Greg Hudson [Thu, 7 Nov 2019 04:02:51 +0000 (23:02 -0500)]
Fix SPNEGO output parameter bugs
When accepting, do not leak a name if the underlying mech reports a
src_name twice. Record mech_type and delegated_cred_handle and report
them to the caller at the final SPNEGO step, not when the underlying
mech reports them.
When initiating or accepting, report ret_flags at every step, and
filter out PROT_READY as required by RFC 4178 section 3.1. Report a
time_rec value at the final step even if we didn't call into the
underlying mech, using a call to gss_context_time() if necessary.
In the mechglue, initialize ret_flags and time_rec for both
gss_initialize_sec_context() and gss_accept_sec_context().
Greg Hudson [Tue, 5 Nov 2019 21:51:02 +0000 (16:51 -0500)]
Restrict SPNEGO acceptor mechs by cred acquisition
When the default cred is used, the SPNEGO initiator restricts the list
of negotiable mechanisms to those we can acquire a cred for, so that
we don't propose a mech we know can't work. The acceptor should do
the same.
Greg Hudson [Wed, 23 Oct 2019 22:31:05 +0000 (18:31 -0400)]
Simplify AS request time handling in KDC
The kdc_time and authtime fields of struct as_req_state are redundant
and can be condensed to just kdc_time. Copying the times structure
from enc_tkt_reply to reply_encpart already sets the authtime field to
kdc_time, so there is no need to repeat that assignment.
Also remove two prototypes for functions which never existed in the
mainline KDC code.
In process_as_req(), get the current time before any KDB lookups, so
that KDB modules can more correctly audit how long the processing of
an AS request takes.
Isaac Boukris [Tue, 15 Oct 2019 17:41:49 +0000 (20:41 +0300)]
Allow client canonicalization in non-krbtgt AS-REP
If a caller makes an AS-REQ with the canonicalize flag set (or with an
enterprise client principal or the anonymous flag), always allow the
KDC to change the client principal. Continue to restrict server name
changes to requests for TGS principals.
Also remove the conditional for setting canon_ok for fully anonymous
requests. Both kinds of anonymous requests change the client
principal or realm, but neither kind changes the server principal or
realm, so this logic is no longer needed now that canon_ok only
applies to server name changes.
Greg Hudson [Wed, 23 Oct 2019 04:48:25 +0000 (00:48 -0400)]
Work around glibc bug 11941 (dlclose assertion)
When building against glibc 2.24 or earlier, suppress calls to
dlclose() to prevent the assertion failure "_dl_close: Assertion
`map->l_init_called' failed" at process exit. We need this workaround
to enable automated tests that load GSSAPI modules.
Greg Hudson [Mon, 21 Oct 2019 14:29:35 +0000 (10:29 -0400)]
Fix gssalloc_realloc() on Windows
gss_inquire_sec_context_by_oid(GSS_C_INQ_SSPI_SESSION_KEY) fails on
Windows because generic_gss_add_buffer_set_member() relies on the
ability to realloc() a null pointer. Unlike realloc(), HeapReAlloc()
requires an input pointer that (from the MSDN documentation) "is
returned by an earlier call to the HeapAlloc or HeapReAlloc function".
So gssalloc_realloc() must test for null inputs and call HeapAlloc()
instead.
Greg Hudson [Thu, 17 Oct 2019 04:52:04 +0000 (00:52 -0400)]
Improve argument validation in some GSS APIs
The prevailing discpline of public GSS APIs is to set output
parameters to default values, then validate input parameters. Some
more recent APIs did not do this consistently, leading to the
possibility of minor_status retaining its previous value or similar
issues.
Greg Hudson [Sun, 6 Oct 2019 22:35:50 +0000 (18:35 -0400)]
Accept GSS mechs which don't supply attributes
If gss_inquire_attrs_for_mech() is called for a mechanism which does
not implement it, the call will succeed with mech_attrs set to
GSS_C_NO_OID_SET (as is explicitly allowed by RFC 5587).
generic_gss_test_oid_set_member() returns an error on this value,
causing gss_accept_sec_context() to erroneously deny the mechanism
when no verifier credential handle is supplied. Change
allow_mech_by_default() to explicitly check for no mech attribute set.
Greg Hudson [Mon, 21 Oct 2019 17:56:55 +0000 (13:56 -0400)]
Fix t_otp.py for pyrad 2.2
pyrad 2.2 throws a KeyError exception in DecodePacket if any
attributes from the packet are not defined in the dictionary. Add a
dictionary entry for Service-Type so this doesn't happen.
Commit 8d8e68283b599e680f9fe45eff8af397e827bd6c logs both invalid and
deprecated enctypes as "DEPRECATED:". An invalid enctype might be too
old or marginal to be supported (like single-DES) or too new to be
recognized. For clarity, prefix invalid enctypes with "UNSUPPORTED:"
instead.
Commit 969331732b62e73d1e073ff3ad87bf1774ee9fd1 (ticket 7369) removed
the code to return UPDATE_BUSY if the database was modified within the
last ten seconds, but did not remove the corresponding documentation
text. Remove it now.
Remove ldapbackend.rst, as it is largely redundant with conf_ldap.rst.
Simplify conf_ldap.rst, using kerberos.openldap.ldif (added by ticket
8529) and removing unnecessary command arguments. Mention the
possibility of using SASL authentication (added by ticket 7944) as an
alternative to binding with DN and password. Remove unnecessary
access rights.
In kdc_conf.rst, remove ldap_servers from the list of relations read
from [dbdefaults], as it is only read from the realm's database
configuration section.
In kdb5_ldap_util.rst, document "-r" as a global parameter, as it
applies in some fashion to all commands. Make the same changes to the
kdb5_ldap_util usage message, and make it fit within 80 columns.
If the environment variable GSS_MECH_CONFIG is set (and the process is
not privileged), read it instead of /etc/gss/mech or files within
/etc/gss/mech.d.
Set GSS_MECH_CONFIG in test frameworks so that system configuration
does not interfere with tests.
Fix documentation to indicate that the default mech config file is in
sysconfdir, not necessarily /etc.
Commit c426ef2ca2ba45dbf96f5380cf7d153ec0679424 added
KRB5_PADATA_PAC_OPTIONS to krb5.hin, but did not put it in an API
index, causing a documentation build failure. Add it now.
Robbie Harwood [Fri, 30 Aug 2019 15:19:52 +0000 (11:19 -0400)]
Remove null check in krb5_gss_duplicate_name()
Within the krb5 mechanism, we require minor_status to be writable
without checking. Remove the null check in krb5_gss_duplicate_name()
to squash a forward-null defect.
Robbie Harwood [Fri, 30 Aug 2019 15:16:58 +0000 (11:16 -0400)]
Squash apparent forward-null in clnttcp_create()
clnttcp_create() only allows raddr to be NULL if *sockp is set.
Static analyzers cannot know this, so can report a forward null
defect. Add an raddr check before calling connect() to squash the
defect.
Isaac Boukris [Sun, 12 May 2019 11:20:29 +0000 (11:20 +0000)]
Add tests for local and cross-realm RBCD requests
Add fake PAC generation and verification facilities to the test KDB
module, and implement the get_authdata_info() and
allowed_to_delegate_from() methods. In t_s4u.py, construct realms
using the test KDB module and test a variety of RBCD scenarios.
Greg Hudson [Thu, 22 Aug 2019 16:38:14 +0000 (12:38 -0400)]
Add minimal cross-realm support to test KDB module
Cross-realm is already possible with the test KDB module, but because
the lookup realm is not included in the profile query or key
derivation, inbound cross-TGTs are implicit and use the same keys as
the local TGT, potentially obscuring bugs. Add the lookup realm to
key derivation so that they use different keys.
Isaac Boukris [Mon, 24 Jun 2019 10:06:38 +0000 (13:06 +0300)]
Fix authdata signatures for non-TGT AS-REQs
PACs (as well as anything wrapped in CAMMAC) should be signed using
the local TGT key. Cross-realm TGS requests, ticket renewal and
validation requests, and non-TGT AS requests currently do not pass the
local TGT DB entry or its key to sign_authdata(), forcing the KDB
module to do a redundant lookup in order to properly sign PACs.
Rename the existing krbtgt and krbtgt_key parameters to header_server
and header_key, to better indicate that they are for the header ticket
server. For AS requests, pass NULL for these parameters instead of
passing a duplicate of server/server_key.
Add local_tgt and local_tgt_key parameters for the realm's local TGT
and its first key.
Isaac Boukris [Wed, 7 Aug 2019 19:39:10 +0000 (19:39 +0000)]
Add API to get client account name from PAC
Add a krb5_pac_get_client_info() API to interpret the PAC_CLIENT_INFO
buffer of a PAC. This API is needed by KDB plugin modules to set the
reply client for cross-realm RBCD requests.
Isaac Boukris [Wed, 7 Aug 2019 19:41:25 +0000 (19:41 +0000)]
Add KDC support for RBCD requests
Add two new KDB methods to support resource-based constrained
delegation. The get_authdata_info method extracts the client
principal for the authdata (necessary for cross-realm RBCD requests as
the evidence ticket is a cross-realm TGT with the requested client's
authdata), and also returns an opaque pointer for consumption by other
KDB methods. The allowed_to_delegate_from method performs a
constrained delegation policy check on the principal entry of the
target principal.
Add the server principal and abstract authdata representation to the
sign_authdata method. Also pass the second ticket server as
header_server since we pass the authorization data from the second
ticket, and pass the impersonated client (if it is in the local realm)
as client instead of the impersonator.
Add core KDC code for RBCD requests. For local RBCD requests
(impersonator and target in the same realm), KDC handling is similar
to existing constrained delegation support. The evidence ticket is
not required to be forwardable, and allowed_to_delegate_from is used
in preference to check_allowed_to_delegate.
For cross-realm RBCD requests, the KDC could be in the impersonator
realm, the target realm, or in a transit realm between the two. In
the transit realm case, the request looks like a regular cross-realm
request for a krbtgt service except for the information in the PAC, so
this case is handled by the KDB module sign_authdata() method.
[ghudson@mit.edu: made style and documentation edits; edited commit
message]
Isaac Boukris [Sat, 3 Aug 2019 21:57:14 +0000 (21:57 +0000)]
Add KDC support functions for PA-PAC-OPTIONS
Add helper functions kdc_get_pa_pac_options() and
kdc_add_pa_pac_options(), to retrieve PA-PAC-OPTIONS values from
request padata and to set a PA-PAC-OPTIONS value in encrypted padata.
Don't actually call kdc_add_pa_pac_options() yet.
[ghudson@mit.edu: rewrote commit message; minor style edits]
Isaac Boukris [Tue, 12 Mar 2019 19:59:55 +0000 (21:59 +0200)]
S4U2Proxy evidence tickets needn't be forwardable
With the introduction of resource-based constrained delegation, the
absence of the forwardable flag no longer implies that a ticket cannot
be used for constrained delegation requests.
Instead, we should check in the PAC to see if the user is marked as
sensitive, and error out in that case rather than making a failed
request. But we don't always have access to the PAC and we currently
do not have the code to retrieve this attribute from the PAC.
Since krb5_get_credentials_for_proxy() no longer needs to look at the
decrypted ticket, change kvno to not require a keytab for constrained
delegation.
[ghudson@mit.edu: made minor style changes and commit message edits;
updated documentation]
Isaac Boukris [Thu, 20 Jun 2019 05:00:06 +0000 (05:00 +0000)]
Add RBCD client support
When making S4U2Proxy requests, include a PA-PAC-OPTIONS pa-data
element advertising resource-based constrained delegation support. If
the KDC returns a referral TGT for the initial request and advertises
RBCD support, chase referrals to the target realm with both a regular
and proxy TGT, and make an S4U2Proxy request to the target realm with
the proxy TGT as evidence ticket.
Because cross-realm S4U2Proxy requests must use referrals, an explicit
foreign realm in the server name cannot be honored. In the GSSAPI
krb5 mech, if a host-based server name is used, omit the realm (if one
was obtained from [domain_realm] or similar) when calling
krb5_get_credentials() for constrained delegation.
[ghudson@mit.edu: rewrote commit message; made style changes]
Isaac Boukris [Sun, 16 Jun 2019 21:21:38 +0000 (00:21 +0300)]
Move S4U2Proxy client code to s4u_creds.c
Add an internal libkrb5 interface k5_get_proxy_cred_from_kdc(), which
implements S4U2Proxy requests synchronously. Call it from
krb5_get_credentials() if constrained delegation is requested.
[ghudson@mit.edu: rewrote commit message; made style changes]
Greg Hudson [Thu, 22 Aug 2019 20:19:12 +0000 (16:19 -0400)]
Simplify krb5_dbe_def_search_enctype()
Key data is now sorted in descending kvno order (since commit 44ad57d8d38efc944f64536354435f5b721c0ee0) and key enctypes can be
compared with a simple equality test (since single-DES support was
removed in commit fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8). Use
these assumptions to simplify krb5_dbe_def_search_enctype().
The rewrite contains one probably-unnoticeable bugfix: if enctype,
salttype, and kvno are all given as -1 in a repeated search, yield all
key entries of permitted enctype, not just entries of the maximum
kvno.
Greg Hudson [Wed, 7 Aug 2019 21:51:17 +0000 (17:51 -0400)]
Allow the KDB to see and modify auth indicators
Amend the sign_authdata method signature to include a modifiable
auth_indicators array. Bump the DAL major version and the libkdb5
soname. Add a test case using the test KDB module.
Greg Hudson [Thu, 22 Aug 2019 06:04:28 +0000 (02:04 -0400)]
Track first local TGT key in KDC code
Decrypt the first local TGT key in get_local_tgt() and save it in the
AS and TGS processing functions. (As we now sort key data by
descending kvno, this is guaranteed to be the most recent key.) Pass
this key to the authdata and FAST cookie functions to simplify cookie
encryption and authdata signing. Decryption and verification
functions must still sometimes decrypt earlier keys to process tickets
predating the last local TGT key rollover.
Isaac Boukris [Sat, 17 Aug 2019 22:59:25 +0000 (22:59 +0000)]
Change definition of KRB5_KDB_FLAG_CROSS_REALM
Set the CROSS_REALM flag if the header ticket was issued by a
different realm, instead of when the client is part of a different
realm. The affected corner cases are:
* In the final request of a cross-realm S4U2Self request, the header
ticket client is local but the header ticket was issued by a
different realm. The CROSS_REALM flag will now be set in this case.
* If a foreign client renews or validates a locally issued ticket, the
CROSS_REALM flag will no longer be set.
* If a foreign client requests a local TGT and then uses it to make a
request, the CROSS_REALM flag will no longer be set.
Also add a new flag KRB5_KDB_FLAG_ISSUING_REFERRAL, which is set when
the KDC decides to issue a referral or alternate TGT. Use the new
flag meanings to simplify S4U2Self processing.
[ghudson@mit.edu: edited comments and commit messages]
Greg Hudson [Mon, 19 Aug 2019 04:51:07 +0000 (00:51 -0400)]
Remove KRB5_KDB_XREALM_NON_TRANSITIVE code
validate_transit_path() was introduced in the mskrb-integ merge, but
the flag it enforces has no documentation and no kadmin support.
Remove the function and the flag. Also remove the
KRB5_KDB_TICKET_GRANTING_SERVICE flag which has no associated code.
Greg Hudson [Fri, 9 Aug 2019 05:17:54 +0000 (01:17 -0400)]
Improve daemon checking in Python test scripts
If a daemon exits early and we detect it with check_daemon(), avoid
trying to terminate it again as the process entry will have been
reaped. Check all daemons on successful exit and exit with an error
if any daemons exited early.
Also remove a piece of Python 2.5 compatibility code which is no
longer relevant with Python 3.
Greg Hudson [Wed, 14 Aug 2019 15:46:14 +0000 (11:46 -0400)]
Don't skip past zero byte in profile parsing
In parse_quoted_string(), only process an escape sequence if there is
a second character after the backlash, to avoid reading past the
terminating zero byte. Reported by Lutz Justen.
Robbie Harwood [Wed, 14 Aug 2019 17:52:27 +0000 (13:52 -0400)]
Fix KCM client time offset propagation
An inverted status check in get_kdc_offset() would cause querying the
offset time from the ccache to always fail (silently) on KCM. Fix the
status check so that KCM can properly handle desync.
Robbie Harwood [Fri, 9 Aug 2019 18:07:22 +0000 (14:07 -0400)]
Initialize life/rlife in kdcpolicy interface
A value of 0 indicates that the plugin doesn't wish to modify lifetimes.
Make this the default, rather than requiring all plugins to set these
values themselves.
Greg Hudson [Mon, 5 Aug 2019 19:39:34 +0000 (15:39 -0400)]
Clean up default ccache in dejagnu test suite
The dejagnu test suite could fail due to a leftover tmpdir/tkt ccache
containing expired tickets. Remove the ccache file along with the
keytab in delete_db. (The file cpw_keytab, formerly written as
cpw_srvtab, is not used in the dejagnu tests and has not been used
going back to 1.0, so replace that removal with the removal of
tmpdir/tkt.)
Greg Hudson [Mon, 5 Aug 2019 05:53:51 +0000 (01:53 -0400)]
Fix memory leaks in soft-pkcs11 code
Fix leaks detected by asan in t_pkinit.py. Add a helper to free a
struct st_object and free objects in C_Finalize(). Duplicate the X509
cert in add_certificate() instead of creating aliases so it can be
properly freed. Start the session handle counter at 1 so that
C_Finalize() won't confuse the first session handle with
CK_INVALID_HANDLE (defined to 0 in pkinit.h) and will properly clean
the session object.
Greg Hudson [Sat, 3 Aug 2019 16:42:26 +0000 (12:42 -0400)]
Display daemon output in Python test scripts
In k5test.py, if a daemon process exits before we terminate it,
display the exit status. If a daemon process generates output beyond
the sentinel, display the output before terminating the process.
Greg Hudson [Thu, 1 Aug 2019 21:55:42 +0000 (17:55 -0400)]
Require Python 3.2.4 for test scripts
In Python 3 releases before 3.2.4, the subprocess.Popen.communicate
method does not accept string inputs when universal_newlines=True is
set (see https://bugs.python.org/issue16903).
Also substitute the minimum Python version displayed by "make
check-pytests-no" from configure.ac to help keep it in sync with the
minimum version we check for.
Remove t_replay.c, which wasn't used or built by default and no longer
works with the simplified replay cache interface. Add t_rcfile2.c to
the sources and rebuild dependencies.
In the unlikely case of an all-zero tag, rc_file2.c:store() could
mistake an empty record for a replay. Check that records from the
file are non-empty (by checking that the timestamp is non-zero) before
comparing them to the tag.
Rewriting the qualname Perl script to use getaddrinfo created an
unchecked dependency on Perl 5.14. Instead, remove the script and use
the C program in tests/resolve for the kadmin and gssrpc test suites.
Commit e23d24beacb73581bbf4351250f3955e6fd44361 missed some Python
scripts, in part because of the "PYTHON = python" line in
src/Makefile.in from commit 7be2ef2b6c8c491781251a5023db48d7690f5fa8.
Remove that line and convert the remaining scripts. Also fix the
check-pytests-no warning to mention Python 3 instead of Python 2.5.
Nothing in the code removes objects from soft_token.object.obs, so
simplify add_st_object() not to search for an empty slot. Avoid using
random() by using a counter for session handles and just the array
slot number for object handles. Add a helper get_rcfilename() to
facilitate checking the result of asprintf(). Properly initialize ap
in sprintf_fill(). Close the file handle in read_conf_file().
In the utilities used by the dejagnu test suites, use
getaddrinfo()/getnameinfo() instead of
gethostbyname()/gethostbyaddr(), as the results can vary when the
local hostname appears in multiple lines in /etc/hosts.
In t_ccselect.py, don't cause an error if the canonicalized local
hostname is "localhost". The tests will continue to run in this case,
as long as we don't try to create duplicate principals.
In sim_server.c, bind to the wildcard address instead of the resolved
local hostname, to resolve a mysterious problem observed in Travis
where the second of three sim_client send() operations fails with
ECONNREFUSED.
Michael Mattioli [Sun, 14 Jul 2019 21:35:17 +0000 (17:35 -0400)]
Correct documentation of final profiles
The documentation for krb5.conf explaining final values is incorrect.
Only sections and subsections may usefully be marked as final, and
final designations only apply to later files, not to the same file.
[ghudson@mit.edu: corrected and shortened documentation; rewrote
commit message]
krb5_ktfile_get_entry() used krb5_c_enctype_compare() to compare
enctypes, in order to share keys between single-DES enctypes. As
key-sharing between enctypes is no longer done and single-DES support
has been removed, use a simple equality test to match the enctype.
This fixes a bug where krb5_kt_get_entry() would error out if the
keytab contained any entries with invalid enctypes (include single-DES
entries, after commit fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8) even
if a matching entry is found.
Greg Hudson [Fri, 7 Jun 2019 16:51:36 +0000 (12:51 -0400)]
Update edwards25519 code from BoringSSL
Bring the SPAKE edwards25519.c code up to date with BoringSSL, adding
edwards25519_fiat.h to contain the Fiat-generated code which BoringSSL
has split out. The relevant BoringSSL commits are:
The updated code avoids undefined signed left-shift behavior (not a
problem in practice, so far) and compiles to faster code with gcc on
platforms where the 64-bit code cannot be used.
Robbie Harwood [Fri, 28 Jun 2019 17:09:47 +0000 (13:09 -0400)]
Remove now-unused checksum functions
fb2dada5eb89c4cd4e39dedd6dbb7dbd5e94f8b8 removed all call sites of
krb5int_cbc_checksum(), krb5int_confounder_verify(), and
krb5int_confounder_checksum(), but neglected the functions themselves.
Greg Hudson [Tue, 18 Jun 2019 17:06:44 +0000 (13:06 -0400)]
Remove PKINIT draft 9 support
PKINIT draft 9 support is required to interoperate with Windows 2000,
Windows XP, and Windows Server 2003, all of which are well beyond
end-of-life. Remove it.
Greg Hudson [Thu, 20 Jun 2019 14:45:18 +0000 (10:45 -0400)]
Add soft-pkcs11 source code
soft-pkcs11 is no longer available upstream and is not generally
packaged in distributions, making it inconvenient to use for tests.
Import the 1.8 source code, detabified and with trailing whitespace
removed but otherwise unmodified.
Greg Hudson [Thu, 20 Jun 2019 02:31:57 +0000 (22:31 -0400)]
Improve Travis test coverage and simplify config
Specify the xenial (16.04) image, as Travis still sometimes uses 14.04
by default. Use cmocka from the package repository instead of
building it. Remove python3-paste as paste is no longer a test
dependency, but add python3-kdcproxy. Install pyrad via pip3 as the
Ubuntu-packaged version still has the assertion bug.
Greg Hudson [Wed, 19 Jun 2019 04:57:30 +0000 (00:57 -0400)]
Convert OTP and kdcproxy tests to Python 3
Commit e23d24beacb73581bbf4351250f3955e6fd44361 did not convert
t_otp.py or paste-kdcproxy.py. Convert t_otp.py to Python3. Rewrite
paste-kdcproxy.py using wsgiref from the standard Python library to
avoid the Paste dependency.
Greg Hudson [Tue, 11 Jun 2019 15:26:04 +0000 (11:26 -0400)]
Use krb5_flags_to_strings() in kproplog
Remove the local flags table in kproplog.c and instead use
krb5_flags_to_strings(), as was done for kadmin.c in commit 971fae8285427b27dfd8c9a535a18eb588ee0689.
Isaac Boukris [Mon, 10 Jun 2019 12:33:06 +0000 (15:33 +0300)]
Verify PAC client name independently of name-type
In krb5_pac_verify(), unparse the provided principal name and compare
using strcmp(), instead of parsing pac principal, in order to avoid
relying on the provided name type.
This change is needed for tickets issued with cross-realm S4U2Proxy
(with resource-based constrained delegation), because the final
request uses a cross-TGT as the evidence ticket, so the ticket client
name is taken from the PAC and does not preserve the name type.
Microsoft KDCs use NT-MS-PRINCIPAL as the ticket client name type in
this case, regardless of the original name type.
[ghudson@mit.edu: rewrote commit message; made minor style edits]
Greg Hudson [Mon, 3 Jun 2019 20:12:03 +0000 (16:12 -0400)]
Add new internal pa-data helpers
Add a new file with five new internal libkrb5 functions to help manage
pa-data lists. Move krb5int_find_pa_data() from fast.c into the new
file and simplify it slightly.
Greg Hudson [Thu, 6 Jun 2019 15:35:36 +0000 (11:35 -0400)]
Improve logging documentation
The default severity was removed by commit 6ce8fd4cfa2e9b1e92debd204a5b2ddf053cca55 (ticket 8630) but the example
still talks about it; remove that text. Add a note about the default
being syslog if nothing else is specified, and a note on how to
disable logging.
Greg Hudson [Thu, 6 Jun 2019 15:46:58 +0000 (11:46 -0400)]
Remove strerror() calls from k5_get_error()
Coverity models strerror() as a function which cannot accept negative
values, even though it has defined behavior on all integers.
k5_get_error() contains code to call strerror_r() and strerror() if
its fptr global is unset, which isn't an expected case in practice.
To silence a large number of Coverity false positives, just return a
fixed string if fptr is null.
Greg Hudson [Sat, 1 Jun 2019 19:08:24 +0000 (15:08 -0400)]
Make rcache file2 code slightly more robust
In rc_file2.c:store(), when making note of available records,
explicitly check for an empty record (r1stamp or t2stamp is 0), to
more closely match the check for terminating the search. This
silences a Coverity false positive, as Coverity does not assume that
now > skew as it would be in practice.
To preserve code readability, shorten some variable names, add an
expired() inline helper function, and add comments.
Michael Mattioli [Sun, 26 May 2019 15:50:21 +0000 (11:50 -0400)]
Update HTTP links
Move http links to https where appropriate. Update links which have
moved. Remove a couple of links which no longer work and have no
obvious replacement. Remove a link from a comment in the German
translation which does not appear to be related to the message.
Greg Hudson [Sat, 1 Jun 2019 17:37:14 +0000 (13:37 -0400)]
Simplify and modernize replay cache interface
Remove all of the replay cache methods except for resolve, close, and
store. Rename the dispatch functions to use a k5_ prefix to indicate
that they are not part of the libkrb5 API. Remove the unused code for
registering replay cache types at runtime.
Remove the krb5_donot_replay structure, as the only concrete replay
cache type just needs the authenticator checksum. Identify the
checksum part of the authenticator ciphertext at the dispatch layer.
Handle container allocation at the dispatch layer so that each replay
cache type only needs to work with its data pointer. Remember the
full name at the dispatch layer to implement a get_name operation.
Consolidate what remains of rcfns.c and rc_conv.c into rc_base.c.
Use k5_rc_default() in preference to krb5_get_server_rcache() since
they now do the same thing. Remove the sim_client code to create a
replay cache, as the per-message functions use a memory reply cache
now.
Greg Hudson [Fri, 17 May 2019 17:45:08 +0000 (13:45 -0400)]
Add KRB5RCACHENAME and default_rcache_name
In krb5_get_server_rcache(), stop constructing a residual value based
on piece and the euid, and instead resolve default replay cache
(previously an unused operation, as krb5_rc_default() was not part of
the API and was never used).
To determine the default replay cache name, try the KRB5RCACHENAME
environment variable first, and then try KRB5RCACHETYPE for
compatibility. If neither of those environment variables are set, try
the default_rcache_name profile relation in [libdefaults] before
falling back to "dfl:".
Greg Hudson [Wed, 15 May 2019 05:01:34 +0000 (01:01 -0400)]
Use file2 replay cache by default
Remove the existing default replay cache implementation and replace it
with a wrapper around the file2 replay cache code. Change the
filename to krb5_EUID.rcache2, ignoring the residual (and therefore
the server principal name). On Windows, use the local appdata
directory if KRB5RCACHEDIR is not set in the environment.
Greg Hudson [Tue, 19 Feb 2019 06:30:41 +0000 (01:30 -0500)]
Add tag to krb5_donot_replay
For each use of replay caches, supply a tag based on a ciphertext or
checksum associated with the use. Stop creating or checking replay
records for unencrypted KRB-CRED messages.
When neither the send-encrypted-sad nor the use-sad-as-key flag is set
in the SAM-2 challenge, the protocol calls for the AS key to be
combined with the string-to-key of the SAD using a key combination
method which has only been implemented for DES and 3DES enctypes.
Rather than extending key combination, remove support for this case.
Greg Hudson [Wed, 22 May 2019 17:05:15 +0000 (13:05 -0400)]
Simplify kdb5_util global argv processing
kdb5_util could issue an unexplained error if a command argument
matched a command name, such as when trying to load a dump file named
"dump". It could also mysteriously work if the command name and its
arguments were misordered, such as "kdb5_util kdb.dump load".
In the main option loop, build cmd_argv without special-casing command
names; then look up cmd_argv[0] after the loop.
Greg Hudson [Tue, 28 May 2019 16:16:41 +0000 (12:16 -0400)]
Stop double-caching referral tickets
Caching referral tickets under two names can generate duplicate cache
entries, and is speculative--if credentials are requested with the
referral realm, there is no good reason to expect a subsequent request
with the canonical realm. Only cache under the referral realm.
Greg Hudson [Tue, 28 May 2019 16:02:00 +0000 (12:02 -0400)]
In klist, display ticket server if different
If the ticket server differs from the credential server, display it as
an extra field. This happens most commonly when the credential is
cached under the referral realm.
Greg Hudson [Tue, 21 May 2019 17:34:39 +0000 (13:34 -0400)]
Display unsupported enctype names
Add a table of unsupported enctype numbers to enctype_util.c and
consult it in krb5_enctype_to_name(). Treat unsupported enctype
numbers as deprecated in krb5int_c_deprecated_enctype(). In kadmin,
display "UNSUPPORTED:" before invalid enctype names.
Robbie Harwood [Fri, 24 May 2019 17:12:03 +0000 (13:12 -0400)]
Remove support for single-DES and CRC
Single-DES removal brings us closer to compliance with RFC 6649.
Single-DES was disabled by default starting in release 1.8, and
user-visible deprecation warnings were issued starting in release
1.17.
Robbie Harwood [Fri, 24 May 2019 17:11:44 +0000 (13:11 -0400)]
Remove the v4 and afs3 salt types
In preparation for removing single-DES support, remove the v4 and afs3
salt types. The afs3 salt type could only be used with single-DES
keys, and the v4 salt type was only useful for single-DES keys from
krb4 databases.
Greg Hudson [Tue, 28 May 2019 14:55:56 +0000 (10:55 -0400)]
Fix Python fallback in configure.ac
Commit 2bd410ecdb366083fe9b4e5f6ac4b741b624230b (ticket 8709)
contained a typo "text" for "test", preventing the Python path check
from falling back from python2 to python. This is now a fallback from
python3 to python, but the typo remains. Fix it now.
Remove rcsid.sty and the uses of the \rcsId macro as git does not
perform the keyword expansion necessary to make it work. Add comments
indicating the historic status of the kadm5 documentation.
[ghudson@mit.edu: fix the tex files instead of marking them as
non-building]
Robbie Harwood [Thu, 2 May 2019 20:57:51 +0000 (16:57 -0400)]
Remove dead variable def_kslist from two files
def_kslist was part of kdb5_create.c since its addition (commit edf8b4d8a6a665c2aa150993cd813ea6c5cf12e1) and has always been
irrelevant since the rblock structure is fully initialized in
kdb5_create().
Robbie Harwood [Mon, 13 May 2019 18:19:57 +0000 (14:19 -0400)]
Remove checksum type profile variables
Remove support for the krb5.conf relations ap_req_checksum_type,
kdc_req_checksum_type, and safe_checksum_type. These values were
useful for interoperating with very old KDCs, which should no longer
be deployed.
Additionally, kdc_req_checksum_type was incorrectly documented as only
applying to single-DES keys; in practice it also worked for RC4. The
other two were not clearly documented, but safe_checksum_type did
allow use of hmac-md5-rc4 for any enctype, and ap_req_checksum_type
did not impose any limitations.
projects / thirdparty / krb5.git / log
