Greg Hudson [Fri, 17 May 2019 17:45:08 +0000 (13:45 -0400)]
Add KRB5RCACHENAME and default_rcache_name
In krb5_get_server_rcache(), stop constructing a residual value based
on piece and the euid, and instead resolve default replay cache
(previously an unused operation, as krb5_rc_default() was not part of
the API and was never used).
To determine the default replay cache name, try the KRB5RCACHENAME
environment variable first, and then try KRB5RCACHETYPE for
compatibility. If neither of those environment variables are set, try
the default_rcache_name profile relation in [libdefaults] before
falling back to "dfl:".
Greg Hudson [Wed, 15 May 2019 05:01:34 +0000 (01:01 -0400)]
Use file2 replay cache by default
Remove the existing default replay cache implementation and replace it
with a wrapper around the file2 replay cache code. Change the
filename to krb5_EUID.rcache2, ignoring the residual (and therefore
the server principal name). On Windows, use the local appdata
directory if KRB5RCACHEDIR is not set in the environment.
Greg Hudson [Tue, 19 Feb 2019 06:30:41 +0000 (01:30 -0500)]
Add tag to krb5_donot_replay
For each use of replay caches, supply a tag based on a ciphertext or
checksum associated with the use. Stop creating or checking replay
records for unencrypted KRB-CRED messages.
When neither the send-encrypted-sad nor the use-sad-as-key flag is set
in the SAM-2 challenge, the protocol calls for the AS key to be
combined with the string-to-key of the SAD using a key combination
method which has only been implemented for DES and 3DES enctypes.
Rather than extending key combination, remove support for this case.
Greg Hudson [Wed, 22 May 2019 17:05:15 +0000 (13:05 -0400)]
Simplify kdb5_util global argv processing
kdb5_util could issue an unexplained error if a command argument
matched a command name, such as when trying to load a dump file named
"dump". It could also mysteriously work if the command name and its
arguments were misordered, such as "kdb5_util kdb.dump load".
In the main option loop, build cmd_argv without special-casing command
names; then look up cmd_argv[0] after the loop.
Greg Hudson [Tue, 28 May 2019 16:16:41 +0000 (12:16 -0400)]
Stop double-caching referral tickets
Caching referral tickets under two names can generate duplicate cache
entries, and is speculative--if credentials are requested with the
referral realm, there is no good reason to expect a subsequent request
with the canonical realm. Only cache under the referral realm.
Greg Hudson [Tue, 28 May 2019 16:02:00 +0000 (12:02 -0400)]
In klist, display ticket server if different
If the ticket server differs from the credential server, display it as
an extra field. This happens most commonly when the credential is
cached under the referral realm.
Greg Hudson [Tue, 21 May 2019 17:34:39 +0000 (13:34 -0400)]
Display unsupported enctype names
Add a table of unsupported enctype numbers to enctype_util.c and
consult it in krb5_enctype_to_name(). Treat unsupported enctype
numbers as deprecated in krb5int_c_deprecated_enctype(). In kadmin,
display "UNSUPPORTED:" before invalid enctype names.
Robbie Harwood [Fri, 24 May 2019 17:12:03 +0000 (13:12 -0400)]
Remove support for single-DES and CRC
Single-DES removal brings us closer to compliance with RFC 6649.
Single-DES was disabled by default starting in release 1.8, and
user-visible deprecation warnings were issued starting in release
1.17.
Robbie Harwood [Fri, 24 May 2019 17:11:44 +0000 (13:11 -0400)]
Remove the v4 and afs3 salt types
In preparation for removing single-DES support, remove the v4 and afs3
salt types. The afs3 salt type could only be used with single-DES
keys, and the v4 salt type was only useful for single-DES keys from
krb4 databases.
Greg Hudson [Tue, 28 May 2019 14:55:56 +0000 (10:55 -0400)]
Fix Python fallback in configure.ac
Commit 2bd410ecdb366083fe9b4e5f6ac4b741b624230b (ticket 8709)
contained a typo "text" for "test", preventing the Python path check
from falling back from python2 to python. This is now a fallback from
python3 to python, but the typo remains. Fix it now.
Remove rcsid.sty and the uses of the \rcsId macro as git does not
perform the keyword expansion necessary to make it work. Add comments
indicating the historic status of the kadm5 documentation.
[ghudson@mit.edu: fix the tex files instead of marking them as
non-building]
Robbie Harwood [Thu, 2 May 2019 20:57:51 +0000 (16:57 -0400)]
Remove dead variable def_kslist from two files
def_kslist was part of kdb5_create.c since its addition (commit edf8b4d8a6a665c2aa150993cd813ea6c5cf12e1) and has always been
irrelevant since the rblock structure is fully initialized in
kdb5_create().
Robbie Harwood [Mon, 13 May 2019 18:19:57 +0000 (14:19 -0400)]
Remove checksum type profile variables
Remove support for the krb5.conf relations ap_req_checksum_type,
kdc_req_checksum_type, and safe_checksum_type. These values were
useful for interoperating with very old KDCs, which should no longer
be deployed.
Additionally, kdc_req_checksum_type was incorrectly documented as only
applying to single-DES keys; in practice it also worked for RC4. The
other two were not clearly documented, but safe_checksum_type did
allow use of hmac-md5-rc4 for any enctype, and ap_req_checksum_type
did not impose any limitations.
Robbie Harwood [Mon, 6 May 2019 17:13:16 +0000 (13:13 -0400)]
Improve error messages from kadmin change_password
The checks for missing option arguments were dead code, because the
loop condition requires at least two remaining arguments. Instead
check for at least one argument with a leading "-", and check for too
many or too few arguments after the loop. Add an initial message for
unrecognized options.
[ghudson@mit.edu: adjusted logic to improve mesages in more cases]
Robbie Harwood [Mon, 6 May 2019 19:14:49 +0000 (15:14 -0400)]
Avoid alignment warnings in openssl rc4.c
Add a comment to k5_arcfour_init_state() explaining how we stretch the
krb5_data cipher state contract. Use void * casts when interpreting
the data pointer to avoid alignment warnings.
[ghudson@mit.edu: moved and expanded comment; rewrote commit message]
Greg Hudson [Sun, 5 May 2019 22:53:27 +0000 (18:53 -0400)]
Simplify SAM-2 as_key handling
The ctx->gak_fct() call in sam2_process() used an empty salt instead
of the default salt when the KDC did not supply an explicit salt.
This bug arose when commit bc096a77ffdab283d77c2e0fc1fdd15b9f77eb41
changed the internal contracts around salts but did not adjust the
SAM-2 code. Commit e9aa891fcdb4c08d39902ab89afb268042b60c86 fixed the
resulting bug, but mistakenly did not adjust the gak_fct call to use
the correct salt.
Later on, the code contains a redundant call to krb5_c_string_to_key()
in the non-USE_SAD_AS_KEY modes, replacing ctx->as_key. This call was
properly adjusted by commit e9aa891fcdb4c08d39902ab89afb268042b60c86,
so the improper gak_fct call did not manifest as a bug.
Fix the gak_fct call to supply the correct salt, and remove the
redundant string_to_key operation.
Greg Hudson [Sun, 5 May 2019 23:32:21 +0000 (19:32 -0400)]
Remove outdated text in krb5kdc/kadmind man pages
Some init systems, such as systemd, can run daemon processes in the
foreground, so admonishments to let krb5kdc and kadmind background
themselves in normal operation can be confusing. Remove those
sentences.
Robbie Harwood [Thu, 2 May 2019 17:36:38 +0000 (13:36 -0400)]
Initialize some data structure magic fields
Static analyzers may complain if they see a data structure copied with
an uninitialized field, even if the copy target won't use the field.
Add magic field initializers in three such places.
On systems with secure_getenv() (glibc 2.17+) use it directly. For
the fallback implementation, check the current process uids and gids
in a library initializer, looking at the saved uid and gid where
possible. Include a comment about more aggressive approaches to
detecting elevated privilege.
In krb5int_hmac_keyblock() and krb5int_pbkdf2_hmac(), check for errors
from previously unchecked OpenSSL function calls and return
KRB5_CRYPTO_INTERNAL if they fail.
HMAC_Init() is deprecated in OpenSSL 1.0 and later; as we are
modifying the call to check for errors, call HMAC_Init_ex() instead.
If configure is explicitly asked to build with libreadline, look for
and link against only -lreadline, relying on the platform to resolve
any dependencies.
The example code for gss_get_mic_iov() using a caller-provided buffer
calls gss_wrap_iov_length() and gss_wrap_iov() instead of
gss_get_mic_iov_length() and gss_get_mic_iov() as intended. Reported
by Frank Filz.
As part of error handling in d3b39a8bac6206b5ea78b0bf6a2958c1df0b0dd5,
an error path in delete_cred() may result in close(-1). While this
shouldn't be a prolblem in practice (just returning EBADF), it does
upset Coverity.
Use data_eq_string() to check the server realm, and do not check if
cred->server is NULL since it is not expected to be (and
k5_marshal_cred() would have already crashed if it were).
Previously, only KCM and MSLA implemented credential removal. Add
support for FILE (and therefore DIR), MEMORY, and KEYRING.
The FILE logic is similar Heimdal's implementation, with additional
logic for skipping removed creds during iteration. In addition to
setting endtime to 0 and changing the realm for config entries as
Heimdal does, we set authtime to -1 to make deleted entries
distinguishable from gssproxy encrypted creds and config entries.
For MEMORY, leave behind empty list elements when removing a cred will
leave behind an empty list element, in case an iterator holds a
pointer to that element.
[ghudson@mit.edu: edited commit message; made minor style and comment
changes; fixed memory leaks detected by asan]
Clarify header comment for krb5_cc_start_seq_get()
Previously this comment seemed to suggest that applications needed to
block all other access to the ccache (including by other processes)
during iteration.
Greg Hudson [Tue, 19 Mar 2019 15:15:26 +0000 (11:15 -0400)]
Suppress krb5_cc_start_seq_get() popups in Leash
Under some circumstances (perhaps related to a February Windows 10
update), Leash can get past the krb5_cc_get_principal() step when
processing an empty MSLSA ccache, and get a KRB5_CC_NOMATCH error from
krb5_cc_start_seq_get(). Do not display a modal error dialog if this
happens.
Robert Marshall [Wed, 13 Mar 2019 03:20:06 +0000 (23:20 -0400)]
Add option to build without libkeyutils
Add a --without-keyutils option to disable the keyring ccache, for
scenarios where minimizing libkrb5 dependencies is important.
[ghudson@mit.edu: moved processing to configure.ac; added error if
explicit --without-keyutils is given and libkeyutils is not found;
nested persistent keyring check for clarity; moved new documentation
to appropriate place and don't mention persistent keyrings; rephrased
commit message]
Isaac Boukris [Wed, 16 Jan 2019 22:23:25 +0000 (00:23 +0200)]
Add KDC support for X.509 S4U2Self requests
Add a KDB function krb5_db_get_s4u_x509_principal() and an associated
method in the DAL, bumping the minor version and cleaning up a
leftover comment in the table from major version 6.
When processing an AS-REQ, look up the client principal by certificate
if the request contains a non-empty PA-S4U-X509-USER value. When
processing an S4U2Self TGS-REQ, allow requests with certificates, and
look up the client principal by certificate if one is presented.
[ghudson@mit.edu: factored out lookup_client() in AS code; rewrote
commit message and some comments; adjusted flow control changes in
kdc_process_s4u_x509_user()]
Isaac Boukris [Tue, 15 Jan 2019 00:53:25 +0000 (02:53 +0200)]
Expand S4U2Self exception in KDC lineage check
An S4U2Self TGS-REQ using only a certificate to identify the user will
not include PA-FOR-USER, so we need to check both types when making an
exception in the lineage check. (S4U2Self requests are allowed to
bypass the lineage check because cross-realm S4U2Self ends with a
backwards cross-realm request to the server realm.)
[ghudson@mit.edu: factored out padata check; deindented the code block
by combining conditionals; rewrote commit message]
Isaac Boukris [Fri, 11 Jan 2019 08:49:19 +0000 (10:49 +0200)]
Fix client code for S4U2Self with certificate
During realm identification, don't send the certificate in the AS
request if we have an enterprise name, for consistency with the
Windows LSA API behavior. If we are using just a certificate, use the
appropriate client principal name type with a single empty data
component.
krb5int_process_tgs_reply() needs to see an S4U2Self padata type in
in_padata to apply the correct logic when verifying the client
principal in the reply. If we are using only a certificate, we
currently do not pass any in_padata (because we do not send
PA-FOR-USER in this case, and the PA-S4U-X509-USER is constructed via
a callback). Change the code to place an empty PA-S4U-X509-USER in
in_padata, to be modified by the callback; that way we can reliably
detect the S4U2Self case when processing the reply.
In krb5_get_self_cred_from_kdc(), when constructing an empty client
principal for a cert-only S4U2Self request, properly terminate the
krb5_build_principal_ext() argument list to avoid a crash. Don't
bother setting the name type as it isn't sent.
Only send the certificate in the first TGS-REQ to the client realm.
To the intermediate and final realms, send the principal name only.
Use the checksum-protected principal name in the first KDC's
PA-S4U-X509-USER response for subsequent requests and to verify the
unprotected client name in the final reply.
After receiving the final reply, check if we had cached credentials
under the discovered client name (unless it's the same as the input
client name) and return the cached credentials if we find them.
Greg Hudson [Fri, 1 Mar 2019 02:28:43 +0000 (21:28 -0500)]
Use memory replay cache for DO_TIME auth contexts
Instead of requiring the caller to set up a persistent replay cache
for KRB-PRIV/KRB-SAFE/KRB-CRED messages produced in DO_TIME auth
contexts, use an in-memory replay cache.
Update the API documentation for the affected functions and correct
some inaccuracies.
Greg Hudson [Wed, 2 Jan 2019 21:54:28 +0000 (16:54 -0500)]
Improve S4U2Self realm identification internals
Realm identification for S4U2Self requests ([MS-SFU] 3.1.5.1.1.1) uses
the AS code path with some differences: we might want to include a
subject certificate in pa-data, we want to stop as soon as we get a
reply indicating which realm the client is in, and we want to
communicate that realm to the caller. The current method of making
these changes is fragile--it uses an optimistic preauth type but does
not actually pre-authenticate, and it assumes that the AS code will
terminate with a predictable error if there is no prompter and a
trivial GAK function.
Instead, add fields to krb5_get_init_creds_context for realm
identification, and support them in the AS state machine, making sure
never to invoke preauth modules. Add a new library-internal function
k5_identify_realm() to set up an appropriate context, run the state
machine, and copy out the client principal of the last request on
success.
Greg Hudson [Mon, 4 Mar 2019 21:11:11 +0000 (16:11 -0500)]
Update comment in lock_file.c
Gnu libc commit 06ab719d30b01da401150068054d3b8ea93dd12f fixed the OFD
locking issue on 32-bit Linux. We still need to work around the bug
for older versions, but update the comment to note the release in
which the bug was fixed.
Greg Hudson [Mon, 4 Mar 2019 16:07:45 +0000 (11:07 -0500)]
Fix ASN.1 test secure cookie comparison
One of the comparisons in ktest_equal_secure_cookie() was
tautological. Use scalar_equal() for consistency with other tests.
Also use scalar_equal() in ktest_equal_kkdcp_message().
Greg Hudson [Sun, 3 Mar 2019 20:42:04 +0000 (15:42 -0500)]
Rename configure.in to configure.ac
autotools plans to drop support for the name configure.in.
(automake's NEWS file expresses plans to drop support for it in
autoconf 2.0; autoconf added a warning in commit 560f16b52d3d3db1536d9ca5b863ce9b1a5c9e35, indicating in the commit
message that support will be dropped in a future version.)
Corene Casper [Sat, 16 Feb 2019 05:49:26 +0000 (00:49 -0500)]
Fix memory leak in 'none' replay cache type
Commit 0f06098e2ab419d02e89a1ca6bc9f2828f6bdb1e fixed part of a memory
leak in the 'none' replay cache type by freeing the outer container,
but we also need to free the mutex.
Greg Hudson [Mon, 18 Feb 2019 00:51:35 +0000 (19:51 -0500)]
Use better name type for PKINIT KDC certs
RFC 4120 recommends NT-SRV-INST for krbtgt principals; use it in
PKINIT KDC certificates rather than NT-PRINCIPAL. Regenerate test
certificates. Reported by Rick van Rein.
Greg Hudson [Fri, 15 Feb 2019 16:59:06 +0000 (11:59 -0500)]
Modernize KRB-PRIV/KRB-SAFE/KRB-CRED functions
In krb5_mk_safe(), krb5_mk_priv(), krb5_mk_ncred(), krb5_rd_safe(),
and krb5_rd_priv(), modify naming, formatting, and memory management
to meet current standards. Add k5_privsafe helpers to generate replay
data and addresses and to store replay records. For krb5_mk_ncred(),
expand the contract of the encoding function to be similar to the
other two krb5_mk functions, and use pointer aliases to reduce the
number of copies required.
Luke Howard [Fri, 28 Dec 2018 12:13:05 +0000 (23:13 +1100)]
Process SPNEGO error tokens through mech
In the SPNEGO initiator code, if the acceptor returns a token with
negState=REJCET and a mechanism token, process the token through the
mech to get a better error status.
[ghudson@mit.edu: modified approach for clarity and to prevent some
edge cases; rewrote commit message]
Greg Hudson [Tue, 22 Jan 2019 17:07:54 +0000 (12:07 -0500)]
Simplify negState choice in SPNEGO initiator
In the SPNEGO initiator code, simplify the choice of the outgoing
negState value, and remember the acceptor negState choice throughout
the process. The outgoing negState value is REJECT if sending an
error token, ACCEPT_COMPLETE when sending a final MIC, and
ACCEPT_INCOMPLETE otherwise.
RFC 4178 permits negState to be omitted in some cases, so rename
ACCEPT_DEFECTIVE_TOKEN to UNSPECIFIED for clarity. Use this value as
the acceptor negState for the first pass through
spnego_gss_init_sec_context() when there is no acceptor token.
Decide whether to return GSS_S_COMPLETE or GSS_S_CONTINUE_NEEDED at
the end of processing, instead of it being a shared responsibility of
the helper functions. Return GSS_S_COMPLETE on success in the helper
functions and use "goto cleanup" in a few more places. Leave
handle_mic() alone as it is also used by the acceptor code.
Isaac Boukris [Mon, 7 Jan 2019 19:09:34 +0000 (21:09 +0200)]
Remove erroneous text from kinit man page
Commit 4c4859fa83295db5c26f47b96c719060cfd9e2b1 changed the kinit man
page to state that kinit -E (enterprise) implies -C (canonicalize).
The client does not automatically set the canonicalize option when
getting tickets for an enterprise principal, and Windows KDCs can
issue tickets for enterprise principals without canonicalizing the
principal (contrary to the implication of RFC 6806 section 5). Remove
the misleading text.
[ghudson@mit.edu: updated RST man page and regenerated nroff file;
rewrote commit message]
krb5_cc_lock(), krb5_cc_unlock(), krb5_cccol_lock(), and
krb5_cccol_unlock() are used internally, so remove them from krb5.h
and rename them to k5_cc_lock(), k5_cc_unlock(), k5_cccol_lock(), and
k5_cccol_unlock() respectively.
krb5_cccol_last_change_time() is not used, so remove it.
krb5_cc_last_change_time() is also not used, so remove it as well.
Update ccache interface to reflect removal. Of particular note, this
function didn't behave as documented for KCM or KEYRING ccaches at
time of removal.
Robbie Harwood [Thu, 10 Jan 2019 21:34:54 +0000 (16:34 -0500)]
Mark deprecated enctypes when used
Preface ETYPE_DEPRECATED enctypes with "DEPRECATED:" in klist output,
KDC logs, and kadmin interactions. Also complain in krb5kdc when the
stash file has a deprecated enctype or a deprecated enctype is
requested with -k.
Robbie Harwood [Tue, 8 Jan 2019 22:42:35 +0000 (17:42 -0500)]
Make etype names in KDC logs human-readable
Introduce enctype_name() as a wrapper over krb5_enctype_to_name for
converting between registered constants and names. Adjust signatures
and rewrite ktypes2str() and rep_etypes2str() to operate on dynamic
buffers.
Robbie Harwood [Tue, 15 Jan 2019 21:16:57 +0000 (16:16 -0500)]
Add function and enctype flag for deprecations
krb5int_c_deprecated_enctype() checks for the ETYPE_DEPRECATED flag on
enctypes. All ENCTYPE_WEAK enctypes are currently deprecated; not all
deprecated enctypes are considered weak. Deprecations follow RFC 6649
and RFC 8429.
Robbie Harwood [Tue, 15 Jan 2019 18:41:16 +0000 (13:41 -0500)]
In kpropd, debug-log proper ticket enctype names
This change replaces the last call of krb5_enctype_to_string() in our
sources with krb5_enctype_to_name(), ensuring that we log consistently
to users using readily discoverable strings.
Robbie Harwood [Mon, 14 Jan 2019 22:14:42 +0000 (17:14 -0500)]
In rd_req_dec, always log non-permitted enctypes
The buffer specified in negotiate_etype() is too small for use with
the AES enctypes when used with krb5_enctype_to_string(), so switch to
using krb5_enctype_to_name().
Greg Hudson [Sun, 30 Dec 2018 21:40:28 +0000 (16:40 -0500)]
Address some optimized-out memset() calls
Ilja Van Sprundel reported a list of memset() calls which gcc
optimizes out. In krb_auth_su.c, use zap() to clear the password, and
remove two memset() calls when there is no password to clear. In
iakerb.c, remove an unnecessary memset() before setting the only two
fields of the IAKERB header structure. In svr_principal.c, use
krb5_free_key_keyblock_contents() instead of hand-freeing key data.
In asn1_k_encode.c, remove an unnecessary memset() of the kdc_req_hack
shell before returning.
sashan [Tue, 18 Dec 2018 11:04:56 +0000 (12:04 +0100)]
Fix build issues with Solaris native compiler
In the LDAP KDB module, fix an empty initializer. In the SPAKE
edwards25519 code, use autoconf tests to determine whether to use the
64-bit code. In the SPAKE update_thash() function, make sure the
types of the conditional expression results match exactly. In
libkrb5support, link against zap.o now that k5buf.o can use zap() (as
of commit 8ee8246c14702dc03b02e31b9fb5b7c2bb674bfb).
Simo Sorce [Tue, 4 Dec 2018 20:22:55 +0000 (15:22 -0500)]
Add dns_canonicalize_hostname=fallback support
Turn dns_canonicalize_hostname into a tristate variable, allowing the
value "fallback" as well as the true/false booleans. If it is set to
fallback, delay DNS canonicalization and attempt it only in
krb5_get_credentials() if the KDC responds that the requested server
principal name is unknown.
Isaac Boukris [Sat, 15 Dec 2018 09:56:36 +0000 (11:56 +0200)]
Remove incorrect KDC assertion
The assertion in return_enc_padata() is reachable because
kdc_make_s4u2self_rep() may have previously added encrypted padata.
It is no longer necessary because the code uses add_pa_data_element()
instead of allocating a new list.
CVE-2018-20217:
In MIT krb5 1.8 or later, an authenticated user who can obtain a TGT
using an older encryption type (DES, DES3, or RC4) can cause an
assertion failure in the KDC by sending an S4U2Self request.
[ghudson@mit.edu: rewrote commit message with CVE description]
Greg Hudson [Mon, 26 Nov 2018 18:37:46 +0000 (13:37 -0500)]
Document necessary delay in master key rolllover
During master key rollover, if the old master key is purged
immediately after updating principal encryption, running processes may
not successfully update their in-memory copies of the master key.
Document that the administrator should delay purging the master key
until after propagation and some daemon activity.
Greg Hudson [Thu, 15 Nov 2018 18:40:43 +0000 (13:40 -0500)]
Clear forwardable flag instead of denying request
If the client requests a forwardable or proxiable ticket and the
option cannot be honored by policy, issue a non-forwardable or
non-proxiable ticket rather than denying the request.
Add a test script for testing KDC request options and populate it with
tests for the forwardable and proxiable flags.
Robbie Harwood [Mon, 5 Nov 2018 18:49:52 +0000 (13:49 -0500)]
Fix spurious errors from kcmio_unix_socket_write
Commit 33634a940166d0b21c3105bab8dcf5550fbbd678 accidentally changed
the return value from kcmio_unix_socket_write to be the result of the
write call. Most commonly this resulted in it returning 8, which led
to many commands failing with "Exec format error".
projects / thirdparty / krb5.git / log
