Greg Hudson [Tue, 31 Aug 2010 01:40:19 +0000 (01:40 +0000)]
For the password quality interface:
* Add a languages argument to the check method to allow localization
of error messages (currently no languages are ever passed, though).
* Add an error code KADM5_PASS_Q_GENERIC.
* In most built-in modules and the combo module, set an error message
with krb5_set_error_message.
Greg Hudson [Sat, 28 Aug 2010 22:39:40 +0000 (22:39 +0000)]
Revise the password quality pluggable interface to match the project
page:
* Modules receive the policy name but not the policy object.
* Enforcement of password policy is out of the interface's scope.
* Built-in modules are: empty, dict, hesiod, princ.
* The consumer API loader takes care of open/close, so there is only
a wrapper function for check.
The project page is at:
http://k5wiki.kerberos.org/wiki/Projects/Password_quality_pluggable_interface
Greg Hudson [Fri, 27 Aug 2010 01:39:17 +0000 (01:39 +0000)]
Add documentation to k5-int.h aimed at developers of new pluggable
interfaces. Add documentation to pwqual_plugin.h aimed at developers
of password quality modules.
On the plugins2 branch, improve the generic plugin support so that it
does not dlopen/dlsym modules which would later be filtered out. Also
edit README.BRANCH a little.
On the plugins2 branch, use function typedefs in pwqual_plugin.h so
that the vtable declaration is tidier. (This is consistent with the
preauth plugin interface; the old way was consistent with the DAL.)
Revert the part of r24157 which added the dal_version argument to the
init_library interface. Instead use the already existing maj_ver
field of the DAL vtable to detect incompatibilities. Since maj_ver
is a short int, use an incrementing number instead of a date for the
major version.
Allow Microsoft HMAC-MD5 checksum types to use non-RC4 keys
In PAC signatures, the hmac-md5 checksum type can be used with AES
keys. Make this work by removing the enc field from the hmac-md5 and
md5-hmac checksum types, and adding a check in
krb5int_hmacmd5_checksum() for a null key or a key which is longer
than the hash block size (64 bytes for MD5). The checksum algorithm
only uses the key bits; it does invoke the cipher.
The checksum type names are kind of wrong, but we'll leave them alone
for compatibility. The descriptions are updated.
Add check_allowed_to_delegate to the DAL with a corresponding libkdb5
API, replacing the last method (CHECK_ALLOWED_TO_DELEGATE) of
db_invoke. Remove db_invoke since it no longer has any methods.
Add audit_as_req to the DAL with a corresponding libkdb5 API,
replacing the AUDIT_AS_REQ method of db_invoke. Remove the
AUDIT_TGS_REQ method of db_invoke without adding a replacement, as
there was no KDC support for it. (It can be added at a later time if
necessary.)
Add check_policy_as and check_policy_tgs to the DAL table with
corresponding libkdb5 APIs, replacing the CHECK_POLICY_AS and
CHECK_POLICY_TGS methods of db_invoke.
Create a KRB5_KDB_FLAG_ALIAS_OK to control whether plugin modules
should return in-realm aliases. Set it where appropriate, and use it
in the LDAP module instead of intuiting the result based on other
flags.
Remove count parameters from get_principal, put_principal,
free_principal, delete_principal, and get_policy. Make get_principal
allocate the DB entry container. Fold krb5_db_get_principal_ext into
krb5_db_get_principal.
Make the APIs for iterate, get_master_key_list, set_master_key_list,
and promote_db return KRB5_PLUGIN_OP_NOTSUPP if the KDB module does
not implement them, avoiding the need for stub default
implementations.
Use KRB5_PLUGIN_OP_NOTSUPP uniformly as the error code for operations
not supported by a KDB module. (Previously KRB5_KDB_DBTYPE_NOSUP was
used in some cases and KRB5_PLUGIN_OP_NOTSUPP in others.)
Remove verify_master_key from the DAL table, as well as its associated
libkdb5 interface. Callers can (and mostly already do) use
krb5_fetch_mkey_list to verify master keyblocks. Adjust tests/create,
tests/verify, and kdb5_util dump to do so.
Remove db_ and similar prefixes from DAL function names, for
consistency. Follow suit inside the DB2 and LDAP modules. (No change
to the caller-facing libkdb5 APIs.)
Remove the set_master_key and get_master_key DAL interfaces and their
corresponding libkdb5 APIs, as they were not productively used. In
kdb5_ldap_util, stop using the realm data's mkey field as a container
to communicate the master key to static helper functions, since the
field no longer exists.
Remove errcode_2_string and release_errcode_string from the DAL table,
and stop using them in kdb5.c. Modules can simply set error messages
in the krb5 context on error.
Remove db_supported_realms and db_free_supported_realms from the DAL
table, and remove the corresponding libkdb5 interfaces (which don't
seem to have been in the library export table).
Add KRB5_KDB_API_VERSION to allow callers to adjust to incompatible
changes in libkdb; to be kept in sync with the libkdb major version,
which is bumped to 5 in anticipation of other changes.
Add KRB5_KDB_DAL_VERSION to allow database modules to detect when they
are mismatched with the KDB version. Since KDB modules are often
developed concurrently with trunk code, this is defined to be the date
of the last incompatible DAL change. The DAL version is passed to the
init_library DAL function; the module should check it against the value
of KRB5_KDB_DAL_VERSION it was compiled with and return
KRB5_KDB_DBTYPE_MISMATCH if it doesn't match.
In kpropd, when getting a wildcard address to listen on, try IPv6
explicitly (with AI_ADDRCONFIG specified where available, to avoid
IPv6 on hosts with no IPv6 interface) and then fall back to IPv4.
Only set IPV6_V6ONLY on the listener socket if the resulting address
is IPv6.
Note: we have mostly confirmed that OpenBSD does not have dual-stack
support, meaning that it would be better to open separate IPv4 and
IPv6 listener sockets, as we do in krb5kdc and kadmind.
Unfortunately, the complicated iprop retry-and-backoff logic makes
this less than straightforward.
Greg Hudson [Sat, 26 Jun 2010 03:32:55 +0000 (03:32 +0000)]
Make kadmin work over IPv6
Make gssrpc work over IPv6 TCP sockets provided that the client
creates and connects/binds the sockets and doesn't query their
addresses or use bindresvport(). Make kadmin work within those
constraints and handle IPv6. Specific changes:
* Make svctcp_create() able to extract the port from an IPv6 socket,
using a new helper function getport().
* Make clnttcp_create() handle a null raddr value if *sockp is set.
* Make kadm5_get_service_name() use getaddrinfo() to canonicalize the
admin server name.
* Make libkadm5clnt's init_any() responsible for connecting its socket
using a new helper function connect_to_server(), which uses
getaddrinfo instead of gethostbyname. Pass a null address to
clnttcp_create().
* Make libapputil's net-server.c set up IPv6 as well as IPv4 listener
ports for RPC connections.
* Adjust the error code expected in a libkadm5 unit test.
Greg Hudson [Fri, 25 Jun 2010 22:26:04 +0000 (22:26 +0000)]
Adjust function names and declarations in libkadm5's client_init.c; in
particular, avoid the use of library namespace prefixes for static
helper functions.
Greg Hudson [Mon, 21 Jun 2010 19:56:29 +0000 (19:56 +0000)]
kdb5_stash() contains its own kdb5_db_open() call (because it doesn't
use util_context for some reason), which didn't work with the LDAP
back end because LDAP doesn't recognize KRB5_KDB_SRV_TYPE_OTHER. As a
minimal fix, change that to KRB5_KDB_SRV_TYPE_ADMIN to be consistent
with open_db_and_mkey()--see also r18736.
Greg Hudson [Mon, 21 Jun 2010 15:18:37 +0000 (15:18 +0000)]
Add correct error table when initializing gss-krb5
gss_krb5int_lib_init was adding the generic GSS error table (again)
instead of the krb5 error table, which could lead to crashes on
library unload. This bug was introduced in krb5 1.7; the fix is also
applicable there.
Patch from Leonardo Chiquitto <leonardo.lists@gmail.com>.
Tom Yu [Fri, 18 Jun 2010 19:41:48 +0000 (19:41 +0000)]
only test t_locate_kdc if known-good DNS name is present
Running "make check" while offline or on a firewalled network may
result in failure in lib/krb5/os because the invocation of
t_locate_kdc requires that the DNS servers for ATHENA.MIT.EDU be
reachable. Autodetect DNS utilities "dig" and "nslookup", and use
them to check for existence of the known-good DNS name. Also
parameterize the test so that the known-good DNS name can be
overridden on the make command line.
Greg Hudson [Mon, 14 Jun 2010 20:00:03 +0000 (20:00 +0000)]
Adjust the PKINIT DH debugging code:
* Use %p and void * for pointers instead of %x and int
* Don't call the computed symmetric key the "secret key" since
that's easily confused with the private key g^x.
* Print the private key when printing DH parameters, instead of the
q value (not even sure what they is).
Greg Hudson [Fri, 11 Jun 2010 21:03:03 +0000 (21:03 +0000)]
Use getaddrinfo() in kprop and kpropd, and recognize IPv6 addresses
when setting up krb5_address structures. kpropd still only binds to
one socket to avoid the need for a select() loop, so we turn off
IPV6_V6ONLY on that socket to ensure that IPv4 connections will still
be accepted.
Based on a patch from Michael Stapelberg <michael@stapelberg.de>.
Greg Hudson [Tue, 8 Jun 2010 18:18:03 +0000 (18:18 +0000)]
kadmin ktadd may display wrong name of default keytab
kadmin's ktadd (and ktrem) displays WRFILE:/etc/krb5.keytab whenever
it uses the default keytab, even if the default has been overridden
(e.g. by KRB5_KTNAME). Use krb5_kt_get_name to get the correct name
of the default cache instead of displaying the string we think was
used to open it.
Greg Hudson [Tue, 8 Jun 2010 17:53:19 +0000 (17:53 +0000)]
When we display enctypes, display the input name rather than the
description. Affects klist -e, kdb5_util list_mkeys, kdb5_util stash
(error message), kadmin getprinc, kadmin ktadd, and ktutil list -e.
Greg Hudson [Tue, 8 Jun 2010 16:26:23 +0000 (16:26 +0000)]
Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech. Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires. In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.
(This is a continuation of r24120, which should have contained the
changes to all four files.)
Greg Hudson [Tue, 8 Jun 2010 16:14:24 +0000 (16:14 +0000)]
Stop checking the current time against the context expiration time in
the message wrap/unwrap functions in the krb5 GSS mech. Heimdal
doesn't do it, and it generally results in poor app behavior when a
ticket expires. In exchange, it doesn't provide much security benefit
since it's not enforced across the board--for example, ssh sessions
can persist beyond ticket expiration time since they don't use GSS to
wrap payload data.
Greg Hudson [Mon, 7 Jun 2010 18:26:17 +0000 (18:26 +0000)]
Trace logging
Add trace logging infrastructure code, enabled by the KRB5_TRACE
environment variable or the API functions krb5_set_trace_callback()
or krb5_set_trace_filename(). As a start, add tracing events for:
* AS-REQ client code, including FAST and preauth
* TGS-REQ client code
* AP-REQ and AP-REP code (client and server)
* sendto_kdc
* Selected ccache operations
* Selected keytab operations
Greg Hudson [Tue, 25 May 2010 02:44:45 +0000 (02:44 +0000)]
FAST negotiation could erroneously succeed
When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply. Initialize
*fast_avail at the beginning of the function per coding practices.
projects / thirdparty / krb5.git / log
