuna" flag.
Also, nss crypto backend continues to use its own prng.
Greg Hudson [Sat, 2 Oct 2010 11:48:06 +0000 (11:48 +0000)]
In the krb5_kuserok implementation, fix an unintentional type change
to "gobble" (was an int, was accidentally changed to a char) which
could result in an infinite loop.
Ken Raeburn [Sat, 2 Oct 2010 03:29:34 +0000 (03:29 +0000)]
Try to require function declarations for GCC, as we already do for the
Sun compiler.
Change the cache variable name construction to distinguish "=" from
"-" in option names. Prefer -Werror-implicit-function-declaration
over -Werror=implicit-function-declaration since in some versions of
GCC only the former works properly.
Sam Hartman [Fri, 1 Oct 2010 17:12:26 +0000 (17:12 +0000)]
Remove support for the old pa-sam-challenge and pa-sam-response
preauth type per discussion on krbdev. The pa-sam-challenge-2 code
remains in the client.
Greg Hudson [Fri, 1 Oct 2010 03:47:38 +0000 (03:47 +0000)]
A cleaner impleentation of r24399 which adds two new auth context APIs
(and is therefore less suitable for backporting to 1.8) but doesn't
reach inside the auth context structure in the krb5 mechanism code.
Greg Hudson [Fri, 1 Oct 2010 03:45:43 +0000 (03:45 +0000)]
GSSAPI forwarded credentials must be encrypted in session key
When IAKERB support was added, the krb5_mk_req checksum function
gained access to the send subkey. This caused GSSAPI forwarded
credentials to be encrypted in the subkey, which violates RFC 4121
section 4.1.1 and is not accepted by Microsoft's implementation.
Temporarily null out the send subkey in the auth context so that
krb5_mk_ncred uses the session key instead.
Use a different construction for defaulting ks_tuple and n_ks_tuple in
the libkadm5 server principal routines, to avoid repeated conditional
expressions.
Follow-on to r24258: initialize the new k5e1 error table where we
initialize the krb5 error table, and add initialize_k5e1_error_table
to the libkrb5 exports list for consistency with the other error
tables.
Make krb5_dbe_def_search_enctype skip key data entries with invalid
enctypes instead of erroring out on them. We had this behavior prior
to 1.8 (more by accident than by design), but it changed as a
side-effect of r23599.
Sam Hartman [Mon, 27 Sep 2010 17:16:41 +0000 (17:16 +0000)]
kpasswd: if a credential cache is present, use FAST
If a credentials cache is available, use it as an armor cache to enable FAST negotiation for kpasswd. This requires an attacker to attack both the user's long-term key for the old password as well as the ticket used for the armor cache in order to attack the password change. Depending on how the armor ticket is obtained, this may provide limited value. However, it provides users an easy option if they are concerned about their current password. Users can kinit with one principal to help protect changing the password of another principal.
* krb5_get_init_creds_opt_set_fast_ccache: new API to set fast ccache based on a krb5_ccache object rather than a resolvable string
* kpasswd: always open the current credential cache even if not needed
for determining the principal. If the cache has tickets, use it as
an armor cache.
* tests/dejagnu/krb-standalone/kadmin.exp: Arrange to test new code path
Add gss_krb5_import_cred from Heimdal; allows krb5 creds to be
acquired from a keytab or ccache into a GSSAPI credential without
using global process or thread variables.
Initialize kdb5_ldap_util's context with kadm5_init_krb5_context, like
kdb5_util does, in order to get the KDC profile settings as well as
the regular krb5 profile settings.
Slight revisions to create_workers() in the KDC:
* Use calloc() to allocate the pids array; squashes a Coverity false
positive.
* Don't leak the pids array in worker processes.
* Use consistent terminology in comments.
Add support for a krb5kdc -w option which causes the KDC to spawn
worker processes which can process requests in parallel. See also:
http://k5wiki.kerberos.org/wiki/Projects/Parallel_KDC
In the PKINIT OpenSSL crypto code, use a signed int to hold the result
of X509_get_ext_by_NID so we can detect negative return values.
Reported by nalin@redhat.com.
Add a license statement to the new extern.h in kinit, use an include
blocker which does not impinge on the system's symbol namespace, and
use the recommended formatting for function prototypes.
Sam Hartman [Wed, 15 Sep 2010 17:13:41 +0000 (17:13 +0000)]
kinit: add KDB keytab support
This implements
http://k5wiki.kerberos.org/Projects/What_does_God_need_with_a_password.
If the KDB keytab is selected by command line options, then kinit will
register the KDB keytab and open the database. This permits an
administrator to obtain tickets as a user without knowing that user's
password.
As a result kinit links against libkadm5srv and libkdb5. Discussion is
ongoing about whether this is desirable or about whether two versions
of kinit are required.
Sam Hartman [Wed, 15 Sep 2010 17:13:23 +0000 (17:13 +0000)]
kdb: store mkey list in context and permit NULL mkey for kdb_dbe_decrypt_key_data
Previously, code needed to run a loop to find the current master key,
possibly fetch a new master key list and try finding the master key
again around each key decryption. This was not universally done;
there are cases where only the current master key was used. In
addition, the correct ideom for decrypting key data is too complicated
and is potentially unavailable to plugins that do not have access to
the master key. Instead, store the master key list in the dal_handle
whenever it is fetched and permit a NULL master key for
krb5_dbe_decrypt_key_data.
* Remove APIs for krb5_db_{get|set}_mkey_list
* krb5_db_fetch_mkey_list: memoize master key list in dal_handle
* krb5_db_free_mkey_list: don't free the memoized list; arrange for it to be freed later
* krb5_dbe_decrypt_key_data: Search for correct master key on NULL argument
* change call sites to take advantage
Luke Howard [Thu, 9 Sep 2010 15:54:32 +0000 (15:54 +0000)]
Allow a zero checksum type to be passed into krb5_k_verify_checksum_iov;
this indicates that the mandatory checksum type for the key is to be used.
This interface is necessary because there is no public interface through
which the mandatory checksum type for an encryption type can be determined.
Luke Howard [Thu, 9 Sep 2010 15:39:47 +0000 (15:39 +0000)]
krb5_k_make_checksum will use the mandatory checksum type if 0 is
passed in as the checksum type; however krb5_k_make_checksum_iov
does not support this. Add the same logic for the behaviour is
consistent.
Merge the camellia-ccm branch to trunk. Since there are no IANA
assignments for Camellia-CCM enctypes or cksumtypes yet, they are
disabled in a default build. They can be made available by defining
(via CPPFLAGS) local-use enctype numbers for the enctypes and
cksumtypes.
Ensure valid key in krb5int_yarrow_cipher_encrypt_block
Under low memory conditions (or when testing memory allocation failures),
the key pointer will be 0 - and not initialized. Test and return failure
before deref a NULL.
Greg Hudson [Sun, 29 Aug 2010 15:32:04 +0000 (15:32 +0000)]
Fix an account lockout error-handling regression by converting the
result of krb5_db_check_policy_as/tgs from a krb5_error_code to a
protocol error number.
Greg Hudson [Tue, 24 Aug 2010 22:45:37 +0000 (22:45 +0000)]
In the LDAP KDB module's populate_krb5_db_entry, fix the checks for
the KDB_PRINC_EXPIRE_TIME_ATTR and KDB_PWD_EXPIRE_TIME_ATTR flags so
that they properly succeed when the flags are set. Bug report from
Rob Crittenden, patch from nalin@redhat.com.
Greg Hudson [Tue, 24 Aug 2010 21:52:32 +0000 (21:52 +0000)]
add profile include support
Add support for "include" and "includedir" directives in profile files.
See http://k5wiki.kerberos.org/wiki/Projects/Profile_Includes for more
details.
Greg Hudson [Mon, 23 Aug 2010 22:03:25 +0000 (22:03 +0000)]
Fail properly when profile can't be accessed
Make profile_init() return EACCESS or EPERM if one of those errors was
encountered when failing to open any of the specified profile files.
This causes krb5_init_os_context() to fail properly when krb5.conf is
unreadable, instead of treating that situation like a nonexistent
krb5.conf.
The library will continue to soldier on if one profile file is
readable and another is not. This is deliberate as of r14116, whether
or not it's a good idea.
Greg Hudson [Thu, 19 Aug 2010 16:38:30 +0000 (16:38 +0000)]
Allow krb5_gss_register_acceptor_identity to unset keytab name
krb5_gss_register_acceptor_identity sets a mutex-locked global (not
thread-specific) variable containing a keytab name. This change
allows the variable to be unset by passing a null value.
A more elegant long-term solution to the problem is Heimdal's
gss_krb5_import_cred function.
Greg Hudson [Thu, 12 Aug 2010 17:39:09 +0000 (17:39 +0000)]
In AS replies, set the key-expiration field to the minimum of account
and password expiration time as specified in RFC 4120. Reported by
Mary Cushion <mary@eiger.demon.co.uk>.
Our ancient RPC value internally decodes 32-bit wire values into a
signed long, which is then casted to the appropriate type.
xdr_u_int() contains a check intended to catch wire values that don't
fit into a u_int on platforms with 16-ints, but on platforms with
64-bit longs it was failing on values of 2^31 or larger because the
sign-extended value appeared larger than UINT_MAX. Fix the check by
casting the value to uint32_t before comparing.
This bug, in combination with a poor choice of types in
kadm_rpc_xdr.c's xdr_krb5_enctype(), prevented negative enctype values
from being transported properly in kadmin's change_password command
result.
projects / thirdparty / krb5.git / log
