Nicolas Williams [Thu, 30 Oct 2014 00:42:49 +0000 (19:42 -0500)]
Include file ccache name in error messages
When a FILE ccache method returns an error, append the filename to the
standard message for the code. Remove code to set extended messages
in helper functions as they would just be overwritten.
Also change the interpretation of errno values. Treat ENAMETOOLONG as
KRB5_FCC_NOFILE instead of KRB5_FCC_INTERNAL, since it has an external
cause and a name that long can't be opened by normal means. Treat
EROFS as KRB5_FCC_PERM. Treat ENOTDIR and ELOOP as KRB5_FCC_NOFILE
instead of KRB5_FCC_PERM as both errors imply that the full pathname
doesn't exist. Treat EBUSY and ETXTBSY as KRB5_CC_IO instead of
KRB5_FCC_PERM as they indicate a conflict rather than a permission
issue.
[ghudson@mit.edu: renamed set_error to set_errmsg_filename; removed
now-inoperative code to set extended messages in helper functions;
trimmed changes to interpret_errno; clarified and shortened commit
message]
Greg Hudson [Tue, 7 Oct 2014 16:12:11 +0000 (12:12 -0400)]
Use OFD locks where available
Linux 3.15 has added OFD locks, which contend with POSIX file locks
but are owned by the open file description instead of the process.
Use these in krb5_lock_file where available, for safer concurrency
behavior.
Ben Kaduk [Wed, 19 Nov 2014 17:04:46 +0000 (12:04 -0500)]
Support keyless principals in LDAP [CVE-2014-5354]
Operations like "kadmin -q 'addprinc -nokey foo'" or
"kadmin -q 'purgekeys -all foo'" result in principal entries with
no keys present, so krb5_encode_krbsecretkey() would just return
NULL, which then got unconditionally dereferenced in
krb5_add_ber_mem_ldap_mod().
Apply some fixes to krb5_encode_krbsecretkey() to handle zero-key
principals better, correct the test for an allocation failure, and
slightly restructure the cleanup handler to be shorter and more
appropriate for the usage. Once it no longer short-circuits when
n_key_data is zero, it will produce an array of length two with both
entries NULL, which is treated as an empty list by the LDAP library,
the correct behavior for a keyless principal.
However, attributes with empty values are only handled by the LDAP
library for Modify operations, not Add operations (which only get
a sequence of Attribute, with no operation field). Therefore, only
add an empty krbprincipalkey to the modlist when we will be performing a
Modify, and not when we will be performing an Add, which is conditional
on the (misspelled) create_standalone_prinicipal boolean.
CVE-2014-5354:
In MIT krb5, when kadmind is configured to use LDAP for the KDC
database, an authenticated remote attacker can cause a NULL
dereference by inserting into the database a principal entry which
contains no long-term keys.
In order for the LDAP KDC backend to translate a principal entry
from the database abstraction layer into the form expected by the
LDAP schema, the principal's keys are encoded into a
NULL-terminated array of length-value entries to be stored in the
LDAP database. However, the subroutine which produced this array
did not correctly handle the case where no keys were present,
returning NULL instead of an empty array, and the array was
unconditionally dereferenced while adding to the list of LDAP
operations to perform.
Versions of MIT krb5 prior to 1.12 did not expose a way for
principal entries to have no long-term key material, and
therefore are not vulnerable.
Greg Hudson [Fri, 5 Dec 2014 19:01:39 +0000 (14:01 -0500)]
Fix LDAP misused policy name crash [CVE-2014-5353]
In krb5_ldap_get_password_policy_from_dn, if LDAP_SEARCH returns
successfully with no results, return KRB5_KDB_NOENTRY instead of
returning success with a zeroed-out policy object. This fixes a null
dereference when an admin attempts to use an LDAP ticket policy name
as a password policy name.
CVE-2014-5353:
In MIT krb5, when kadmind is configured to use LDAP for the KDC
database, an authenticated remote attacker can cause a NULL dereference
by attempting to use a named ticket policy object as a password policy
for a principal. The attacker needs to be authenticated as a user who
has the elevated privilege for setting password policy by adding or
modifying principals.
Queries to LDAP scoped to the krbPwdPolicy object class will correctly
not return entries of other classes, such as ticket policy objects, but
may return success with no returned elements if an object with the
requested DN exists in a different object class. In this case, the
routine to retrieve a password policy returned success with a password
policy object that consisted entirely of zeroed memory. In particular,
accesses to the policy name will dereference a NULL pointer. KDC
operation does not access the policy name field, but most kadmin
operations involving the principal with incorrect password policy
will trigger the crash.
Greg Hudson [Mon, 8 Dec 2014 20:30:25 +0000 (15:30 -0500)]
Fix LDAP tests when sasl.h not found
Do not try to run the SASL EXTERNAL auth test if we could not define a
useful interact function. With current libraries the interact
function is asked for an authorization name, and the bind fails if it
gets an unsuccessful result or if no interaction function is defined.
Nicolas Williams [Wed, 12 Nov 2014 21:49:37 +0000 (15:49 -0600)]
Use new error message wrapping APIs
Define internal names k5_prendmsg and k5_wrapmsg and use them where we
amend error messages. This slightly changes the error message when we
fail to construct FAST AP-REQ armor, decrypt a FAST reply, or store
credentials in a gic_opts output ccache. Adjust the test suite for
the latter of those changes.
[ghudson@mit.edu: define and use internal names for brevity; pull in
test fix from later commit; expand commit message; fix redundant
separators in LDAP messages]
Nicolas Williams [Wed, 12 Nov 2014 21:47:53 +0000 (15:47 -0600)]
Add new error message wrapping APIs
Add four new public APIs for wrapping error messages:
krb5_prepend_error_message, krb5_vprepend_error_message,
krb5_wrap_error_message, and krb5_vwrap_error_message. The first two
functions are from Heimdal and allow a prefix to be added to the
existing message for a code. The latter two functions also allow the
code to be changed.
[ghudson@mit.edu: rename krb5_prepend_error_message2 to
krb5_wrap_error_message; clarify doxygen comments and put them in the
proper form; implement krb5_prepend_error_message in terms of
krb5_wrap_error_message; fix leak and null context handling in
krb5_wrap_error_message; rewrite commit message]
Ben Kaduk [Mon, 24 Nov 2014 23:23:32 +0000 (18:23 -0500)]
Don't fdopen() in append mode in cc_file.c
Implementations of fdopen() are inconsistent about the state of
the file offset after fdopen(., "a+") -- some position the stream
at the end of the file immediately (e.g., Solaris), for both reading
and writing, but others let reads occur from the beginning of the
file (e.g., glibc).
As it turns out, we only ever write to the file descriptor, not
through stdio, so opening the file with O_APPEND and using fdopen()
with "r+b" should give us sufficient append semantics, while
more portably letting the stream read from the beginning of the file.
Ben Kaduk [Thu, 20 Nov 2014 20:44:04 +0000 (15:44 -0500)]
Avoid infinite loop on duplicate keysalts
When duplicate suppression was requested, we would enter an
infinite loop upon encountering a duplicate entry, a bug
introduced in commit 0918990bf1d8560d74473fc0e41d08d433da1a15
and thus present in release 1.13.
Rework the conditional to avoid the loop, at the expense of
additional indentation for some of the code.
Greg Hudson [Tue, 4 Nov 2014 15:13:11 +0000 (10:13 -0500)]
Fix minor cleanup issue in file ccache
If we fail to open the cache file in fcc_initialize, we could wind up
calling close(-1) which is harmless but incorrect. Avoid this by
initializing fd and conditionalizing its cleanup.
Greg Hudson [Wed, 5 Nov 2014 19:12:35 +0000 (14:12 -0500)]
Fix input race condition in t_skew.py
In two of the kinit tests run by t_skew.py, we expect kinit to exit
before reading the password. If we supply a password input for those
commands, we can fail with a broken pipe exception if the master
process tries to write the password after the slave process exits.
Also correctly check the output of the last kinit invocation.
Greg Hudson [Mon, 3 Nov 2014 22:27:00 +0000 (17:27 -0500)]
Fix spurious gcc warning in cc_file.c
gcc 4.6.3 (present in Ubuntu 12.04) is smart enough to look at
get_size and see that it does not always assign to *size_out, but not
smart enough to figure out that it always assigns to *size_out when it
returns 0. As a result, it outputs two warnings which we treat as
errors. Add an initial assignment to *size_out at the beginning of
get_size to work around this.
Greg Hudson [Sun, 12 Oct 2014 22:46:17 +0000 (18:46 -0400)]
Use stdio reads, O_APPEND writes in FILE ccache
Remove open file state from the cache handle, use stdio for reading,
use single O_APPEND writes for writing, and use O_CLOEXEC when
opening. Keep the file handle open during iteration. These changes
simplify the code, fix some concurrency issues, and reduce the
dependency on POSIX file locks. We still acquire file locks for
compatibility with older code, and in case O_APPEND writes aren't
concurrency-atomic.
Helper functions change as follows:
* open_cache_file yields a stdio handle, and only opens and locks.
* close_cache_file takes a stdio handle.
* read_header (new) reads the file header and yields a version.
* invalidate_cache and fcc_lseek are no longer needed.
* get_size, read_bytes, and load_bytes operate on a stdio handle.
* read32, read16, load_data, load_principal, and load_cred operate on
a stdio handle and version.
* write_bytes, store32, store16, and store_principal are no longer
needed.
fcc_initialize now takes responsibility for writing the header and
default client principal, using a single write.
Greg Hudson [Tue, 7 Oct 2014 00:09:27 +0000 (20:09 -0400)]
Remove cc_file.c global lookup table
The FILE ccache type maintains a global reference-counted table of
handles, which is perhaps an imperfect workaround for POSIX
per-process file locks. Remove this table, since we plan to maintain
read fds in cursors and use O_APPEND writes to render locking less
important.
Greg Hudson [Mon, 6 Oct 2014 13:47:10 +0000 (09:47 -0400)]
Remove KRB5_TC_OPENCLOSE handling in FILE ccache
Stop processing the KRB5_TC_OPENCLOSE flag in cc_file.c; always reopen
the file instead. This will be replaced with more efficient cursor
handling. Also remove some unused KRB5_TC_OPENCLOSE macros in scc.h.
Greg Hudson [Tue, 28 Oct 2014 18:31:19 +0000 (14:31 -0400)]
Adjust asn1c test vector code for new asn1c
asn1c 0.9.22 added support for representing integers using unsigned
types if they have appropriate constraints. This changes the
representation of RFC4120's UInt32 type from Integer_t to unsigned
long. In make-vectors.c, this means we can use a static initializer
for kvno, and that the old method of calling asn_long2INTEGER doesn't
work. Adjust make-vectors.c to assume the newer version of asn1c.
Greg Hudson [Wed, 29 Oct 2014 16:16:40 +0000 (12:16 -0400)]
Remove length limit on PKINIT PKCS#12 prompt
Long pathnames can trigger the 128-byte prompt length limit in
pkinit_get_certs_pkcs12. Use asprintf instead of snprintf. Also
check the result of the prompter invocation.
Expand out MAKE_CODEC macro invocations into MAKE_ENCODER and
MAKE_DECODER invocations, so that the defined function names appear in
the macro calls. This makes it easier to find the function
definitions using grep, although one still has to look up the macro to
see what it does.
Ben Kaduk [Wed, 22 Oct 2014 18:53:52 +0000 (14:53 -0400)]
Remove unused variables from kprop.c
Commit 29dee7d2cece615bec4616fa9b727e77210051db removed the
need for a ccache to hold the credentials used by the process,
but did not remove the ccname and ccache variables which became
unused as a result.
Greg Hudson [Mon, 20 Oct 2014 16:52:45 +0000 (12:52 -0400)]
Report output ccache errors getting initial creds
In init_creds_step_reply, if we get an error storing output
credentials, do set ctx->complete (since retrieving creds or times
will work at this point) but don't suppress the error code.
Tom Yu [Thu, 16 Oct 2014 19:40:33 +0000 (15:40 -0400)]
Parse "ktadd -norandkey" in remote kadmin client
The remote kadmin client would not parse the "-norandkey" option to
the ktadd subcommand, terminating option parsing and possibly causing
options to be interpreted as principal names.
Greg Hudson [Sun, 5 Oct 2014 00:32:19 +0000 (20:32 -0400)]
Separate ccache display and checking in klist
In klist, use separate functions to display a ccache and check its
status. Also use a helper function to check if a credential's server
principal is the local krbtgt principal for the realm.
Greg Hudson [Wed, 8 Oct 2014 00:22:52 +0000 (20:22 -0400)]
Use gssalloc_malloc for GSS error tokens
In kg_accept_krb5, use gssalloc_malloc when allocating space for the
error token, since it will be freed with gssalloc_free. Using malloc
can cause heap corruption on Windows. This bug was masked by #1445
before 1.12.
Greg Hudson [Wed, 27 Aug 2014 20:15:46 +0000 (16:15 -0400)]
Fix minor memory leak in klist (again)
Commit 6e51f9cc3152c8e419fe7f459bcf521d60358434 attempted to fix two
minor memory leaks in klist, but one of the fixes was dead code. In
do_ccache, free princ before we look at the code which terminated the
loop, not after we have returned on either branch.
Greg Hudson [Thu, 21 Aug 2014 17:52:07 +0000 (13:52 -0400)]
Return only new keys in randkey [CVE-2014-5351]
In kadmind's randkey operation, if a client specifies the keepold
flag, do not include the preserved old keys in the response.
CVE-2014-5351:
An authenticated remote attacker can retrieve the current keys for a
service principal when generating a new set of keys for that
principal. The attacker needs to be authenticated as a user who has
the elevated privilege for randomizing the keys of other principals.
Normally, when a Kerberos administrator randomizes the keys of a
service principal, kadmind returns only the new keys. This prevents
an administrator who lacks legitimate privileged access to a service
from forging tickets to authenticate to that service. If the
"keepold" flag to the kadmin randkey RPC operation is true, kadmind
retains the old keys in the KDC database as intended, but also
unexpectedly returns the old keys to the client, which exposes the
service to ticket forgery attacks from the administrator.
A mitigating factor is that legitimate clients of the affected service
will start failing to authenticate to the service once they begin to
receive service tickets encrypted in the new keys. The affected
service will be unable to decrypt the newly issued tickets, possibly
alerting the legitimate administrator of the affected service.
If gss_acquire_cred_impersonate_name is called using an
impersonator_cred_handle acquired with GSS_C_ACCEPT, we could
dereference null fields of the cred handle and crash. Fix this by
checking the impersonator_cred_handle usage and returning
GSS_S_NO_CRED if it isn't what we expect, just as we do in
init_sec_context.
Based on a patch from Solly Ross <sross@redhat.com>.
If two processes try to initialize the same replay cache at the same
time, krb5_rc_io_creat can race between unlink and open, leading to a
KRB5_RC_IO_PERM error. When this happens, make the losing process
retry so that it can continue.
This does not solve the replay cache creation race, nor is that the
only replay cache race issue. It simply prevents the race from
causing a spurious failure.
Restore providing password TGTs for the ksu target
The use of "stored" was originally for marking whether or not creds
had been found in the source cache and copied to the target. If it was
false, the obtain-a-TGT-using-a-password path would be triggered and
it would populate the target ccache directly.
When the intermediate cache was introduced (in commit dccc80a), the
variable started marking whether or not creds had been copied to the
intermediate cache, and this was then used to decide whether or not to
copy creds to the target cache.
The obtain-a-TGT-using-a-password path began storing its creds in the
temporary cache as well, but neglected to set the flag so that the
creds would be copied to the target cache later, so the target ccache
would never be created and populated with the newly-obtained TGT.
In order to allow ksu to use any locally-present service key for
verifying creds, the previous change to ksu switched from using a
retrieved or obtained TGT to fetch creds for the local "host" service,
and then passing those creds to krb5_verify_init_creds(), to passing the
retrieved TGT directly to krb5_verify_init_creds().
It did not take care to retrieve the TGT from the temporary ccache if it
had obtained them, and in those cases it would attempt to verify NULL
creds.
Modify the krb5_get_tkt_via_passwd() function to call
krb5_get_init_creds_password(), to pass back the freshly-obtained creds,
to take a "krb5_get_init_creds_opt" pointer instead of a locally-defined
options structure, and rename it to ksu_get_tgt_via_passwd().
Ben Kaduk [Thu, 14 Aug 2014 17:57:48 +0000 (13:57 -0400)]
Avoid unneeded GetMSTGT() calls in cc_mslsa.c
Both lcc_resolve() and lcc_get_principal() were using GetMSTGT()
to fetch a ticket from which to obtain the client principal name
of the credentials cache. However, that name is contained in
the results of the the cache information query; there is no need
to retrieve a full ticket of any sort to get it. Since there
may sometimes be difficulties obtaining a TGT when UAC is enabled,
avoid these unneeded calls.
Ben Kaduk [Wed, 13 Aug 2014 20:28:57 +0000 (16:28 -0400)]
Remove unused code from cc_mslsa.c
Remove PreserveInitialTicketIdentity() and IsKerberosLogon(), as well
as the preprocessor conditionals ENABLE_PURGING and PURGE_ALL, which
have not been used in a very long time, if ever.
There was one potential callsite of IsKerberosLogon(), in
lcc_resolve(), which was disabled. It is perfectly reasonable to want
to use the MSLSA cache on a non-domain-joined workstation, as it is
now a read-write cache type, so we need not concern ourselves whether
the logon was performed or may have been performed using kerberos.
Ben Kaduk [Wed, 13 Aug 2014 20:31:49 +0000 (16:31 -0400)]
comment some future cleanup for cc_mslsa.c
The function does_query_ticket_cache_ex2() will not be needed once
Windows Server 2003 drops out of support in approximately one year's
time. Note the doom timer at its definition, to facilitate future
cleanup.
Ben Kaduk [Wed, 13 Aug 2014 16:54:37 +0000 (12:54 -0400)]
Remove old Windows support from cc_mslsa.c
It is safe to remove is_windows_2000(), is_windows_xp(), and
is_windows_vista(), since the former two only check for very old
versions of windows which are no longer supported, and
is_windows_vista() was unused. Note that the check being implemented
was whether the running OS was the named version or higher, not an
exact match. The current Microsoft documentation recommends against
the sort of OS version checks that were employed here, in favor of
explicit feature tests.
Remove is_broken_wow64() as the problem it works around (Microsoft
Article ID 960077) is believed to have been fixed in subsequent
updates to Windows Server 2003 and XP.
Remove does_retrieve_ticket_cache_ticket() since support for the
KERB_RETRIEVE_TICKET_CACHE_TICKET flag in the
KERB_RETRIEVE_TKT_REQUEST structure was added in service packs for
Windows Server 2003 and XP. Also remove buildtime fallbacks that
are no longer needed.
Remove the conditionals TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS,
HAVE_CACHE_INFO_EX2, and KERB_SUBMIT_TICKET as all current SDK
versions have the relevant functionality.
In all cases, de-indent chunks that are no longer conditional.
Where indentation levels changed, update the style of the reindented
code to current practices.
Ben Kaduk [Thu, 21 Aug 2014 22:56:24 +0000 (18:56 -0400)]
Let libgssapi see TGTs in the MSLSA cache
When the current user is a local administrator of a windows machine
where User Account Control (UAC) is enabled, the Windows LSA will
return a block of zeros as the session key for any TGT entry in the
MSLSA: cache. The lcc_retrieve() implementation checks for such
"null" session keys and prevents them from escaping to callers (as
attempts to use them would encounger strange errors). However,
when the TGT is the only entry in the cache, this filtering prevents
scan_ccache() from detecting that the cache contains non-expired
credentials (and that there is a TGT present).
Since scan_ccache() is only looking at metadata in the cache entries,
and does not need to actually use any tickets or session keys, set
the KRB5_TC_NOTICKET flag on the ccache before scanning it. This
will allow the MSLSA implementation to return a cred for the TGT
entry and cause the GSSAPI credential selection algorithm to function
properly.
ticket: 8000 (new)
tags: pullup
target_version: 1.12.3
subject: gssapi.dll fails to detect TGTs in the MSLSA cache when UAC is enabled
Ben Kaduk [Thu, 21 Aug 2014 21:33:11 +0000 (17:33 -0400)]
Add some KDC entries to the registry via WiX
Though our library happily uses DNS, I can't get Windows to
successfully contact KDCs found through the SRV records.
So, we do need to stay in the business of shipping around
KDC entries, after all.
In ksu, handle typeless default_ccache_name values
When a configured or compiled-in default ccache name doesn't contain a
cache type and ':' as a prefix, add one to the writeable value that we
construct when we go to look it up. This lets the rest of the
application always assume that it'll be there.
Now that add_key_rnd isn't looking up the TGT principal entry, it
could use retval before initializing it if the loop runs for zero
iterations. Get rid of the add_key_rnd label (as it no longer does
anything) and just return 0 after the loop ends.
Greg Hudson [Mon, 25 Aug 2014 23:14:50 +0000 (19:14 -0400)]
Simplify kdb_cpw.c
In add_key_rnd, stop looking up the krbtgt DB entry; we have not used
it since 1.1.
Use copy_key_data in add_key_rnd and add_key_pwd.
krb5_dbe_crk, krb5_dbe_ark, krb5_dbe_def_cpw, and krb5_dbe_apw all
contained similar logic. Consolidate all of them into a static helper
function which does the work of all four. The ark/apw variants had
slightly different behavior then crk/cpw with keepold=true, so
introduce a three-value enum to express all three behaviors.
Greg Hudson [Mon, 25 Aug 2014 16:48:14 +0000 (12:48 -0400)]
Re-encrypt preserved key data in new master key
When we are preserving old key data in kdb_cpw.c, ensure that it is
encrypted with the same master key as the new key data. This ensures
that the KRB5_TL_MKVNO tl-data on the principal entry applies to all
of the key data, not just some of it.
Benjamin Kaduk [Wed, 3 Sep 2014 02:16:51 +0000 (22:16 -0400)]
Update NOTICE with new changes for 1.13
The KCM RPC definitions are copyright KTH/Apple, since it is present
for interoperability with OS X.
Add MS-KKDCP client copyright; alas, it does not match the existing
Red Hat copyrights, since the new code is a 2-clause BSD license, and
there was only a 3-clause Red Hat copyright block present already.
The actual Sphinx output for NOTICE would adjust the wrapping and
indentation of some existing content, but those changes were removed
by hand, so this commit only reflects new added content.
Commit 956cbd24e645609c94fbc836840ce0f87ba3ce79 created a memory leak
if the KCM_OP_GET_DEFAULT_CACHE call fails inside kcm_ptcursor_new
after the KCM_OP_GET_CACHE_UUID_LIST call succeeds. Fix it.
Greg Hudson [Thu, 28 Aug 2014 22:43:56 +0000 (18:43 -0400)]
Fix KCM ccache per-type cursor
The KCM per-type cursor was too simplistic and did not obey the
conventions of the other ccache types. Fix it to return a singleton
cursor when the default cache is a subsidiary and to return the
primary cache first.
For internal convenience, make_cache now accepts a context parameter
and creates a kcmio if necessary.
Tom Yu [Tue, 26 Aug 2014 22:18:02 +0000 (18:18 -0400)]
Allow logger.c to work with redirected stderr
In lib/kadm5/logger.c:krb5_klog_init(), if the configuration requests
STDERR logging, call fdopen() using mode "w" instead of "a+", to avoid
errors when stderr happens to be opened for write only.
Ben Kaduk [Thu, 28 Aug 2014 21:54:39 +0000 (17:54 -0400)]
Map .hin files to the C language for doxygen
In Debian unstable, the current version of doxygen is unhappy with
our generated Doxyfile, and does not handle krb5.hin in the expected
fashion (as a C header). Work around this issue by explicitly
specifying that files with the .hin extension are to be treated
as C language files.
Ben Kaduk [Fri, 29 Aug 2014 02:58:49 +0000 (22:58 -0400)]
Export gssrpc_bindresvport_sa
It was added in commit 0d04b60d159ab83b943e43802b1449a3b074bc83, but
was not added to the library export symbol list, and thus was unusable
on systems that enforced library export lists.
Greg Hudson [Mon, 18 Aug 2014 19:09:41 +0000 (15:09 -0400)]
Make randkey update principal mkvno
In kadm5_randkey_principal_3, after updating the principal's keys,
update its mkvno tl-data to indicate the master key version we
encrypted the new keys with.
Tomas Kuthan [Wed, 28 May 2014 13:24:20 +0000 (15:24 +0200)]
kadm5_randkey_principal interop with Solaris KDC
When kadm5_randkey_principal is called on Solaris kadmind (as opposed
to kadm5_randkey_principal_3), the KDC assumes the peer is a Solaris 9
system, and only creates DES keys.
For better interoperability, always call kadm5_randkey_principal_3
first. If this procedure is not present on the remote server, fall
back to calling kadm5_randkey_principal if possible.
Nalin Dahyabhai [Tue, 19 Aug 2014 18:07:26 +0000 (14:07 -0400)]
Simplify and improve ksu cred verification
When verifying the user's initial credentials, don't compute a server
name and preemptively obtain creds for it. This change allows
krb5_verify_init_creds to use any host key in the keytab, and not just
the one for the canonicalized local hostname.
Michael Osipov [Fri, 15 Aug 2014 12:20:10 +0000 (14:20 +0200)]
Fix test syntax in configure.in
Commits 1e4bdcfe and 8df1965d used the wrong test equality operator.
Some versions of test allow == for equality, but others (such as the
HP-UX version) do not. Use a single = for correctness.
Michael Osipov [Thu, 14 Aug 2014 13:48:11 +0000 (15:48 +0200)]
Fix HP-UX build support
Rename hpux10.exports to hpux.exports. In the HP-UX section of
shlib.conf, remove '+s' because it just specifies a default, add a
MAKE_SHLIB_COMMAND, and set SHLIBEXT based on the host CPU.
Greg Hudson [Fri, 8 Aug 2014 17:32:51 +0000 (13:32 -0400)]
Allow SPNEGO fallback to NTLM without mechlistMIC
For interoperability with Windows Server 2003 and earlier, loosen the
initiator's enforcement of RFC 4178's mechlistMIC requirement when
falling back to NTLMSSP.
[ghudson@mit.edu: rewrote commit message, added comment to NTLMSSP
OID]
Greg Hudson [Fri, 8 Aug 2014 20:50:38 +0000 (16:50 -0400)]
Fix GSS krb5 GSS_C_DELEG_FLAG ret_flags result
The krb5 gss_accept_sec_context could erroneously return
GSS_C_DELEG_FLAG in ret_flags if either:
* The token included the GSS_C_DELEG_FLAG but did not include at least
28 bytes in the authenticator checksum.
* The initial token included the GSS_C_DELEG_FLAG but a DCE-style
exchange was performed.
When generating a suffix to append to a ccache name that will hold the
credentials for a ksu-invoked process, instead of using integers
counting up from 1, use the result of base64-encoding six randomly-
generated octets. Tweak the output alphabet just a bit to avoid using
'+' or '/' in the generated names, the latter of which could really
confuse things.
Nalin Dahyabhai [Thu, 31 Oct 2013 01:47:14 +0000 (21:47 -0400)]
Make ksu respect the default_ccache_name setting
Move the logic for resolving and initializing a cache that we're
copying creds into out of krb5_ccache_copy(), and let the caller deal
with it. Add a helper functions to select/resolve an output ccache in
the default location for the target user after we've switched to the
target user's privileges. If the destination is a collection, take
care not to change which subsidiary is its primary, and reuse a
subsidiary cache if we can. If the destination is not a collection,
append a unique value to its name to make a new ccache.
[ghudson@mit.edu: some changes to variable names and comments; move
responsibility for getting target ccache name from
resolve_target_ccache to main]
Nalin Dahyabhai [Thu, 31 Oct 2013 01:45:35 +0000 (21:45 -0400)]
Use an intermediate memory cache in ksu
Instead of copying source or obtained creds into the target cache and
changing ownership if everything succeeds, copy them into a MEMORY:
cache and then, if everything succeeds, create the target cache as the
target user.
We no longer need to clean up the temporary ccache when exiting in
most error cases.
Use a fake principal name ("_ksu/_ksu@_ksu") as the primary holder of
the temporary cache so that we won't accidentally select it when we
make a subsequent call to krb5_cc_cache_match() (to be added in a
later patch) to find the target location where the creds should be
stored for use while running as the target user.
Nalin Dahyabhai [Fri, 1 Nov 2013 13:48:13 +0000 (09:48 -0400)]
In ksu, don't stat() not-on-disk ccache residuals
Don't assume that ccache residual names are filenames which we can
stat() usefully. Instead, use helper functions to call the library
routines to try to read the default principal name from caches, and
use whether or not that succeeds as an indication of whether or not
there's a ccache in a given location.
In ksu, merge krb5_ccache_copy() and _restricted()
Other than whether or not they limit the creds it stores to the new
ccache based on the principal name of the client for whom the creds were
issued, there's no meaningful difference between what these two
functions do. Merge them.
Tomas Kuthan [Fri, 1 Aug 2014 13:25:50 +0000 (15:25 +0200)]
Fix LDAP key data segmentation [CVE-2014-4345]
For principal entries having keys with multiple kvnos (due to use of
-keepold), the LDAP KDB module makes an attempt to store all the keys
having the same kvno into a single krbPrincipalKey attribute value.
There is a fencepost error in the loop, causing currkvno to be set to
the just-processed value instead of the next kvno. As a result, the
second and all following groups of multiple keys by kvno are each
stored in two krbPrincipalKey attribute values. Fix the loop to use
the correct kvno value.
CVE-2014-4345:
In MIT krb5, when kadmind is configured to use LDAP for the KDC
database, an authenticated remote attacker can cause it to perform an
out-of-bounds write (buffer overrun) by performing multiple cpw
-keepold operations. An off-by-one error while copying key
information to the new database entry results in keys sharing a common
kvno being written to different array buckets, in an array whose size
is determined by the number of kvnos present. After sufficient
iterations, the extra writes extend past the end of the
(NULL-terminated) array. The NULL terminator is always written after
the end of the loop, so no out-of-bounds data is read, it is only
written.
Historically, it has been possible to convert an out-of-bounds write
into remote code execution in some cases, though the necessary
exploits must be tailored to the individual application and are
usually quite complicated. Depending on the allocated length of the
array, an out-of-bounds write may also cause a segmentation fault
and/or application crash.
Tom Yu [Wed, 6 Aug 2014 22:45:20 +0000 (18:45 -0400)]
Disallow unlocked iteration of hash databases
It's not clear whether unlocked iteration over a hash DB2 database
will omit unaffected entries if database additions or deletions occur
concurrently with the iteration. Avoid this situation by disabling
unlocked iteration in the unlikely event that someone is still using a
hash database for their KDB.
Greg Hudson [Tue, 5 Aug 2014 03:34:32 +0000 (23:34 -0400)]
Fix glob memory leak in GSS initialization
In loadConfigFiles, call globfree even if glob fails, since glob can
allocate memory and report partial results on failure. Also
initialize globbuf before calling glob; this is not strictly required,
but hedges against hypothetical libc implementation bugs which could
leave globbuf.gl_pathc or globbuf.gl_pathv uninitialized on error.
Tom Yu [Wed, 6 Aug 2014 19:03:03 +0000 (15:03 -0400)]
Fix KDC race in t_unlockiter.py
The second KDC startup in t_unlockiter.py could race with the
garbage-collected shutdown of the first, causing the second one to
fail to bind the listening port. Avoid the situation by setting
start_kdc=False, because there doesn't need to be a KDC running for
these tests anyway. Also use create_user=False and create_host=False,
because those principals aren't necessary either.
Ben Kaduk [Wed, 6 Aug 2014 16:49:52 +0000 (12:49 -0400)]
Fix OS X build
Commit 58312ae8beb0499ac3a06196164eb833e9f8975e, "Fix the build on
windows", had a typo that broke the build of KCM support on OS X.
Attempt to increment the cardinality of the set of buildable platforms,
instead of just adjusting its contents, by fixing the typo.
Ben Kaduk [Tue, 5 Aug 2014 15:11:45 +0000 (11:11 -0400)]
Fix the build on windows
Windows does not provide the glob() functionality used to implement
the /etc/gss/mechs.d/ feature, so we must avoid compiling the
relevant code for windows. (It would never have been called, anyway.)
Adjust the ccache/Makefile.in rules to not use '-' or '@' in
make variable names that are processed by nmake.
Also in ccache/Makefile.in, remove some latent leading whitespace that
had been previously hidden by the previous rule; this exposed some
flawed dependencies that are now removed.
Windows does not provide sys/socket.h or sys/un.h, so don't try
to include them in cc_kcm.c.
The commit which moved the KKDCP TLS support to a plugin left some
dangling references to checkhost.c byproducts in os/Makefile.in,
which can be safely removed.
Use k5-platform.h in support/json.c instead of a set of system includes;
this lets windows build the static inline helper functions therein.
When ksu was explicitly told to spawn a shell, a line in .k5users which
listed "*" as the allowed command would cause the principal named on the
line to be considered as a candidate for authentication.
When ksu was not passed a command to run, which implicitly meant that
the invoking user wanted to run the target user's login shell, knowledge
that the principal was a valid candidate was ignored, which could cause
a less optimal choice of the default target principal.
This doesn't impact the authorization checks which we perform later.
projects / thirdparty / krb5.git / log
