Greg Hudson [Fri, 17 Jun 2011 13:44:33 +0000 (13:44 +0000)]
Convert preauth_plugin.h to new plugin framework
The preauth plugin interface was introduced in 1.6 but was never made
a public API. In preparation for making it public in 1.10, convert it
to use the new plugin framework. This will require changes to any
existing preauth plugins.
A number of symbols were renamed for namespace cleanliness, and
abstract types were introduced for module data and module per-request
data for better type safety.
On the consumer end (preauth2.c and kdc_preauth.c), this is a pretty
rough conversion. Eventually we should create proper consumer APIs
with module handles, and the flat lists of preauth types should hold
pointers to module handles rather than copies of the vtables. The
built-in preauth type handlers should then be converted to built-in
module providers linked into the consumer code (as should encrypted
challenge, since it has no external dependencies). None of this will
impact the provider API for preauth plugins, so it can wait.
Greg Hudson [Mon, 13 Jun 2011 18:54:33 +0000 (18:54 +0000)]
Fix old-style GSSRPC authentication
r24147 (ticket #6746) made libgssrpc ignorant of the remote address of
the kadmin socket, even when it's IPv4. This made old-style GSSAPI
authentication fail because it uses the wrong channel bindings. Fix
this problem by making clnttcp_create() get the remote address from
the socket using getpeername() if the caller doesn't provide it and
it's an IPv4 address.
Greg Hudson [Fri, 10 Jun 2011 18:17:22 +0000 (18:17 +0000)]
Add localization support to com_err
* Add compile_et arguments --textdomain and --localedir.
* Store text domain and localedir at the end of error tables.
* error_message() calls dgettext if the table has a text domain.
* add_error_table() calls bindtextdomain if the table has a localedir.
* Define N_() as no-op in generated source and mark up error messages.
* When using system compile_et, test for --textdomain support.
* Use --textdomain option when available.
* Run xgettext over generated sources in compile_et rule.
* Translate com_err results in krb5int_get_error() if com_err won't.
Greg Hudson [Sun, 5 Jun 2011 22:05:04 +0000 (22:05 +0000)]
Remove static error table list in built-in com_err
_et_list has been private to error_message.c since March 2004, and
since nothing in that file ever added entries to it, it is always
NULL. As it's not doing any good, get rid of it, and rename the
dynamic error table list to "et_list", along with its type. Also
remove some old lclint annotations.
Greg Hudson [Fri, 3 Jun 2011 01:00:52 +0000 (01:00 +0000)]
Restore fallback non-referral TGS request to same realm
MIT krb5 1.2 and earlier KDCs reject TGS requests if the canonicalize
bit is set. Prior to 1.9, we used to handle this by making a
non-referral fallback request on any error, but the rewrite in 1.9
mistakenly changed the behavior so that fallback requests are only
made if the original request used the referral realm and the fallback
realm is different from the default realm. Restore the old behavior.
Greg Hudson [Thu, 26 May 2011 18:05:49 +0000 (18:05 +0000)]
Restore krb5_get_credentials caching for referral requests
The krb5_get_credentials() rewrite for IAKERB accidentally omitted the
final step of restoring the requested realm in the output credentials.
As a result, referral entries are not cached, and the caller sees the
actual realm in (*out_creds)->server instead of the referral realm as
before. Fix this in complete() by swapping ctx->req_server into
ctx->reply_creds->server.
Greg Hudson [Sun, 22 May 2011 02:08:37 +0000 (02:08 +0000)]
Fix multiple tl-data updates over iprop
krb5_dbe_update_tl_data() accepts a single read-only tl-data entry,
but ulog_conv_2dbentry() expects it to process a full list. Fix
ulog_conv_2dbentry() to call krb5_db2_update_tl_data() on each entry
individually, simplifying its memory management in the process.
Greg Hudson [Fri, 20 May 2011 15:21:28 +0000 (15:21 +0000)]
Revert r5233 and mark get_age as deprecated in the DAL documentation.
We do not need to check reply retransmissions for staleness any more
than TCP needs to. A genuinely new request will have a different
nonce.
Zhanna Tsitkov [Mon, 16 May 2011 18:36:55 +0000 (18:36 +0000)]
In mk_rd_cred if recv_subkey in the authentication context is NULL and the decryption with the session key fails, do not try to decrypt the message with the session key again.
Greg Hudson [Mon, 16 May 2011 04:20:55 +0000 (04:20 +0000)]
Document the lockout-related options in kadmin (modprinc -unlock and
addpol/modpol -maxfailure, -failurecountinterval, and
-lockoutduration), in the man page and in admin.texinfo. Based on
text submitted by shawn.emery@oracle.com.
Greg Hudson [Mon, 16 May 2011 03:54:16 +0000 (03:54 +0000)]
In kadmin, try using get_date() for lockout-related duration inputs to
modpol and addpol, but still allow bare numbers of seconds since
that's what we took in 1.8 and 1.9. Use strdur() to display
lockout-related durations in getpol. Reported by
shawn.emery@oracle.com.
Greg Hudson [Sat, 14 May 2011 14:49:00 +0000 (14:49 +0000)]
Use hmac-md5 checksum for PA-FOR-USER padata
The MS-S4U documentation specifies that hmac-md5 be used for
PA-FOR-USER checksums; we were using the mandatory checksum type for
the key. Although some other checksum types appear to be allowed by
Active Directory KDCs, Richard Silverman reports that md5-des is not
one of them, causing S4U2Self requests to fail for DES keys.
Luke Howard [Mon, 9 May 2011 22:05:48 +0000 (22:05 +0000)]
fix regression in r24853: PAC no longer exposed
Windows PAC is not AD-KDCIssued, rather it is signed with the long-term
service session key (or user-to-user key). Advertise this correctly in
the internal authorization data SPI.
Greg Hudson [Mon, 9 May 2011 18:41:03 +0000 (18:41 +0000)]
Kernel subset
Add a directory containing a "kernel subset" (context import and
message functions only) of the gss-krb5 library, with a test framework
to exercise the functionality and indicate when unknown dependencies
creep in.
Greg Hudson [Mon, 9 May 2011 17:28:07 +0000 (17:28 +0000)]
Delete sec context properly in gss_krb5_export_lucid_sec_context
Since r21690, gss_krb5_export_lucid_sec_context() has been passing a
union context to krb5_gss_delete_sec_context(), causing a crash as the
krb5 routine attempts to interpret a union context structure as a krb5
GSS context. Call the mechglue gss_delete_sec_context instead.
Greg Hudson [Mon, 2 May 2011 20:45:38 +0000 (20:45 +0000)]
Add poll support to sendto_kdc.c so that it can work in processes with
large numbers of open files. Move krb5int_cm_call_select() to a
separate file so that the poll support doesn't interfere with
net-server.c's continuing use of select.
Greg Hudson [Mon, 2 May 2011 15:37:38 +0000 (15:37 +0000)]
r24899 moved the declarations of krb5int_mk_chpw_req and related
functions from k5-int.h to int-proto.h. The removal of those
declarations from k5-int.h was accidentally omitted from the commit;
commit it now.
The MIT krb5 and Heimdal implementations of
gss_krb5_export_lucid_sec_context error on version arguments other
than 1, so the version negotiation described in the function
documentation would not be backward-compatible. Change the docs so
that the caller can assume the returned structure is of the requested
version, but the caller will be responsible for retrying with lower
version numbers on error. (Unfortunately, Heimdal and MIT return
different error codes, and MIT's is in a currently-unpublished header,
so we can't document the error code for unknown versions.)
Correctly set the expiration field of impersonated credentials in
kg_compose_deleg_cred(), so we can find them in the cache in
init_sec_context. From aberry@likewise.com.
Refactor krb5int_rd_chpw_rep() and make it properly handle both framed
and unframed KRB-ERROR messages. Eliminate krb5int_rd_setpw_rep() and
krb5int_setpw_result_code_string() by making the chpw versions of
those functions handle RFC 3244 replies.
Do not reference krb5_chpw_result_code_string in
krb5_change_password() documentation, as it is not a public function.
Do not falsely claim that the result_code_string parameter is unused.
Since there is conflicting precedent as to whether dotfile man pages
should be installed with or without the leading dot, install the
.k5login man page both ways.
The dispatch() in kadmind's schpw.c could return a failure code with
an allocated response container. net-server.c does not expect this
and leaks the container in the UDP case. Free the container in
dispatch() if we are returning an error.
Check mech_type as well as mech_name in gssint_import_internal_name(),
for the sake of static analyzers. (Also, since this is an internal
function, it can be called on a half-constructed MN; checking the type
alone would be insufficient.)
Revert r24826. Export krb5int_nfold from libk5crypto and link t_nfold
against libk5crypto, matching the approach used in most other library
unit tests.
Tom Yu [Wed, 13 Apr 2011 18:43:37 +0000 (18:43 +0000)]
Fix the sole case in process_chpw_request() where a return could occur
without allocating the data pointer in the response. This prevents a
later free() of an invalid pointer in kill_tcp_or_rpc_connection().
Also initialize rep->data to NULL in process_chpw_request() and clean
up *response in dispatch() as an additional precaution.
In krb5_gss_display_status, correct the sense of the
g_make_string_buffer test, and return GSS_S_FAILURE if it fails.
Reported by snambakam@likewise.com.
Implement gss_authorize_localname, as discussed on the kitten list,
and make gss_userok a wrapper around it matching the Gnu GSS
prototype. The SPI for gss_authorize_localname doesn't match the API
since we have no way of representing the contents of an internal name
to a mech at the moment. From r24855, r24857, r24858, r24862, r24863,
r24864, r24866, r24867, and r24868 in
users/lhoward/moonshot-mechglue-fixes.
Add k5_kt_get_principal, an internal krb5 interface to try to get a
principal name from a keytab. Used currently by vfy_increds.c (in
place of its static helper); will also be used when querying the name
of the default gss-krb5 acceptor cred.
In the authdata framework, determine which authdata sources to query
based on the module's usage flags. From r24794 in
users/lhoward/moonshot-mechglue-fixes.
Allow anonymous name to be imported with empty name buffer
When importing a name of type GSS_C_NT_ANONYMOUS, allow the input name
buffer to be null or empty (null is translated into empty before
mechanisms see it).
From r24820 in users/lhoward/moonshot-mechglue-fixes.
Preserve attributes when duplicating a name, using the mechanism's
implementation of gss_duplicate_name if present, or a loop over
the attributes if not.
More sensical mech selection for gss_acquire_cred/accept_sec_context
If a caller passes an empty mech set to gss_acquire_cred, get a cred
for all mechs instead of just the krb5 mech, as we don't know what
mechanism the cred is going to be used with (particularly in the
acceptor case). As a related fix, if a caller passes a credential to
gss_accept_sec_context and it does not contain a mech-specific cred
for the token's mech, error out instead of using the default cred with
the token's mechanism.
r24838 accidentally added a gss_duplicate_name line to
build_dynamicMech(), breaking the build (since gss_duplicate_name
isn't in gss_mechanism yet). Revert that part of the change.
Prevent bleed-through of mechglue symbols into loaded mechs
When loading a mech's symbols individually, make sure the symbol we
got wasn't just a mechglue symbol showing through because the mech
was linked against the mechglue. From r24719 in
users/lhoward/moonshot-mechglue-fixes.
Resurrect gss_userok and gss_pname_to_uid in the mechglue. Add krb5
mech implementations using krb5_kuserok and krb5_aname_to_localname,
as well as mechanism-independent implementations based on name
attributes.
From r24710, r24715, r24717, r24731, r24732, r24733, r24734, r24735,
r24747, r24816, and r24819 in users/lhoward/moonshot-mechglue-fixes,
with minor edits.
projects / thirdparty / krb5.git / log
