Luke Howard [Mon, 9 May 2011 22:05:48 +0000 (22:05 +0000)]
fix regression in r24853: PAC no longer exposed
Windows PAC is not AD-KDCIssued, rather it is signed with the long-term
service session key (or user-to-user key). Advertise this correctly in
the internal authorization data SPI.
Greg Hudson [Mon, 9 May 2011 18:41:03 +0000 (18:41 +0000)]
Kernel subset
Add a directory containing a "kernel subset" (context import and
message functions only) of the gss-krb5 library, with a test framework
to exercise the functionality and indicate when unknown dependencies
creep in.
Greg Hudson [Mon, 9 May 2011 17:28:07 +0000 (17:28 +0000)]
Delete sec context properly in gss_krb5_export_lucid_sec_context
Since r21690, gss_krb5_export_lucid_sec_context() has been passing a
union context to krb5_gss_delete_sec_context(), causing a crash as the
krb5 routine attempts to interpret a union context structure as a krb5
GSS context. Call the mechglue gss_delete_sec_context instead.
Greg Hudson [Mon, 2 May 2011 20:45:38 +0000 (20:45 +0000)]
Add poll support to sendto_kdc.c so that it can work in processes with
large numbers of open files. Move krb5int_cm_call_select() to a
separate file so that the poll support doesn't interfere with
net-server.c's continuing use of select.
Greg Hudson [Mon, 2 May 2011 15:37:38 +0000 (15:37 +0000)]
r24899 moved the declarations of krb5int_mk_chpw_req and related
functions from k5-int.h to int-proto.h. The removal of those
declarations from k5-int.h was accidentally omitted from the commit;
commit it now.
The MIT krb5 and Heimdal implementations of
gss_krb5_export_lucid_sec_context error on version arguments other
than 1, so the version negotiation described in the function
documentation would not be backward-compatible. Change the docs so
that the caller can assume the returned structure is of the requested
version, but the caller will be responsible for retrying with lower
version numbers on error. (Unfortunately, Heimdal and MIT return
different error codes, and MIT's is in a currently-unpublished header,
so we can't document the error code for unknown versions.)
Correctly set the expiration field of impersonated credentials in
kg_compose_deleg_cred(), so we can find them in the cache in
init_sec_context. From aberry@likewise.com.
Refactor krb5int_rd_chpw_rep() and make it properly handle both framed
and unframed KRB-ERROR messages. Eliminate krb5int_rd_setpw_rep() and
krb5int_setpw_result_code_string() by making the chpw versions of
those functions handle RFC 3244 replies.
Do not reference krb5_chpw_result_code_string in
krb5_change_password() documentation, as it is not a public function.
Do not falsely claim that the result_code_string parameter is unused.
Since there is conflicting precedent as to whether dotfile man pages
should be installed with or without the leading dot, install the
.k5login man page both ways.
The dispatch() in kadmind's schpw.c could return a failure code with
an allocated response container. net-server.c does not expect this
and leaks the container in the UDP case. Free the container in
dispatch() if we are returning an error.
Check mech_type as well as mech_name in gssint_import_internal_name(),
for the sake of static analyzers. (Also, since this is an internal
function, it can be called on a half-constructed MN; checking the type
alone would be insufficient.)
Revert r24826. Export krb5int_nfold from libk5crypto and link t_nfold
against libk5crypto, matching the approach used in most other library
unit tests.
Tom Yu [Wed, 13 Apr 2011 18:43:37 +0000 (18:43 +0000)]
Fix the sole case in process_chpw_request() where a return could occur
without allocating the data pointer in the response. This prevents a
later free() of an invalid pointer in kill_tcp_or_rpc_connection().
Also initialize rep->data to NULL in process_chpw_request() and clean
up *response in dispatch() as an additional precaution.
In krb5_gss_display_status, correct the sense of the
g_make_string_buffer test, and return GSS_S_FAILURE if it fails.
Reported by snambakam@likewise.com.
Implement gss_authorize_localname, as discussed on the kitten list,
and make gss_userok a wrapper around it matching the Gnu GSS
prototype. The SPI for gss_authorize_localname doesn't match the API
since we have no way of representing the contents of an internal name
to a mech at the moment. From r24855, r24857, r24858, r24862, r24863,
r24864, r24866, r24867, and r24868 in
users/lhoward/moonshot-mechglue-fixes.
Add k5_kt_get_principal, an internal krb5 interface to try to get a
principal name from a keytab. Used currently by vfy_increds.c (in
place of its static helper); will also be used when querying the name
of the default gss-krb5 acceptor cred.
In the authdata framework, determine which authdata sources to query
based on the module's usage flags. From r24794 in
users/lhoward/moonshot-mechglue-fixes.
Allow anonymous name to be imported with empty name buffer
When importing a name of type GSS_C_NT_ANONYMOUS, allow the input name
buffer to be null or empty (null is translated into empty before
mechanisms see it).
From r24820 in users/lhoward/moonshot-mechglue-fixes.
Preserve attributes when duplicating a name, using the mechanism's
implementation of gss_duplicate_name if present, or a loop over
the attributes if not.
More sensical mech selection for gss_acquire_cred/accept_sec_context
If a caller passes an empty mech set to gss_acquire_cred, get a cred
for all mechs instead of just the krb5 mech, as we don't know what
mechanism the cred is going to be used with (particularly in the
acceptor case). As a related fix, if a caller passes a credential to
gss_accept_sec_context and it does not contain a mech-specific cred
for the token's mech, error out instead of using the default cred with
the token's mechanism.
r24838 accidentally added a gss_duplicate_name line to
build_dynamicMech(), breaking the build (since gss_duplicate_name
isn't in gss_mechanism yet). Revert that part of the change.
Prevent bleed-through of mechglue symbols into loaded mechs
When loading a mech's symbols individually, make sure the symbol we
got wasn't just a mechglue symbol showing through because the mech
was linked against the mechglue. From r24719 in
users/lhoward/moonshot-mechglue-fixes.
Resurrect gss_userok and gss_pname_to_uid in the mechglue. Add krb5
mech implementations using krb5_kuserok and krb5_aname_to_localname,
as well as mechanism-independent implementations based on name
attributes.
From r24710, r24715, r24717, r24731, r24732, r24733, r24734, r24735,
r24747, r24816, and r24819 in users/lhoward/moonshot-mechglue-fixes,
with minor edits.
In libkrb5, move krb5int_auth_con_chkseqnum to a new file privsafe.c,
renamed to k5_privsafe_check_seqnum. Declare it in int-proto.h rather
than k5-int.h.
Add gss_encapsulate_token(), gss_decapsulate_token(), and
gss_oid_equal() APIs, which are already present in Heimdal and Shishi.
From r24737, r24738, and r24740 in
users/lhoward/moonshot-mechglue-fixes.
Greg Hudson [Tue, 29 Mar 2011 22:44:30 +0000 (22:44 +0000)]
In r21175 (on the mskrb branch, merged in r21690) the result codes for
password quality and other errors were accidentally reversed. Fix
them so that password quality errors generate a "soft" failure and
other errors generate a "hard" failure, as Heimdal and Microsoft do.
Also recognize KADM5_PASS_Q_GENERIC (added in 1.9) as a password
quality error.
Zhanna Tsitkov [Tue, 29 Mar 2011 16:22:05 +0000 (16:22 +0000)]
If the new configuration data that is passed to krb5_cc_set_config is NULL, just remove the old configuration.
Moved short krb5_cc_set_config usage example from krb5.hin into the separate file.
Zhanna Tsitkov [Tue, 29 Mar 2011 15:19:41 +0000 (15:19 +0000)]
Updated the documentation for the krb5_ error_message function family.
Created the directory doc/doxy_examples/ to hold examples used in the doxygen documentation.
Added usage example for the krb5_get/set/free_error_message functions
Greg Hudson [Mon, 28 Mar 2011 23:35:54 +0000 (23:35 +0000)]
Remove the weak key checks from the builtin rc4 enc provider. There
is no standards support for avoiding RC4 weak keys, so rejecting them
causes periodic failures. Heimdal and Microsoft do not check for weak
keys. Attacks based on these weak keys are probably thwarted by the
use of a confounder, and even if not, the reduction in work factor is
not terribly significant for 128-bit keys.
Greg Hudson [Mon, 28 Mar 2011 17:05:54 +0000 (17:05 +0000)]
Use first principal in keytab when verifying creds
In krb5_verify_init_creds(), use the first principal in the keytab
to verify the credentials instead of the result of
krb5_sname_to_principal(). Also add tests.
Greg Hudson [Thu, 24 Mar 2011 01:24:42 +0000 (01:24 +0000)]
Fix DAL documentation to recommend using krb5_db_get_context() and
krb5_db_set_context() instead of directly accessing
context->dal_handle->db_context (which requires internal headers).
Zhanna Tsitkov [Fri, 18 Mar 2011 20:48:06 +0000 (20:48 +0000)]
Move doxygen comments from source to header. Updated comments and added some usage examples.
Affected functions: krb5_cc_get_config, krb5_cc_set_config, krb5_is_config_principal
projects / thirdparty / krb5.git / log
