summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Updates for krb5-1.22-prereleaseHEADmasterGreg Hudson2023-04-142-17/+30
|
* make regenGreg Hudson2023-04-1333-300/+332
|
* Update config.guess, config.subGreg Hudson2023-04-132-22/+59
|
* Update features list for 1.21Greg Hudson2023-04-131-0/+42
|
* Convey realm names to certauth modulesGreg Hudson2023-04-112-10/+23
| | | | | | | In the certauth pluggable interface, add an extended init method which receives the realm list. ticket: 9090 (new)
* Add PA-REDHAT-PASSKEY padata typePavel Březina2023-04-113-0/+3
| | | | | | | | | Recognize the Red Hat passkey preauth mechanism in trace messages, and add a declaration for it in krb5.h. [ghudson@mit.edu: edited comment and commit message] ticket: 9093 (new)
* Add GSS_C_INQ_ODBC_SESSION_KEYGreg Hudson2023-04-105-31/+93
| | | | | | | | | The Oracle database wire protocol contains a cipher reinitialization operation using the ticket session key. Add a query operation (similar to GSS_C_INQ_SSPI_SESSION_KEY) to retrieve the ticket session key rather than the subkey. ticket: 9091 (new)
* Update ax-pthread.m4 from autoconf archiveGreg Hudson2023-04-102-108/+145
| | | | Fixes a warning from autoconf 2.70 that $as_echo is obsolete.
* Run Github Actions on ubuntu-latest (not 18.04)Greg Hudson2023-04-102-7/+7
| | | | | | | | | | | | | | | | The ubuntu-18.04 image no longer works on Github Actions. Run most jobs on ubuntu-latest instead. libresolv-wrapper does not work on ubuntu-22.04 at this time (Launchpad bug #2015570), so don't install it for now. The URI discovery tests will be skipped until this is rectified. For the doc build, move doc-newest-sphix to ubuntu-latest; the Ubuntu version doesn't matter much for this build as it downloads sphinx from pypi.org. Move the doc-older-sphinx to ubuntu-22.04 (currently the same as ubuntu-latest), skipping ubuntu-20.04 as its version of doxygen (1.18.17) doesn't correctly the type declaration for krb5_const_principal.
* Squash unused variable warnings in kdb5_ldap_utilGreg Hudson2023-04-101-24/+16
|
* Squash a Berkeley DB warningGreg Hudson2023-04-101-27/+1
| | | | | | | | In __delpair(), the assignment to next_key is not used unless DEBUG is defined, and the debugging assert can never fail--next_realkey() will always return n + 1 as we just checked KEY_OFF(pagep, n + 1). Remove the variable, the assert, and the otherwise unused next_realkey() function. This change eliminates a warning issued by clang 14.
* Fix indentation in x-deltat.yGreg Hudson2023-04-102-5/+5
| | | | | clang 14 issues a warning for having the next line at the same indentation level as the if body.
* Fix maintainer-mode build for binutils 2.37Greg Hudson2023-04-101-0/+1
| | | | | | | | binutils 2.37 makes --with-symbol-versions the default for nm. In export-check.pl, remove the default symbol versions in the nm output if they are present. ticket: 9092 (new)
* Add pac_privsvr_enctype string attributeGreg Hudson2023-03-277-15/+105
| | | | | | | | | | | | | | | | | | The KDC uses the first local TGT key for the privsvr and full PAC checksums. If this key is of an aes-sha2 enctype in a cross-realm TGT, a Microsoft KDC in the target realm may reject the ticket because it has an unexpectedly large privsvr checksum buffer. This behavior is unnecessarily picky as the target realm KDC cannot and does not need to very the privsvr checksum, but [MS-PAC] 2.8.2 does limit the checksum key to three specific enctypes. As a workaround, add a string attribute which can force the privsvr key to use a specified enctype using key derivation when issuing tickets to that principal. This attribute can be set on cross-realm TGT entries when the target realm uses Active Directory and the local TGT uses an aes-sha2 primary key. ticket: 9089 (new)
* Fix potential memory leak in recent commitGreg Hudson2023-03-261-2/+3
| | | | | | In get_negTokenInit(), reject a zero-length mechTypes field before copying it into *der_mechSet, to prevent allocating a zero-length GSS buffer.
* Eliminate TWRITE macros in GSS libraryGreg Hudson2023-03-244-106/+43
| | | | | | Use dynamic k5buf structures to replace the two uses of the TWRITE_ macros, and replace the uses of TREAD_ macros with the equivalent pointer assignments.
* Use k5-der.h in GSS libraryGreg Hudson2023-03-2412-1530/+474
| | | | Remove the DER implementations in lib/gssapi and use k5-der.h instead.
* Add a simple DER support headerGreg Hudson2023-03-241-0/+149
|
* Make k5buf more flexible for binary dataGreg Hudson2023-03-2425-87/+101
| | | | | | | | | | | Remove the invariant that buf.data is always zero-terminated, to allow marshalling of binary data into precisely allocated fixed regions. Add k5_buf_cstring() to zero-terminate the buffer and retrieve the data pointer. Adjust all callers that build C strings appropriately. Add a k5_buf_add_byte() convenience wrapper alongside the integer marshalling wrappers. Change k5_buf_init_fixed() to accept a void pointer so it can more conveniently be used with uint8_t arrays.
* Update copyright years to 2023Greg Hudson2023-03-248-8/+8
|
* Use control flow guard flag in Windows buildsgakamath2023-03-131-1/+1
| | | | ticket: 9088 (new)
* Modernize PAC codeGreg Hudson2023-03-053-465/+362
| | | | | | Put the version and buffers directly in krb5_pac_data to avoid using a variable-length array. Use k5input for krb5_pac_parse(). Adjust some names and comments.
* Modernize default key data encryption functionsGreg Hudson2023-03-012-136/+111
|
* Fix possible double-free during KDB creationJulien Rische2023-03-011-0/+2
| | | | | | | | | | | | | | | | In krb5_dbe_def_encrypt_key_data(), when we free key_data->key_data_contents[0], reset it to null so the caller doesn't free it as well. Since commit a06945b4ec267e8b80e5e8c95edd89930ff12103 this bug manifests as a double-free during KDB creation if master key encryption fails. [ghudson@mit.edu: edited commit message] ticket: 9086 (new) tags: pullup target_version: 1.20-next
* Avoid using internal APIs in sim_clientGreg Hudson2023-02-271-20/+9
| | | | | | | | | | | In sim_client.c, remove the calls to krb5_gen_portaddr() and krb5_gen_replay_name() as they don't do anything after commit dcb853ac32779b173f39e19c0f24b0087de85771. Remove them, and include krb5.h plus appropriate system headers rather than k5-int.h. Also use a subkey when negotiating the auth context. Kerberos application protocols should generally use subkeys to prevent cross-connection replay attacks.
* Fix meridian type in getdate.yJulien Rische2023-02-271-1/+2
| | | | | | | | | | | | | | | | | Commit d3356bc42191c1896ab06835a2fb245e00471420 (ticket 8927) incorrectly tagged tMERIDIAN as <Number>. So while the lexer assigns meridian values to the Meridian union field, the parser erroneously reads them from the Number field. On 64-bit IBM zSystems (s390x), this can result in using the most recently read number as a meridian value, leading to an abort in ToSeconds(). Fix the tMERIDIAN token type to be <Meridian>. [ghudson@mit.edu: edited commit message] ticket: 9087 (new) tags: pullup target_version: 1.20-next
* Fix read overruns in SPNEGO parsingGreg Hudson2023-02-131-6/+10
| | | | | | | | | | | | | | | | Fix three read overruns discovered by the GitHub Security Lab team (GHSL-2023-016, GHSL-2023-017, and GHSL-2023-018) using OSS-Fuzz. In get_mech_set(), error out if gss_add_oid_set_member() fails rather than continue the loop and increment i past the current bound of returned_mechSet. In g_verify_neg_token_init(), check for zero-byte sequences before reading tag bytes, and reduce cur_size by one to account for the tag byte when calling gssint_get_der_length(). ticket: 9085 (new) tags: pullup target_version: 1.20-next target_version: 1.19-next
* Add margin to expired tickets in test suiteGreg Hudson2023-02-012-2/+2
| | | | | | Very occasionally a test using expired tickets will fail because the ticket isn't seen as expired. Obtain tickets with a longer expiration margin to avoid these failures.
* Fix t_ndr to return a define value from main()Greg Hudson2023-01-271-0/+1
|
* Add PAC full checksumsGreg Hudson2023-01-246-175/+240
| | | | | | | | | | | | A paper by Tom Tervoort noted that computing the PAC privsvr checksum over only the server checksum is vulnerable to collision attacks (CVE-2022-37967). In response, Microsoft has added a second KDC checksum over the full contents of the PAC. Generate and verify full KDC checksums in PACs for service tickets. Update the t_pac.c ticket test case to use a ticket issued by a recent version of Active Directory (provided by Stefan Metzmacher). ticket: 9084 (new)
* Don't issue session keys with deprecated enctypesGreg Hudson2023-01-2310-20/+107
| | | | | | | | | | | | | | | | A paper by Tom Tervoort noted that rc4-hmac pre-hashes the input for its checksum and GSS operations before applying HMAC, and is therefore potentially vulnerable to hash collision attacks if a protocol contains a restricted signing oracle. In light of these potential attacks, begin the functional deprecation of DES3 and RC4 by disallowing their use as session key enctypes by default. Add the variables allow_des3 and allow_rc4 in case negotiability of these enctypes for session keys needs to be turned back on, with the expectation that in future releases the enctypes will be more comprehensively deprecated. ticket: 9081
* In KDC, assume all services support aes256-sha1Greg Hudson2023-01-232-3/+7
| | | | | | | | To facilitate negotiating session keys with acceptable security, assume that services support aes256-cts-hmac-sha1 unless a session_enctypes string attribute says otherwise. ticket: 9075
* Remove man page includes from RST documentationGreg Hudson2023-01-197-493/+147
| | | | | Rewrite parts of database.rst and appl_servers.rst to avoid including full option descriptions from the (already linked) man pages.
* Fix PKINIT CMS error checking for older OpenSSLGreg Hudson2023-01-131-11/+3
| | | | | | | | | | | | | | Commit 70f61d417261ca17efe3d60d180033bea2da60b0 updated the CMS_verify() error code checks, using two error codes new to OpenSSL 3.0 (RSA_R_DIGEST_NOT_ALLOWED and CMS_R_UNKNOWN_DIGEST_ALGORITHM). This change broke the build for OpenSSL 1.0 and 1.1. Instead of looking for codes indicating an algorithm issue and assuming that everything else is an invalid signature, check for the code indicating an invalid signature and assume that everything else is an algorithm issue. ticket: 9069
* Fix policy DB fallback error handlingGreg Hudson2023-01-041-10/+5
| | | | | | | | | In osa_adb_open_and_lock(), if the btree dbopen() call returns EINVAL or EFTYPE and the fallback hash dbopen() call also returns an error, release the lock and return an error instead of returning success with a null database. ticket: 9082 (new)
* Fix kpropd crash with unrecognized optionabushwang2023-01-041-0/+1
| | | | | | | ticket: 9083 (new) tags: pullup target_version: 1.20-next target_version: 1.19-next
* Remove unused Unicode functionsGreg Hudson2022-12-2619-5249/+7
|
* Simplify krb5_chpw_message() UTF-8 processingGreg Hudson2022-12-263-6/+33
| | | | | Only validate the message as a UTF-8 string, rather than normalizing it.
* Remove line continuations in et_c.awkgakamath2022-12-062-20/+11
| | | | | | | | Line continuations cause issues for the awk in MinGW, so just have long lines instead. [ghudson@mit.edu: rewrote commit message; factored out some string constructions for readability]
* Fix gic_keytab crash on memory exhaustionChenChen Zhou2022-12-051-8/+4
| | | | | | | | | | get_as_key_keytab() does not check the result of krb5_copy_keyblock(), and dereferences a null pointer if it fails. Remove the call and steal the memory from kt_ent instead. [ghudson@mit.edu: rewrote commit message; fixed comments] ticket: 9080 (new)
* Fix preauth crash on memory exhaustionChenChen Zhou2022-12-051-0/+4
| | | | | | | | In k5_preauth_request_context_init(), check the result of calloc(). [ghudson@mit.edu: rewrote commit message; added free() of reqctx on error] ticket: 9079 (new)
* Fix profile crash on memory exhaustionChenChen Zhou2022-12-051-1/+1
| | | | | | | | | | In profile_get_values(), if init_list() fails to allocate values.list, end_list() will dereference a null pointer. Fix end_list() to handle list->list being null. [ghudson@mit.edu: rewrote commit message] ticket: 9078 (new)
* Fix aclocal.m4 syntax error for autoconf 2.72Julien Rische2022-11-181-2/+2
| | | | | | | | | | | | | An incorrect closure inside KRB5_AC_INET6 is innocuous with autoconf versions up to 2.71, but will cause an error at configure time with the forthcoming autoconf 2.72. [ghudson@mit.edu: added more context to commit message] ticket: 9077 (new) tags: pullup target_version: 1.20-next target_version: 1.19-next
* Add Georgian translationNorwayFun2022-11-172-2/+9189
| | | | [ghudson@mit.edu: added the translation to po/Makefile.in]
* Use memmove() in Unicode functionsGreg Hudson2022-11-033-16/+16
| | | | | | | | | Where the upstream OpenLDAP code uses AC_MEMCPY(), use memmove() instead of memcpy() as the copies frequently involve overlapping memory regions. Credit to OSS-Fuzz for discovering one instance of the issue. ticket: 9076 (new)
* Fix integer overflows in PAC parsingGreg Hudson2022-11-032-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | In krb5_parse_pac(), check for buffer counts large enough to threaten integer overflow in the header length and memory length calculations. Avoid potential integer overflows when checking the length of each buffer. Credit to OSS-Fuzz for discovering one of the issues. CVE-2022-42898: In MIT krb5 releases 1.8 and later, an authenticated attacker may be able to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service to crash. On 32-bit platforms, an attacker can also cause insufficient memory to be allocated for the result, potentially leading to remote code execution in a KDC, kadmind, or GSS or Kerberos application server process. An attacker with the privileges of a cross-realm KDC may be able to extract secrets from a KDC process's memory by having them copied into the PAC of a new ticket. ticket: 9074 (new) tags: pullup target_version: 1.20-next target_version: 1.19-next
* Fix null deref in KDC when decoding invalid NDRGreg Hudson2022-11-032-10/+36
| | | | | | | | | | | | | In ndr_dec_delegation_info(), keep di->transited_services_length valid by incrementing it as we add entries. Otherwise ndr_free_delegation_info() could dereference a null di->transited_services field. Also bound nservices using data->length to prevent inordinately large memory allocations. Credit to OSS-Fuzz for discovering the issues. ticket: 9073 (new) tags: pullup target_version: 1.20-next
* Avoid small read overrun in UTF8 normalizationGreg Hudson2022-11-031-0/+6
| | | | | | | | In krb5int_utf8_normalize(), check the length of the current character against the buffer length before reading more than one byte. Credit to OSS-Fuzz for discovering the overrun. ticket: 9072 (new)
* Fix typo in TRACE_FAST_ARMOR_CCACHE_KEY messageRichard E. Silverman2022-11-021-1/+1
|
* Refactor KDC TGS processing codeGreg Hudson2022-10-038-824/+872
| | | | | | | | | | | Split the TGS processing code into information gathering, constraint and policy checking, and ticket-issuing steps, using a structure to hold the gathered information. Split validate_tgs_request() into validate_tgs_constraints() and check_tgs_policy() for better auditing. Fold kdc_process_s4u2proxy_req() into check_tgs_policy(), except for the get_pac_princ_with_realm() step which is now performed in gather_tgs_req_info(). Modify some other utility functions to fit the new design.
View Lorry Controller Status