diff options
| author | Hans Insulander <hin@cvs.openbsd.org> | 2003-05-11 02:16:17 +0000 |
|---|---|---|
| committer | Hans Insulander <hin@cvs.openbsd.org> | 2003-05-11 02:16:17 +0000 |
| commit | bfb08542bd5613665d425969a4b0af2c6fec3261 (patch) | |
| tree | 2accba174432e291fe86ca6437f9d5f3bd3f6c0d /kerberosV | |
| parent | a699d686bbf0e22f403e81e561ae8dbddfd0ccd7 (diff) | |
Import of heimdal-0.6rc1
Diffstat (limited to 'kerberosV')
210 files changed, 28330 insertions, 6123 deletions
diff --git a/kerberosV/src/ChangeLog b/kerberosV/src/ChangeLog index 5442e497cdd..9f3a085906f 100644 --- a/kerberosV/src/ChangeLog +++ b/kerberosV/src/ChangeLog @@ -1,1006 +1,517 @@ -2001-09-03 Assar Westerlund <assar@sics.se> +2003-04-28 Love Hörnquist Åstrand <lha@it.su.se> - * Release 0.4e + * kdc/v4_dump.c: 1.4->1.5: (v4_prop_dump): limit strings length, + from openbsd -2001-09-02 Johan Danielsson <joda@pdc.kth.se> +2003-04-24 Love Hörnquist Åstrand <lha@it.su.se> - * kuser/Makefile.am: install kauth as a symlink to kinit + * doc/programming.texi: 1.2-1.3: s/managment/management/, from jmc + <jmc@prioris.mini.pw.edu.pl> - * kuser/kinit.c: get v4_tickets by default +2003-04-22 Love Hörnquist Åstrand <lha@it.su.se> - * lib/asn1/Makefile.am: fix for broken automake + * lib/krb5/krbhst.c: 1.43->1.44: copy NUL too, from janj@wenf.org + via openbsd -2001-08-31 Johan Danielsson <joda@pdc.kth.se> +2003-04-17 Love Hörnquist Åstrand <lha@it.su.se> - * lib/hdb/hdb-ldap.c: some pretty much untested changes from Luke - Howard - - * kuser/kinit.1: remove references to kauth - - * kuser/Makefile.am: kauth is no more - - * kuser/kinit.c: use appdefaults for everything. defaults are now - as in kauth. - - * lib/krb5/appdefault.c: also check libdefaults, and realms/realm - - * lib/krb5/context.c (krb5_free_context): free more stuff - -2001-08-30 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/verify_krb5_conf.c: do some checks of the values in the - file - - * lib/krb5/krb5.conf.5: remove srv_try_txt, fix spelling - - * lib/krb5/context.c: don't init srv_try_txt, since it isn't used - anymore - -2001-08-29 Jacques Vidrine <n@nectar.com> - - * configure.in: Check for already-installed com_err. - -2001-08-28 Assar Westerlund <assar@sics.se> - - * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set versoin to 18:2:1 - -2001-08-24 Assar Westerlund <assar@sics.se> - - * kuser/Makefile.am: remove CHECK_LOCAL - non bin programs require - no special treatment now - - * kuser/generate-requests.c: parse arguments in a useful way - * kuser/kverify.c: add --help/--verify - -2001-08-22 Assar Westerlund <assar@sics.se> - - * configure.in: bump prereq to 2.52 remove unused test_LIB_KRB4 - - * configure.in: re-write the handling of crypto libraries. try to - use the one of openssl's libcrypto or krb4's libdes that has all - the required functionality (md4, md5, sha1, des, rc4). if there - is no such library, the included lib/des is built. - - * kdc/headers.h: include libutil.h if it exists - * kpasswd/kpasswd_locl.h: include libutil.h if it exists - * kdc/kerberos4.c (get_des_key): check for null keys even if - is_server - -2001-08-21 Assar Westerlund <assar@sics.se> - - * lib/asn1/asn1_print.c: print some size_t correctly - * configure.in: remove extra space after -L check for libutil.h - -2001-08-17 Johan Danielsson <joda@pdc.kth.se> - - * kdc/kdc_locl.h: fix prototype for get_des_key - - * kdc/kaserver.c: fix call to get_des_key - - * kdc/524.c: fix call to get_des_key - - * kdc/kerberos4.c (get_des_key): if getting a key for a server, - return any des-key not just keys that can be string-to-keyed by - the client - -2001-08-10 Assar Westerlund <assar@sics.se> - - * Release 0.4d - -2001-08-10 Assar Westerlund <assar@sics.se> - - * configure.in: check for openpty - * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:4:0 - -2001-08-08 Assar Westerlund <assar@sics.se> - - * configure.in: just add -L (if required) from krb4 when testing - for libdes/libcrypto - -2001-08-04 Assar Westerlund <assar@sics.se> - - * lib/krb5/Makefile.am (man_MANS): add some missing man pages - * fix-export: fix the sed expression for finding the man pages - -2001-07-31 Assar Westerlund <assar@sics.se> - - * kpasswd/kpasswd-generator.c (main): implement --version and - --help - - * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): update version to - 18:1:1 - -2001-07-27 Assar Westerlund <assar@sics.se> - - * lib/krb5/context.c (init_context_from_config_file): check - parsing of addresses - -2001-07-26 Assar Westerlund <assar@sics.se> - - * lib/krb5/sock_principal.c (krb5_sock_to_principal): rename - sa_len -> salen to avoid the macro that's defined on irix. noted - by "Jacques A. Vidrine" <n@nectar.com> - -2001-07-24 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/addr_families.c: add support for type - KRB5_ADDRESS_ADDRPORT - - * lib/krb5/addr_families.c (krb5_address_order): complain about - unsuppored address types - -2001-07-23 Johan Danielsson <joda@pdc.kth.se> - - * admin/get.c: don't open connection to server until we loop over - the principals, at that time we know the realm of the (first) - principal and we can default to that admin server - - * admin: add a rename command - -2001-07-19 Assar Westerlund <assar@sics.se> - - * kdc/hprop.c (usage): clarify a tiny bit - -2001-07-19 Assar Westerlund <assar@sics.se> - - * Release 0.4c - -2001-07-19 Assar Westerlund <assar@sics.se> - - * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to - 18:0:1 - - * lib/krb5/get_for_creds.c (krb5_fwd_tgt_creds): make it behave - the same way as the MIT function - - * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:3:0 - * lib/krb5/sock_principal.c (krb5_sock_to_principal): use - getnameinfo - - * lib/krb5/krbhst.c (srv_find_realm): handle port numbers - consistenly in local byte order - - * lib/krb5/get_default_realm.c (krb5_get_default_realm): set an - error string - - * kuser/kinit.c (renew_validate): invert condition correctly. get - v4 tickets if we succeed renewing - * lib/krb5/principal.c (krb5_principal_get_type): add - (default_v4_name_convert): add "smtp" - -2001-07-13 Assar Westerlund <assar@sics.se> - - * configure.in: remove make-print-version from LIBOBJS, it's no - longer in lib/roken but always built in lib/vers - -2001-07-12 Johan Danielsson <joda@pdc.kth.se> - - * lib/hdb/mkey.c: more set_error_string - -2001-07-12 Assar Westerlund <assar@sics.se> - - * lib/hdb/Makefile.am (libhdb_la_LIBADD): add required library - dependencies - - * lib/asn1/Makefile.am (libasn1_la_LIBADD): add required library - dependencies - -2001-07-11 Johan Danielsson <joda@pdc.kth.se> - - * kdc/hprop.c: remove v4 master key handling; remove old v4-db and - ka-db flags; add defaults for v4_realm and afs_cell - -2001-07-09 Assar Westerlund <assar@sics.se> - - * lib/krb5/sock_principal.c (krb5_sock_to_principal): copy hname - before calling krb5_sname_to_principal. from "Jacques A. Vidrine" - <n@nectar.com> - -2001-07-08 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/context.c: use krb5_copy_addresses instead of - copy_HostAddresses - -2001-07-06 Assar Westerlund <assar@sics.se> - - * configure.in (LIB_des_a, LIB_des_so): add these so that they can - be used by lib/auth/sia - - * kuser/kinit.c: re-do some of the v4 fallbacks: look at - get-tokens flag do not print extra errors do not try to do 524 if - we got tickets from a v4 server - -2001-07-03 Assar Westerlund <assar@sics.se> - - * lib/krb5/replay.c (krb5_get_server_rcache): cast argument to - printf - - * lib/krb5/get_addrs.c (find_all_addresses): call free_addresses - on ignore_addresses correctly - * lib/krb5/init_creds.c - (krb5_get_init_creds_opt_set_default_flags): change to take a - const realm - - * lib/krb5/principal.c (krb5_425_conv_principal_ext): if the - instance is the first component of the local hostname, the - converted host should be the long hostname. from - <shadow@dementia.org> - -2001-07-02 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/Makefile.am: address.c is no more; add a couple of - manpages - - * lib/krb5/krb5_timeofday.3: new manpage - - * lib/krb5/krb5_get_all_client_addrs.3: new manpage - - * lib/krb5/get_in_tkt.c (init_as_req): treat no addresses as - wildcard - - * lib/krb5/get_cred.c (get_cred_kdc_la): treat no addresses as - wildcard - - * lib/krb5/get_addrs.c: don't include client addresses that match - ignore_addresses - - * lib/krb5/context.c: initialise ignore_addresses - - * lib/krb5/addr_families.c: add new `arange' fake address type, - that matches more than one address; this required some internal - changes to many functions, so all of address.c got moved here - (wasn't much left there) - - * lib/krb5/krb5.h: add list of ignored addresses to context - -2001-07-03 Assar Westerlund <assar@sics.se> - - * Release 0.4b - -2001-07-03 Assar Westerlund <assar@sics.se> - - * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set version to 17:0:0 - * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): set version to 7:2:0 - -2001-07-03 Assar Westerlund <assar@sics.se> - - * Release 0.4a - -2001-07-02 Johan Danielsson <joda@pdc.kth.se> - - * kuser/kinit.c: make this compile without krb4 support - - * lib/krb5/write_message.c: remove priv parameter from - write_safe_message; don't know why it was there in the first place - - * doc/install.texi: remove kaserver switches, it's always compiled - in now - - * kdc/hprop.c: always include kadb support - - * kdc/kaserver.c: always include kaserver support - -2001-07-02 Assar Westerlund <assar@sics.se> - - * kpasswd/kpasswdd.c (doit): make failing to bind a socket a - non-fatal error, and abort if no sockets were bound - -2001-07-01 Assar Westerlund <assar@sics.se> - - * lib/krb5/krbhst.c: remember the real port number when falling - back from kpasswd -> kadmin, and krb524 -> kdc - -2001-06-29 Assar Westerlund <assar@sics.se> - - * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): if - no_addresses is set, do not add any local addresses to KRB_CRED - - * kuser/kinit.c: remove extra clearing of password and some - redundant code - -2001-06-29 Johan Danielsson <joda@pdc.kth.se> - - * kuser/kinit.c: move ticket conversion code to separate function, - and call that from a couple of places, like when renewing a - ticket; also add a flag for just converting a ticket - - * lib/krb5/init_creds_pw.c: set renew-life to some sane value - - * kdc/524.c: don't send more data than required - -2001-06-24 Assar Westerlund <assar@sics.se> - - * lib/krb5/store_fd.c (krb5_storage_from_fd): check malloc returns - - * lib/krb5/keytab_any.c (any_resolve); improving parsing of ANY: - (any_start_seq_get): remove a double free - (any_next_entry): iterate over all (sub) keytabs and avoid leave data - around to be freed again - - * kdc/kdc_locl.h: add a define for des_new_random_key when using - openssl's libcrypto - - * configure.in: move v6 tests down - - * lib/krb5/krb5.h (krb5_context_data): remove srv_try_rfc2052 - - * update to libtool 1.4 and autoconf 2.50 - -2001-06-22 Johan Danielsson <joda@pdc.kth.se> - - * lib/hdb/hdb.c: use krb5_add_et_list - -2001-06-21 Johan Danielsson <joda@pdc.kth.se> - - * lib/hdb/Makefile.am: add generation number - * lib/hdb/common.c: add generation number code - * lib/hdb/hdb.asn1: add generation number - * lib/hdb/print.c: use krb5_storage to make it more dynamic - -2001-06-21 Assar Westerlund <assar@sics.se> - - * lib/krb5/krb5.conf.5: update to changed names used by - krb5_get_init_creds_opt_set_default_flags - * lib/krb5/init_creds.c - (krb5_get_init_creds_opt_set_default_flags): make the appdefault - keywords have the same names - - * configure.in: only add -L and -R to the krb4 libdir if we are - actually using it - - * lib/krb5/krbhst.c (fallback_get_hosts): do not copy trailing - dot of hostname add some comments - * lib/krb5/krbhst.c: use getaddrinfo instead of dns_lookup when - testing for kerberos.REALM. this allows reusing that information - when actually contacting the server and thus avoids one DNS lookup - -2001-06-20 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/krb5.h: include k524_err.h - - * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): don't test - for keytype, the server will do this for us if it has anything to - complain about - - * lib/krb5/context.c: add protocol compatible krb524 error codes + * lib/asn1/der_copy.c (copy_general_string): use strdup + * lib/asn1/der_put.c: remove sprintf + * lib/asn1/gen.c: remove strcpy/sprintf + + * lib/krb5/name-45-test.c: use a more unique name then ratatosk so + that other (me) have such hosts in the local domain and the tests + fails, to take hokkigai.pdc.kth.se instead + + * lib/krb5/test_alname.c: add --version and --help + +2003-04-16 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/Makefile.am: add protocol compatible krb524 error codes + * lib/krb5/krb5_warn.3: add krb5_get_err_text + + * lib/krb5/transited.c: use strlcat/strlcpy, from openbsd + * lib/krb5/krbhst.c (srv_find_realm): use strlcpy, from openbsd + * lib/krb5/aname_to_localname.c (krb5_aname_to_localname): use + strlcpy, from openbsd + * kdc/hpropd.c: s/strcat/strlcat/, inspired from openbsd + * appl/kf/kfd.c: use strlcpy, from openbsd + +2003-04-16 Johan Danielsson <joda@pdc.kth.se> - * lib/krb5/k524_err.et: add protocol compatible krb524 error codes + * configure.in: fix for large file support in AIX, _LARGE_FILES + needs to be defined on the command line, since lex likes to + include stdio.h before we get to config.h - * lib/krb5/krb5_principal_get_realm.3: manpage +2003-04-16 Love Hörnquist Åstrand <lha@it.su.se> + + * lib/krb5/*.3: Change .Fd #include <header.h> to .In header.h, + from Thomas Klausner <wiz@netbsd.org> + + * lib/krb5/krb5.conf.5: spelling, from Thomas Klausner + <wiz@netbsd.org> - * lib/krb5/principal.c: add functions `krb5_principal_get_realm' - and `krb5_principal_get_comp_string' that returns parts of a - principal; this is a replacement for the internal - `krb5_princ_realm' and `krb5_princ_component' macros that everyone - seem to use +2003-04-15 Love Hörnquist Åstrand <lha@it.su.se> -2001-06-19 Assar Westerlund <assar@sics.se> + * kdc/kerberos5.c: fix some more memory leaks + +2003-04-11 Love Hörnquist Åstrand <lha@it.su.se> - * kuser/kinit.c (main): dereference result from krb5_princ_realm. - from Thomas Nystrom <thn@saeab.se> + * appl/kf/kf.1: spelling, from jmc <jmc@prioris.mini.pw.edu.pl> + +2003-04-08 Love Hörnquist Åstrand <lha@it.su.se> -2001-06-18 Johan Danielsson <joda@pdc.kth.se> + * admin/ktutil.8: typos, from jmc <jmc@acn.waw.pl> + +2003-04-06 Love Hörnquist Åstrand <lha@it.su.se> + + * lib/krb5/krb5.3: s/kerberos/Kerberos/ + * lib/krb5/krb5_data.3: s/kerberos/Kerberos/ + * lib/krb5/krb5_address.3: s/kerberos/Kerberos/ + * lib/krb5/krb5_ccache.3: s/kerberos/Kerberos/ + * lib/krb5/krb5.conf.5: s/kerberos/Kerberos/ + * kuser/kinit.1: s/kerberos/Kerberos/ + * kdc/kdc.8: s/kerberos/Kerberos/ + +2003-04-01 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/mk_req.c (krb5_mk_req_exact): free creds when done - * lib/krb5/crypto.c (krb5_string_to_key_derived): fix memory leak - * lib/krb5/krbhst.c (config_get_hosts): free hostlist - * kuser/kinit.c: free principal + * lib/krb5/test_alname.c: more krb5_aname_to_localname tests + + * lib/krb5/aname_to_localname.c (krb5_aname_to_localname): when + converting too root, make sure user is ok according to + krb5_kuserok before allowing it. -2001-06-18 Assar Westerlund <assar@sics.se> + * lib/krb5/Makefile.am (noinst_PROGRAMS): += test_alname + + * lib/krb5/test_alname.c: add test for krb5_aname_to_localname + + * lib/krb5/crypto.c (krb5_DES_AFS3_CMU_string_to_key): used p1 + instead of the "illegal" salt #~, same change as kth-krb did + 1999. Problems occur with crypt() that behaves like AT&T crypt + (openssl does this). Pointed out by Marcus Watts. + + * admin/change.c (kt_change): collect all principals we are going + to change, and pick the highest kvno and use that to guess what + kvno the resulting kvno is going to be. Now two ktutil change in a + row works. XXX fix the protocol to pass the kvno back. + +2003-03-31 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/send_to_kdc.c (krb5_sendto): remove an extra - freeaddrinfo + * appl/kf/kf.1: afs->AFS, from jmc <jmc@acn.waw.pl> + +2003-03-30 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/convert_creds.c (krb524_convert_creds_kdc_ccache): - remove some unused variables + * doc/setup.texi: add description on how to turn on v4, 524 and + kaserver support - * lib/krb5/krbhst.c (admin_get_next): spell kerberos correctly - * kdc/kerberos5.c: update to new krb5_auth_con* names - * kdc/hpropd.c: update to new krb5_auth_con* names - * lib/krb5/rd_req.c (krb5_rd_req): use krb5_auth_con* functions - and remove some comments - * lib/krb5/rd_safe.c (krb5_rd_safe): pick the keys in the right - order: remote - local - session - * lib/krb5/rd_rep.c (krb5_rd_rep): save the remote sub key in the - auth_context - * lib/krb5/rd_priv.c (krb5_rd_priv): pick keys in the correct - order: remote - local - session - * lib/krb5/mk_safe.c (krb5_mk_safe): pick keys in the right order, - local - remote - session +2003-03-29 Love Hörnquist Åstrand <lha@it.su.se> -2001-06-18 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/verify_krb5_conf.c (appdefaults_entries): add afslog + and afs-use-524 - * lib/krb5/convert_creds.c: use starttime instead of authtime, - from Chris Chiappa +2003-03-28 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/convert_creds.c: make krb524_convert_creds_kdc match - the MIT function by the same name; add - krb524_convert_creds_kdc_ccache that does what the old version did + * kdc/kerberos5.c (as_rep): when the second enctype_to_string + failes, remember to free memory from the first enctype_to_string - * admin/list.c (do_list): make sure list of keys is NULL - terminated; similar to patch sent by Chris Chiappa + * lib/krb5/crypto.c (usage2arcfour): map KRB5_KU_TICKET to 2, + from Harald Joerg <harald.joerg@fujitsu-siemens.com> + (enctype_arcfour_hmac_md5): disable checksum_hmac_md5_enc -2001-06-18 Assar Westerlund <assar@sics.se> + * lib/hdb/mkey.c (hdb_unseal_keys_mkey): truncate key to the key + length when key is longer then expected length, its probably + longer since the encrypted data was padded, reported by Aidan + Cully <aidan@kublai.com> - * lib/krb5/mcache.c (mcc_remove_cred): use - krb5_free_creds_contents + * lib/krb5/crypto.c (krb5_enctype_keysize): return key size of + encyption type, inspired by Aidan Cully <aidan@kublai.com> + +2003-03-27 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/auth_context.c: name function krb5_auth_con more - consistenly - * lib/krb5/rd_req.c (krb5_verify_authenticator_checksum): use - renamed krb5_auth_con_getauthenticator + * lib/krb5/keytab.c (krb5_kt_get_entry): avoid printing 0 + (wildcard kvno) after principal when the keytab entry isn't found, + reported by Chris Chiappa <chris@chiappa.net> + +2003-03-26 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): update to - use krb5_krbhst API - * lib/krb5/changepw.c (krb5_change_password): update to use - krb5_krbhst API - * lib/krb5/send_to_kdc.c: update to use krb5_krbhst API - * lib/krb5/krbhst.c (krb5_krbhst_get_addrinfo): add set def_port - in krb5_krbhst_info - (krb5_krbhst_free): free everything + * doc/misc.texi: update 2b example to match reality (from + mattiasa@e.kth.se) - * lib/krb5/krb5.h (KRB5_VERIFY_NO_ADDRESSES): add - (krb5_krbhst_info): add def_port (default port for this service) + * doc/misc.texi: spelling and add `Configuring AFS clients' + subsection - * lib/krb5/krbhst-test.c: make it more verbose and useful - * lib/krb5/krbhst.c: remove some more memory leaks do not try any - dns operations if there is local configuration admin: fallback to - kerberos.REALM 524: fallback to kdcs kpasswd: fallback to admin - add some comments +2003-03-25 Love Hörnquist Åstrand <lha@it.su.se> - * configure.in: remove initstate and setstate, they should be in - cf/roken-frag.m4 + * lib/krb5/krb5.3: add krb5_free_data_contents.3 + + * lib/krb5/data.c: add krb5_free_data_contents for compat with MIT + API - * lib/krb5/Makefile.am (noinst_PROGRAMS): add krbhst-test - * lib/krb5/krbhst-test.c: new program for testing krbhst - * lib/krb5/krbhst.c (common_init): remove memory leak - (main): move test program into krbhst-test + * lib/krb5/krb5_data.3: add krb5_free_data_contents for compat + with MIT API + + * lib/krb5/krb5_verify_user.3: write more about how the ccache + argument should be inited when used + +2003-03-25 Johan Danielsson <joda@pdc.kth.se> -2001-06-17 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/addr_families.c (krb5_print_address): make sure + print_addr is defined for the given address type; make addrports + printable - * lib/krb5/krb5_krbhst_init.3: manpage + * kdc/string2key.c: print the used enctype for kerberos 5 keys - * lib/krb5/krb5_get_krbhst.3: manpage +2003-03-25 Love Hörnquist Åstrand <lha@it.su.se> -2001-06-16 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/aes-test.c: add another arcfour test + +2003-03-22 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/krb5.h: add opaque krb5_krbhst_handle type + * lib/krb5/aes-test.c: sneek in a test for arcfour-hmac-md5 + +2003-03-20 Love Hörnquist Åstrand <lha@it.su.se> + + * lib/krb5/krb5_ccache.3: update .Dd - * lib/krb5/krbhst.c: change void* to krb5_krbhst_handle + * lib/krb5/krb5.3: sort in krb5_data functions - * lib/krb5/krb5.h: types for new krbhst api + * lib/krb5/Makefile.am (man_MANS): += krb5_data.3 - * lib/krb5/krbhst.c: implement a new api that looks up one host at - a time, instead of making a list of hosts + * lib/krb5/krb5_data.3: document krb5_data -2001-06-09 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/init_creds_pw.c (krb5_get_init_creds_password): if + prompter is NULL, don't try to ask for a password to + change. reported by Iain Moffat @ ufl.edu via Howard Chu + <hyc@highlandsun.com> - * configure.in: test for initstate and setstate +2003-03-19 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/krbhst.c: remove rfc2052 support + * lib/krb5/krb5_keytab.3: spelling, from + <jmc@prioris.mini.pw.edu.pl> -2001-06-08 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/krb5.conf.5: . means new line + + * lib/krb5/krb5.conf.5: spelling, from + <jmc@prioris.mini.pw.edu.pl> - * fix some manpages for broken mdoc.old grog test + * lib/krb5/krb5_auth_context.3: spelling, from + <jmc@prioris.mini.pw.edu.pl> -2001-05-28 Assar Westerlund <assar@sics.se> +2003-03-18 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/krb5.conf.5: add [appdefaults] - * lib/krb5/init_creds_pw.c: remove configuration reading that is - now done in krb5_get_init_creds_opt_set_default_flags - * lib/krb5/init_creds.c - (krb5_get_init_creds_opt_set_default_flags): add reading of - libdefaults versions of these and add no_addresses + * kuser/Makefile.am: INCLUDES: -I$(srcdir)/../lib/krb5 + + * lib/krb5/convert_creds.c: add _krb5_krb_life_to_time + + * lib/krb5/krb5-v4compat.h: add _krb5_krb_life_to_time - * lib/krb5/get_in_tkt.c (krb5_get_in_cred): clear error string - when preauth was required and we retry + * kdc/kdc_locl.h: 524 is independent of kerberos 4, so move out + #ifdef KRB4 from enable_v4_cross_realm since 524 needs it + + * kdc/config.c: 524 is independent of kerberos 4, so move out + enable_v4_cross_realm from #ifdef KRB4 since 524 needs it + +2003-03-17 Assar Westerlund <assar@kth.se> -2001-05-25 Assar Westerlund <assar@sics.se> + * kdc/kdc.8: document --kerberos4-cross-realm + * kdc/kerberos4.c: pay attention to enable_v4_cross_realm + * kdc/kdc_locl.h (enable_v4_cross_realm): add + * kdc/524.c (encode_524_response): check the enable_v4_cross_realm + flag before giving out v4 tickets for foreign v5 principals + * kdc/config.c: add --enable-kerberos4-cross-realm option (default + to off) - * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): call - krb5_get_krb524hst - * lib/krb5/krbhst.c (krb5_get_krb524hst): add and restructure the - support functions +2003-03-17 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-22 Assar Westerlund <assar@sics.se> + * lib/krb5/Makefile.am (man_MANS) += krb5_aname_to_localname.3 + + * lib/krb5/krb5_aname_to_localname.3: manpage for + krb5_aname_to_localname - * kdc/kerberos5.c (tgs_rep2): alloc and free csec and cusec - properly + * lib/krb5/krb5_kuserok.3: s/KRB5_USEROK/KRB5_KUSEROK/ + +2003-03-16 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-17 Assar Westerlund <assar@sics.se> + * lib/krb5/Makefile.am (man_MANS): add krb5_set_default_realm.3 - * Release 0.3f + * lib/krb5/krb5.3: add manpages from krb5_set_default_realm.3 -2001-05-17 Assar Westerlund <assar@sics.se> + * lib/krb5/krb5_set_default_realm.3: Manpage for + krb5_free_host_realm, krb5_get_default_realm, + krb5_get_default_realms, krb5_get_host_realm, and + krb5_set_default_realm. - * lib/krb5/Makefile.am: bump version to 16:0:0 - * lib/hdb/Makefile.am: bump version to 7:1:0 - * lib/asn1/Makefile.am: bump version to 5:0:0 - * lib/krb5/keytab_krb4.c: add SRVTAB as an alias for krb4 - * lib/krb5/codec.c: remove dead code + * admin/ktutil.8: s/entype/enctype/, from Igor Sobrado + <sobrado@acm.org> via NetBSD -2001-05-17 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/krb5_keytab.3: add documention for krb5_kt_get_type + + * lib/krb5/keytab.c (krb5_kt_get_type): get prefix/type of keytab + + * lib/krb5/krb5.h (KRB5_KT_PREFIX_MAX_LEN): max length of prefix + + * lib/krb5/krb5_ccache.3: document krb5_cc_get_ops, add more + types, add krb5_fcc_ops and krb5_mcc_ops + + * lib/krb5/cache.c (krb5_cc_get_ops): new function, return ops for + a id - * kdc/config.c: actually check the ticket addresses +2003-03-15 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-15 Assar Westerlund <assar@sics.se> + * doc/intro.texi: add reference to source code, binaries and the + manual - * lib/krb5/rd_error.c (krb5_error_from_rd_error): use correct - parenthesis + * lib/krb5/krb5.3: krb5.h isn't in krb5 directory in heimdal + +2003-03-14 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/eai_to_heim_errno.c (krb5_eai_to_heim_errno): add - `errno' (called system_error) to allow callers to make sure they - pass the current and relevant value. update callers + * kdc/kdc.8: better/difrent english -2001-05-14 Johan Danielsson <joda@pdc.kth.se> + * kdc/kdc.8: . -> .\n, copyright/license + + * kdc/kdc.8: changed configuration file -> restart kdc - * lib/krb5/verify_user.c: krb5_verify_user_opt + * kdc/kerberos4.c: add krb4 into the most error messages written + to the logfile - * lib/krb5/krb5.h: verify_opt + * lib/krb5/krb5_ccache.3: add missing name of argument + (krb5_context) to most functions - * kdc/kerberos5.c: pass context to krb5_domain_x500_decode +2003-03-13 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-14 Assar Westerlund <assar@sics.se> + * lib/krb5/kuserok.c (krb5_kuserok): preserve old behviour of + function and return FALSE when there isn't a local account for + `luser'. - * kpasswd/kpasswdd.c: adapt to new address functions - * kdc/kerberos5.c: adapt to changing address functions use LR_TYPE - * kdc/connect.c: adapt to changing address functions - * kdc/config.c: new krb5_config_parse_file - * kdc/524.c: new krb5_sockaddr2address - * lib/krb5/*: add some krb5_{set,clear}_error_string + * lib/krb5/krb5_kuserok.3: fix prototype, spelling and more text + describing the function - * lib/asn1/k5.asn1 (LR_TYPE): add - * lib/asn1/Makefile.am (gen_files): add asn1_LR_TYPE.x +2003-03-12 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-11 Assar Westerlund <assar@sics.se> + * lib/krb5/cache.c (krb5_cc_default): if krb5_cc_default_name + returned memory, don't return ENOMEM - * kdc/kerberos5.c (tsg_rep): fix typo in variable name +2003-03-11 Love Hörnquist Åstrand <lha@it.su.se> - * kpasswd/kpasswd-generator.c (nop_prompter): update prototype - * lib/krb5/init_creds_pw.c: update to new prompter, use prompter - types and send two prompts at once when changning password - * lib/krb5/prompter_posix.c (krb5_prompter_posix): add name - * lib/krb5/krb5.h (krb5_prompt): add type - (krb5_prompter_fct): add anem + * lib/krb5/krb5.3: add krb5_address stuff and sort + + * lib/krb5/krb5_address.3: fix krb5_addr2sockaddr description + + * lib/krb5/Makefile.am (man_MANS): += krb5_address.3 + + * lib/krb5/krb5_address.3: document types krb5_address and + krb5_addresses and their helper functions - * lib/krb5/cache.c (krb5_cc_next_cred): transpose last two - paramaters to krb5_cc_next_cred (as MIT does, and not as they - document). From "Jacques A. Vidrine" <n@nectar.com> +2003-03-10 Love Hörnquist Åstrand <lha@it.su.se> -2001-05-11 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/Makefile.am (man_MANS): += krb5_kuserok.3 - * lib/krb5/Makefile.am: store-test + * lib/krb5/krb5_kuserok.3: spelling, from cizzi@it.su.se - * lib/krb5/store-test.c: simple bit storage test + * lib/krb5/Makefile.am (man_MANS): += krb5_ccache.3 - * lib/krb5/store.c: add more byteorder storage flags + * lib/krb5/krb5_ccache.3: spelling, from cizzi@it.su.se - * lib/krb5/krb5.h: add more byteorder storage flags + * lib/krb5/krb5.3: add more functions - * kdc/kerberos5.c: don't use NULL where we mean 0 - - * kdc/kerberos5.c: put referral test code in separate function, - and test for KRB5_NT_SRV_INST + * lib/krb5/krb5_ccache.3: document krb5_ccache and krb5_cc + functions -2001-05-10 Assar Westerlund <assar@sics.se> + * lib/krb5/krb5_kuserok.3: document krb5_kuserok + + * lib/krb5/krb5_verify_user.3: document + krb5_verify_opt_set_flags(opt, KRB5_VERIFY_LREALMS) behavior - * admin/list.c (do_list): do not close the keytab if opening it - failed - * admin/list.c (do_list): always print complete names. print - everything to stdout. - * admin/list.c: print both v5 and v4 list by default - * admin/remove.c (kt_remove): reorganize some. open the keytab - (defaulting to the modify one). - * admin/purge.c (kt_purge): reorganize some. open the keytab - (defaulting to the modify one). correct usage strings - * admin/list.c (kt_list): reorganize some. open the keytab - * admin/get.c (kt_get): reorganize some. open the keytab - (defaulting to the modify one) - * admin/copy.c (kt_copy): default to modify key name. re-organise - * admin/change.c (kt_change): reorganize some. open the keytab - (defaulting to the modify one) - * admin/add.c (kt_add): reorganize some. open the keytab - (defaulting to the modify one) - * admin/ktutil.c (main): do not open the keytab, let every - sub-function handle it + * lib/krb5/krb5_verify_user.3: document krb5_verify_opt* and + krb5_verify_user_opt - * kdc/config.c (configure): call free_getarg_strings + * lib/krb5/*.[0-9]: add copyright/licenses on more manpages - * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set error strings for - a few more errors + * kuser/kdestroy.c (main): handle that krb5_cc_default_name can + return NULL - * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): make - `use_dns' parameter boolean + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump minor + (TESTS): add test_cc - * lib/krb5/krb5.h (krb5_context_data): add default_keytab_modify + * lib/krb5/test_cc.c: test some + krb5_cc_default_name/krb5_cc_set_default_name combinations + * lib/krb5/context.c (init_context_from_config_file): set - default_keytab_modify - * lib/krb5/krb5_locl.h (KEYTAB_DEFAULT): change to - ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab - (KEYTAB_DEFAULT_MODIFY): add - * lib/krb5/keytab.c (krb5_kt_default_modify_name): add - (krb5_kt_resolve): set error string for failed keytab type - -2001-05-08 Assar Westerlund <assar@sics.se> - - * lib/krb5/crypto.c (encryption_type): make field names more - consistent - (create_checksum): separate usage and type - (krb5_create_checksum): add a separate type parameter - (encrypt_internal): only free once on mismatched checksum length - - * lib/krb5/send_to_kdc.c (krb5_sendto_kdc2): try to tell what - realm we didn't manage to reach any KDC for in the error string - - * lib/krb5/generate_seq_number.c (krb5_generate_seq_number): free - the entire subkey. from <tmartin@mirapoint.com> + default_cc_name to NULL + (krb5_free_context): free default_cc_name if set -2001-05-07 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/cache.c (krb5_cc_set_default_name): new function + (krb5_cc_default_name): use krb5_cc_set_default_name - * lib/krb5/keytab_keyfile.c (akf_start_seq_get): return - KT_NOTFOUND if the file is empty - -2001-05-07 Assar Westerlund <assar@sics.se> - - * lib/krb5/fcache.c: call krb5_set_error_string when open fails - fatally - * lib/krb5/keytab_file.c: call krb5_set_error_string when open - fails fatally - - * lib/krb5/warn.c (_warnerr): print error_string in context in - preference to error string derived from error code - * kuser/kinit.c (main): try to print the error string - * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set some sensible - error strings for errors - - * lib/krb5/krb5.h (krb5_context_data): add error_string and - error_buf - * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add error_string.c - * lib/krb5/error_string.c: new file - -2001-05-02 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/time.c: krb5_string_to_deltat - - * lib/krb5/sock_principal.c: one less data copy - - * lib/krb5/eai_to_heim_errno.c: conversion function for h_errno's - - * lib/krb5/get_default_principal.c: change this slightly - - * lib/krb5/crypto.c: make checksum_types into an array of pointers - - * lib/krb5/convert_creds.c: make sure we always use a des-cbc-crc - ticket - -2001-04-29 Assar Westerlund <assar@sics.se> - - * kdc/kerberos5.c (tgs_rep2): return a reference to a krbtgt for - the right realm if we fail to find a non-krbtgt service in the - database and the second component does a succesful non-dns lookup - to get the real realm (which has to be different from the - originally-supplied realm). this should help windows 2000 clients - that always start their lookups in `their' realm and do not have - any idea of how to map hostnames into realms - * kdc/kerberos5.c (is_krbtgt): rename to get_krbtgt_realm - -2001-04-27 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): add extra - parameter to request use of dns or not - -2001-04-25 Assar Westerlund <assar@sics.se> - - * admin/get.c (kt_get): allow specification of encryption types - * lib/krb5/verify_init.c (krb5_verify_init_creds): do not try to - close an unopened ccache, noted by <marc@mit.edu> - - * lib/krb5/krb5.h (krb5_any_ops): add declaration - * lib/krb5/context.c (init_context_from_config_file): register - krb5_any_ops - - * lib/krb5/keytab_any.c: new file, implementing union of keytabs - * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add keytab_any.c + * lib/krb5/krb5.h (krb5_context_data): add default_cc_name - * lib/krb5/init_creds_pw.c (get_init_creds_common): handle options - == NULL. noted by <marc@mit.edu> - -2001-04-19 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/rd_cred.c: set ret_creds to NULL before doing anything - else, from Jacques Vidrine - -2001-04-18 Johan Danielsson <joda@pdc.kth.se> - - * lib/hdb/libasn1.h: asn1.h -> krb5_asn1.h - - * lib/asn1/Makefile.am: add asn1_ENCTYPE.x - - * lib/krb5/krb5.h: adapt to asn1 changes - - * lib/asn1/k5.asn1: move enctypes here - - * lib/asn1/libasn1.h: rename asn1.h to krb5_asn1.h to avoid - conflicts - - * lib/asn1/Makefile.am: rename asn1.h to krb5_asn1.h to avoid - conflicts - - * lib/asn1/lex.l: use strtol to parse constants - -2001-04-06 Johan Danielsson <joda@pdc.kth.se> - - * kuser/kinit.c: add simple support for running commands - -2001-03-26 Assar Westerlund <assar@sics.se> - - * lib/hdb/hdb-ldap.c: change order of includes to allow it to work - with more versions of openldap - - * kdc/kerberos5.c (tgs_rep2): try to set sec and usec in error - replies - (*): update callers of krb5_km_error - (check_tgs_flags): handle renews requesting non-renewable tickets - - * lib/krb5/mk_error.c (krb5_mk_error): allow specifying both ctime - and cusec +2003-02-25 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/krb5.h (krb5_checksum, krb5_keyusage): add - compatibility names - - * lib/krb5/crypto.c (create_checksum): change so that `type == 0' - means pick from the `crypto' (context) and otherwise use that - type. this is not a large change in practice and allows callers - to specify the exact checksum algorithm to use - -2001-03-13 Assar Westerlund <assar@sics.se> - - * lib/krb5/get_cred.c (get_cred_kdc): add support for falling back - to KRB5_KU_AP_REQ_AUTH when KRB5_KU_TGS_REQ_AUTH gives `bad - integrity'. this helps for talking to old (pre 0.3d) KDCs - -2001-03-12 Assar Westerlund <assar@pdc.kth.se> - - * lib/krb5/crypto.c (krb5_derive_key): new function, used by - derived-key-test.c - * lib/krb5/string-to-key-test.c: add new test vectors posted by - Ken Raeburn <raeburn@mit.edu> in <tx1bsra8919.fsf@raeburn.org> to - ietf-krb-wg@anl.gov - * lib/krb5/n-fold-test.c: more test vectors from same source - * lib/krb5/derived-key-test.c: more tests from same source - -2001-03-06 Assar Westerlund <assar@sics.se> - - * acconfig.h: include roken_rename.h when appropriate - -2001-03-06 Assar Westerlund <assar@sics.se> - - * lib/krb5/krb5.h (krb5_enctype): remove trailing comma - -2001-03-04 Assar Westerlund <assar@sics.se> - - * lib/krb5/krb5.h (krb5_enctype): add ENCTYPE_* aliases for - compatibility with MIT krb5 - -2001-03-02 Assar Westerlund <assar@sics.se> - - * kuser/kinit.c (main): only request a renewable ticket when - explicitly requested. it still gets a renewable one if the renew - life is specified - * kuser/kinit.c (renew_validate): treat -1 as flags not being set - -2001-02-28 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/context.c (krb5_init_ets): use krb5_add_et_list - -2001-02-27 Johan Danielsson <joda@pdc.kth.se> - - * lib/krb5/get_cred.c: implement krb5_get_cred_from_kdc_opt - -2001-02-25 Assar Westerlund <assar@sics.se> - - * configure.in: do not use -R when testing for des functions - -2001-02-14 Assar Westerlund <assar@sics.se> - - * configure.in: test for lber.h when trying to link against - openldap to handle openldap v1, from Sumit Bose - <sumit.bose@suse.de> - -2001-02-19 Assar Westerlund <assar@sics.se> - - * lib/asn1/libasn1.h: add string.h (for memset) - -2001-02-15 Assar Westerlund <assar@sics.se> - - * lib/krb5/warn.c (_warnerr): add printf attributes - * lib/krb5/send_to_kdc.c (krb5_sendto): loop over all address - returned by getaddrinfo before trying the next kdc. from - thorpej@netbsd.org - - * lib/krb5/krb5.conf.5: fix default_realm in example - - * kdc/connect.c: fix a few kdc_log format types - - * configure.in: try to handle libdes/libcrypto ont requiring -L - -2001-02-10 Assar Westerlund <assar@sics.se> - - * lib/asn1/gen_decode.c (generate_type_decode): zero the data at - the beginning of the generated function, and add a label `fail' - that the code jumps to in case of errors that frees all allocated - data - -2001-02-07 Assar Westerlund <assar@sics.se> - - * configure.in: aix dce: fix misquotes, from Ake Sandgren - <ake@cs.umu.se> - - * configure.in (dpagaix_LDFLAGS): try to add export file - -2001-02-05 Assar Westerlund <assar@sics.se> - - * lib/krb5/krb5_keytab.3: new man page, contributed by - <lha@stacken.kth.se> - - * kdc/kaserver.c: update to new db_fetch4 - -2001-02-05 Assar Westerlund <assar@assaris.sics.se> - - * Release 0.3e - -2001-01-30 Assar Westerlund <assar@sics.se> - - * kdc/hprop.c (v4_get_masterkey): check kdb_verify_master_key - properly - (kdb_prop): decrypt key properly - * kdc/hprop.c: handle building with KRB4 always try to decrypt v4 - data with the master key leave it up to the v5 how to encrypt with - that master key - - * kdc/kstash.c: include file name in error messages - * kdc/hprop.c: fix a typo and check some more return values - * lib/hdb/hdb-ldap.c (LDAP__lookup_princ): call ldap_search_s - correctly. From Jacques Vidrine <n@nectar.com> - * kdc/misc.c (db_fetch): HDB_ERR_NOENTRY makes more sense than - ENOENT - - * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to - 15:0:0 - * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): bump version to 7:0:0 - * lib/asn1/Makefile.am (libasn1_la_LDFLAGS): bump version to 4:0:2 - * kdc/misc.c (db_fetch): return an error code. change callers to - look at this and try to print it in log messages - - * lib/krb5/crypto.c (decrypt_internal_derived): check that there's - enough data - -2001-01-29 Assar Westerlund <assar@sics.se> - - * kdc/hprop.c (realm_buf): move it so it becomes properly - conditional on KRB4 - - * lib/hdb/mkey.c (hdb_unseal_keys_mkey, hdb_seal_keys_mkey, - hdb_unseal_keys, hdb_seal_keys): check that we have the correct - master key and that we manage to decrypt the key properly, - returning an error code. fix all callers to check return value. - - * tools/krb5-config.in: use @LIB_des_appl@ - * tools/Makefile.am (krb5-config): add LIB_des_appl - * configure.in (LIB_des): set correctly - (LIB_des_appl): add for the use by krb5-config.in + * appl/kf/kf.1: s/securly/securely/ from NetBSD + +2003-02-18 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/store_fd.c (fd_fetch, fd_store): use net_{read,write} - to make sure of not dropping data when doing it over a socket. - (this might break when used with ordinary files on win32) + * kdc/connect.c: s/intialize/initialize, from + <jmc@prioris.mini.pw.edu.pl> - * lib/hdb/hdb_err.et (NO_MKEY): add +2003-02-17 Love Hörnquist Åstrand <lha@it.su.se> - * kdc/kerberos5.c (as_rep): be paranoid and check - krb5_enctype_to_string for failure, noted by <lha@stacken.kth.se> + * configure.in: add AM_MAINTAINER_MODE + +2003-02-16 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/krb5_init_context.3, lib/krb5/krb5_context.3, - lib/krb5/krb5_auth_context.3: add new man pages, contributed by - <lha@stacken.kth.se> + * **/*.[0-9]: add copyright/licenses on all manpages - * use the openssl api for md4/md5/sha and handle openssl/*.h +2003-14-16 Jacques Vidrine <nectar@kth.se> - * kdc/kaserver.c (do_getticket): check length of ticket. noted by - <lha@stacken.kth.se> + * lib/krb5/get_in_tkt.c (init_as_req): Send only a single + PA-ENC-TIMESTAMP in the AS-REQ, using the first encryption + type specified by the KDC. -2001-01-28 Assar Westerlund <assar@sics.se> +2003-02-15 Love Hörnquist Åstrand <lha@it.su.se> - * configure.in: send -R instead of -rpath to libtool to set - runtime library paths + * fix-export: some autoconf put their version number in + autom4te.cache, so remove autom4te*.cache + + * fix-export: make sure $1 is a directory + +2003-02-04 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/Makefile.am: remove all dependencies on libkrb + * kpasswd/kpasswdd.8: spelling, from jmc <jmc@prioris.mini.pw.edu.pl> -2001-01-27 Assar Westerlund <assar@sics.se> + * kdc/kdc.8: spelling, from jmc <jmc@prioris.mini.pw.edu.pl> + +2003-01-31 Love Hörnquist Åstrand <lha@it.su.se> - * appl/rcp: add port of bsd rcp changed to use existing rsh, - contributed by Richard Nyberg <rnyberg@it.su.se> + * kdc/hpropd.8: s/databases/a database/ s/Not/not/ -2001-01-27 Johan Danielsson <joda@pdc.kth.se> + * kdc/hprop.8: add missing . + +2003-01-30 Love Hörnquist Åstrand <lha@it.su.se> - * lib/krb5/get_port.c: don't warn if the port name can't be found, - nobody cares anyway + * lib/krb5/krb5.conf.5: documentation for of boolean, etypes, + address, write out encryption type in sentences, s/Host/host + +2003-01-26 Love Hörnquist Åstrand <lha@it.su.se> -2001-01-26 Johan Danielsson <joda@pdc.kth.se> + * lib/asn1/check-gen.c: add checks for Authenticator too + +2003-01-25 Love Hörnquist Åstrand <lha@it.su.se> - * kdc/hprop.c: make it possible to convert a v4 dump file without - having any v4 libraries; the kdb backend still require them + * doc/setup.texi: in the hprop example, use hprop and the first + component, not host - * kdc/v4_dump.c: include shadow definition of kdb Principal, so we - don't have to depend on any v4 libraries + * lib/krb5/get_addrs.c (find_all_addresses): address-less + point-to-point might not have an address, just ignore + those. Reported by Harald Barth. - * kdc/hprop.h: include shadow definition of kdb Principal, so we - don't have to depend on any v4 libraries +2003-01-23 Love Hörnquist Åstrand <lha@it.su.se> - * lib/hdb/print.c: reduce number of memory allocations + * lib/krb5/verify_krb5_conf.c (check_section): when key isn't + found, don't print out all known keys - * lib/hdb/mkey.c: add support for reading krb4 /.k files + * lib/krb5/verify_krb5_conf.c (syslogvals): mark up where severity + and facility start resp + (check_log): find_value() returns -1 when key isn't found -2001-01-19 Assar Westerlund <assar@sics.se> + * lib/krb5/crypto.c (_krb5_aes_cts_encrypt): make key argument a + 'const void *' to avoid AES_KEY being exposed in krb5-private.h + + * lib/krb5/krb5.conf.5: add [kdc]use_2b - * lib/krb5/krb5.conf.5: document admin_server and kpasswd_server - for realms document capath better + * kdc/524.c (encode_524_response): its 2b not b2 + + * doc/misc.texi: quote @ where missing + + * lib/asn1/Makefile.am: add check-gen + + * lib/asn1/check-gen.c: add Principal check + + * lib/asn1/check-common.h: move generic asn1/der functions from + check-der.c to here - * lib/krb5/krbhst.c (krb5_get_krb_changepw_hst): preferably look - at kpasswd_server before admin_server + * lib/asn1/check-common.c: move generic asn1/der functions from + check-der.c to here - * lib/krb5/get_cred.c (get_cred_from_kdc_flags): look in - [libdefaults]capath for better hint of realm to send request to. - this allows the client to specify `realm routing information' in - case it cannot be done at the server (which is preferred) + * lib/asn1/check-der.c: move out the generic asn1/der functions to + a common file - * lib/krb5/rd_priv.c (krb5_rd_priv): handle no sequence number as - zero when we were expecting a sequence number. MIT krb5 cannot - generate a sequence number of zero, instead generating no sequence - number - * lib/krb5/rd_safe.c (krb5_rd_safe): dito +2003-01-22 Love Hörnquist Åstrand <lha@it.su.se> -2001-01-11 Assar Westerlund <assar@sics.se> + * doc/misc.texi: more text about afs, how to get get your KeyFile, + and how to start use 2b tokens - * kpasswd/kpasswdd.c: add --port option + * lib/krb5/krb5.conf.5: spelling, from Jason McIntyre + <jmc@cvs.openbsd.org> + +2003-01-21 Jacques Vidrine <nectar@kth.se> -2001-01-10 Assar Westerlund <assar@sics.se> + * kuser/kuser_locl.h: include crypto-headers.h for + des_read_pw_string prototype - * lib/krb5/appdefault.c (krb5_appdefault_string): fix condition - just before returning +2003-01-16 Love Hörnquist Åstrand <lha@it.su.se> -2001-01-09 Assar Westerlund <assar@sics.se> + * admin/ktutil.8: document -v, --verbose - * appl/kf/kfd.c (proto): use krb5_rd_cred2 instead of krb5_rd_cred + * admin/get.c (kt_get): make getarg usage consistent with other + other parts of ktutil -2001-01-05 Johan Danielsson <joda@pdc.kth.se> + * admin/copy.c (kt_copy): remove adding verbose_flag to args + struct, since it will overrun the args array (from Sumit Bose) + +2003-01-15 Love Hörnquist Åstrand <lha@it.su.se> - * kuser/kinit.c: call a time `time', and not `seconds' + * lib/krb5/krb5.conf.5: write more about [realms] REALM = { kdc = + ... } - * lib/krb5/init_creds.c: not much point in setting the anonymous - flag here + * lib/krb5/aes-test.c: test vectors in aes-draft + + * lib/krb5/Makefile.am: add aes-test.c - * lib/krb5/krb5_appdefault.3: document appdefault_time + * lib/krb5/crypto.c: Add support for AES + (draft-raeburn-krb-rijndael-krb-02), not enabled by default. + (HMAC_SHA1_DES3_checksum): rename to SP_HMAC_SHA1_checksum and modify + to support checksumtype that are have a shorter wireformat then + their output block size. + + * lib/krb5/crypto.c (struct encryption_type): split the blocksize + into blocksize and padsize, padsize is the minimum padding + size. they are the same for now + (enctype_*): add padsize + (encrypt_internal): use padsize + (encrypt_internal_derived): use padsize + (wrapped_length): use padsize + (wrapped_length_dervied): use padsize + + * lib/krb5/crypto.c: add extra `opaque' argument to string_to_key + function for each enctype in preparation enctypes that uses + `Encryption and Checksum Specifications for Kerberos 5' draft + + * lib/asn1/k5.asn1: add checksum and enctype for AES from + draft-raeburn-krb-rijndael-krb-02.txt -2001-01-04 Johan Danielsson <joda@pdc.kth.se> + * lib/krb5/krb5.h (krb5_keytype): add KEYTYPE_AES128, + KEYTYPE_AES256 - * lib/krb5/verify_user.c: use - krb5_get_init_creds_opt_set_default_flags +2003-01-14 Love Hörnquist Åstrand <lha@it.su.se> - * kuser/kinit.c: use krb5_get_init_creds_opt_set_default_flags + * lib/hdb/common.c (_hdb_fetch): handle error code from + hdb_value2entry - * lib/krb5/init_creds.c: new function - krb5_get_init_creds_opt_set_default_flags to set options from - krb5.conf + * kdc/Makefile.am: always include kerberos4.c and 524.c in + kdc_SOURCES to support 524 - * lib/krb5/rd_cred.c: make this match the MIT function + * kdc/524.c: always compile in support for 524 - * lib/krb5/appdefault.c (krb5_appdefault_string): handle NULL - def_val - (krb5_appdefault_time): new function - -2001-01-03 Assar Westerlund <assar@sics.se> - - * kdc/hpropd.c (main): handle EOF when reading from stdin + * kdc/kdc_locl.h: move out krb/524 protos from under #ifdef KRB4 + + * kdc/config.c: always compile in support for 524 + + * kdc/connect.c: always compile in support for 524 + + * kdc/kerberos4.c: export encode_v4_ticket() and get_des_key() + even when we build without kerberos 4, 524 needs them + + * lib/krb5/convert_creds.c, lib/krb5/krb5-v4compat.h: Split out + Kerberos 4 help functions/structures so other parts of the source + tree can use it (like the KDC) diff --git a/kerberosV/src/ChangeLog.2001 b/kerberosV/src/ChangeLog.2001 new file mode 100644 index 00000000000..b048488f8d4 --- /dev/null +++ b/kerberosV/src/ChangeLog.2001 @@ -0,0 +1,1122 @@ +2001-12-20 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/crypto.c: use our own des string-to-key function, since + the one from openssl sometimes generates wrong output + +2001-12-05 Jacques Vidrine <n@nectar.cc> + + * lib/hdb/mkey.c: fix a bug in which kstash would crash if + there were no /etc/krb5.conf + +2001-11-09 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5_verify_user.3: sort references (from Thomas + Klausner) + + * lib/krb5/krb5_principal_get_realm.3: add section to reference + (from Thomas Klausner) + + * lib/krb5/krb5_krbhst_init.3: sort references (from Thomas + Klausner) + + * lib/krb5/krb5_keytab.3: white space fixes (from Thomas Klausner) + + * lib/krb5/krb5_get_krbhst.3: remove extra white space (from + Thomas Klausner) + + * lib/krb5/krb5_get_all_client_addrs.3: add section to reference + (from Thomas Klausner) + +2001-10-29 Jacques Vidrine <n@nectar.com> + + * admin/get.c: fix a bug in which a reference to a data + structure on the stack was being kept after the containing + function's lifetime, resulting in a segfault during `ktutil + get'. + +2001-10-22 Assar Westerlund <assar@sics.se> + + * lib/krb5/crypto.c: make all high-level encrypting and decrypting + functions check the return value of the underlying function and + handle errors more consistently. noted by Sam Hartman + <hartmans@mit.edu> + +2001-10-21 Assar Westerlund <assar@sics.se> + + * lib/krb5/crypto.c (enctype_arcfour_hmac_md5): actually use a + non-keyed checksum when it should be non-keyed + +2001-09-29 Assar Westerlund <assar@sics.se> + + * kuser/kinit.1: add the kauth alias + * kuser/kinit.c: allow specification of afslog in krb5.conf, noted + by jhutz@cs.cmu.edu + +2001-09-27 Assar Westerlund <assar@sics.se> + + * lib/asn1/gen.c: remove the need for libasn1.h, also make + generated files include all files from IMPORTed modules + + * lib/krb5/krb5.h (KRB5_KPASSWD_*): set correct values + * kpasswd/kpasswd.c: improve error message printing + * lib/krb5/changepw.c (krb5_passwd_result_to_string): add change + to use sequence numbers connect the udp socket so that we can + figure out the local address + +2001-09-25 Assar Westerlund <assar@sics.se> + + * lib/asn1: implement OBJECT IDENTIFIER and ENUMERATED + +2001-09-20 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/principal.c (krb5_425_conv_principal_ext): try using + lower case realm as domain, but only when given a verification + function + +2001-09-20 Assar Westerlund <assar@sics.se> + + * lib/asn1/der_put.c (der_put_length): do not even try writing + anything when len == 0 + +2001-09-18 Johan Danielsson <joda@pdc.kth.se> + + * kdc/hpropd.c: add realm override option + + * lib/krb5/set_default_realm.c (krb5_set_default_realm): make + realm parameter const + + * kdc/hprop.c: more free's + + * lib/krb5/init_creds_pw.c (krb5_get_init_creds_keytab): free key + proc data + + * lib/krb5/expand_hostname.c (krb5_expand_hostname_realms): free + addrinfo + + * lib/hdb/mkey.c (hdb_set_master_keyfile): clear error string when + not returning error + +2001-09-16 Assar Westerlund <assar@sics.se> + + * lib/krb5/appdefault.c (krb5_appdefault_{boolean,string,time): + make realm const + + * lib/krb5/crypto.c: use des functions to avoid generating + warnings with openssl's prototypes + +2001-09-05 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: check for termcap.h + + * lib/asn1/lex.l: add another undef ECHO to keep AIX lex happy + +2001-09-03 Assar Westerlund <assar@sics.se> + + * lib/krb5/addr_families.c (krb5_print_address): handle snprintf + returning < 0. noticed by hin@stacken.kth.se + +2001-09-03 Assar Westerlund <assar@sics.se> + + * Release 0.4e + +2001-09-02 Johan Danielsson <joda@pdc.kth.se> + + * kuser/Makefile.am: install kauth as a symlink to kinit + + * kuser/kinit.c: get v4_tickets by default + + * lib/asn1/Makefile.am: fix for broken automake + +2001-08-31 Johan Danielsson <joda@pdc.kth.se> + + * lib/hdb/hdb-ldap.c: some pretty much untested changes from Luke + Howard + + * kuser/kinit.1: remove references to kauth + + * kuser/Makefile.am: kauth is no more + + * kuser/kinit.c: use appdefaults for everything. defaults are now + as in kauth. + + * lib/krb5/appdefault.c: also check libdefaults, and realms/realm + + * lib/krb5/context.c (krb5_free_context): free more stuff + +2001-08-30 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_krb5_conf.c: do some checks of the values in the + file + + * lib/krb5/krb5.conf.5: remove srv_try_txt, fix spelling + + * lib/krb5/context.c: don't init srv_try_txt, since it isn't used + anymore + +2001-08-29 Jacques Vidrine <n@nectar.com> + + * configure.in: Check for already-installed com_err. + +2001-08-28 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set versoin to 18:2:1 + +2001-08-24 Assar Westerlund <assar@sics.se> + + * kuser/Makefile.am: remove CHECK_LOCAL - non bin programs require + no special treatment now + + * kuser/generate-requests.c: parse arguments in a useful way + * kuser/kverify.c: add --help/--verify + +2001-08-22 Assar Westerlund <assar@sics.se> + + * configure.in: bump prereq to 2.52 remove unused test_LIB_KRB4 + + * configure.in: re-write the handling of crypto libraries. try to + use the one of openssl's libcrypto or krb4's libdes that has all + the required functionality (md4, md5, sha1, des, rc4). if there + is no such library, the included lib/des is built. + + * kdc/headers.h: include libutil.h if it exists + * kpasswd/kpasswd_locl.h: include libutil.h if it exists + * kdc/kerberos4.c (get_des_key): check for null keys even if + is_server + +2001-08-21 Assar Westerlund <assar@sics.se> + + * lib/asn1/asn1_print.c: print some size_t correctly + * configure.in: remove extra space after -L check for libutil.h + +2001-08-17 Johan Danielsson <joda@pdc.kth.se> + + * kdc/kdc_locl.h: fix prototype for get_des_key + + * kdc/kaserver.c: fix call to get_des_key + + * kdc/524.c: fix call to get_des_key + + * kdc/kerberos4.c (get_des_key): if getting a key for a server, + return any des-key not just keys that can be string-to-keyed by + the client + +2001-08-10 Assar Westerlund <assar@sics.se> + + * Release 0.4d + +2001-08-10 Assar Westerlund <assar@sics.se> + + * configure.in: check for openpty + * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:4:0 + +2001-08-08 Assar Westerlund <assar@sics.se> + + * configure.in: just add -L (if required) from krb4 when testing + for libdes/libcrypto + +2001-08-04 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am (man_MANS): add some missing man pages + * fix-export: fix the sed expression for finding the man pages + +2001-07-31 Assar Westerlund <assar@sics.se> + + * kpasswd/kpasswd-generator.c (main): implement --version and + --help + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): update version to + 18:1:1 + +2001-07-27 Assar Westerlund <assar@sics.se> + + * lib/krb5/context.c (init_context_from_config_file): check + parsing of addresses + +2001-07-26 Assar Westerlund <assar@sics.se> + + * lib/krb5/sock_principal.c (krb5_sock_to_principal): rename + sa_len -> salen to avoid the macro that's defined on irix. noted + by "Jacques A. Vidrine" <n@nectar.com> + +2001-07-24 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/addr_families.c: add support for type + KRB5_ADDRESS_ADDRPORT + + * lib/krb5/addr_families.c (krb5_address_order): complain about + unsuppored address types + +2001-07-23 Johan Danielsson <joda@pdc.kth.se> + + * admin/get.c: don't open connection to server until we loop over + the principals, at that time we know the realm of the (first) + principal and we can default to that admin server + + * admin: add a rename command + +2001-07-19 Assar Westerlund <assar@sics.se> + + * kdc/hprop.c (usage): clarify a tiny bit + +2001-07-19 Assar Westerlund <assar@sics.se> + + * Release 0.4c + +2001-07-19 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to + 18:0:1 + + * lib/krb5/get_for_creds.c (krb5_fwd_tgt_creds): make it behave + the same way as the MIT function + + * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): update to 7:3:0 + * lib/krb5/sock_principal.c (krb5_sock_to_principal): use + getnameinfo + + * lib/krb5/krbhst.c (srv_find_realm): handle port numbers + consistenly in local byte order + + * lib/krb5/get_default_realm.c (krb5_get_default_realm): set an + error string + + * kuser/kinit.c (renew_validate): invert condition correctly. get + v4 tickets if we succeed renewing + * lib/krb5/principal.c (krb5_principal_get_type): add + (default_v4_name_convert): add "smtp" + +2001-07-13 Assar Westerlund <assar@sics.se> + + * configure.in: remove make-print-version from LIBOBJS, it's no + longer in lib/roken but always built in lib/vers + +2001-07-12 Johan Danielsson <joda@pdc.kth.se> + + * lib/hdb/mkey.c: more set_error_string + +2001-07-12 Assar Westerlund <assar@sics.se> + + * lib/hdb/Makefile.am (libhdb_la_LIBADD): add required library + dependencies + + * lib/asn1/Makefile.am (libasn1_la_LIBADD): add required library + dependencies + +2001-07-11 Johan Danielsson <joda@pdc.kth.se> + + * kdc/hprop.c: remove v4 master key handling; remove old v4-db and + ka-db flags; add defaults for v4_realm and afs_cell + +2001-07-09 Assar Westerlund <assar@sics.se> + + * lib/krb5/sock_principal.c (krb5_sock_to_principal): copy hname + before calling krb5_sname_to_principal. from "Jacques A. Vidrine" + <n@nectar.com> + +2001-07-08 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/context.c: use krb5_copy_addresses instead of + copy_HostAddresses + +2001-07-06 Assar Westerlund <assar@sics.se> + + * configure.in (LIB_des_a, LIB_des_so): add these so that they can + be used by lib/auth/sia + + * kuser/kinit.c: re-do some of the v4 fallbacks: look at + get-tokens flag do not print extra errors do not try to do 524 if + we got tickets from a v4 server + +2001-07-03 Assar Westerlund <assar@sics.se> + + * lib/krb5/replay.c (krb5_get_server_rcache): cast argument to + printf + + * lib/krb5/get_addrs.c (find_all_addresses): call free_addresses + on ignore_addresses correctly + * lib/krb5/init_creds.c + (krb5_get_init_creds_opt_set_default_flags): change to take a + const realm + + * lib/krb5/principal.c (krb5_425_conv_principal_ext): if the + instance is the first component of the local hostname, the + converted host should be the long hostname. from + <shadow@dementia.org> + +2001-07-02 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/Makefile.am: address.c is no more; add a couple of + manpages + + * lib/krb5/krb5_timeofday.3: new manpage + + * lib/krb5/krb5_get_all_client_addrs.3: new manpage + + * lib/krb5/get_in_tkt.c (init_as_req): treat no addresses as + wildcard + + * lib/krb5/get_cred.c (get_cred_kdc_la): treat no addresses as + wildcard + + * lib/krb5/get_addrs.c: don't include client addresses that match + ignore_addresses + + * lib/krb5/context.c: initialise ignore_addresses + + * lib/krb5/addr_families.c: add new `arange' fake address type, + that matches more than one address; this required some internal + changes to many functions, so all of address.c got moved here + (wasn't much left there) + + * lib/krb5/krb5.h: add list of ignored addresses to context + +2001-07-03 Assar Westerlund <assar@sics.se> + + * Release 0.4b + +2001-07-03 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): set version to 17:0:0 + * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): set version to 7:2:0 + +2001-07-03 Assar Westerlund <assar@sics.se> + + * Release 0.4a + +2001-07-02 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.c: make this compile without krb4 support + + * lib/krb5/write_message.c: remove priv parameter from + write_safe_message; don't know why it was there in the first place + + * doc/install.texi: remove kaserver switches, it's always compiled + in now + + * kdc/hprop.c: always include kadb support + + * kdc/kaserver.c: always include kaserver support + +2001-07-02 Assar Westerlund <assar@sics.se> + + * kpasswd/kpasswdd.c (doit): make failing to bind a socket a + non-fatal error, and abort if no sockets were bound + +2001-07-01 Assar Westerlund <assar@sics.se> + + * lib/krb5/krbhst.c: remember the real port number when falling + back from kpasswd -> kadmin, and krb524 -> kdc + +2001-06-29 Assar Westerlund <assar@sics.se> + + * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): if + no_addresses is set, do not add any local addresses to KRB_CRED + + * kuser/kinit.c: remove extra clearing of password and some + redundant code + +2001-06-29 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.c: move ticket conversion code to separate function, + and call that from a couple of places, like when renewing a + ticket; also add a flag for just converting a ticket + + * lib/krb5/init_creds_pw.c: set renew-life to some sane value + + * kdc/524.c: don't send more data than required + +2001-06-24 Assar Westerlund <assar@sics.se> + + * lib/krb5/store_fd.c (krb5_storage_from_fd): check malloc returns + + * lib/krb5/keytab_any.c (any_resolve); improving parsing of ANY: + (any_start_seq_get): remove a double free + (any_next_entry): iterate over all (sub) keytabs and avoid leave data + around to be freed again + + * kdc/kdc_locl.h: add a define for des_new_random_key when using + openssl's libcrypto + + * configure.in: move v6 tests down + + * lib/krb5/krb5.h (krb5_context_data): remove srv_try_rfc2052 + + * update to libtool 1.4 and autoconf 2.50 + +2001-06-22 Johan Danielsson <joda@pdc.kth.se> + + * lib/hdb/hdb.c: use krb5_add_et_list + +2001-06-21 Johan Danielsson <joda@pdc.kth.se> + + * lib/hdb/Makefile.am: add generation number + * lib/hdb/common.c: add generation number code + * lib/hdb/hdb.asn1: add generation number + * lib/hdb/print.c: use krb5_storage to make it more dynamic + +2001-06-21 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5.conf.5: update to changed names used by + krb5_get_init_creds_opt_set_default_flags + * lib/krb5/init_creds.c + (krb5_get_init_creds_opt_set_default_flags): make the appdefault + keywords have the same names + + * configure.in: only add -L and -R to the krb4 libdir if we are + actually using it + + * lib/krb5/krbhst.c (fallback_get_hosts): do not copy trailing + dot of hostname add some comments + * lib/krb5/krbhst.c: use getaddrinfo instead of dns_lookup when + testing for kerberos.REALM. this allows reusing that information + when actually contacting the server and thus avoids one DNS lookup + +2001-06-20 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.h: include k524_err.h + + * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): don't test + for keytype, the server will do this for us if it has anything to + complain about + + * lib/krb5/context.c: add protocol compatible krb524 error codes + + * lib/krb5/Makefile.am: add protocol compatible krb524 error codes + + * lib/krb5/k524_err.et: add protocol compatible krb524 error codes + + * lib/krb5/krb5_principal_get_realm.3: manpage + + * lib/krb5/principal.c: add functions `krb5_principal_get_realm' + and `krb5_principal_get_comp_string' that returns parts of a + principal; this is a replacement for the internal + `krb5_princ_realm' and `krb5_princ_component' macros that everyone + seem to use + +2001-06-19 Assar Westerlund <assar@sics.se> + + * kuser/kinit.c (main): dereference result from krb5_princ_realm. + from Thomas Nystrom <thn@saeab.se> + +2001-06-18 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/mk_req.c (krb5_mk_req_exact): free creds when done + * lib/krb5/crypto.c (krb5_string_to_key_derived): fix memory leak + * lib/krb5/krbhst.c (config_get_hosts): free hostlist + * kuser/kinit.c: free principal + +2001-06-18 Assar Westerlund <assar@sics.se> + + * lib/krb5/send_to_kdc.c (krb5_sendto): remove an extra + freeaddrinfo + + * lib/krb5/convert_creds.c (krb524_convert_creds_kdc_ccache): + remove some unused variables + + * lib/krb5/krbhst.c (admin_get_next): spell kerberos correctly + * kdc/kerberos5.c: update to new krb5_auth_con* names + * kdc/hpropd.c: update to new krb5_auth_con* names + * lib/krb5/rd_req.c (krb5_rd_req): use krb5_auth_con* functions + and remove some comments + * lib/krb5/rd_safe.c (krb5_rd_safe): pick the keys in the right + order: remote - local - session + * lib/krb5/rd_rep.c (krb5_rd_rep): save the remote sub key in the + auth_context + * lib/krb5/rd_priv.c (krb5_rd_priv): pick keys in the correct + order: remote - local - session + * lib/krb5/mk_safe.c (krb5_mk_safe): pick keys in the right order, + local - remote - session + +2001-06-18 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/convert_creds.c: use starttime instead of authtime, + from Chris Chiappa + + * lib/krb5/convert_creds.c: make krb524_convert_creds_kdc match + the MIT function by the same name; add + krb524_convert_creds_kdc_ccache that does what the old version did + + * admin/list.c (do_list): make sure list of keys is NULL + terminated; similar to patch sent by Chris Chiappa + +2001-06-18 Assar Westerlund <assar@sics.se> + + * lib/krb5/mcache.c (mcc_remove_cred): use + krb5_free_creds_contents + + * lib/krb5/auth_context.c: name function krb5_auth_con more + consistenly + * lib/krb5/rd_req.c (krb5_verify_authenticator_checksum): use + renamed krb5_auth_con_getauthenticator + + * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): update to + use krb5_krbhst API + * lib/krb5/changepw.c (krb5_change_password): update to use + krb5_krbhst API + * lib/krb5/send_to_kdc.c: update to use krb5_krbhst API + * lib/krb5/krbhst.c (krb5_krbhst_get_addrinfo): add set def_port + in krb5_krbhst_info + (krb5_krbhst_free): free everything + + * lib/krb5/krb5.h (KRB5_VERIFY_NO_ADDRESSES): add + (krb5_krbhst_info): add def_port (default port for this service) + + * lib/krb5/krbhst-test.c: make it more verbose and useful + * lib/krb5/krbhst.c: remove some more memory leaks do not try any + dns operations if there is local configuration admin: fallback to + kerberos.REALM 524: fallback to kdcs kpasswd: fallback to admin + add some comments + + * configure.in: remove initstate and setstate, they should be in + cf/roken-frag.m4 + + * lib/krb5/Makefile.am (noinst_PROGRAMS): add krbhst-test + * lib/krb5/krbhst-test.c: new program for testing krbhst + * lib/krb5/krbhst.c (common_init): remove memory leak + (main): move test program into krbhst-test + +2001-06-17 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5_krbhst_init.3: manpage + + * lib/krb5/krb5_get_krbhst.3: manpage + +2001-06-16 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.h: add opaque krb5_krbhst_handle type + + * lib/krb5/krbhst.c: change void* to krb5_krbhst_handle + + * lib/krb5/krb5.h: types for new krbhst api + + * lib/krb5/krbhst.c: implement a new api that looks up one host at + a time, instead of making a list of hosts + +2001-06-09 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: test for initstate and setstate + + * lib/krb5/krbhst.c: remove rfc2052 support + +2001-06-08 Johan Danielsson <joda@pdc.kth.se> + + * fix some manpages for broken mdoc.old grog test + +2001-05-28 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5.conf.5: add [appdefaults] + * lib/krb5/init_creds_pw.c: remove configuration reading that is + now done in krb5_get_init_creds_opt_set_default_flags + * lib/krb5/init_creds.c + (krb5_get_init_creds_opt_set_default_flags): add reading of + libdefaults versions of these and add no_addresses + + * lib/krb5/get_in_tkt.c (krb5_get_in_cred): clear error string + when preauth was required and we retry + +2001-05-25 Assar Westerlund <assar@sics.se> + + * lib/krb5/convert_creds.c (krb524_convert_creds_kdc): call + krb5_get_krb524hst + * lib/krb5/krbhst.c (krb5_get_krb524hst): add and restructure the + support functions + +2001-05-22 Assar Westerlund <assar@sics.se> + + * kdc/kerberos5.c (tgs_rep2): alloc and free csec and cusec + properly + +2001-05-17 Assar Westerlund <assar@sics.se> + + * Release 0.3f + +2001-05-17 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am: bump version to 16:0:0 + * lib/hdb/Makefile.am: bump version to 7:1:0 + * lib/asn1/Makefile.am: bump version to 5:0:0 + * lib/krb5/keytab_krb4.c: add SRVTAB as an alias for krb4 + * lib/krb5/codec.c: remove dead code + +2001-05-17 Johan Danielsson <joda@pdc.kth.se> + + * kdc/config.c: actually check the ticket addresses + +2001-05-15 Assar Westerlund <assar@sics.se> + + * lib/krb5/rd_error.c (krb5_error_from_rd_error): use correct + parenthesis + + * lib/krb5/eai_to_heim_errno.c (krb5_eai_to_heim_errno): add + `errno' (called system_error) to allow callers to make sure they + pass the current and relevant value. update callers + +2001-05-14 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_user.c: krb5_verify_user_opt + + * lib/krb5/krb5.h: verify_opt + + * kdc/kerberos5.c: pass context to krb5_domain_x500_decode + +2001-05-14 Assar Westerlund <assar@sics.se> + + * kpasswd/kpasswdd.c: adapt to new address functions + * kdc/kerberos5.c: adapt to changing address functions use LR_TYPE + * kdc/connect.c: adapt to changing address functions + * kdc/config.c: new krb5_config_parse_file + * kdc/524.c: new krb5_sockaddr2address + * lib/krb5/*: add some krb5_{set,clear}_error_string + + * lib/asn1/k5.asn1 (LR_TYPE): add + * lib/asn1/Makefile.am (gen_files): add asn1_LR_TYPE.x + +2001-05-11 Assar Westerlund <assar@sics.se> + + * kdc/kerberos5.c (tsg_rep): fix typo in variable name + + * kpasswd/kpasswd-generator.c (nop_prompter): update prototype + * lib/krb5/init_creds_pw.c: update to new prompter, use prompter + types and send two prompts at once when changning password + * lib/krb5/prompter_posix.c (krb5_prompter_posix): add name + * lib/krb5/krb5.h (krb5_prompt): add type + (krb5_prompter_fct): add anem + + * lib/krb5/cache.c (krb5_cc_next_cred): transpose last two + paramaters to krb5_cc_next_cred (as MIT does, and not as they + document). From "Jacques A. Vidrine" <n@nectar.com> + +2001-05-11 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/Makefile.am: store-test + + * lib/krb5/store-test.c: simple bit storage test + + * lib/krb5/store.c: add more byteorder storage flags + + * lib/krb5/krb5.h: add more byteorder storage flags + + * kdc/kerberos5.c: don't use NULL where we mean 0 + + * kdc/kerberos5.c: put referral test code in separate function, + and test for KRB5_NT_SRV_INST + +2001-05-10 Assar Westerlund <assar@sics.se> + + * admin/list.c (do_list): do not close the keytab if opening it + failed + * admin/list.c (do_list): always print complete names. print + everything to stdout. + * admin/list.c: print both v5 and v4 list by default + * admin/remove.c (kt_remove): reorganize some. open the keytab + (defaulting to the modify one). + * admin/purge.c (kt_purge): reorganize some. open the keytab + (defaulting to the modify one). correct usage strings + * admin/list.c (kt_list): reorganize some. open the keytab + * admin/get.c (kt_get): reorganize some. open the keytab + (defaulting to the modify one) + * admin/copy.c (kt_copy): default to modify key name. re-organise + * admin/change.c (kt_change): reorganize some. open the keytab + (defaulting to the modify one) + * admin/add.c (kt_add): reorganize some. open the keytab + (defaulting to the modify one) + * admin/ktutil.c (main): do not open the keytab, let every + sub-function handle it + + * kdc/config.c (configure): call free_getarg_strings + + * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set error strings for + a few more errors + + * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): make + `use_dns' parameter boolean + + * lib/krb5/krb5.h (krb5_context_data): add default_keytab_modify + * lib/krb5/context.c (init_context_from_config_file): set + default_keytab_modify + * lib/krb5/krb5_locl.h (KEYTAB_DEFAULT): change to + ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab + (KEYTAB_DEFAULT_MODIFY): add + * lib/krb5/keytab.c (krb5_kt_default_modify_name): add + (krb5_kt_resolve): set error string for failed keytab type + +2001-05-08 Assar Westerlund <assar@sics.se> + + * lib/krb5/crypto.c (encryption_type): make field names more + consistent + (create_checksum): separate usage and type + (krb5_create_checksum): add a separate type parameter + (encrypt_internal): only free once on mismatched checksum length + + * lib/krb5/send_to_kdc.c (krb5_sendto_kdc2): try to tell what + realm we didn't manage to reach any KDC for in the error string + + * lib/krb5/generate_seq_number.c (krb5_generate_seq_number): free + the entire subkey. from <tmartin@mirapoint.com> + +2001-05-07 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab_keyfile.c (akf_start_seq_get): return + KT_NOTFOUND if the file is empty + +2001-05-07 Assar Westerlund <assar@sics.se> + + * lib/krb5/fcache.c: call krb5_set_error_string when open fails + fatally + * lib/krb5/keytab_file.c: call krb5_set_error_string when open + fails fatally + + * lib/krb5/warn.c (_warnerr): print error_string in context in + preference to error string derived from error code + * kuser/kinit.c (main): try to print the error string + * lib/krb5/get_in_tkt.c (krb5_get_in_cred): set some sensible + error strings for errors + + * lib/krb5/krb5.h (krb5_context_data): add error_string and + error_buf + * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add error_string.c + * lib/krb5/error_string.c: new file + +2001-05-02 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/time.c: krb5_string_to_deltat + + * lib/krb5/sock_principal.c: one less data copy + + * lib/krb5/eai_to_heim_errno.c: conversion function for h_errno's + + * lib/krb5/get_default_principal.c: change this slightly + + * lib/krb5/crypto.c: make checksum_types into an array of pointers + + * lib/krb5/convert_creds.c: make sure we always use a des-cbc-crc + ticket + +2001-04-29 Assar Westerlund <assar@sics.se> + + * kdc/kerberos5.c (tgs_rep2): return a reference to a krbtgt for + the right realm if we fail to find a non-krbtgt service in the + database and the second component does a succesful non-dns lookup + to get the real realm (which has to be different from the + originally-supplied realm). this should help windows 2000 clients + that always start their lookups in `their' realm and do not have + any idea of how to map hostnames into realms + * kdc/kerberos5.c (is_krbtgt): rename to get_krbtgt_realm + +2001-04-27 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/get_host_realm.c (krb5_get_host_realm_int): add extra + parameter to request use of dns or not + +2001-04-25 Assar Westerlund <assar@sics.se> + + * admin/get.c (kt_get): allow specification of encryption types + * lib/krb5/verify_init.c (krb5_verify_init_creds): do not try to + close an unopened ccache, noted by <marc@mit.edu> + + * lib/krb5/krb5.h (krb5_any_ops): add declaration + * lib/krb5/context.c (init_context_from_config_file): register + krb5_any_ops + + * lib/krb5/keytab_any.c: new file, implementing union of keytabs + * lib/krb5/Makefile.am (libkrb5_la_SOURCES): add keytab_any.c + + * lib/krb5/init_creds_pw.c (get_init_creds_common): handle options + == NULL. noted by <marc@mit.edu> + +2001-04-19 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/rd_cred.c: set ret_creds to NULL before doing anything + else, from Jacques Vidrine + +2001-04-18 Johan Danielsson <joda@pdc.kth.se> + + * lib/hdb/libasn1.h: asn1.h -> krb5_asn1.h + + * lib/asn1/Makefile.am: add asn1_ENCTYPE.x + + * lib/krb5/krb5.h: adapt to asn1 changes + + * lib/asn1/k5.asn1: move enctypes here + + * lib/asn1/libasn1.h: rename asn1.h to krb5_asn1.h to avoid + conflicts + + * lib/asn1/Makefile.am: rename asn1.h to krb5_asn1.h to avoid + conflicts + + * lib/asn1/lex.l: use strtol to parse constants + +2001-04-06 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.c: add simple support for running commands + +2001-03-26 Assar Westerlund <assar@sics.se> + + * lib/hdb/hdb-ldap.c: change order of includes to allow it to work + with more versions of openldap + + * kdc/kerberos5.c (tgs_rep2): try to set sec and usec in error + replies + (*): update callers of krb5_km_error + (check_tgs_flags): handle renews requesting non-renewable tickets + + * lib/krb5/mk_error.c (krb5_mk_error): allow specifying both ctime + and cusec + + * lib/krb5/krb5.h (krb5_checksum, krb5_keyusage): add + compatibility names + + * lib/krb5/crypto.c (create_checksum): change so that `type == 0' + means pick from the `crypto' (context) and otherwise use that + type. this is not a large change in practice and allows callers + to specify the exact checksum algorithm to use + +2001-03-13 Assar Westerlund <assar@sics.se> + + * lib/krb5/get_cred.c (get_cred_kdc): add support for falling back + to KRB5_KU_AP_REQ_AUTH when KRB5_KU_TGS_REQ_AUTH gives `bad + integrity'. this helps for talking to old (pre 0.3d) KDCs + +2001-03-12 Assar Westerlund <assar@pdc.kth.se> + + * lib/krb5/crypto.c (krb5_derive_key): new function, used by + derived-key-test.c + * lib/krb5/string-to-key-test.c: add new test vectors posted by + Ken Raeburn <raeburn@mit.edu> in <tx1bsra8919.fsf@raeburn.org> to + ietf-krb-wg@anl.gov + * lib/krb5/n-fold-test.c: more test vectors from same source + * lib/krb5/derived-key-test.c: more tests from same source + +2001-03-06 Assar Westerlund <assar@sics.se> + + * acconfig.h: include roken_rename.h when appropriate + +2001-03-06 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5.h (krb5_enctype): remove trailing comma + +2001-03-04 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5.h (krb5_enctype): add ENCTYPE_* aliases for + compatibility with MIT krb5 + +2001-03-02 Assar Westerlund <assar@sics.se> + + * kuser/kinit.c (main): only request a renewable ticket when + explicitly requested. it still gets a renewable one if the renew + life is specified + * kuser/kinit.c (renew_validate): treat -1 as flags not being set + +2001-02-28 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/context.c (krb5_init_ets): use krb5_add_et_list + +2001-02-27 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/get_cred.c: implement krb5_get_cred_from_kdc_opt + +2001-02-25 Assar Westerlund <assar@sics.se> + + * configure.in: do not use -R when testing for des functions + +2001-02-14 Assar Westerlund <assar@sics.se> + + * configure.in: test for lber.h when trying to link against + openldap to handle openldap v1, from Sumit Bose + <sumit.bose@suse.de> + +2001-02-19 Assar Westerlund <assar@sics.se> + + * lib/asn1/libasn1.h: add string.h (for memset) + +2001-02-15 Assar Westerlund <assar@sics.se> + + * lib/krb5/warn.c (_warnerr): add printf attributes + * lib/krb5/send_to_kdc.c (krb5_sendto): loop over all address + returned by getaddrinfo before trying the next kdc. from + thorpej@netbsd.org + + * lib/krb5/krb5.conf.5: fix default_realm in example + + * kdc/connect.c: fix a few kdc_log format types + + * configure.in: try to handle libdes/libcrypto ont requiring -L + +2001-02-10 Assar Westerlund <assar@sics.se> + + * lib/asn1/gen_decode.c (generate_type_decode): zero the data at + the beginning of the generated function, and add a label `fail' + that the code jumps to in case of errors that frees all allocated + data + +2001-02-07 Assar Westerlund <assar@sics.se> + + * configure.in: aix dce: fix misquotes, from Ake Sandgren + <ake@cs.umu.se> + + * configure.in (dpagaix_LDFLAGS): try to add export file + +2001-02-05 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5_keytab.3: new man page, contributed by + <lha@stacken.kth.se> + + * kdc/kaserver.c: update to new db_fetch4 + +2001-02-05 Assar Westerlund <assar@assaris.sics.se> + + * Release 0.3e + +2001-01-30 Assar Westerlund <assar@sics.se> + + * kdc/hprop.c (v4_get_masterkey): check kdb_verify_master_key + properly + (kdb_prop): decrypt key properly + * kdc/hprop.c: handle building with KRB4 always try to decrypt v4 + data with the master key leave it up to the v5 how to encrypt with + that master key + + * kdc/kstash.c: include file name in error messages + * kdc/hprop.c: fix a typo and check some more return values + * lib/hdb/hdb-ldap.c (LDAP__lookup_princ): call ldap_search_s + correctly. From Jacques Vidrine <n@nectar.com> + * kdc/misc.c (db_fetch): HDB_ERR_NOENTRY makes more sense than + ENOENT + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to + 15:0:0 + * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): bump version to 7:0:0 + * lib/asn1/Makefile.am (libasn1_la_LDFLAGS): bump version to 4:0:2 + * kdc/misc.c (db_fetch): return an error code. change callers to + look at this and try to print it in log messages + + * lib/krb5/crypto.c (decrypt_internal_derived): check that there's + enough data + +2001-01-29 Assar Westerlund <assar@sics.se> + + * kdc/hprop.c (realm_buf): move it so it becomes properly + conditional on KRB4 + + * lib/hdb/mkey.c (hdb_unseal_keys_mkey, hdb_seal_keys_mkey, + hdb_unseal_keys, hdb_seal_keys): check that we have the correct + master key and that we manage to decrypt the key properly, + returning an error code. fix all callers to check return value. + + * tools/krb5-config.in: use @LIB_des_appl@ + * tools/Makefile.am (krb5-config): add LIB_des_appl + * configure.in (LIB_des): set correctly + (LIB_des_appl): add for the use by krb5-config.in + + * lib/krb5/store_fd.c (fd_fetch, fd_store): use net_{read,write} + to make sure of not dropping data when doing it over a socket. + (this might break when used with ordinary files on win32) + + * lib/hdb/hdb_err.et (NO_MKEY): add + + * kdc/kerberos5.c (as_rep): be paranoid and check + krb5_enctype_to_string for failure, noted by <lha@stacken.kth.se> + + * lib/krb5/krb5_init_context.3, lib/krb5/krb5_context.3, + lib/krb5/krb5_auth_context.3: add new man pages, contributed by + <lha@stacken.kth.se> + + * use the openssl api for md4/md5/sha and handle openssl/*.h + + * kdc/kaserver.c (do_getticket): check length of ticket. noted by + <lha@stacken.kth.se> + +2001-01-28 Assar Westerlund <assar@sics.se> + + * configure.in: send -R instead of -rpath to libtool to set + runtime library paths + + * lib/krb5/Makefile.am: remove all dependencies on libkrb + +2001-01-27 Assar Westerlund <assar@sics.se> + + * appl/rcp: add port of bsd rcp changed to use existing rsh, + contributed by Richard Nyberg <rnyberg@it.su.se> + +2001-01-27 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/get_port.c: don't warn if the port name can't be found, + nobody cares anyway + +2001-01-26 Johan Danielsson <joda@pdc.kth.se> + + * kdc/hprop.c: make it possible to convert a v4 dump file without + having any v4 libraries; the kdb backend still require them + + * kdc/v4_dump.c: include shadow definition of kdb Principal, so we + don't have to depend on any v4 libraries + + * kdc/hprop.h: include shadow definition of kdb Principal, so we + don't have to depend on any v4 libraries + + * lib/hdb/print.c: reduce number of memory allocations + + * lib/hdb/mkey.c: add support for reading krb4 /.k files + +2001-01-19 Assar Westerlund <assar@sics.se> + + * lib/krb5/krb5.conf.5: document admin_server and kpasswd_server + for realms document capath better + + * lib/krb5/krbhst.c (krb5_get_krb_changepw_hst): preferably look + at kpasswd_server before admin_server + + * lib/krb5/get_cred.c (get_cred_from_kdc_flags): look in + [libdefaults]capath for better hint of realm to send request to. + this allows the client to specify `realm routing information' in + case it cannot be done at the server (which is preferred) + + * lib/krb5/rd_priv.c (krb5_rd_priv): handle no sequence number as + zero when we were expecting a sequence number. MIT krb5 cannot + generate a sequence number of zero, instead generating no sequence + number + * lib/krb5/rd_safe.c (krb5_rd_safe): dito + +2001-01-11 Assar Westerlund <assar@sics.se> + + * kpasswd/kpasswdd.c: add --port option + +2001-01-10 Assar Westerlund <assar@sics.se> + + * lib/krb5/appdefault.c (krb5_appdefault_string): fix condition + just before returning + +2001-01-09 Assar Westerlund <assar@sics.se> + + * appl/kf/kfd.c (proto): use krb5_rd_cred2 instead of krb5_rd_cred + +2001-01-05 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.c: call a time `time', and not `seconds' + + * lib/krb5/init_creds.c: not much point in setting the anonymous + flag here + + * lib/krb5/krb5_appdefault.3: document appdefault_time + +2001-01-04 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_user.c: use + krb5_get_init_creds_opt_set_default_flags + + * kuser/kinit.c: use krb5_get_init_creds_opt_set_default_flags + + * lib/krb5/init_creds.c: new function + krb5_get_init_creds_opt_set_default_flags to set options from + krb5.conf + + * lib/krb5/rd_cred.c: make this match the MIT function + + * lib/krb5/appdefault.c (krb5_appdefault_string): handle NULL + def_val + (krb5_appdefault_time): new function + +2001-01-03 Assar Westerlund <assar@sics.se> + + * kdc/hpropd.c (main): handle EOF when reading from stdin diff --git a/kerberosV/src/ChangeLog.2002 b/kerberosV/src/ChangeLog.2002 new file mode 100644 index 00000000000..37fda2e4940 --- /dev/null +++ b/kerberosV/src/ChangeLog.2002 @@ -0,0 +1,726 @@ +2002-12-19 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/mk_rep.c: free allocated storage; reported by Howard + Chu + +2002-12-08 Johan Danielsson <joda@pdc.kth.se> + + * kdc/kdc_locl.h: remove old encrypt_v4_ticket prototype + +2002-12-02 Johan Danielsson <joda@pdc.kth.se> + + * kpasswd/kpasswdd.c (doit): initialise sa_size to size of + sockaddr_storage + + * kdc/connect.c (init_socket): initialise sa_size to size of + sockaddr_storage + +2002-11-15 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.h: remove trailing comma in enum + +2002-11-07 Johan Danielsson <joda@pdc.kth.se> + + * kdc/524.c: implement crude b2 style (non-)conversion for use + with afs + + * kdc/kerberos4.c: move encrypt_v4_ticket to 524.c, since that's + where it's used + +2002-10-21 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab_keyfile.c: more strcspn + + * lib/krb5/store_emem.c (emem_store): limit how much we allocate + (from Olaf Kirch) + + * lib/krb5/principal.c: don't allow trailing backslashes in + components + + * kdc/connect.c: check that %-quotes are followed by two hex + digits + + * lib/krb5/keytab_any.c: properly close the open keytabs (from + Larry Greenfield) + + * kdc/kaserver.c: make sure life is positive (from John Godehn) + +2002-10-17 Johan Danielsson <joda@pdc.kth.se> + + * kuser/klist.c (display_tokens): allow tokens up to size of + buffer (from Magnus Holmberg) + +2002-09-29 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/changepw.c (process_reply): fix reply length check + calculation (reported by various people) + +2002-09-24 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab_file.c (fkt_remove_entry): check return value + from start_seq_get (from Wynn Wilkes) + +2002-09-19 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/context.c (krb5_set_config_files): return ENXIO instead + of ENOENT when "unconfigured" + +2002-09-16 Jacques Vidrine <nectar@kth.se> + + * lib/krb5/kuserok.c, lib/krb5/prompter_posix.c: use strcspn + to convert the newline to NUL in fgets results. + +2002-09-13 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.1: remove unneeded Ns + + * lib/krb5/krb5_appdefault.3: remove extra "application" + + * fix-export: remove autom4ate.cache + +2002-09-10 Johan Danielsson <joda@pdc.kth.se> + + * include/make_crypto.c: don't use function macros if possible + + * lib/krb5/krb5_locl.h: get limits.h for UINT_MAX + + * include/Makefile.am: use make_crypto to create crypto-headers.h + + * include/make_crypto.c: crypto header generation tool + + * configure.in: move crypto test to just after testing for krb4, + and move roken tests to after both, this speeds up various failure + cases with krb4 + + * lib/krb5/config_file.c: don't use NULL when we mean 0 + + * configure.in: we don't set package_libdir anymore, so no point + in testing for it + + * tools/Makefile.am: subst INCLUDE_des + + * tools/krb5-config.in: add INCLUDE_des to cflags + + * configure.in: use AC_CONFIG_SRCDIR + + * fix-export: remove some unneeded stuff + + * kuser/kinit.c (do_524init): free principals + +2002-09-09 Jacques Vidrine <nectar@kth.se> + + * kdc/kerberos5.c (get_pa_etype_info, fix_transited_encoding), + kdc/kaserver.c (krb5_ret_xdr_data), + lib/krb5/transited.c (krb5_domain_x500_decode): Validate some + counts: Check that they are non-negative, and that they are small + enough to avoid integer overflow when used in memory allocation + calculations. Potential problem areas pointed out by + Sebastian Krahmer <krahmer@suse.de>. + + * lib/krb5/keytab_keyfile.c (akf_add_entry): Use O_EXCL when + creating a new keyfile. + +2002-09-09 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: don't try to build pam module + +2002-09-05 Johan Danielsson <joda@pdc.kth.se> + + * appl/kf/kf.c: fix warning string + + * lib/krb5/log.c (krb5_vlog_msg): delay message formating till we + know we need it + +2002-09-04 Assar Westerlund <assar@kth.se> + + * kdc/kerberos5.c (encode_reply): correct error logging + +2002-09-04 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/sendauth.c: close ccache if we opened it + + * appl/kf/kf.c: handle new protocol + + * appl/kf/kfd.c: use krb5_err instead of sysloging directly, + handle the new protocol, and bail out if an old client tries to + connect + + * appl/kf/kf_locl.h: we need a protocol version string + + * lib/hdb/hdb-ldap.c: use ASN1_MALLOC_ENCODE + + * kdc/kerberos5.c: use ASN1_MALLOC_ENCODE + + * kdc/hprop.c: set AP_OPTS_USE_SUBKEY + + * lib/hdb/common.c: use ASN1_MALLOC_ENCODE + + * lib/asn1/gen.c: add convenience macro that allocates a buffer + and encoded into that + + * lib/krb5/get_cred.c (init_tgs_req): use + in_creds->session.keytype literally instead of trying to convert + to a list of enctypes (it should already be an enctype) + + * lib/krb5/get_cred.c (init_tgs_req): init ret + +2002-09-03 Johan Danielsson <joda@pdc.kth.se> + + * lib/asn1/k5.asn1: remove ETYPE_DES3_CBC_NONE_IVEC + + * lib/krb5/krb5.h: remove ENCTYPE_DES3_CBC_NONE_IVEC + + * lib/krb5/crypto.c: get rid of DES3_CBC_encrypt_ivec, just use + zero ivec in DES3_CBC_encrypt if passed ivec is NULL + + * lib/krb5/Makefile.am: back out 1.144, since it will re-create + krb5-protos.h at build-time, which requires perl, which is bad + + * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): don't + blindly use the local subkey + + * lib/krb5/crypto.c: add function krb5_crypto_getblocksize that + extracts the required blocksize from a crypto context + + * lib/krb5/build_auth.c: just get the length of the encoded + authenticator instead of trying to grow a buffer + +2002-09-03 Assar Westerlund <assar@kth.se> + + * configure.in: add --disable-mmap option, and tests for + sys/mman.h and mmap + +2002-09-03 Jacques Vidrine <nectar@kth.se> + + * lib/krb5/changepw.c: verify lengths in response + + * lib/asn1/der_get.c (decode_integer, decode_unsigned): check for + truncated integers + +2002-09-02 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/mk_req_ext.c: generate a local subkey if + AP_OPTS_USE_SUBKEY is set + + * lib/krb5/build_auth.c: we don't have enough information about + whether to generate a local subkey here, so don't try to + + * lib/krb5/auth_context.c: new function + krb5_auth_con_generatelocalsubkey + + * lib/krb5/get_in_tkt.c: only set kdc_sec_offset if looking at an + initial ticket + + * lib/krb5/context.c (init_context_from_config_file): simplify + initialisation of srv_lookup + + * lib/krb5/changepw.c (send_request): set AP_OPTS_USE_SUBKEY + + * lib/krb5/krb5.h: add AP_OPTS_USE_SUBKEY + +2002-08-30 Assar Westerlund <assar@kth.se> + + * lib/krb5/name-45-test.c: also test krb5_524_conv_principal + * lib/krb5/Makefile.am (TESTS): add name-45-test + * lib/krb5/name-45-test.c: add testcases for + krb5_425_conv_principal + +2002-08-29 Assar Westerlund <assar@kth.se> + + * lib/krb5/parse-name-test.c: also test unparse_short functions + * lib/asn1/asn1_print.c: use com_err/error_message API + * lib/krb5/Makefile.am: add parse-name-test + * lib/krb5/parse-name-test.c: add a program for testing parsing + and unparsing principal names + +2002-08-28 Assar Westerlund <assar@kth.se> + + * kdc/config.c: add missing ifdef DAEMON + +2002-08-28 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: use rk_SUNOS + + * kdc/config.c: add detach options + + * kdc/main.c: maybe detach from console? + + * kdc/kdc.8: markup changes + + * configure.in: AC_TEST_PACKAGE_NEW -> rk_TEST_PACKAGE + + * configure.in: use rk_TELNET, rename some other macros, and don't + add -ldes to krb4 link command + + * kuser/kinit.1: whitespace fix (from NetBSD) + + * include/bits.c: we may need unistd.h for ssize_t + +2002-08-26 Assar Westerlund <assar@kth.se> + + * lib/krb5/principal.c (krb5_425_conv_principal_ext): lookup AAAA + rrs before A ones when using the resolver to verify a mapping, + also use getaddrinfo when resolver is not available + + * lib/hdb/keytab.c (find_db): const-correctness in parameters to + krb5_config_get_next + + * lib/asn1/gen.c: include <string.h> in the generated files (for + memset) + +2002-08-22 Assar Westerlund <assar@kth.se> + + * lib/krb5/test_get_addrs.c, lib/krb5/krbhst-test.c: make it use + getarg so that it can handle --help and --version (and thus make + check can pass) + + * lib/asn1/check-der.c: make this build again + +2002-08-22 Assar Westerlund <assar@kth.se> + + * lib/asn1/der_get.c (der_get_int): handle len == 0. based on a + patch from Love <lha@stacken.kth.se> + +2002-08-22 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.h: we seem to call KRB5KDC_ERR_KEY_EXP + KRB5KDC_ERR_KEY_EXPIRED, so define the former to the latter + + * kdc/kdc.8: add blurb about adding and removing addresses; update + kdc.conf section to match reality + + * configure.in: KRB_SENDAUTH_VLEN seems to always have existed, so + don't define it + +2002-08-21 Assar Westerlund <assar@kth.se> + + * lib/asn1/asn1_print.c: print OIDs too, based on a patch from + Love <lha@stacken.kth.se> + +2002-08-21 Johan Danielsson <joda@pdc.kth.se> + + * kuser/kinit.c (do_v4_fallback): don't use krb_get_pw_in_tkt2 + since it might not exist, and we don't actually care about the key + +2002-08-20 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.conf.5: correct documentation for + verify_ap_req_nofail + + * lib/krb5/log.c: rename syslog_data to avoid name conflicts (from + Mattias Amnefelt) + + * kuser/klist.c (display_tokens): increase token buffer size, and + add more checks of the kernel data (from Love) + +2002-08-19 Johan Danielsson <joda@pdc.kth.se> + + * fix-export: use make to parse Makefile.am instead of perl + + * configure.in: use argument-less AM_INIT_AUTOMAKE, now that it + groks AC_INIT with package name etc. + + * kpasswd/kpasswdd.c: include <kadm5/private.h> + + * lib/asn1/asn1_print.c: include com_right.h + + * lib/krb5/addr_families.c: socklen_t -> krb5_socklen_t + + * include/bits.c: define krb5_socklen_t type; this should really + go someplace else, but this was easy + + * lib/krb5/verify_krb5_conf.c: don't bail out if parsing of a file + fails, just warn about it + + * kdc/log.c (kdc_openlog): no need for a config_file parameter + + * kdc/config.c: just treat kdc.conf like any other config file + + * lib/krb5/context.c (krb5_get_default_config_files): ignore + duplicate files + +2002-08-16 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5.h: turn strings into pointers, so we can assign to + them + + * lib/krb5/constants.c: turn strings into pointers, so we can + assign to them + + * lib/krb5/get_addrs.c (get_addrs_int): initialise res if + SCAN_INTERFACES is not set + + * lib/krb5/context.c: fix various borked stuff in previous commits + +2002-08-16 Jacques Vidrine <n@nectar.com> + + * lib/krb5/krbhst.c (kpasswd_get_next): if we fall back to using + the `admin_server' entry for kpasswd, override the `proto' result + to be UDP. + +2002-08-15 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/auth_context.c: check return value of + krb5_sockaddr2address + + * lib/krb5/addr_families.c: check return value of + krb5_sockaddr2address + + * lib/krb5/context.c: get the default keytab from KRB5_KTNAME + +2002-08-14 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_krb5_conf.c: allow parsing of more than one file + + * lib/krb5/context.c: allow changing config files with the + function krb5_set_config_files, there are also related functions + krb5_get_default_config_files and krb5_free_config_files; these + should work similar to their MIT counterparts + + * lib/krb5/config_file.c: allow the use of more than one config + file by using the new function krb5_config_parse_file_multi + +2002-08-12 Johan Danielsson <joda@pdc.kth.se> + + * use sysconfdir instead of /etc + + * configure.in: require autoconf 2.53; rename dpagaix_LDFLAGS etc + to appease automake; force sysconfdir and localstatedir to /etc + and /var/heimdal for now + + * kdc/connect.c (addr_to_string): check return value of + sockaddr2address + +2002-08-09 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/rd_cred.c: if the remote address isn't an addrport, + don't try comparing to one; this should make old clients work with + new servers + + * lib/asn1/gen_decode.c: remove unused variable + +2002-07-31 Johan Danielsson <joda@pdc.kth.se> + + * kdc/{kerberos5,524}.c: ENOENT -> HDB_ERR_NOENTRY (from Derrick + Brashear) + + * lib/krb5/principal.c: actually lower case the lower case + instance name (spotted by Derrick Brashear) + +2002-07-24 Johan Danielsson <joda@pdc.kth.se> + + * fix-export: if DATEDVERSION is set, change the version to + current date + + * configure.in: don't use AC_PROG_RANLIB, and use magic foo to set + LTLIBOBJS + +2002-07-04 Johan Danielsson <joda@pdc.kth.se> + + * kdc/connect.c: add some cache-control-foo to the http responses + (from Gombas Gabor) + + * lib/krb5/addr_families.c (krb5_print_address): don't copy size + if ret_len == NULL + +2002-06-28 Johan Danielsson <joda@pdc.kth.se> + + * kuser/klist.c (display_tokens): don't bail out before we get + EDOM (signaling the end of the tokens), the kernel can also return + ENOTCONN, meaning that the index does not exist anymore (for + example if the token has expired) + +2002-06-06 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/changepw.c: make sure we return an error if there are + no changepw hosts found; from Wynn Wilkes + +2002-05-29 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/cache.c (krb5_cc_register): break out of loop when the + same type is found; spotted by Wynn Wilkes + +2002-05-28 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab_file.c: check size of entry before trying to + read 32-bit kvno; also fix typo in previous + +2002-05-24 Johan Danielsson <joda@pdc.kth.se> + + * include/Makefile.am: only add to INCLUDES + + * lib/45/mk_req.c: fix for storage change + + * lib/hdb/print.c: fix for storage change + +2002-05-15 Johan Danielsson <joda@pdc.kth.se> + + * kdc/kerberos5.c: don't free encrypted padata until we're really + done with it + +2002-05-07 Johan Danielsson <joda@pdc.kth.se> + + * kdc/kerberos5.c: when decrypting pa-data, try all keys matching + enctype + + * kuser/kinit.1: document -a + + * kuser/kinit.c: add command line switch for extra addresses + +2002-04-30 Johan Danielsson <joda@blubb.pdc.kth.se> + + * configure.in: remove some duplicate tests + + * configure.in: use AC_HELP_STRING + +2002-04-29 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/crypto.c (usage2arcfour): don't abort if the usage is + unknown + +2002-04-25 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: use rk_DESTDIRS + +2002-04-22 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/krb5_verify_user.3: make it clear that _lrealm modifies + the principal + +2002-04-19 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_init.c: fix typo in error string + +2002-04-18 Johan Danielsson <joda@pdc.kth.se> + + * acconfig.h: remove some stuff that is defined elsewhere + + * lib/krb5/krb5_locl.h: include <sys/file.h> + + * lib/krb5/acl.c: rename acl_string parameter + + * lib/krb5/Makefile.am: remove __P from protos, and put parameter + names in comments + + * kuser/klist.c: better align some headers + + * kdc/kerberos4.c: storage tweaks + + * kdc/kaserver.c: storage tweaks + + * kdc/524.c: storage tweaks + + * lib/krb5/keytab_krb4.c: storage tweaks + + * lib/krb5/keytab_keyfile.c: storage tweaks + + * lib/krb5/keytab_file.c: storage tweaks; also try to handle zero + sized keytab files + + * lib/krb5/keytab_any.c: use KRB5_KT_END instead of KRB5_CC_END + + * lib/krb5/fcache.c: storage tweaks + + * lib/krb5/store_mem.c: make the krb5_storage opaque, and add + function wrappers for store/fetch/seek, and also make the eof-code + configurable + + * lib/krb5/store_fd.c: make the krb5_storage opaque, and add + function wrappers for store/fetch/seek, and also make the eof-code + configurable + + * lib/krb5/store_emem.c: make the krb5_storage opaque, and add + function wrappers for store/fetch/seek, and also make the eof-code + configurable + + * lib/krb5/store.c: make the krb5_storage opaque, and add function + wrappers for store/fetch/seek, and also make the eof-code + configurable + + * lib/krb5/store-int.h: make the krb5_storage opaque, and add + function wrappers for store/fetch/seek, and also make the eof-code + configurable + + * lib/krb5/krb5.h: make the krb5_storage opaque, and add function + wrappers for store/fetch/seek, and also make the eof-code + configurable + + * include/bits.c: include <sys/socket.h> to get socklen_t + + * kdc/kerberos5.c (get_pa_etype_info): sort ETYPE-INFOs by + requested KDC-REQ etypes + + * kdc/hpropd.c: constify + + * kdc/hprop.c: constify + + * kdc/string2key.c: constify + + * kdc/kdc_locl.h: make port_str const + + * kdc/config.c: constify + + * lib/krb5/config_file.c: constify + + * kdc/kstash.c: constify + + * lib/krb5/verify_user.c: remove unnecessary cast + + * lib/krb5/recvauth.c: constify + + * lib/krb5/principal.c (krb5_parse_name): const qualify + + * lib/krb5/mcache.c (mcc_get_name): constify return type + + * lib/krb5/context.c (krb5_free_context): don't try to free the + ccache prefix + + * lib/krb5/cache.c (krb5_cc_register): don't make a copy of the + prefix + + * lib/krb5/krb5.h: constify some struct members + + * lib/krb5/log.c: constify + + * lib/krb5/init_creds_pw.c (krb5_get_init_creds_password): const + qualify + + * lib/krb5/get_in_tkt.c (krb5_init_etype): constify + + * lib/krb5/crypto.c: constify some + + * lib/krb5/config_file.c: constify + + * lib/krb5/aname_to_localname.c (krb5_aname_to_localname): + constify local variable + + * lib/krb5/addr_families.c (ipv4_sockaddr2port): constify + +2002-04-17 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/verify_krb5_conf.c: add some log checking + + * lib/krb5/log.c (krb5_addlog_dest): reorganise syslog parsing + +2002-04-16 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/crypto.c (krb5_crypto_init): check that the key size + matches the expected length + +2002-03-27 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/send_to_kdc.c: rename send parameter to send_data + + * lib/krb5/mk_error.c: rename ctime parameter to client_time + +2002-03-22 Johan Danielsson <joda@pdc.kth.se> + + * kdc/kerberos5.c (find_etype): unsigned -> krb5_enctype (from + Reinoud Zandijk) + +2002-03-18 Johan Danielsson <joda@pdc.kth.se> + + * lib/asn1/k5.asn1: add the GSS-API checksum type here + +2002-03-11 Assar Westerlund <assar@sics.se> + + * lib/krb5/Makefile.am (libkrb5_la_LDFLAGS): bump version to + 18:3:1 + * lib/hdb/Makefile.am (libhdb_la_LDFLAGS): bump version to 7:5:0 + * lib/asn1/Makefile.am (libasn1_la_LDFLAGS): bump version to 6:0:0 + +2002-03-10 Assar Westerlund <assar@sics.se> + + * lib/krb5/rd_cred.c: handle addresses with port numbers + + * lib/krb5/keytab_file.c, lib/krb5/keytab.c: + store the kvno % 256 as the byte and the complete 32 bit kvno after + the end of the current keytab entry + + * lib/krb5/init_creds_pw.c: + handle LR_PW_EXPTIME and LR_ACCT_EXPTIME in the same way + + * lib/krb5/get_for_creds.c (krb5_get_forwarded_creds): + handle ports giving for the remote address + + * lib/krb5/get_cred.c: + get a ticket with no addresses if no-addresses is set + + * lib/krb5/crypto.c: + rename functions DES_* to krb5_* to avoid colliding with modern + openssl + + * lib/krb5/addr_families.c: + make all functions taking 'struct sockaddr' actually take a socklen_t + instead of int and that acts as an in-out parameter (indicating the + maximum length of the sockaddr to be written) + + * kdc/kerberos4.c: + make the kvno's in the krb4 universe by the real one % 256, since they + cannot only be 8 bit, and the v5 ones are actually 32 bits + +2002-02-15 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab_keyfile.c (akf_add_entry): don't create the file + before we need to write to it + (from Åke Sandgren) + +2002-02-14 Johan Danielsson <joda@pdc.kth.se> + + * configure.in: rk_RETSIGTYPE and rk_BROKEN_REALLOC are called via + rk_ROKEN (from Gombas Gabor); find inttypes by CHECK_TYPES + directly + + * lib/krb5/rd_safe.c: actually use the correct key (from Daniel + Kouril) + +2002-02-12 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/context.c (krb5_get_err_text): protect against NULL + context + +2002-02-11 Johan Danielsson <joda@pdc.kth.se> + + * admin/ktutil.c: no need to use the "modify" keytab anymore + + * lib/krb5/keytab_any.c: implement add and remove + + * lib/krb5/keytab_krb4.c: implement add and remove + + * lib/krb5/store_emem.c (emem_free): clear memory before freeing + (this should perhaps be selectable with a flag) + +2002-02-04 Johan Danielsson <joda@pdc.kth.se> + + * kdc/config.c (get_dbinfo): if there are database specifications + in the config file, don't automatically try to use the default + values (from Gombas Gabor) + + * lib/krb5/log.c (krb5_closelog): don't pass pointer to pointer + (from Gombas Gabor) + +2002-01-30 Johan Danielsson <joda@pdc.kth.se> + + * admin/list.c: get the default keytab from krb5.conf, and list + all parts of an ANY type keytab + + * lib/krb5/context.c: default default_keytab_modify to NULL + + * lib/krb5/keytab.c (krb5_kt_default_modify_name): if no modify + name is specified take it from the first component of the default + keytab name + +2002-01-29 Johan Danielsson <joda@pdc.kth.se> + + * lib/krb5/keytab.c: compare keytab types case insensitively + +2002-01-07 Assar Westerlund <assar@sics.se> + + * lib/krb5/crypto.c (create_checksum): make usage `unsigned' (it's + not really a krb5_key_usage). From Ben Harris <bjh21@netbsd.org> + * lib/krb5/get_in_tkt.c: use krb5_enctype consistently. From Ben + Harris <bjh21@netbsd.org> + * lib/krb5/crypto.c: use krb5_enctype consistently. From Ben + Harris <bjh21@netbsd.org> + * kdc/kerberos5.c: use krb5_enctype consistently. From Ben Harris + <bjh21@netbsd.org> diff --git a/kerberosV/src/admin/add.c b/kerberosV/src/admin/add.c index dabc37767cf..e644cce11bb 100644 --- a/kerberosV/src/admin/add.c +++ b/kerberosV/src/admin/add.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "ktutil_locl.h" -RCSID("$KTH: add.c,v 1.3 2001/07/23 09:46:40 joda Exp $"); +RCSID("$KTH: add.c,v 1.5 2002/09/10 19:26:52 joda Exp $"); int kt_add(int argc, char **argv) diff --git a/kerberosV/src/admin/change.c b/kerberosV/src/admin/change.c index 1e89db4fc8f..46d9496d9c1 100644 --- a/kerberosV/src/admin/change.c +++ b/kerberosV/src/admin/change.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,11 +33,11 @@ #include "ktutil_locl.h" -RCSID("$KTH: change.c,v 1.4 2001/07/23 09:46:40 joda Exp $"); +RCSID("$KTH: change.c,v 1.5 2003/04/01 15:04:49 lha Exp $"); static void change_entry (krb5_context context, krb5_keytab keytab, - krb5_keytab_entry *entry, + krb5_principal principal, krb5_kvno kvno, const char *realm, const char *admin_server, int server_port) { krb5_error_code ret; @@ -48,7 +48,7 @@ change_entry (krb5_context context, krb5_keytab keytab, int num_keys; int i; - ret = krb5_unparse_name (context, entry->principal, &client_name); + ret = krb5_unparse_name (context, principal, &client_name); if (ret) { krb5_warn (context, ret, "krb5_unparse_name"); return; @@ -59,7 +59,7 @@ change_entry (krb5_context context, krb5_keytab keytab, if(realm) conf.realm = (char *)realm; else - conf.realm = *krb5_princ_realm (context, entry->principal); + conf.realm = *krb5_princ_realm (context, principal); conf.mask |= KADM5_CONFIG_REALM; if (admin_server) { @@ -83,8 +83,7 @@ change_entry (krb5_context context, krb5_keytab keytab, krb5_warn (context, ret, "kadm5_c_init_with_skey_ctx"); return; } - ret = kadm5_randkey_principal (kadm_handle, entry->principal, - &keys, &num_keys); + ret = kadm5_randkey_principal (kadm_handle, principal, &keys, &num_keys); kadm5_destroy (kadm_handle); if (ret) { krb5_warn(context, ret, "kadm5_randkey_principal"); @@ -93,9 +92,9 @@ change_entry (krb5_context context, krb5_keytab keytab, for (i = 0; i < num_keys; ++i) { krb5_keytab_entry new_entry; - new_entry = *entry; + new_entry.principal = principal; new_entry.timestamp = time (NULL); - ++new_entry.vno; + new_entry.vno = kvno + 1; new_entry.keyblock = keys[i]; ret = krb5_kt_add_entry (context, keytab, &new_entry); @@ -110,6 +109,11 @@ change_entry (krb5_context context, krb5_keytab keytab, * their keys, writing the new keys */ +struct change_set { + krb5_principal principal; + krb5_kvno kvno; +}; + int kt_change (int argc, char **argv) { @@ -122,8 +126,8 @@ kt_change (int argc, char **argv) int server_port = 0; int help_flag = 0; int optind = 0; - int j, max; - krb5_principal *princs; + int i, j, max; + struct change_set *changeset; struct getargs args[] = { { "realm", 'r', arg_string, NULL, @@ -154,12 +158,8 @@ kt_change (int argc, char **argv) return 1; j = 0; - max = 10; - princs = malloc (max * sizeof(*princs)); - if (princs == NULL) { - krb5_warnx (context, "malloc: out of memory"); - goto out; - } + max = 0; + changeset = NULL; ret = krb5_kt_start_seq_get(context, keytab, &cursor); if(ret){ @@ -168,20 +168,21 @@ kt_change (int argc, char **argv) } while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0) { - int i; - int done = 0; + int add = 0; - for (i = 0; i < j; ++i) - if (krb5_principal_compare (context, princs[i], - entry.principal)) + for (i = 0; i < j; ++i) { + if (krb5_principal_compare (context, changeset[i].principal, + entry.principal)) { + if (changeset[i].kvno < entry.vno) + changeset[i].kvno = entry.vno; break; + } + } if (i < j) continue; if (optind == argc) { - change_entry (context, keytab, &entry, realm, admin_server, - server_port); - done = 1; + add = 1; } else { for (i = optind; i < argc; ++i) { krb5_principal princ; @@ -191,40 +192,64 @@ kt_change (int argc, char **argv) krb5_warn (context, ret, "krb5_parse_name %s", argv[i]); continue; } - if (krb5_principal_compare (context, princ, entry.principal)) { - change_entry (context, keytab, &entry, - realm, admin_server, server_port); - done = 1; - } + if (krb5_principal_compare (context, princ, entry.principal)) + add = 1; + krb5_free_principal (context, princ); } } - if (done) { + + if (add) { if (j >= max) { void *tmp; - max *= 2; - tmp = realloc (princs, max * sizeof(*princs)); + max = max(max * 2, 1); + tmp = realloc (changeset, max * sizeof(*changeset)); if (tmp == NULL) { krb5_kt_free_entry (context, &entry); krb5_warnx (context, "realloc: out of memory"); + ret = ENOMEM; break; } - princs = tmp; + changeset = tmp; } - ret = krb5_copy_principal (context, entry.principal, &princs[j]); + ret = krb5_copy_principal (context, entry.principal, + &changeset[j].principal); if (ret) { krb5_warn (context, ret, "krb5_copy_principal"); krb5_kt_free_entry (context, &entry); break; } + changeset[j].kvno = entry.vno; ++j; } krb5_kt_free_entry (context, &entry); } - while (j-- > 0) - krb5_free_principal (context, princs[j]); - free (princs); + + if (ret == KRB5_KT_END) { + for (i = 0; i < j; i++) { + if (verbose_flag) { + char *client_name; + + ret = krb5_unparse_name (context, changeset[i].principal, + &client_name); + if (ret) { + krb5_warn (context, ret, "krb5_unparse_name"); + } else { + printf("Changing %s kvno %d\n", + client_name, changeset[i].kvno); + free(client_name); + } + } + change_entry (context, keytab, + changeset[i].principal, changeset[i].kvno, + realm, admin_server, server_port); + } + } + for (i = 0; i < j; i++) + krb5_free_principal (context, changeset[i].principal); + free (changeset); + ret = krb5_kt_end_seq_get(context, keytab, &cursor); out: krb5_kt_close(context, keytab); diff --git a/kerberosV/src/admin/copy.c b/kerberosV/src/admin/copy.c index 674fdf10924..c798edb989e 100644 --- a/kerberosV/src/admin/copy.c +++ b/kerberosV/src/admin/copy.c @@ -33,7 +33,7 @@ #include "ktutil_locl.h" -RCSID("$KTH: copy.c,v 1.7 2001/05/11 00:54:01 assar Exp $"); +RCSID("$KTH: copy.c,v 1.9 2003/01/16 18:59:03 lha Exp $"); static krb5_boolean @@ -144,7 +144,6 @@ kt_copy (int argc, char **argv) int i = 0; args[i++].value = &help_flag; - args[i++].value = &verbose_flag; if(getarg(args, num_args, argc, argv, &optind)) { arg_printusage(args, num_args, "ktutil copy", @@ -170,7 +169,7 @@ kt_copy (int argc, char **argv) } #ifndef KEYFILE -#define KEYFILE "/etc/srvtab" +#define KEYFILE SYSCONFDIR "/srvtab" #endif /* copy to from v4 srvtab, just short for copy */ diff --git a/kerberosV/src/admin/get.c b/kerberosV/src/admin/get.c index d800cefa7d4..7203b8d15ac 100644 --- a/kerberosV/src/admin/get.c +++ b/kerberosV/src/admin/get.c @@ -33,7 +33,7 @@ #include "ktutil_locl.h" -RCSID("$KTH: get.c,v 1.20 2001/07/23 14:30:09 joda Exp $"); +RCSID("$KTH: get.c,v 1.22 2003/01/16 19:03:23 lha Exp $"); static void* open_kadmin_connection(char *principal, @@ -41,8 +41,8 @@ open_kadmin_connection(char *principal, char *admin_server, int server_port) { + static kadm5_config_params conf; krb5_error_code ret; - kadm5_config_params conf; void *kadm_handle; memset(&conf, 0, sizeof(conf)); @@ -89,7 +89,6 @@ kt_get(int argc, char **argv) int server_port = 0; int help_flag = 0; int optind = 0; - int i, j; struct getarg_strings etype_strs = {0, NULL}; krb5_enctype *etypes = NULL; size_t netypes = 0; @@ -111,13 +110,14 @@ kt_get(int argc, char **argv) }, { "help", 'h', arg_flag, NULL } }; + int i = 0, j; - args[0].value = &principal; - args[1].value = &etype_strs; - args[2].value = &realm; - args[3].value = &admin_server; - args[4].value = &server_port; - args[5].value = &help_flag; + args[i++].value = &principal; + args[i++].value = &etype_strs; + args[i++].value = &realm; + args[i++].value = &admin_server; + args[i++].value = &server_port; + args[i++].value = &help_flag; if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind) || help_flag) { diff --git a/kerberosV/src/admin/ktutil.8 b/kerberosV/src/admin/ktutil.8 index e208909e1d4..24315257918 100644 --- a/kerberosV/src/admin/ktutil.8 +++ b/kerberosV/src/admin/ktutil.8 @@ -1,4 +1,35 @@ -.\" $KTH: ktutil.8,v 1.14 2001/07/23 14:47:31 joda Exp $ +.\" Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: ktutil.8,v 1.19 2003/04/08 20:55:10 lha Exp $ .\" .Dd December 16, 2000 .Dt KTUTIL 8 @@ -9,17 +40,26 @@ .Sh SYNOPSIS .Nm .Oo Fl k Ar keytab \*(Ba Xo -.Fl -keytab= Ns Ar keytab +.Fl -keytab= Ns Ar keytab .Xc .Oc .Op Fl v | Fl -verbose .Op Fl -version .Op Fl h | Fl -help -.Ar command +.Ar command .Op Ar args .Sh DESCRIPTION .Nm is a program for managing keytabs. +Supported options: +.Bl -tag -width Ds +.It Xo +.Fl v , +.Fl -verbose +.Xc +Verbose output. +.El +.Pp .Ar command can be one of the following: .Bl -tag -width srvconvert @@ -28,7 +68,7 @@ can be one of the following: .Op Fl -principal= Ns Ar principal .Op Fl V Ar kvno .Op Fl -kvno= Ns Ar kvno -.Op Fl e Ar encype +.Op Fl e Ar enctype .Op Fl -enctype= Ns Ar enctype .Op Fl w Ar password .Op Fl -password= Ns Ar password @@ -52,7 +92,7 @@ command, which talks to the kadmin server. .Op Fl -server-port= Ns Ar port .Xc Update one or several keys to new versions. By default, use the admin -server for the realm of an keytab entry. Otherwise it will use the +server for the realm of a keytab entry. Otherwise it will use the values specified by the options. .Pp If no principals are given, all the ones in the keytab are updated. @@ -101,7 +141,7 @@ List the keys stored in the keytab. .Xc Removes the specified key or keys. Not specifying a .Ar kvno -removes keys with any version number. Not specifying a +removes keys with any version number. Not specifying an .Ar enctype removes keys of any type. .It rename Xo @@ -110,14 +150,14 @@ removes keys of any type. .Xc Renames all entries in the keytab that match the .Ar from-principal -to +to .Ar to-principal . .It purge Xo .Op Fl -age= Ns Ar age .Xc Removes all old entries (for which there is a newer version) that are older than -.Ar age +.Ar age (default one week). .It srvconvert .It srv2keytab Xo @@ -127,12 +167,12 @@ older than Converts the version 4 srvtab in .Ar srvtab to a version 5 keytab and stores it in -.Ar keytab . +.Ar keytab . Identical to: .Bd -ragged -offset indent -.Li ktutil copy +.Li ktutil copy .Li krb4: Ns Ar srvtab -.Ar keytab +.Ar keytab .Ed .It srvcreate .It key2srvtab Xo @@ -145,8 +185,8 @@ to a version 4 srvtab and stores it in .Ar srvtab . Identical to: .Bd -ragged -offset indent -.Li ktutil copy -.Ar keytab +.Li ktutil copy +.Ar keytab .Li krb4: Ns Ar srvtab .Ed .El diff --git a/kerberosV/src/appl/afsutil/ChangeLog b/kerberosV/src/appl/afsutil/ChangeLog index 8dfd532ce2c..a74403bd283 100644 --- a/kerberosV/src/appl/afsutil/ChangeLog +++ b/kerberosV/src/appl/afsutil/ChangeLog @@ -1,3 +1,40 @@ +2003-04-23 Love Hörnquist Åstrand <lha@it.su.se> + + * afslog.c: 1.21->1.22: (log_func): drop the error number + +2003-04-14 Love Hörnquist Åstrand <lha@it.su.se> + + * afslog.c: set kafs log function if verbose is turned on + +2003-03-18 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am (LDADD): use LIB_kafs + + * afslog.1: --no-v4, --no-v5 + + * Makefile.am: always build afsutils now + + * afslog.c: make build without KRB4 + +2002-11-26 Johan Danielsson <joda@pdc.kth.se> + + * afslog.c: remove plural form in help string + + * Makefile.am: add afslog manpage + + * afslog.1: manpage + + * afslog.c: try more files when trying to expand a cell name + + * afslog.c: create a list of cells to get tokens for, before + actually doing anything, and try to get tokens via krb4 if krb5 + fails, and give it a chance to work with krb4-only; also some bug + fixes, partially from Tomas Olsson. + +2002-08-23 Assar Westerlund <assar@kth.se> + + * pagsh.c: make it handle --version/--help + 2001-05-17 Assar Westerlund <assar@sics.se> * afslog.c (main): call free_getarg_strings diff --git a/kerberosV/src/appl/afsutil/afslog.1 b/kerberosV/src/appl/afsutil/afslog.1 new file mode 100644 index 00000000000..49ea503568a --- /dev/null +++ b/kerberosV/src/appl/afsutil/afslog.1 @@ -0,0 +1,137 @@ +.\" Copyright (c) 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: afslog.1,v 1.3 2003/03/18 04:29:34 lha Exp $ +.\" +.Dd November 26, 2002 +.Dt AFSLOG 1 +.Os HEIMDAL +.Sh NAME +.Nm afslog +.Nd +obtain AFS tokens +.Sh SYNOPSIS +.Nm +.Oo Fl c Ar cell \*(Ba Xo +.Fl -cell= Ns Ar cell +.Xc +.Oc +.Oo Fl p Ar path \*(Ba Xo +.Fl -file= Ns Ar path +.Xc +.Oc +.Oo Fl k Ar realm \*(Ba Xo +.Fl -realm= Ns Ar realm +.Xc +.Oc +.Op Fl -no-v4 +.Op Fl -no-v5 +.Op Fl u | Fl -unlog +.Op Fl v | Fl -verbose +.Op Fl -version +.Op Fl h | Fl -help +.Op Ar cell | path ... +.Sh DESCRIPTION +.Nm +obtains AFS tokens for a number of cells. What cells to get tokens for +can either be specified as an explicit list, as file paths to get +tokens for, or be left unspecified, in which case +.Nm +will use whatever magic +.Xr krb_afslog 3 +decides upon. +.Pp +Supported options: +.Bl -tag -width Ds +.It Xo +.Fl c Ar cell, +.Fl -cell= Ns Ar cell +.Xc +This specified one or more cell names to get tokens for. +.It Xo +.Fl p Ar path , +.Fl -file= Ns Ar path +.Xc +This specified one or more file paths for which tokens should be +obtained. +.It Xo +.Fl k Ar realm , +.Fl -realm= Ns Ar realm +.Xc +This is the Kerberos realm the AFS servers live in, this should +normally not be specified. +.It Fl -no-v4 +This makes +.Nm +not try using Kerberos 4. +.It Fl -no-v5 +This makes +.Nm +not try using Kerberos 5. +.It Xo +.Fl u , +.Fl -unlog +.Xc +Destroy tokens instead of obtaining new. If this is specified, all +other options are ignored (except for +.Fl -help +and +.Fl -version ) . +.It Xo +.Fl v , +.Fl -verbose +.Xc +Adds more verbosity for what is actually going on. +.El +Instead of using +.Fl c +and +.Fl p , +you may also pass a list of cells and file paths after any other +options. These arguments are considered files if they are either +the strings +.Do . Dc +or +.Dq .. +or they contain a slash, or if there exists a file by that name. +.Sh EXAMPLES +Assuming that there is no file called +.Dq openafs.org +in the current directory, and that +.Pa /afs/openafs.org +points to that cell, the follwing should be identical: +.Bd -literal -offset indent +$ afslog -c openafs.org +$ afslog openafs.org +$ afslog /afs/openafs.org/some/file +.Ed +.Sh SEE ALSO +.Xr krb_afslog 3 diff --git a/kerberosV/src/doc/ack.texi b/kerberosV/src/doc/ack.texi index 61b6bb5f9b8..1fa181f7248 100644 --- a/kerberosV/src/doc/ack.texi +++ b/kerberosV/src/doc/ack.texi @@ -1,4 +1,4 @@ -@c $KTH: ack.texi,v 1.14 2001/02/24 05:09:23 assar Exp $ +@c $KTH: ack.texi,v 1.16 2003/03/15 14:21:41 lha Exp $ @node Acknowledgments, , Migration, Top @comment node-name, next, previous, up @@ -19,6 +19,9 @@ of NetBSD/FreeBSD. @code{editline} was written by Simmule Turner and Rich Salz. +The @code{getifaddrs} implementation for Linux was written by Hideaki +YOSHIFUJI for the Usagi project. + Bugfixes, documentation, encouragement, and code has been contributed by: @table @asis @item Derrick J Brashear @@ -57,6 +60,8 @@ Bugfixes, documentation, encouragement, and code has been contributed by: @email{rnyberg@@it.su.se} @item Frank van der Linden @email{fvdl@@netbsd.org} +@item Cizzi Storm +@email{cizzi@@it.su.se} @item and we hope that those not mentioned here will forgive us. @end table diff --git a/kerberosV/src/doc/heimdal.info b/kerberosV/src/doc/heimdal.info index 54475c3f9cd..6a752e8cb9d 100644 --- a/kerberosV/src/doc/heimdal.info +++ b/kerberosV/src/doc/heimdal.info @@ -1,4 +1,4 @@ -This is heimdal.info, produced by makeinfo version 4.0 from +This is heimdal.info, produced by makeinfo version 4.5 from heimdal.texi. INFO-DIR-SECTION Heimdal @@ -7,1756 +7,47 @@ START-INFO-DIR-ENTRY END-INFO-DIR-ENTRY -File: heimdal.info, Node: Top, Next: Introduction, Prev: (dir), Up: (dir) - -Heimdal -******* - -* Menu: - -* Introduction:: -* What is Kerberos?:: -* Building and Installing:: -* Setting up a realm:: -* Things in search for a better place:: -* Kerberos 4 issues:: -* Windows 2000 compatability:: -* Programming with Kerberos:: -* Migration:: -* Acknowledgments:: - - -File: heimdal.info, Node: Introduction, Next: What is Kerberos?, Prev: Top, Up: Top - -Introduction -************ - -What is Heimdal? -================ - -Heimdal is a free implementation of Kerberos 5. The goals are to: - - * have an implementation that can be freely used by anyone - - * be protocol compatible with existing implementations and, if not in - conflict, with RFC 1510 (and any future updated RFC) - - * be reasonably compatible with the M.I.T Kerberos V5 API - - * have support for Kerberos V5 over GSS-API (RFC1964) - - * include the most important and useful application programs (rsh, - telnet, popper, etc.) - - * include enough backwards compatibility with Kerberos V4 - -Status -====== - -Heimdal has the following features (this does not mean any of this -works): - - * a stub generator and a library to encode/decode/whatever ASN.1/DER - stuff - - * a `libkrb5' library that should be possible to get to work with - simple applications - - * a GSS-API library that should have all the important functions for - building applications - - * Eric Young's `libdes' - - * `kinit', `klist', `kdestroy' - - * `telnet', `telnetd' - - * `rsh', `rshd' - - * `popper', `push' (a movemail equivalent) - - * `ftp', and `ftpd' - - * a library `libkafs' for authenticating to AFS and a program - `afslog' that uses it - - * some simple test programs - - * a KDC that supports most things; optionally, it may also support - Kerberos V4 and kaserver, - - * simple programs for distributing databases between a KDC master and - slaves - - * a password changing daemon `kpasswdd', library functions for - changing passwords and a simple client - - * some kind of administration system - - * Kerberos V4 support in many of the applications. - -Bug reports -=========== - -If you find bugs in this software, make sure it is a genuine bug and not -just a part of the code that isn't implemented. - -Bug reports should be sent to <heimdal-bugs@pdc.kth.se>. Please include -information on what machine and operating system (including version) -you are running, what you are trying to do, what happens, what you -think should have happened, an example for us to repeat, the output you -get when trying the example, and a patch for the problem if you have -one. Please make any patches with `diff -u' or `diff -c'. - -Suggestions, comments and other non bug reports are also welcome. - -Mailing list -============ - -There are two mailing lists with talk about Heimdal. -<heimdal-announce@sics.se> is a low-volume announcement list, while -<heimdal-discuss@sics.se> is for general discussion. Send a message to -<majordomo@sics.se> to subscribe. - - -File: heimdal.info, Node: What is Kerberos?, Next: Building and Installing, Prev: Introduction, Up: Top - -What is Kerberos? -***************** - - Now this Cerberus had three heads of dogs, - the tail of a dragon, and on his back the - heads of all sorts of snakes. - -- Pseudo-Apollodorus Library 2.5.12 - -Kerberos is a system for authenticating users and services on a network. -It is built upon the assumption that the network is "unsafe". For -example, data sent over the network can be eavesdropped and altered, and -addresses can also be faked. Therefore they cannot be used for -authentication purposes. - -Kerberos is a trusted third-party service. That means that there is a -third party (the kerberos server) that is trusted by all the entities on -the network (users and services, usually called "principals"). All -principals share a secret password (or key) with the kerberos server and -this enables principals to verify that the messages from the kerberos -server are authentic. Thus trusting the kerberos server, users and -services can authenticate each other. - -Basic mechanism -=============== - - *Note:* This discussion is about Kerberos version 4, but version 5 - works similarly. - -In Kerberos, principals use "tickets" to prove that they are who they -claim to be. In the following example, A is the initiator of the -authentication exchange, usually a user, and B is the service that A -wishes to use. - -To obtain a ticket for a specific service, A sends a ticket request to -the kerberos server. The request contains A's and B's names (along with -some other fields). The kerberos server checks that both A and B are -valid principals. - -Having verified the validity of the principals, it creates a packet -containing A's and B's names, A's network address (A<ADDR>), the -current time (T<ISSUE>), the lifetime of the ticket (LIFE), and a -secret "session key" (K<AB>). This packet is encrypted with B's secret -key (K<B>). The actual ticket (T<AB>) looks like this: ({A, B, -A<ADDR>, T<ISSUE>, LIFE, K<AB>}K<B>). - -The reply to A consists of the ticket (T<AB>), B's name, the current -time, the lifetime of the ticket, and the session key, all encrypted in -A's secret key ({B, T<ISSUE>, LIFE, K<AB>, T<AB>}K<A>). A decrypts the -reply and retains it for later use. - - -Before sending a message to B, A creates an authenticator consisting of -A's name, A's address, the current time, and a "checksum" chosen by A, -all encrypted with the secret session key ({A, A<ADDR>, T<CURRENT>, -CHECKSUM}K<AB>). This is sent together with the ticket received from -the kerberos server to B. Upon reception, B decrypts the ticket using -B's secret key. Since the ticket contains the session key that the -authenticator was encrypted with, B can now also decrypt the -authenticator. To verify that A really is A, B now has to compare the -contents of the ticket with that of the authenticator. If everything -matches, B now considers A as properly authenticated. - -Different attacks -================= - -Impersonating A ---------------- - -An impostor, C could steal the authenticator and the ticket as it is -transmitted across the network, and use them to impersonate A. The -address in the ticket and the authenticator was added to make it more -difficult to perform this attack. To succeed C will have to either use -the same machine as A or fake the source addresses of the packets. By -including the time stamp in the authenticator, C does not have much -time in which to mount the attack. - -Impersonating B ---------------- - -C can hijack B's network address, and when A sends her credentials, C -just pretend to verify them. C can't be sure that she is talking to A. - -Defense strategies -================== - -It would be possible to add a "replay cache" to the server side. The -idea is to save the authenticators sent during the last few minutes, so -that B can detect when someone is trying to retransmit an already used -message. This is somewhat impractical (mostly regarding efficiency), -and is not part of Kerberos 4; MIT Kerberos 5 contains it. - -To authenticate B, A might request that B sends something back that -proves that B has access to the session key. An example of this is the -checksum that A sent as part of the authenticator. One typical -procedure is to add one to the checksum, encrypt it with the session -key and send it back to A. This is called "mutual authentication". - -The session key can also be used to add cryptographic checksums to the -messages sent between A and B (known as "message integrity"). -Encryption can also be added ("message confidentiality"). This is -probably the best approach in all cases. - -Further reading -=============== - -The original paper on Kerberos from 1988 is `Kerberos: An -Authentication Service for Open Network Systems', by Jennifer Steiner, -Clifford Neuman and Jeffrey I. Schiller. - -A less technical description can be found in `Designing an -Authentication System: a Dialogue in Four Scenes' by Bill Bryant, also -from 1988. - -These documents can be found on our web-page at -<http://www.pdc.kth.se/kth-krb/>. - - -File: heimdal.info, Node: Building and Installing, Next: Setting up a realm, Prev: What is Kerberos?, Up: Top - -Building and Installing -*********************** - -Heimdal uses GNU Autoconf to configure for specific hosts, and GNU -Automake to manage makefiles. If this is new to you, the short -instruction is to run the `configure' script in the top level -directory, and when that finishes `make'. - -If you want to build the distribution in a different directory from the -source directory, you will need a make that implements VPATH correctly, -such as GNU make. - -You will need to build the distribution: - - * A compiler that supports a "loose" ANSI C mode, such as `gcc'. - - * lex or flex - - * awk - - * yacc or bison - - * a socket library - - * NDBM or Berkeley DB for building the server side. - -When everything is built, you can install by doing `make install'. The -default location for installation is `/usr/heimdal', but this can be -changed by running `configure' with `--prefix=/some/other/place'. - -If you need to change the default behavior, configure understands the -following options: - -`--without-berkeley-db' - DB is preferred before NDBM, but if you for some reason want to - use NDBM instead, you can use this option. - -`--with-krb4=`dir'' - Gives the location of Kerberos 4 libraries and headers. This - enables Kerberos 4 support in the applications (telnet, rsh, - popper, etc) and the KDC. It is automatically check for in - `/usr/athena'. If you keep libraries and headers in different - places, you can instead give the path to each with the - `--with-krb4-lib=`dir'', and `--with-krb4-include=`dir'' options. - - You will need a fairly recent version of our Kerberos 4 - distribution for `rshd' and `popper' to support version 4 clients. - -`--enable-dce' - Enables support for getting DCE credentials and tokens. See the - README files in `appl/dceutils' for more information. - -`--disable-otp' - By default some of the application programs will build with - support for one-time passwords (OTP). Use this option to disable - that support. - -`--enable-osfc2' - Enable some C2 support for OSF/Digital Unix/Tru64. Use this - option if you are running your OSF operating system in C2 mode. - -`--with-readline=`dir'' - Gives the path for the GNU Readline library, which will be used in - some programs. If no readline library is found, the (simpler) - editline library will be used instead. - -`--with-hesiod=`dir'' - Enables hesiod support in push. - -`--enable-netinfo' - Add support for using netinfo to lookup configuration information. - Probably only useful (and working) on NextStep/Mac OS X. - -`--without-ipv6' - Disable the IPv6 support. - -`--with-openldap' - Compile Heimdal with support for storing the database in LDAP. - Requires OpenLDAP <http://www.openldap.org>. See - <http://www.padl.com/~lukeh/heimdal/> for more information. - -`--enable-bigendian' - -`--enable-littleendian' - Normally, the build process will figure out by itself if the - machine is big or little endian. It might fail in some cases when - cross-compiling. If it does fail to figure it out, use the - relevant of these two options. - -`--with-mips-abi=ABI' - On Irix there are three different ABIs that can be used (`32', - `n32', or `64'). This option allows you to override the automatic - selection. - - -File: heimdal.info, Node: Setting up a realm, Next: Things in search for a better place, Prev: Building and Installing, Up: Top - -Setting up a realm -****************** - -* Menu: - -* Configuration file:: -* Creating the database:: -* keytabs:: -* Remote administration:: -* Password changing:: -* Testing clients and servers:: -* Slave Servers:: -* Incremental propagation:: -* Salting:: - -A realm is an administrative domain. The name of a Kerberos realm is -usually the Internet domain name in uppercase. Call your realm the same -as your Internet domain name if you do not have strong reasons for not -doing so. It will make life easier for you and everyone else. - - -File: heimdal.info, Node: Configuration file, Next: Creating the database, Prev: Setting up a realm, Up: Setting up a realm - -Configuration file -================== - -To setup a realm you will first have to create a configuration file: -`/etc/krb5.conf'. The `krb5.conf' file can contain many configuration -options, some of which are described here. - -There is a sample `krb5.conf' supplied with the distribution. - -The configuration file is a hierarchical structure consisting of -sections, each containing a list of bindings (either variable -assignments or subsections). A section starts with `[section-name]'. A -binding consists of a left hand side, an equal (`=') and a right hand -side (the left hand side tag must be separated from the equal with some -whitespace.) Subsections has a `{' as the first non-whitespace -character after the equal. All other bindings are treated as variable -assignments. The value of a variable extends to the end of the line. - - [section1] - a-subsection = { - var = value1 - other-var = value with {} - sub-sub-section = { - var = 123 - } - } - var = some other value - [section2] - var = yet another value - -In this manual, names of sections and bindings will be given as strings -separated by slashes (`/'). The `other-var' variable will thus be -`section1/a-subsection/other-var'. - -For in-depth information about the contents of the config file, refer to -the `krb5.conf' manual page. Some of the more important sections are -briefly described here. - -The `libdefaults' section contains a list of library configuration -parameters, such as the default realm and the timeout for kdc -responses. The `realms' section contains information about specific -realms, such as where they hide their KDC. This section serves the same -purpose as the Kerberos 4 `krb.conf' file, but can contain more -information. Finally the `domain_realm' section contains a list of -mappings from domains to realms, equivalent to the Kerberos 4 -`krb.realms' file. - -To continue with the realm setup, you will have to create a config file, -with contents similar to the following. - - [libdefaults] - default_realm = MY.REALM - [realms] - MY.REALM = { - kdc = my.kdc - } - [domain_realm] - .my.domain = MY.REALM - -If you use a realm name equal to your domain name, you can omit the -`libdefaults', and `domain_realm', sections. If you have a SRV-record -for your realm, or your kerberos server has CNAME called -`kerberos.my.realm', you can omit the `realms' section too. - - -File: heimdal.info, Node: Creating the database, Next: keytabs, Prev: Configuration file, Up: Setting up a realm - -Creating the database -===================== - -The database library will look for the database in `/var/heimdal', so -you should probably create that directory. - -The keys of all the principals are stored in the database. If you -choose to, these can be encrypted with a master key. You do not have to -remember this key (or password), but just to enter it once and it will -be stored in a file (`/var/heimdal/m-key'). If you want to have a -master key, run `kstash' to create this master key: - - # kstash - Master key: - Verifying password - Master key: - -To initialise the database use the `kadmin' program, with the `-l' -option (to enable local database mode). First issue a `init MY.REALM' -command. This will create the database and insert default principals -for that realm. You can have more than one realm in one database, so -`init' does not destroy any old database. - -Before creating the database, `init' will ask you some questions about -max ticket lifetimes. - -After creating the database you should probably add yourself to it. You -do this with the `add' command. It takes as argument the name of a -principal. The principal should contain a realm, so if you haven't setup -a default realm, you will need to explicitly include the realm. - - # kadmin -l - kadmin> init MY.REALM - Realm max ticket life [unlimited]: - Realm max renewable ticket life [unlimited]: - kadmin> add me - Max ticket life [unlimited]: - Max renewable life [unlimited]: - Attributes []: - Password: - Verifying password - Password: - -Now start the KDC and try getting a ticket. - - # kdc & - # kinit me - me@MY.REALMS's Password: - # klist - Credentials cache: /tmp/krb5cc_0 - Principal: me@MY.REALM - - Issued Expires Principal - Aug 25 07:25:55 Aug 25 17:25:55 krbtgt/MY.REALM@MY.REALM - -If you are curious you can use the `dump' command to list all the -entries in the database. It should look something similar to the -following example (note that the entries here are truncated for -typographical reasons): - - kadmin> dump - me@MY.REALM 1:0:1:0b01d3cb7c293b57:-:0:7:8aec316b9d1629e3baf8 ... - kadmin/admin@MY.REALM 1:0:1:e5c8a2675b37a443:-:0:7:cb913ebf85 ... - krbtgt/MY.REALM@MY.REALM 1:0:1:52b53b61c875ce16:-:0:7:c8943be ... - kadmin/changepw@MY.REALM 1:0:1:f48c8af2b340e9fb:-:0:7:e3e6088 ... - - -File: heimdal.info, Node: keytabs, Next: Remote administration, Prev: Creating the database, Up: Setting up a realm - -keytabs -======= - -To extract a service ticket from the database and put it in a keytab you -need to first create the principal in the database with `ank' (using -the `--random-key' flag to get a random key) and then extract it with -`ext_keytab'. - - kadmin> add --random-key host/my.host.name - Max ticket life [unlimited]: - Max renewable life [unlimited]: - Attributes []: - kadmin> ext host/my.host.name - # ktutil list - Version Type Principal - 1 des-cbc-md5 host/my.host.name@MY.REALM - 1 des-cbc-md4 host/my.host.name@MY.REALM - 1 des-cbc-crc host/my.host.name@MY.REALM - 1 des3-cbc-sha1 host/my.host.name@MY.REALM - - -File: heimdal.info, Node: Remote administration, Next: Password changing, Prev: keytabs, Up: Setting up a realm - -Remote administration -===================== - -The administration server, `kadmind', can be started by `inetd' (which -isn't recommended) or run as a normal daemon. If you want to start it -from `inetd' you should add a line similar to the one below to your -`/etc/inetd.conf'. - - kerberos-adm stream tcp nowait root /usr/heimdal/libexec/kadmind kadmind - -You might need to add `kerberos-adm' to your `/etc/services' as 749/tcp. - -Access to the admin server is controlled by an acl-file, (default -`/var/heimdal/kadmind.acl'.) The lines in the access file, has the -following syntax: - principal [priv1,priv2,...] [glob-pattern] - -The matching is from top to bottom for matching principal (and if given, -glob-pattern). When there is a match, the rights of that lines are -used. - -The privileges you can assign to a principal are: `add', -`change-password' (or `cpw' for short), `delete', `get', `list', and -`modify', or the special privilege `all'. All of these roughly -corresponds to the different commands in `kadmin'. - -If a GLOB-PATTERN is given on a line, it restricts the right for the -principal to only apply for the subjects that match the pattern. The -patters are of the same type as those used in shell globbing, see -<none,,fnmatch(3)>. - -In the example below `lha/admin' can change every principal in the -database. `jimmy/admin' can only modify principals that belong to the -realm `E.KTH.SE'. `mille/admin' is working at the helpdesk, so he -should only be able to change the passwords for single component -principals (ordinary users). He will not be able to change any `/admin' -principal. - - lha/admin@E.KTH.SE all - jimmy/admin@E.KTH.SE all *@E.KTH.SE - jimmy/admin@E.KTH.SE all */*@E.KTH.SE - mille/admin@E.KTH.SE change-password *@E.KTH.SE - - -File: heimdal.info, Node: Password changing, Next: Testing clients and servers, Prev: Remote administration, Up: Setting up a realm - -Password changing -================= - -To allow users to change their passwords, you should run `kpasswdd'. -It is not run from `inetd'. - -You might need to add `kpasswd' to your `/etc/services' as 464/udp. - -Password quality assurance --------------------------- - -It is important that users have good passwords, both to make it harder -to guess them and to avoid off-line attacks (pre-authentication provides -some defense against off-line attacks). To ensure that the users choose -good passwords, you can enable password quality controls in `kpasswdd'. -The controls themselves are done in a shared library that is used by -`kpasswdd'. To configure in these controls, add lines similar to the -following to your `/etc/krb5.conf': - - [password_quality] - check_library = LIBRARY - check_function = FUNCTION - -The function FUNCTION in the shared library LIBRARY will be called for -proposed new passwords. The function should be declared as: - - const char * - function(krb5_context context, krb5_principal principal, krb5_data *pwd); - -The function should verify that PWD is a good password for PRINCIPAL -and if so return `NULL'. If it is deemed to be of low quality, it -should return a string explaining why that password should not be used. - -Code for a password quality checking function that uses the cracklib -library can be found in `lib/kadm5/sample_password_check.c' in the -source code distribution. It requires the cracklib library built with -the patch available at -<ftp://ftp.pdc.kth.se/pub/krb/src/cracklib.patch>. - -If no password quality checking function is configured, it is only -verified that it is at least six characters of length. - - -File: heimdal.info, Node: Testing clients and servers, Next: Slave Servers, Prev: Password changing, Up: Setting up a realm - -Testing clients and servers -=========================== - -Now you should be able to run all the clients and servers. Refer to the -appropriate man pages for information on how to use them. - - -File: heimdal.info, Node: Slave Servers, Next: Incremental propagation, Prev: Testing clients and servers, Up: Setting up a realm - -Slave servers, Incremental propagation, Testing clients and servers, Setting up a realm -======================================================================================= - -It is desirable to have at least one backup (slave) server in case the -master server fails. It is possible to have any number of such slave -servers but more than three usually doesn't buy much more redundancy. - -All Kerberos servers for a realm shall have the same database so that -they present the same service to all the users. The `hprop' program, -running on the master, will propagate the database to the slaves, -running `hpropd' processes. - -Every slave needs a keytab with a principal, `hprop/HOSTNAME'. Add -that with the `ktutil' command and start `propd', as follows: - - slave# ktutil get -p foo/admin host/`hostname` - slave# hpropd - -The master will use the principal `kadmin/hprop' to authenticate to the -slaves. This principal should be added when running `kadmin -l init' -but if you do not have it in your database for whatever reason, please -add it with `kadmin -l add'. - -Then run `hprop' on the master: - - master# hprop slave - -This was just an on-hands example to make sure that everything was -working properly. Doing it manually is of course the wrong way and to -automate this you will want to start `hpropd' from `inetd' on the -slave(s) and regularly run `hprop' on the master to regularly propagate -the database. Starting the propagation once an hour from `cron' is -probably a good idea. - - -File: heimdal.info, Node: Incremental propagation, Next: Salting, Prev: Slave Servers, Up: Setting up a realm - -Incremental propagation -======================= - -There is also a newer and still somewhat experimental mechanism for -doing incremental propagation in Heimdal. Instead of sending the whole -database regularly, it sends the changes as they happen on the master to -the slaves. The master keeps track of all the changes by assigned a -version number to every change to the database. The slaves know which -was the latest version they saw and in this way it can be determined if -they are in sync or not. A log of all the changes is kept on the master -and when a slave is at an older versioner than the oldest one in the -log, the whole database has to be sent. - -Protocol-wise, all the slaves connects to the master and as a greeting -tell it the latest version that they have (`IHAVE' message). The -master then responds by sending all the changes between that version and -the current version at the master (a series of `FORYOU' messages) or -the whole database in a `TELLYOUEVERYTHING' message. - -Configuring incremental propagation ------------------------------------ - -The program that runs on the master is `ipropd-master' and all clients -run `ipropd-slave'. - -Create the file `/var/heimdal/slaves' on the master containing all the -slaves that the database should be propagated to. Each line contains -the full name of the principal (for example -`iprop/hemligare.foo.se@FOO.SE'). - -You should already have `iprop/tcp' defined as 2121, in your -`/etc/services'. Otherwise, or if you need to use a different port for -some peculiar reason, you can use the `--port' option. This is useful -when you have multiple realms to distribute from one server. - -Then you need to create these principals that you added in the -configuration file. Create one `iprop/hostname' for the master and for -every slave. - - master# /usr/heimdal/sbin/ktutil get iprop/`hostname` - -The next step is to start the `ipropd-master' process on the master -server. The `ipropd-master' listens on the UNIX-socket -`/var/heimdal/signal' to know when changes have been made to the -database so they can be propagated to the slaves. There is also a -safety feature of testing the version number regularly (every 30 -seconds) to see if it has been modified by some means that do not raise -this signal. Then, start `ipropd-slave' on all the slaves: - - master# /usr/heimdal/libexec/ipropd-master & - slave# /usr/heimdal/libexec/ipropd-slave master & - - -File: heimdal.info, Node: Salting, Prev: Incremental propagation, Up: Setting up a realm - -Salting -======= - -Salting is used to make it harder to precalculate all possible keys. -Using a salt increases the search space to make it almost impossible to -precalculate all keys. Salting is the process of mixing a public string -(the salt) with the password, then sending it through an -encryption-type specific string-to-key function that will output the -fixed size encryption key. - -In Kerberos 5 the salt is determined by the encryption-type, except in -some special cases. - -In `des' there is the Kerberos 4 salt (none at all) or the afs-salt -(using the cell (realm in afs-lingo)). - -In `arcfour' (the encryption type that Microsoft Windows 2000 uses) -there is no salt. This is to be compatible with NTLM keys in Windows NT -4. - -`[kadmin]default_keys' in `krb5.conf' controls what salting to use, - -The syntax of `[kadmin]default_keys' is -`[etype:]salt-type[:salt-string]'. `etype' is the encryption type (des, -des3, arcfour), `salt-type' is the type of salt (pw-salt or afs3-salt), -and the salt-string is the string that will be used as salt (remember -that if the salt is appened/prepended, the empty salt "" is the same -thing as no salt at all). - -Common types of salting includes - - * `v4' (or `des:pw-salt:') - - The Kerberos 4 salting is using no salt att all. Reson there is - colon that the end is that - - * `v5' (or `pw-salt') - - `pw-salt' means all regular encryption-types that is regular - - * `afs3-salt' - - `afs3-salt' is the salting that is used with Transarc kaserver. Its - the cell appended to the password. - - - -File: heimdal.info, Node: Things in search for a better place, Next: Kerberos 4 issues, Prev: Setting up a realm, Up: Top - -Things in search for a better place -*********************************** - -Making things work on Ciscos -============================ - -Modern versions of Cisco IOS has some support for authenticating via -Kerberos 5. This can be used both by having the router get a ticket when -you login (boring), and by using Kerberos authenticated telnet to access -your router (less boring). The following has been tested on IOS -11.2(12), things might be different with other versions. Old versions -are known to have bugs. - -To make this work, you will first have to configure your router to use -Kerberos (this is explained in the documentation). A sample -configuration looks like the following: - - aaa new-model - aaa authentication login default krb5-telnet krb5 enable - aaa authorization exec krb5-instance - kerberos local-realm FOO.SE - kerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 - kerberos server FOO.SE 10.0.0.1 - kerberos instance map admin 15 - -This tells you (among other things) that when logging in, the router -should try to authenticate with kerberised telnet, and if that fails try -to verify a plain text password via a Kerberos ticket exchange (as -opposed to a local database, RADIUS or something similar), and if that -fails try the local enable password. If you're not careful when you -specify the `login default' authentication mechanism, you might not be -able to login at all. The `instance map' and `authorization exec' lines -says that people with `admin' instances should be given `enabled' shells -when logging in. - -The numbers after the principal on the `srvtab' line are principal type, -timestamp (in seconds since 1970), key version number (4), keytype (1 == -des), key length (always 8 with des), and then the key. - -To make the Heimdal KDC produce tickets that the Cisco can decode you -might have to turn on the `encode_as_rep_as_tgs_rep' flag in the KDC. -You will also have to specify that the router can't handle anything but -`des-cbc-crc'. This can be done with the `del_enctype' command of -`kadmin'. - -This all fine and so, but unless you have an IOS version with encryption -(available only in the U.S) it doesn't really solve any problems. Sure -you don't have to send your password over the wire, but since the telnet -connection isn't protected it's still possible for someone to steal your -session. This won't be fixed until someone adds integrity to the telnet -protocol. - -A working solution would be to hook up a machine with a real operating -system to the console of the Cisco and then use it as a backwards -terminal server. - -Making things work on Transarc AFS -================================== - -How to get a KeyFile --------------------- - -`ktutil -k AFSKEYFILE:KeyFile get afs@MY.REALM' - - -File: heimdal.info, Node: Kerberos 4 issues, Next: Windows 2000 compatability, Prev: Things in search for a better place, Up: Top - -Kerberos 4 issues -***************** - -If compiled with version 4 support, the KDC can serve requests from a -Kerberos 4 client. There are a few things you must do for this to work. - -The KDC will also have kaserver emulation and be able to handle -AFS-clients that use `klog'. - -* Menu: - -* Principal conversion issues:: -* Converting a version 4 database:: -* kaserver:: - - -File: heimdal.info, Node: Principal conversion issues, Next: Converting a version 4 database, Prev: Kerberos 4 issues, Up: Kerberos 4 issues - -Principal conversion issues -=========================== - -First, Kerberos 4 and Kerberos 5 principals are different. A version 4 -principal consists of a name, an instance, and a realm. A version 5 -principal has one or more components, and a realm (the terms "name" and -"instance" are still used, for the first and second component, -respectively). Also, in some cases the name of a version 4 principal -differs from the first component of the corresponding version 5 -principal. One notable example is the "host" type principals, where the -version 4 name is `rcmd' (for "remote command"), and the version 5 name -is `host'. For the class of principals that has a hostname as instance, -there is an other major difference, Kerberos 4 uses only the first -component of the hostname, whereas Kerberos 5 uses the fully qualified -hostname. - -Because of this it can be hard or impossible to correctly convert a -version 4 principal to a version 5 principal (1). The biggest problem is -to know if the conversion resulted in a valid principal. To give an -example, suppose you want to convert the principal `rcmd.foo'. - -The `rcmd' name suggests that the instance is a hostname (even if there -are exceptions to this rule). To correctly convert the instance `foo' -to a hostname, you have to know which host it is referring to. You can -to this by either guessing (from the realm) which domain name to -append, or you have to have a list of possible hostnames. In the -simplest cases you can cover most principals with the first rule. If you -have several domains sharing a single realm this will not usually work. -If the exceptions are few you can probably come by with a lookup table -for the exceptions. - -In a complex scenario you will need some kind of host lookup mechanism. -Using DNS for this is tempting, but DNS is error prone, slow and unsafe -(2). - -Fortunately, the KDC has a trump on hand: it can easily tell if a -principal exists in the database. The KDC will use -`krb5_425_conv_principal_ext' to convert principals when handling to -version 4 requests. - ----------- Footnotes ---------- - -(1) the other way is not always trivial either, but usually easier - -(2) at least until secure DNS is commonly available - - -File: heimdal.info, Node: Converting a version 4 database, Next: kaserver, Prev: Principal conversion issues, Up: Kerberos 4 issues - -Converting a version 4 database -=============================== - -If you want to convert an existing version 4 database, the principal -conversion issue arises too. - -If you decide to convert your database once and for all, you will only -have to do this conversion once. It is also possible to run a version 5 -KDC as a slave to a version 4 KDC. In this case this conversion will -happen every time the database is propagated. When doing this -conversion, there are a few things to look out for. If you have stale -entries in the database, these entries will not be converted. This might -be because these principals are not used anymore, or it might be just -because the principal couldn't be converted. - -You might also see problems with a many-to-one mapping of principals. -For instance, if you are using DNS lookups and you have two principals -`rcmd.foo' and `rcmd.bar', where `foo' is a CNAME for `bar', the -resulting principals will be the same. Since the conversion function -can't tell which is correct, these conflicts will have to be resolved -manually. - -Conversion example ------------------- - -Given the following set of hosts and services: - - foo.se rcmd - mail.foo.se rcmd, pop - ftp.bar.se rcmd, ftp - -you have a database that consists of the following principals: - -`rcmd.foo', `rcmd.mail', `pop.mail', `rcmd.ftp', and `ftp.ftp'. - -lets say you also got these extra principals: `rcmd.gone', -`rcmd.old-mail', where `gone.foo.se' was a machine that has now passed -away, and `old-mail.foo.se' was an old mail machine that is now a CNAME -for `mail.foo.se'. - -When you convert this database you want the following conversions to be -done: - rcmd.foo host/foo.se - rcmd.mail host/mail.foo.se - pop.mail pop/mail.foo.se - rcmd.ftp host/ftp.bar.se - ftp.ftp ftp/ftp.bar.se - rcmd.gone removed - rcmd.old-mail removed - -A `krb5.conf' that does this looks like: - - [realms] - FOO.SE = { - v4_name_convert = { - host = { - ftp = ftp - pop = pop - rcmd = host - } - } - v4_instance_convert = { - foo = foo.se - ftp = ftp.bar.se - } - default_domain = foo.se - } - -The `v4_name_convert' section says which names should be considered -having an instance consisting of a hostname, and it also says how the -names should be converted (for instance `rcmd' should be converted to -`host'). The `v4_instance_convert' section says how a hostname should -be qualified (this is just a hosts-file in disguise). Host-instances -that aren't covered by `v4_instance_convert' are qualified by appending -the contents of the `default_domain'. - -Actually, this example doesn't work. Or rather, it works to well. Since -it has no way of knowing which hostnames are valid and which are not, it -will happily convert `rcmd.gone' to `host/gone.foo.se'. This isn't a -big problem, but if you have run your kerberos realm for a few years, -chances are big that you have quite a few `junk' principals. - -If you don't want this you can remove the `default_domain' statement, -but then you will have to add entries for _all_ your hosts in the -`v4_instance_convert' section. - -Instead of doing this you can use DNS to convert instances. This is not -a solution without problems, but it is probably easier than adding lots -of static host entries. - -To enable DNS lookup you should turn on `v4_instance_resolve' in the -`[libdefaults]' section. - -Converting a database ---------------------- - -The database conversion is done with `hprop'. You can run this command -to propagate the database to the machine called `slave-server' (which -should be running a `hpropd'). - - hprop --source=krb4-db --master-key=/.m slave-server - -This command can also be to use for converting the v4 database on the -server: - - hprop -n --source=krb4-db -d /var/kerberos/principal --master-key=/.m | hpropd -n - -Version 4 Kadmin -================ - -`kadmind' can act as a version 4 kadmind, and you can do most -operations, but with some restrictions (since the version 4 kadmin -protocol is, lets say, very ad hoc.) One example is that it only passes -des keys when creating principals and changing passwords (modern kpasswd -clients do send the password, so it's possible to to password quality -checks). Because of this you can only create principals with des keys, -and you can't set any flags or do any other fancy stuff. - -To get this to work, you have to add another entry to inetd (since -version 4 uses port 751, not 749). - -_And then there are a many more things you can do; more on this in a -later version of this manual. Until then, UTSL._ - - -File: heimdal.info, Node: kaserver, Prev: Converting a version 4 database, Up: Kerberos 4 issues - -kaserver -======== - -kaserver emulation ------------------- - -The Heimdal kdc can emulate a kaserver. The kaserver is a Kerberos 4 -server with pre-authentication using Rx as the on-wire protocol. The kdc -contains a minimalistic Rx implementation. - -There are three parts of the kaserver; KAA (Authentication), KAT (Ticket -Granting), and KAM (Maintenance). The KAA interface and KAT interface -both passes over DES encrypted data-blobs (just like the -Kerberos-protocol) and thus do not need any other protection. The KAM -interface uses `rxkad' (Kerberos authentication layer for Rx) for -security and data protection, and is used for example for changing -passwords. This part is not implemented in the kdc. - -Another difference between the ka-protocol and the Kerberos 4 protocol -is that the pass-phrase is salted with the cellname in the `string to -key' function in the ka-protocol, while in the Kerberos 4 protocol there -is no salting of the password at all. To make sure AFS-compatible keys -are added to each principals when they are created or their password are -changed, `afs3-salt' should be added to `[kadmin]default_keys'. - -Transarc AFS Windows client ---------------------------- - -The Transarc Windows client uses Kerberos 4 to obtain tokens, and thus -does not need a kaserver. The Windows client assumes that the Kerberos -server is on the same machine as the AFS-database server. If you do not -like to do that you can add a small program that runs on the database -servers that forward all kerberos requests to the real kerberos server. -A program that does this is `krb-forward' -(<ftp://ftp.stacken.kth.se/pub/projekts/krb-forward>). - - -File: heimdal.info, Node: Windows 2000 compatability, Next: Programming with Kerberos, Prev: Kerberos 4 issues, Up: Top - -Windows 2000 compatability -************************** - -Windows 2000 (formerly known as Windows NT 5) from Microsoft implements -Kerberos 5. Their implementation, however, has some quirks, -peculiarities, and bugs. This chapter is a short summary of the things -that we have found out while trying to test Heimdal against Windows -2000. Another big problem with the Kerberos implementation in Windows -2000 is that the available documentation is more focused on getting -things to work rather than how they work and not that useful in figuring -out how things really work. - -This information should apply to Heimdal 0.3a and Windows 2000 -Professional. It's of course subject all the time and mostly consists -of our not so inspired guesses. Hopefully it's still somewhat useful. - -* Menu: - -* Configuring Windows 2000 to use a Heimdal KDC:: -* Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC:: -* Create account mappings:: -* Encryption types:: -* Authorization data:: -* Quirks of Windows 2000 KDC:: -* Useful links when reading about the Windows 2000:: - - -File: heimdal.info, Node: Configuring Windows 2000 to use a Heimdal KDC, Next: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Prev: Windows 2000 compatability, Up: Windows 2000 compatability - -Configuring Windows 2000 to use a Heimdal KDC -============================================= - -You need the command line program called `ksetup.exe' which is available -in the file `SUPPORT/TOOLS/SUPPORT.CAB' on the Windows 2000 Professional -CD-ROM. This program is used to configure the Kerberos settings on a -Workstation. - -`Ksetup' store the domain information under the registry key: -`HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\Kerberos\Domains'. - -Use the kadmin program in Heimdal to create a host principal in the -Kerberos realm. - - unix% kadmin - kadmin> ank -pw password host/datan.my.domain - -You must configure the Workstation as a member of a workgroup, as -opposed to a member in an NT domain, and specify the KDC server of the -realm as follows: - C:> ksetup /setdomain MY.REALM - C:> ksetup /addkdc MY.REALM kdc.my.domain - -Set the machine password, i.e. create the local keytab: - C:> ksetup /setmachpassword password - -The workstation must now be rebooted. - -A mapping between local NT users and Kerberos principals must be -specified, you have two choices: - - C:> ksetup /mapuser user@MY.REALM nt_user - -This will map a user to a specific principal, this allows you to have -other usernames in the realm than in your NT user database. (Don't ask -me why on earth you would want that...) - -You can also say: - C:> ksetup /mapuser * * -The Windows machine will now map any user to the corresponding -principal, for example `nisse' to the principal `nisse@MY.REALM'. -(This is most likely what you want.) - - -File: heimdal.info, Node: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Next: Create account mappings, Prev: Configuring Windows 2000 to use a Heimdal KDC, Up: Windows 2000 compatability - -Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC -=============================================================== - -See also the Step-by-Step guide from Microsoft, referenced below. - -Install Windows 2000, and create a new controller (Active Directory -Server) for the domain. - -By default the trust will be non-transitive. This means that only users -directly from the trusted domain may authenticate. This can be changed -to transitive by using the `netdom.exe' tool. - -You need to tell Windows 2000 on what hosts to find the KDCs for the -non-Windows realm with `ksetup', see *Note Configuring Windows 2000 to -use a Heimdal KDC::. - -This need to be done on all computers that want enable cross-realm -login with `Mapped Names'. - -Then you need to add the inter-realm keys on the Windows kdc. Start the -Domain Tree Management tool. (Found in Programs, Administrative tools, -Active Directory Domains and Trusts). - -Right click on Properties of your domain, select the Trust tab. Press -Add on the appropriate trust windows and enter domain name and -password. When prompted if this is a non-Windows Kerberos realm, press -OK. - -Do not forget to add trusts in both directions. - -You also need to add the inter-realm keys to the Heimdal KDC. There are -some tweaks that you need to do to `krb5.conf' beforehand. - - [libdefaults] - default_etypes = des-cbc-crc - default_etypes_des = des-cbc-crc - -since otherwise checksum types that are not understood by Windows 2000 -will be generated (*Note Quirks of Windows 2000 KDC::.). - -Another issue is salting. Since Windows 2000 does not seem to -understand Kerberos 4 salted hashes you might need to turn off anything -similar to the following if you have it, at least while adding the -principals that are going to share keys with Windows 2000. - - [kadmin]default_keys = v5 v4 - -You must also set: - -Once that is also done, you can add the required inter-realm keys: - - kadmin add krbtgt/NT.REALM.EXAMPLE.COM@EXAMPLE.COM - kadmin add krbtgt/REALM.EXAMPLE.COM@NT.EXAMPLE.COM - -Use the same passwords for both keys. - -Do not forget to reboot before trying the new realm-trust (after running -`ksetup'). It looks like it might work, but packets are never sent to -the non-Windows KDC. - - -File: heimdal.info, Node: Create account mappings, Next: Encryption types, Prev: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Up: Windows 2000 compatability - -Create account mappings -======================= - -Start the `Active Directory Users and Computers' tool. Select the View -menu, that is in the left corner just below the real menu (or press -Alt-V), and select Advanced Features. Right click on the user that you -are going to do a name mapping for and choose Name mapping. - -Click on the Kerberos Names tab and add a new principal from the -non-Windows domain. - - -File: heimdal.info, Node: Encryption types, Next: Authorization data, Prev: Create account mappings, Up: Windows 2000 compatability - -Encryption types -================ - -Windows 2000 supports both the standard DES encryptions (des-cbc-crc and -des-cbc-md5) and its own proprietary encryption that is based on MD4 and -rc4 that is documented in and is supposed to be described in -`draft-brezak-win2k-krb-rc4-hmac-03.txt'. New users will get both MD4 -and DES keys. Users that are converted from a NT4 database, will only -have MD4 passwords and will need a password change to get a DES key. - -Heimdal implements both of these encryption types, but since DES is the -standard and the hmac-code is somewhat newer, it is likely to work -better. - - -File: heimdal.info, Node: Authorization data, Next: Quirks of Windows 2000 KDC, Prev: Encryption types, Up: Windows 2000 compatability - -Authorization data -================== - -The Windows 2000 KDC also adds extra authorization data in tickets. It -is at this point unclear what triggers it to do this. The format of -this data is only available under a "secret" license from Microsoft, -which prohibits you implementing it. - -A simple way of getting hold of the data to be able to understand it -better is described here. - - 1. Find the client example on using the SSPI in the SDK documentation. - - 2. Change "AuthSamp" in the source code to lowercase. - - 3. Build the program. - - 4. Add the "authsamp" principal with a known password to the - database. Make sure it has a DES key. - - 5. Run `ktutil add' to add the key for that principal to a keytab. - - 6. Run `appl/test/nt_gss_server -p 2000 -s authsamp --dump-auth=file' - where file is an appropriate file. - - 7. It should authenticate and dump for you the authorization data in - the file. - - 8. The tool `lib/asn1/asn1_print' is somewhat useful for analyzing - the data. - - -File: heimdal.info, Node: Quirks of Windows 2000 KDC, Next: Useful links when reading about the Windows 2000, Prev: Authorization data, Up: Windows 2000 compatability - -Quirks of Windows 2000 KDC -========================== - -There are some issues with salts and Windows 2000. Using an empty salt, -which is the only one that Kerberos 4 supported and is therefore known -as a Kerberos 4 compatible salt does not work, as far as we can tell -from out experiments and users reports. Therefore, you have to make -sure you keep around keys with all the different types of salts that are -required. - -Microsoft seems also to have forgotten to implement the checksum -algorithms `rsa-md4-des' and `rsa-md5-des'. This can make Name mapping -(*note Create account mappings::) fail if a `des-cbc-md5' key is used. -To make the KDC return only `des-cbc-crc' you must delete the -`des-cbc-md5' key from the kdc using the `kadmin del_enctype' command. - - kadmin del_enctype lha des-cbc-md5 - -You should also add the following entries to the `krb5.conf' file: - - [libdefaults] - default_etypes = des-cbc-crc - default_etypes_des = des-cbc-crc - -These configuration options will make sure that no checksums of the -unsupported types are generated. - - -File: heimdal.info, Node: Useful links when reading about the Windows 2000, Prev: Quirks of Windows 2000 KDC, Up: Windows 2000 compatability - -Useful links when reading about the Windows 2000 -================================================ - -See also our paper presented at the 2001 usenix Annual Technical -Conference, available in the proceedings or at -<http://www.usenix.org/publications/library/proceedings/usenix01/freenix01/westerlund.html>. - -There are lots of text about Kerberos on Microsoft's web site, here is a -short list of the interesting documents that we have managed to find. - - * Step-by-Step Guide to Kerberos 5 (krb5 1.0) Interoperability - - <http://www.microsoft.com/windows2000/library/planning/security/kerbsteps.asp> - Kerberos GSS-API (in Windows-ize SSPI), Windows as a client in a - non-Windows KDC realm, adding unix clients to a Windows 2000 KDC, - and adding cross-realm trust (*Note Inter-Realm keys (trust) - between Windows 2000 and a Heimdal KDC::.). - - * Windows 2000 Kerberos Authentication - - <http://www.microsoft.com/TechNet/win2000/win2ksrv/technote/kerberos.asp> - White paper that describes how Kerberos is used in Windows 2000. - - * Overview of kerberos - - <http://support.microsoft.com/support/kb/articles/Q248/7/58.ASP> - Links to useful other links. - - * Klist for windows - - <http://msdn.microsoft.com/library/periodic/period00/security0500.htm> - Describes where to get a klist for Windows 2000. - - * Event logging for kerberos - - <http://support.microsoft.com/support/kb/articles/Q262/1/77.ASP>. - Basicly it say that you can add a registry key - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\LogLevel' - with value DWORD equal to 1, and then you'll get logging in the - Event Logger. - - * Access to the active directory through LDAP - <http://msdn.microsoft.com/library/techart/kerberossamp.htm> - - -Other useful programs include these: - - * pwdump2 <http://www.webspan.net/~tas/pwdump2/> - - -File: heimdal.info, Node: Programming with Kerberos, Next: Migration, Prev: Windows 2000 compatability, Up: Top - -Programming with Kerberos -************************* - -First you need to know how the Kerberos model works, go read the -introduction text (*note What is Kerberos?::). - -* Menu: - -* Kerberos 5 API Overview:: -* Walkthru a sample Kerberos 5 client:: -* Validating a password in a server application:: - - -File: heimdal.info, Node: Kerberos 5 API Overview, Next: Walkthru a sample Kerberos 5 client, Prev: Programming with Kerberos, Up: Programming with Kerberos - -Kerberos 5 API Overview -======================= - -Most functions are documenteded in manual pages. This overview only -tries to point to where to look for a specific function. - -Kerberos context ----------------- - -A kerberos context (`krb5_context') holds all per thread state. All -global variables that are context specific are stored in this struture, -including default encryption types, credential-cache (ticket file), and -default realms. - -See the manual pages for `krb5_context(3)' and `krb5_init_context(3)'. - -Kerberos authenication context ------------------------------- - -Kerberos authentication context (`krb5_auth_context') holds all context -related to an authenticated connection, in a similar way to the -kerberos context that holds the context for the thread or process. - -The `krb5_auth_context' is used by various functions that are directly -related to authentication between the server/client. Example of data -that this structure contains are various flags, addresses of client and -server, port numbers, keyblocks (and subkeys), sequence numbers, replay -cache, and checksum types. - -See the manual page for `krb5_auth_context(3)'. - -Keytab managment ----------------- - -A keytab is a storage for locally stored keys. Heimdal includes keytab -support for Kerberos 5 keytabs, Kerberos 4 srvtab, AFS-KeyFile's, and -for storing keys in memory. - -See also manual page for `krb5_keytab(3)' - - -File: heimdal.info, Node: Walkthru a sample Kerberos 5 client, Next: Validating a password in a server application, Prev: Kerberos 5 API Overview, Up: Programming with Kerberos - -Walkthru a sample Kerberos 5 client -=================================== - -This example contains parts of a sample TCP Kerberos 5 clients, if you -want a real working client, please look in `appl/test' directory in the -Heimdal distribution. - -All Kerberos error-codes that are returned from kerberos functions in -this program are passed to `krb5_err', that will print a descriptive -text of the error code and exit. Graphical programs can convert -error-code to a humal readable error-string with the -`krb5_get_err_text(3)' function. - -Note that you should not use any Kerberos function before -`krb5_init_context()' have completed successfully. That is the reson -`err()' is used when `krb5_init_context()' fails. - -First the client needs to call `krb5_init_context' to initialize the -Kerberos 5 library. This is only needed once per thread in the program. -If the function returns a non-zero value it indicates that either the -Kerberos implemtation is failing or its disabled on this host. - - #include <krb5.h> - - int - main(int argc, char **argv) - { - krb5_context context; - - if (krb5_context(&context)) - errx (1, "krb5_context"); - -Now the client wants to connect to the host at the other end. The -preferred way of doing this is using `getaddrinfo(3)' (for operating -system that have this function implemented), since getaddrinfo is -neutral to the address type and can use any protocol that is available. - - struct addrinfo *ai, *a; - struct addrinfo hints; - int error; - - memset (&hints, 0, sizeof(hints)); - hints.ai_socktype = SOCK_STREAM; - hints.ai_protocol = IPPROTO_TCP; - - error = getaddrinfo (hostname, "pop3", &hints, &ai); - if (error) - errx (1, "%s: %s", hostname, gai_strerror(error)); - - for (a = ai; a != NULL; a = a->ai_next) { - int s; - - s = socket (a->ai_family, a->ai_socktype, a->ai_protocol); - if (s < 0) - continue; - if (connect (s, a->ai_addr, a->ai_addrlen) < 0) { - warn ("connect(%s)", hostname); - close (s); - continue; - } - freeaddrinfo (ai); - ai = NULL; - } - if (ai) { - freeaddrinfo (ai); - errx ("failed to contact %s", hostname); - } - -Before authenticating, an authentication context needs to be created. -This context keeps all information for one (to be) authenticated -connection (see `krb5_auth_context(3)'). - - status = krb5_auth_con_init (context, &auth_context); - if (status) - krb5_err (context, 1, status, "krb5_auth_con_init"); - -For setting the address in the authentication there is a help function -`krb5_auth_con_setaddrs_from_fd' that does everthing that is needed -when given a connected file descriptor to the socket. - - status = krb5_auth_con_setaddrs_from_fd (context, - auth_context, - &sock); - if (status) - krb5_err (context, 1, status, - "krb5_auth_con_setaddrs_from_fd"); - -The next step is to build a server principal for the service we want to -connect to. (See also `krb5_sname_to_principal(3)'.) - - status = krb5_sname_to_principal (context, - hostname, - service, - KRB5_NT_SRV_HST, - &server); - if (status) - krb5_err (context, 1, status, "krb5_sname_to_principal"); - -The client principal is not passed to `krb5_sendauth(3)' function, this -causes the `krb5_sendauth' function to try to figure it out itself. - -The server program is using the function `krb5_recvauth(3)' to receive -the Kerberos 5 authenticator. - -In this case, mutual authenication will be tried. That means that the -server will authenticate to the client. Using mutual authenication is -good since it enables the user to verify that they are talking to the -right server (a server that knows the key). - -If you are using a non-blocking socket you will need to do all work of -`krb5_sendauth' yourself. Basically you need to send over the -authenticator from `krb5_mk_req(3)' and, in case of mutual -authentication, verifying the result from the server with -`krb5_rd_rep(3)'. - - status = krb5_sendauth (context, - &auth_context, - &sock, - VERSION, - NULL, - server, - AP_OPTS_MUTUAL_REQUIRED, - NULL, - NULL, - NULL, - NULL, - NULL, - NULL); - if (status) - krb5_err (context, 1, status, "krb5_sendauth"); - -Once authentication has been performed, it is time to send some data. -First we create a krb5_data structure, then we sign it with -`krb5_mk_safe(3)' using the `auth_context' that contains the -session-key that was exchanged in the -`krb5_sendauth(3)'/`krb5_recvauth(3)' authentication sequence. - - data.data = "hej"; - data.length = 3; - - krb5_data_zero (&packet); - - status = krb5_mk_safe (context, - auth_context, - &data, - &packet, - NULL); - if (status) - krb5_err (context, 1, status, "krb5_mk_safe"); - -And send it over the network. - - len = packet.length; - net_len = htonl(len); - - if (krb5_net_write (context, &sock, &net_len, 4) != 4) - err (1, "krb5_net_write"); - if (krb5_net_write (context, &sock, packet.data, len) != len) - err (1, "krb5_net_write"); - -To send encrypted (and signed) data `krb5_mk_priv(3)' should be used -instead. `krb5_mk_priv(3)' works the same way as `krb5_mk_safe(3)', -with the exception that it encrypts the data in addition to signing it. - - data.data = "hemligt"; - data.length = 7; - - krb5_data_free (&packet); - - status = krb5_mk_priv (context, - auth_context, - &data, - &packet, - NULL); - if (status) - krb5_err (context, 1, status, "krb5_mk_priv"); - -And send it over the network. - - len = packet.length; - net_len = htonl(len); - - if (krb5_net_write (context, &sock, &net_len, 4) != 4) - err (1, "krb5_net_write"); - if (krb5_net_write (context, &sock, packet.data, len) != len) - err (1, "krb5_net_write"); - -The server is using `krb5_rd_safe(3)' and `krb5_rd_priv(3)' to verify -the signature and decrypt the packet. - - -File: heimdal.info, Node: Validating a password in a server application, Prev: Walkthru a sample Kerberos 5 client, Up: Programming with Kerberos - -Validating a password in an application -======================================= - -See the manual page for `krb5_verify_user(3)'. - - -File: heimdal.info, Node: Migration, Next: Acknowledgments, Prev: Programming with Kerberos, Up: Top - -Migration -********* - -General issues -============== - -When migrating from a Kerberos 4 KDC. - -Order in what to do things: -=========================== - - * Convert the database, check all principals that hprop complains - about. - - `hprop -n --source=<NNN>| hpropd -n' - - Replace <NNN> with whatever source you have, like krb4-db or - krb4-dump. - - * Run a Kerberos 5 slave for a while. - - * Figure out if it does everything you want it to. - - Make sure that all things that you use works for you. - - * Let a small number of controlled users use Kerberos 5 tools. - - Find a sample population of your users and check what programs - they use, you can also check the kdc-log to check what ticket are - checked out. - - * Burn the bridge and change the master. - - * Let all users use the Kerberos 5 tools by default. - - * Turn off services that do not need Kerberos 4 authentication. - - Things that might be hard to get away is old programs with support - for Kerberos 4. Example applications are old Eudora installations - using KPOP, and Zephyr. Eudora can use the Kerberos 4 kerberos in - the Heimdal kdc. - - - -File: heimdal.info, Node: Acknowledgments, Prev: Migration, Up: Top - -Acknowledgments -*************** - -Eric Young wrote "libdes". - -The University of California at Berkeley initially wrote `telnet', and -`telnetd'. The authentication and encryption code of `telnet' and -`telnetd' was added by David Borman (then of Cray Research, Inc). The -encryption code was removed when this was exported and then added back -by Juha Eskelinen, <esc@magic.fi>. - -The `popper' was also a Berkeley program initially. - -Some of the functions in `libroken' also come from Berkeley by way of -NetBSD/FreeBSD. - -`editline' was written by Simmule Turner and Rich Salz. - -Bugfixes, documentation, encouragement, and code has been contributed -by: -Derrick J Brashear - <shadow@dementia.org> - -Ken Hornstein - <kenh@cmf.nrl.navy.mil> - -Johan Ihrén - <johani@pdc.kth.se> - -Love Hörnquist-Åstrand - <lha@stacken.kth.se> - -Magnus Ahltorp - <map@stacken.kth.se> - -Mark Eichin - <eichin@cygnus.com> - -Marc Horowitz - <marc@cygnus.com> - -Luke Howard - <lukeh@xedoc.com.au> - -Brandon S. Allbery KF8NH - <allbery@kf8nh.apk.net> - -Jun-ichiro itojun Hagino - <itojun@kame.net> - -Daniel Kouril - <kouril@informatics.muni.cz> - -Åke Sandgren - <ake@cs.umu.se> - -Michal Vocu - <michal@karlin.mff.cuni.cz> - -Miroslav Ruda - <ruda@ics.muni.cz> - -Brian A May - <bmay@snoopy.apana.org.au> - -Chaskiel M Grundman - <cg2v@andrew.cmu.edu> - -Richard Nyberg - <rnyberg@it.su.se> - -Frank van der Linden - <fvdl@netbsd.org> - -and we hope that those not mentioned here will forgive us. -All bugs were introduced by ourselves. - - +Indirect: +heimdal.info-1: 210 +heimdal.info-2: 47805 Tag Table: +(Indirect) Node: Top210 Node: Introduction565 -Node: What is Kerberos?3207 -Node: Building and Installing8281 -Node: Setting up a realm11684 -Node: Configuration file12345 -Node: Creating the database15035 -Node: keytabs17538 -Node: Remote administration18372 -Node: Password changing20274 -Node: Testing clients and servers22083 -Node: Slave Servers22403 -Node: Incremental propagation24035 -Node: Salting26563 -Node: Things in search for a better place28198 -Node: Kerberos 4 issues31083 -Node: Principal conversion issues31585 -Ref: Principal conversion issues-Footnote-133808 -Ref: Principal conversion issues-Footnote-233876 -Node: Converting a version 4 database33929 -Node: kaserver38957 -Node: Windows 2000 compatability40696 -Node: Configuring Windows 2000 to use a Heimdal KDC41882 -Node: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC43634 -Node: Create account mappings46082 -Node: Encryption types46672 -Node: Authorization data47413 -Node: Quirks of Windows 2000 KDC48557 -Node: Useful links when reading about the Windows 200049798 -Node: Programming with Kerberos51832 -Node: Kerberos 5 API Overview52245 -Node: Walkthru a sample Kerberos 5 client53797 -Node: Validating a password in a server application61613 -Node: Migration61894 -Node: Acknowledgments63148 +Node: What is Kerberos?3443 +Node: Building and Installing8517 +Node: Setting up a realm12130 +Node: Configuration file12827 +Node: Creating the database15517 +Node: keytabs18020 +Node: Serving Kerberos 4/524/kaserver18864 +Node: Remote administration20312 +Node: Password changing22238 +Node: Testing clients and servers24047 +Node: Slave Servers24367 +Node: Incremental propagation26000 +Node: Salting28528 +Node: Things in search for a better place30242 +Node: Kerberos 4 issues35254 +Node: Principal conversion issues35756 +Ref: Principal conversion issues-Footnote-137979 +Ref: Principal conversion issues-Footnote-238047 +Node: Converting a version 4 database38100 +Node: kaserver43128 +Node: Windows 2000 compatability44867 +Node: Configuring Windows 2000 to use a Heimdal KDC46053 +Node: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC47805 +Node: Create account mappings50253 +Node: Encryption types50843 +Node: Authorization data51584 +Node: Quirks of Windows 2000 KDC52728 +Node: Useful links when reading about the Windows 200053969 +Node: Programming with Kerberos56003 +Node: Kerberos 5 API Overview56416 +Node: Walkthru a sample Kerberos 5 client57970 +Node: Validating a password in a server application65786 +Node: Migration66067 +Node: Acknowledgments67321 End Tag Table diff --git a/kerberosV/src/doc/heimdal.info-1 b/kerberosV/src/doc/heimdal.info-1 new file mode 100644 index 00000000000..726a114674e --- /dev/null +++ b/kerberosV/src/doc/heimdal.info-1 @@ -0,0 +1,1261 @@ +This is heimdal.info, produced by makeinfo version 4.5 from +heimdal.texi. + +INFO-DIR-SECTION Heimdal +START-INFO-DIR-ENTRY +* Heimdal: (heimdal). The Kerberos 5 distribution from KTH +END-INFO-DIR-ENTRY + + +File: heimdal.info, Node: Top, Next: Introduction, Prev: (dir), Up: (dir) + +Heimdal +******* + +* Menu: + +* Introduction:: +* What is Kerberos?:: +* Building and Installing:: +* Setting up a realm:: +* Things in search for a better place:: +* Kerberos 4 issues:: +* Windows 2000 compatability:: +* Programming with Kerberos:: +* Migration:: +* Acknowledgments:: + + +File: heimdal.info, Node: Introduction, Next: What is Kerberos?, Prev: Top, Up: Top + +Introduction +************ + +What is Heimdal? +================ + +Heimdal is a free implementation of Kerberos 5. The goals are to: + + * have an implementation that can be freely used by anyone + + * be protocol compatible with existing implementations and, if not in + conflict, with RFC 1510 (and any future updated RFC) + + * be reasonably compatible with the M.I.T Kerberos V5 API + + * have support for Kerberos V5 over GSS-API (RFC1964) + + * include the most important and useful application programs (rsh, + telnet, popper, etc.) + + * include enough backwards compatibility with Kerberos V4 + +Status +====== + +Heimdal has the following features (this does not mean any of this +works): + + * a stub generator and a library to encode/decode/whatever ASN.1/DER + stuff + + * a `libkrb5' library that should be possible to get to work with + simple applications + + * a GSS-API library that should have all the important functions for + building applications + + * Eric Young's `libdes' + + * `kinit', `klist', `kdestroy' + + * `telnet', `telnetd' + + * `rsh', `rshd' + + * `popper', `push' (a movemail equivalent) + + * `ftp', and `ftpd' + + * a library `libkafs' for authenticating to AFS and a program + `afslog' that uses it + + * some simple test programs + + * a KDC that supports most things; optionally, it may also support + Kerberos V4 and kaserver, + + * simple programs for distributing databases between a KDC master and + slaves + + * a password changing daemon `kpasswdd', library functions for + changing passwords and a simple client + + * some kind of administration system + + * Kerberos V4 support in many of the applications. + +Bug reports +=========== + +If you find bugs in this software, make sure it is a genuine bug and not +just a part of the code that isn't implemented. + +Bug reports should be sent to <heimdal-bugs@pdc.kth.se>. Please include +information on what machine and operating system (including version) +you are running, what you are trying to do, what happens, what you +think should have happened, an example for us to repeat, the output you +get when trying the example, and a patch for the problem if you have +one. Please make any patches with `diff -u' or `diff -c'. + +Suggestions, comments and other non bug reports are also welcome. + +Mailing list +============ + +There are two mailing lists with talk about Heimdal. +<heimdal-announce@sics.se> is a low-volume announcement list, while +<heimdal-discuss@sics.se> is for general discussion. Send a message to +<majordomo@sics.se> to subscribe. + +Heimdal source code, binaries and the manual +============================================ + +The source code for heimdal, links to binaries and the manual (this +document) can be found on our web-page at +<http://www.pdc.kth.se/heimdal/>. + + +File: heimdal.info, Node: What is Kerberos?, Next: Building and Installing, Prev: Introduction, Up: Top + +What is Kerberos? +***************** + + Now this Cerberus had three heads of dogs, + the tail of a dragon, and on his back the + heads of all sorts of snakes. + -- Pseudo-Apollodorus Library 2.5.12 + +Kerberos is a system for authenticating users and services on a network. +It is built upon the assumption that the network is "unsafe". For +example, data sent over the network can be eavesdropped and altered, and +addresses can also be faked. Therefore they cannot be used for +authentication purposes. + +Kerberos is a trusted third-party service. That means that there is a +third party (the kerberos server) that is trusted by all the entities on +the network (users and services, usually called "principals"). All +principals share a secret password (or key) with the kerberos server and +this enables principals to verify that the messages from the kerberos +server are authentic. Thus trusting the kerberos server, users and +services can authenticate each other. + +Basic mechanism +=============== + + *Note:* This discussion is about Kerberos version 4, but version 5 + works similarly. + +In Kerberos, principals use "tickets" to prove that they are who they +claim to be. In the following example, A is the initiator of the +authentication exchange, usually a user, and B is the service that A +wishes to use. + +To obtain a ticket for a specific service, A sends a ticket request to +the kerberos server. The request contains A's and B's names (along with +some other fields). The kerberos server checks that both A and B are +valid principals. + +Having verified the validity of the principals, it creates a packet +containing A's and B's names, A's network address (A<ADDR>), the +current time (T<ISSUE>), the lifetime of the ticket (LIFE), and a +secret "session key" (K<AB>). This packet is encrypted with B's secret +key (K<B>). The actual ticket (T<AB>) looks like this: ({A, B, +A<ADDR>, T<ISSUE>, LIFE, K<AB>}K<B>). + +The reply to A consists of the ticket (T<AB>), B's name, the current +time, the lifetime of the ticket, and the session key, all encrypted in +A's secret key ({B, T<ISSUE>, LIFE, K<AB>, T<AB>}K<A>). A decrypts the +reply and retains it for later use. + + +Before sending a message to B, A creates an authenticator consisting of +A's name, A's address, the current time, and a "checksum" chosen by A, +all encrypted with the secret session key ({A, A<ADDR>, T<CURRENT>, +CHECKSUM}K<AB>). This is sent together with the ticket received from +the kerberos server to B. Upon reception, B decrypts the ticket using +B's secret key. Since the ticket contains the session key that the +authenticator was encrypted with, B can now also decrypt the +authenticator. To verify that A really is A, B now has to compare the +contents of the ticket with that of the authenticator. If everything +matches, B now considers A as properly authenticated. + +Different attacks +================= + +Impersonating A +--------------- + +An impostor, C could steal the authenticator and the ticket as it is +transmitted across the network, and use them to impersonate A. The +address in the ticket and the authenticator was added to make it more +difficult to perform this attack. To succeed C will have to either use +the same machine as A or fake the source addresses of the packets. By +including the time stamp in the authenticator, C does not have much +time in which to mount the attack. + +Impersonating B +--------------- + +C can hijack B's network address, and when A sends her credentials, C +just pretend to verify them. C can't be sure that she is talking to A. + +Defense strategies +================== + +It would be possible to add a "replay cache" to the server side. The +idea is to save the authenticators sent during the last few minutes, so +that B can detect when someone is trying to retransmit an already used +message. This is somewhat impractical (mostly regarding efficiency), +and is not part of Kerberos 4; MIT Kerberos 5 contains it. + +To authenticate B, A might request that B sends something back that +proves that B has access to the session key. An example of this is the +checksum that A sent as part of the authenticator. One typical +procedure is to add one to the checksum, encrypt it with the session +key and send it back to A. This is called "mutual authentication". + +The session key can also be used to add cryptographic checksums to the +messages sent between A and B (known as "message integrity"). +Encryption can also be added ("message confidentiality"). This is +probably the best approach in all cases. + +Further reading +=============== + +The original paper on Kerberos from 1988 is `Kerberos: An +Authentication Service for Open Network Systems', by Jennifer Steiner, +Clifford Neuman and Jeffrey I. Schiller. + +A less technical description can be found in `Designing an +Authentication System: a Dialogue in Four Scenes' by Bill Bryant, also +from 1988. + +These documents can be found on our web-page at +<http://www.pdc.kth.se/kth-krb/>. + + +File: heimdal.info, Node: Building and Installing, Next: Setting up a realm, Prev: What is Kerberos?, Up: Top + +Building and Installing +*********************** + +Heimdal uses GNU Autoconf to configure for specific hosts, and GNU +Automake to manage makefiles. If this is new to you, the short +instruction is to run the `configure' script in the top level +directory, and when that finishes `make'. + +If you want to build the distribution in a different directory from the +source directory, you will need a make that implements VPATH correctly, +such as GNU make. + +You will need to build the distribution: + + * A compiler that supports a "loose" ANSI C mode, such as `gcc'. + + * lex or flex + + * awk + + * yacc or bison + + * a socket library + + * NDBM or Berkeley DB for building the server side. + +When everything is built, you can install by doing `make install'. The +default location for installation is `/usr/heimdal', but this can be +changed by running `configure' with `--prefix=/some/other/place'. + +If you need to change the default behavior, configure understands the +following options: + +`--without-berkeley-db' + DB is preferred before NDBM, but if you for some reason want to + use NDBM instead, you can use this option. + +`--with-krb4=`dir'' + Gives the location of Kerberos 4 libraries and headers. This + enables Kerberos 4 support in the applications (telnet, rsh, + popper, etc) and the KDC. It is automatically check for in + `/usr/athena'. If you keep libraries and headers in different + places, you can instead give the path to each with the + `--with-krb4-lib=`dir'', and `--with-krb4-include=`dir'' options. + + You will need a fairly recent version of our Kerberos 4 + distribution for `rshd' and `popper' to support version 4 clients. + +`--enable-dce' + Enables support for getting DCE credentials and tokens. See the + README files in `appl/dceutils' for more information. + +`--disable-otp' + By default some of the application programs will build with + support for one-time passwords (OTP). Use this option to disable + that support. + +`--enable-osfc2' + Enable some C2 support for OSF/Digital Unix/Tru64. Use this + option if you are running your OSF operating system in C2 mode. + +`--with-readline=`dir'' + Gives the path for the GNU Readline library, which will be used in + some programs. If no readline library is found, the (simpler) + editline library will be used instead. + +`--with-hesiod=`dir'' + Enables hesiod support in push. + +`--enable-netinfo' + Add support for using netinfo to lookup configuration information. + Probably only useful (and working) on NextStep/Mac OS X. + +`--without-ipv6' + Disable the IPv6 support. + +`--with-openldap' + Compile Heimdal with support for storing the database in LDAP. + Requires OpenLDAP <http://www.openldap.org>. See + <http://www.padl.com/~lukeh/heimdal/> for more information. + +`--enable-bigendian' + +`--enable-littleendian' + Normally, the build process will figure out by itself if the + machine is big or little endian. It might fail in some cases when + cross-compiling. If it does fail to figure it out, use the + relevant of these two options. + +`--with-mips-abi=ABI' + On Irix there are three different ABIs that can be used (`32', + `n32', or `64'). This option allows you to override the automatic + selection. + +`--disable-mmap' + Do not use the mmap system call. Normally, configure detects if + there is a working mmap and it is only used if there is one. Only + try this option if it fails to work anyhow. + + + +File: heimdal.info, Node: Setting up a realm, Next: Things in search for a better place, Prev: Building and Installing, Up: Top + +Setting up a realm +****************** + +* Menu: + +* Configuration file:: +* Creating the database:: +* keytabs:: +* Serving Kerberos 4/524/kaserver:: +* Remote administration:: +* Password changing:: +* Testing clients and servers:: +* Slave Servers:: +* Incremental propagation:: +* Salting:: + +A realm is an administrative domain. The name of a Kerberos realm is +usually the Internet domain name in uppercase. Call your realm the same +as your Internet domain name if you do not have strong reasons for not +doing so. It will make life easier for you and everyone else. + + +File: heimdal.info, Node: Configuration file, Next: Creating the database, Prev: Setting up a realm, Up: Setting up a realm + +Configuration file +================== + +To setup a realm you will first have to create a configuration file: +`/etc/krb5.conf'. The `krb5.conf' file can contain many configuration +options, some of which are described here. + +There is a sample `krb5.conf' supplied with the distribution. + +The configuration file is a hierarchical structure consisting of +sections, each containing a list of bindings (either variable +assignments or subsections). A section starts with `[section-name]'. A +binding consists of a left hand side, an equal (`=') and a right hand +side (the left hand side tag must be separated from the equal with some +whitespace.) Subsections has a `{' as the first non-whitespace +character after the equal. All other bindings are treated as variable +assignments. The value of a variable extends to the end of the line. + + [section1] + a-subsection = { + var = value1 + other-var = value with {} + sub-sub-section = { + var = 123 + } + } + var = some other value + [section2] + var = yet another value + +In this manual, names of sections and bindings will be given as strings +separated by slashes (`/'). The `other-var' variable will thus be +`section1/a-subsection/other-var'. + +For in-depth information about the contents of the config file, refer to +the `krb5.conf' manual page. Some of the more important sections are +briefly described here. + +The `libdefaults' section contains a list of library configuration +parameters, such as the default realm and the timeout for kdc +responses. The `realms' section contains information about specific +realms, such as where they hide their KDC. This section serves the same +purpose as the Kerberos 4 `krb.conf' file, but can contain more +information. Finally the `domain_realm' section contains a list of +mappings from domains to realms, equivalent to the Kerberos 4 +`krb.realms' file. + +To continue with the realm setup, you will have to create a config file, +with contents similar to the following. + + [libdefaults] + default_realm = MY.REALM + [realms] + MY.REALM = { + kdc = my.kdc + } + [domain_realm] + .my.domain = MY.REALM + +If you use a realm name equal to your domain name, you can omit the +`libdefaults', and `domain_realm', sections. If you have a SRV-record +for your realm, or your kerberos server has CNAME called +`kerberos.my.realm', you can omit the `realms' section too. + + +File: heimdal.info, Node: Creating the database, Next: keytabs, Prev: Configuration file, Up: Setting up a realm + +Creating the database +===================== + +The database library will look for the database in `/var/heimdal', so +you should probably create that directory. + +The keys of all the principals are stored in the database. If you +choose to, these can be encrypted with a master key. You do not have to +remember this key (or password), but just to enter it once and it will +be stored in a file (`/var/heimdal/m-key'). If you want to have a +master key, run `kstash' to create this master key: + + # kstash + Master key: + Verifying password - Master key: + +To initialise the database use the `kadmin' program, with the `-l' +option (to enable local database mode). First issue a `init MY.REALM' +command. This will create the database and insert default principals +for that realm. You can have more than one realm in one database, so +`init' does not destroy any old database. + +Before creating the database, `init' will ask you some questions about +max ticket lifetimes. + +After creating the database you should probably add yourself to it. You +do this with the `add' command. It takes as argument the name of a +principal. The principal should contain a realm, so if you haven't setup +a default realm, you will need to explicitly include the realm. + + # kadmin -l + kadmin> init MY.REALM + Realm max ticket life [unlimited]: + Realm max renewable ticket life [unlimited]: + kadmin> add me + Max ticket life [unlimited]: + Max renewable life [unlimited]: + Attributes []: + Password: + Verifying password - Password: + +Now start the KDC and try getting a ticket. + + # kdc & + # kinit me + me@MY.REALMS's Password: + # klist + Credentials cache: /tmp/krb5cc_0 + Principal: me@MY.REALM + + Issued Expires Principal + Aug 25 07:25:55 Aug 25 17:25:55 krbtgt/MY.REALM@MY.REALM + +If you are curious you can use the `dump' command to list all the +entries in the database. It should look something similar to the +following example (note that the entries here are truncated for +typographical reasons): + + kadmin> dump + me@MY.REALM 1:0:1:0b01d3cb7c293b57:-:0:7:8aec316b9d1629e3baf8 ... + kadmin/admin@MY.REALM 1:0:1:e5c8a2675b37a443:-:0:7:cb913ebf85 ... + krbtgt/MY.REALM@MY.REALM 1:0:1:52b53b61c875ce16:-:0:7:c8943be ... + kadmin/changepw@MY.REALM 1:0:1:f48c8af2b340e9fb:-:0:7:e3e6088 ... + + +File: heimdal.info, Node: keytabs, Next: Serving Kerberos 4/524/kaserver, Prev: Creating the database, Up: Setting up a realm + +keytabs +======= + +To extract a service ticket from the database and put it in a keytab you +need to first create the principal in the database with `ank' (using +the `--random-key' flag to get a random key) and then extract it with +`ext_keytab'. + + kadmin> add --random-key host/my.host.name + Max ticket life [unlimited]: + Max renewable life [unlimited]: + Attributes []: + kadmin> ext host/my.host.name + # ktutil list + Version Type Principal + 1 des-cbc-md5 host/my.host.name@MY.REALM + 1 des-cbc-md4 host/my.host.name@MY.REALM + 1 des-cbc-crc host/my.host.name@MY.REALM + 1 des3-cbc-sha1 host/my.host.name@MY.REALM + + +File: heimdal.info, Node: Serving Kerberos 4/524/kaserver, Next: Remote administration, Prev: keytabs, Up: Setting up a realm + +Serving Kerberos 4/524/kaserver +=============================== + +Heimdal can be configured to support 524, Kerberos 4 or kaserver. All +theses services are default turned off. Kerberos 4 support also depends +on if Kerberos 4 support is compiled in with heimdal. + +524 +--- + +524 is a service that allows the kdc to convert Kerberos 5 tickets to +Kerberos 4 tickets for backward compatibility. See also Using 2b tokens +with AFS in *Note Things in search for a better place::. + +524 can be turned on by adding this to the configuration file + + [kdc] + enable-524 = yes + +Kerberos 4 +---------- + +Kerberos 4 is the predecessor to to Kerberos 5. It only support single +DES. You should only enable Kerberos 4 support if you have a need for +for compatibility with an installed base of Kerberos 4 clients/servers. + +Kerberos 4 can be turned on by adding this to the configuration file + + [kdc] + enable-kerberos4 = yes + +kaserver +-------- + +Kaserver is a Kerberos 4 that is used in AFS, the protocol have some +features over plain Kerberos 4, but like kerberos 4 only use single DES +too. + +You should only enable Kerberos 4 support if you have a need for for +compatibility with an installed base of AFS machines. + +Kaserver can be turned on by adding this to the configuration file + + [kdc] + enable-kaserver = yes + + +File: heimdal.info, Node: Remote administration, Next: Password changing, Prev: Serving Kerberos 4/524/kaserver, Up: Setting up a realm + +Remote administration +===================== + +The administration server, `kadmind', can be started by `inetd' (which +isn't recommended) or run as a normal daemon. If you want to start it +from `inetd' you should add a line similar to the one below to your +`/etc/inetd.conf'. + + kerberos-adm stream tcp nowait root /usr/heimdal/libexec/kadmind kadmind + +You might need to add `kerberos-adm' to your `/etc/services' as 749/tcp. + +Access to the admin server is controlled by an acl-file, (default +`/var/heimdal/kadmind.acl'.) The lines in the access file, has the +following syntax: + principal [priv1,priv2,...] [glob-pattern] + +The matching is from top to bottom for matching principal (and if given, +glob-pattern). When there is a match, the rights of that lines are +used. + +The privileges you can assign to a principal are: `add', +`change-password' (or `cpw' for short), `delete', `get', `list', and +`modify', or the special privilege `all'. All of these roughly +corresponds to the different commands in `kadmin'. + +If a GLOB-PATTERN is given on a line, it restricts the right for the +principal to only apply for the subjects that match the pattern. The +patters are of the same type as those used in shell globbing, see +<none,,fnmatch(3)>. + +In the example below `lha/admin' can change every principal in the +database. `jimmy/admin' can only modify principals that belong to the +realm `E.KTH.SE'. `mille/admin' is working at the helpdesk, so he +should only be able to change the passwords for single component +principals (ordinary users). He will not be able to change any `/admin' +principal. + + lha/admin@E.KTH.SE all + jimmy/admin@E.KTH.SE all *@E.KTH.SE + jimmy/admin@E.KTH.SE all */*@E.KTH.SE + mille/admin@E.KTH.SE change-password *@E.KTH.SE + + +File: heimdal.info, Node: Password changing, Next: Testing clients and servers, Prev: Remote administration, Up: Setting up a realm + +Password changing +================= + +To allow users to change their passwords, you should run `kpasswdd'. +It is not run from `inetd'. + +You might need to add `kpasswd' to your `/etc/services' as 464/udp. + +Password quality assurance +-------------------------- + +It is important that users have good passwords, both to make it harder +to guess them and to avoid off-line attacks (pre-authentication provides +some defense against off-line attacks). To ensure that the users choose +good passwords, you can enable password quality controls in `kpasswdd'. +The controls themselves are done in a shared library that is used by +`kpasswdd'. To configure in these controls, add lines similar to the +following to your `/etc/krb5.conf': + + [password_quality] + check_library = LIBRARY + check_function = FUNCTION + +The function FUNCTION in the shared library LIBRARY will be called for +proposed new passwords. The function should be declared as: + + const char * + function(krb5_context context, krb5_principal principal, krb5_data *pwd); + +The function should verify that PWD is a good password for PRINCIPAL +and if so return `NULL'. If it is deemed to be of low quality, it +should return a string explaining why that password should not be used. + +Code for a password quality checking function that uses the cracklib +library can be found in `lib/kadm5/sample_password_check.c' in the +source code distribution. It requires the cracklib library built with +the patch available at +<ftp://ftp.pdc.kth.se/pub/krb/src/cracklib.patch>. + +If no password quality checking function is configured, it is only +verified that it is at least six characters of length. + + +File: heimdal.info, Node: Testing clients and servers, Next: Slave Servers, Prev: Password changing, Up: Setting up a realm + +Testing clients and servers +=========================== + +Now you should be able to run all the clients and servers. Refer to the +appropriate man pages for information on how to use them. + + +File: heimdal.info, Node: Slave Servers, Next: Incremental propagation, Prev: Testing clients and servers, Up: Setting up a realm + +Slave servers, Incremental propagation, Testing clients and servers, Setting up a realm +======================================================================================= + +It is desirable to have at least one backup (slave) server in case the +master server fails. It is possible to have any number of such slave +servers but more than three usually doesn't buy much more redundancy. + +All Kerberos servers for a realm shall have the same database so that +they present the same service to all the users. The `hprop' program, +running on the master, will propagate the database to the slaves, +running `hpropd' processes. + +Every slave needs a keytab with a principal, `hprop/HOSTNAME'. Add +that with the `ktutil' command and start `propd', as follows: + + slave# ktutil get -p foo/admin hprop/`hostname` + slave# hpropd + +The master will use the principal `kadmin/hprop' to authenticate to the +slaves. This principal should be added when running `kadmin -l init' +but if you do not have it in your database for whatever reason, please +add it with `kadmin -l add'. + +Then run `hprop' on the master: + + master# hprop slave + +This was just an on-hands example to make sure that everything was +working properly. Doing it manually is of course the wrong way and to +automate this you will want to start `hpropd' from `inetd' on the +slave(s) and regularly run `hprop' on the master to regularly propagate +the database. Starting the propagation once an hour from `cron' is +probably a good idea. + + +File: heimdal.info, Node: Incremental propagation, Next: Salting, Prev: Slave Servers, Up: Setting up a realm + +Incremental propagation +======================= + +There is also a newer and still somewhat experimental mechanism for +doing incremental propagation in Heimdal. Instead of sending the whole +database regularly, it sends the changes as they happen on the master to +the slaves. The master keeps track of all the changes by assigned a +version number to every change to the database. The slaves know which +was the latest version they saw and in this way it can be determined if +they are in sync or not. A log of all the changes is kept on the master +and when a slave is at an older versioner than the oldest one in the +log, the whole database has to be sent. + +Protocol-wise, all the slaves connects to the master and as a greeting +tell it the latest version that they have (`IHAVE' message). The +master then responds by sending all the changes between that version and +the current version at the master (a series of `FORYOU' messages) or +the whole database in a `TELLYOUEVERYTHING' message. + +Configuring incremental propagation +----------------------------------- + +The program that runs on the master is `ipropd-master' and all clients +run `ipropd-slave'. + +Create the file `/var/heimdal/slaves' on the master containing all the +slaves that the database should be propagated to. Each line contains +the full name of the principal (for example +`iprop/hemligare.foo.se@FOO.SE'). + +You should already have `iprop/tcp' defined as 2121, in your +`/etc/services'. Otherwise, or if you need to use a different port for +some peculiar reason, you can use the `--port' option. This is useful +when you have multiple realms to distribute from one server. + +Then you need to create these principals that you added in the +configuration file. Create one `iprop/hostname' for the master and for +every slave. + + master# /usr/heimdal/sbin/ktutil get iprop/`hostname` + +The next step is to start the `ipropd-master' process on the master +server. The `ipropd-master' listens on the UNIX-socket +`/var/heimdal/signal' to know when changes have been made to the +database so they can be propagated to the slaves. There is also a +safety feature of testing the version number regularly (every 30 +seconds) to see if it has been modified by some means that do not raise +this signal. Then, start `ipropd-slave' on all the slaves: + + master# /usr/heimdal/libexec/ipropd-master & + slave# /usr/heimdal/libexec/ipropd-slave master & + + +File: heimdal.info, Node: Salting, Prev: Incremental propagation, Up: Setting up a realm + +Salting +======= + +Salting is used to make it harder to precalculate all possible keys. +Using a salt increases the search space to make it almost impossible to +precalculate all keys. Salting is the process of mixing a public string +(the salt) with the password, then sending it through an +encryption-type specific string-to-key function that will output the +fixed size encryption key. + +In Kerberos 5 the salt is determined by the encryption-type, except in +some special cases. + +In `des' there is the Kerberos 4 salt (none at all) or the afs-salt +(using the cell (realm in afs-lingo)). + +In `arcfour' (the encryption type that Microsoft Windows 2000 uses) +there is no salt. This is to be compatible with NTLM keys in Windows NT +4. + +`[kadmin]default_keys' in `krb5.conf' controls what salting to use, + +The syntax of `[kadmin]default_keys' is +`[etype:]salt-type[:salt-string]'. `etype' is the encryption type (des, +des3, arcfour), `salt-type' is the type of salt (pw-salt or afs3-salt), +and the salt-string is the string that will be used as salt (remember +that if the salt is appened/prepended, the empty salt "" is the same +thing as no salt at all). + +Common types of salting includes + + * `v4' (or `des:pw-salt:') + + The Kerberos 4 salting is using no salt att all. Reason there is + colon that the end or the salt string is that it makes the salt + the empty string (same as no salt). + + * `v5' (or `pw-salt') + + `pw-salt' means all regular encryption-types that is regular + + * `afs3-salt' + + `afs3-salt' is the salting that is used with Transarc kaserver. Its + the cell appended to the password. + + + +File: heimdal.info, Node: Things in search for a better place, Next: Kerberos 4 issues, Prev: Setting up a realm, Up: Top + +Things in search for a better place +*********************************** + +Making things work on Ciscos +============================ + +Modern versions of Cisco IOS has some support for authenticating via +Kerberos 5. This can be used both by having the router get a ticket when +you login (boring), and by using Kerberos authenticated telnet to access +your router (less boring). The following has been tested on IOS +11.2(12), things might be different with other versions. Old versions +are known to have bugs. + +To make this work, you will first have to configure your router to use +Kerberos (this is explained in the documentation). A sample +configuration looks like the following: + + aaa new-model + aaa authentication login default krb5-telnet krb5 enable + aaa authorization exec krb5-instance + kerberos local-realm FOO.SE + kerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 + kerberos server FOO.SE 10.0.0.1 + kerberos instance map admin 15 + +This tells you (among other things) that when logging in, the router +should try to authenticate with kerberised telnet, and if that fails try +to verify a plain text password via a Kerberos ticket exchange (as +opposed to a local database, RADIUS or something similar), and if that +fails try the local enable password. If you're not careful when you +specify the `login default' authentication mechanism, you might not be +able to login at all. The `instance map' and `authorization exec' lines +says that people with `admin' instances should be given `enabled' shells +when logging in. + +The numbers after the principal on the `srvtab' line are principal type, +time stamp (in seconds since 1970), key version number (4), keytype (1 +== des), key length (always 8 with des), and then the key. + +To make the Heimdal KDC produce tickets that the Cisco can decode you +might have to turn on the `encode_as_rep_as_tgs_rep' flag in the KDC. +You will also have to specify that the router can't handle anything but +`des-cbc-crc'. This can be done with the `del_enctype' command of +`kadmin'. + +This all fine and so, but unless you have an IOS version with encryption +(available only in the U.S) it doesn't really solve any problems. Sure +you don't have to send your password over the wire, but since the telnet +connection isn't protected it's still possible for someone to steal your +session. This won't be fixed until someone adds integrity to the telnet +protocol. + +A working solution would be to hook up a machine with a real operating +system to the console of the Cisco and then use it as a backwards +terminal server. + +Making things work on Transarc/OpenAFS AFS +========================================== + +How to get a KeyFile +-------------------- + +`ktutil -k AFSKEYFILE:KeyFile get afs@MY.REALM' + +or you can extract it with kadmin + + kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@My.CELL.NAME + +You have to make sure you have a `des-cbc-md5' encryption type since +that is the key that will be converted. + +How to convert a srvtab to a KeyFile +------------------------------------ + +You need a `/usr/vice/etc/ThisCell' containing the cellname of you +AFS-cell. + +`ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile'. + +If keyfile already exists, this will add the new key in afs-srvtab to +KeyFile. + +Using 2b tokens with AFS +======================== + +What is 2b ? +------------ + +2b is the name of the proposal that was implemented to give basic +Kerberos 5 support to AFS in rxkad. Its not real Kerberos 5 support +since it still uses fcrypt for data encryption and not Kerberos +encryption types. + +Its only possible (in all cases) to do this for DES encryption types +because only then the token (the AFS equivalent of a ticket) will be be +smaller than the maximum size that can fit in the token cache in +OpenAFS/Transarc client. Its so tight fit that some extra wrapping on +the ASN1/DER encoding is removed from the Kerberos ticket. + +2b uses a Kerberos 5 EncTicketPart instead of a Kerberos 4 ditto for +the part of the ticket that is encrypted with the service's key. The +client doesn't know what's inside the encrypted data so to the client +it doesn't matter. + +To differentiate between Kerberos 4 tickets and Kerberos 5 tickets 2b +uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens. + +Its a requirement that all AFS servers that support 2b also support +native Kerberos 5 in rxkad. + +Configuring Heimdal to use 2b tokens +------------------------------------ + +Support for 2b tokens are turned on for specific principals by adding +them to the string list option `[kdc]use_2b' in the kdc's `krb5.conf' +file. + + [kdc] + use_2b = { + afs@SU.SE = yes + afs/it.su.se@SU.SE = yes + } + +Configuring AFS clients +----------------------- + +There is no need to configure AFS clients. The only software that needs +to be installed/upgrade is a Kerberos 5 enabled `afslog'. + + +File: heimdal.info, Node: Kerberos 4 issues, Next: Windows 2000 compatability, Prev: Things in search for a better place, Up: Top + +Kerberos 4 issues +***************** + +If compiled with version 4 support, the KDC can serve requests from a +Kerberos 4 client. There are a few things you must do for this to work. + +The KDC will also have kaserver emulation and be able to handle +AFS-clients that use `klog'. + +* Menu: + +* Principal conversion issues:: +* Converting a version 4 database:: +* kaserver:: + + +File: heimdal.info, Node: Principal conversion issues, Next: Converting a version 4 database, Prev: Kerberos 4 issues, Up: Kerberos 4 issues + +Principal conversion issues +=========================== + +First, Kerberos 4 and Kerberos 5 principals are different. A version 4 +principal consists of a name, an instance, and a realm. A version 5 +principal has one or more components, and a realm (the terms "name" and +"instance" are still used, for the first and second component, +respectively). Also, in some cases the name of a version 4 principal +differs from the first component of the corresponding version 5 +principal. One notable example is the "host" type principals, where the +version 4 name is `rcmd' (for "remote command"), and the version 5 name +is `host'. For the class of principals that has a hostname as instance, +there is an other major difference, Kerberos 4 uses only the first +component of the hostname, whereas Kerberos 5 uses the fully qualified +hostname. + +Because of this it can be hard or impossible to correctly convert a +version 4 principal to a version 5 principal (1). The biggest problem is +to know if the conversion resulted in a valid principal. To give an +example, suppose you want to convert the principal `rcmd.foo'. + +The `rcmd' name suggests that the instance is a hostname (even if there +are exceptions to this rule). To correctly convert the instance `foo' +to a hostname, you have to know which host it is referring to. You can +to this by either guessing (from the realm) which domain name to +append, or you have to have a list of possible hostnames. In the +simplest cases you can cover most principals with the first rule. If you +have several domains sharing a single realm this will not usually work. +If the exceptions are few you can probably come by with a lookup table +for the exceptions. + +In a complex scenario you will need some kind of host lookup mechanism. +Using DNS for this is tempting, but DNS is error prone, slow and unsafe +(2). + +Fortunately, the KDC has a trump on hand: it can easily tell if a +principal exists in the database. The KDC will use +`krb5_425_conv_principal_ext' to convert principals when handling to +version 4 requests. + +---------- Footnotes ---------- + +(1) the other way is not always trivial either, but usually easier + +(2) at least until secure DNS is commonly available + + +File: heimdal.info, Node: Converting a version 4 database, Next: kaserver, Prev: Principal conversion issues, Up: Kerberos 4 issues + +Converting a version 4 database +=============================== + +If you want to convert an existing version 4 database, the principal +conversion issue arises too. + +If you decide to convert your database once and for all, you will only +have to do this conversion once. It is also possible to run a version 5 +KDC as a slave to a version 4 KDC. In this case this conversion will +happen every time the database is propagated. When doing this +conversion, there are a few things to look out for. If you have stale +entries in the database, these entries will not be converted. This might +be because these principals are not used anymore, or it might be just +because the principal couldn't be converted. + +You might also see problems with a many-to-one mapping of principals. +For instance, if you are using DNS lookups and you have two principals +`rcmd.foo' and `rcmd.bar', where `foo' is a CNAME for `bar', the +resulting principals will be the same. Since the conversion function +can't tell which is correct, these conflicts will have to be resolved +manually. + +Conversion example +------------------ + +Given the following set of hosts and services: + + foo.se rcmd + mail.foo.se rcmd, pop + ftp.bar.se rcmd, ftp + +you have a database that consists of the following principals: + +`rcmd.foo', `rcmd.mail', `pop.mail', `rcmd.ftp', and `ftp.ftp'. + +lets say you also got these extra principals: `rcmd.gone', +`rcmd.old-mail', where `gone.foo.se' was a machine that has now passed +away, and `old-mail.foo.se' was an old mail machine that is now a CNAME +for `mail.foo.se'. + +When you convert this database you want the following conversions to be +done: + rcmd.foo host/foo.se + rcmd.mail host/mail.foo.se + pop.mail pop/mail.foo.se + rcmd.ftp host/ftp.bar.se + ftp.ftp ftp/ftp.bar.se + rcmd.gone removed + rcmd.old-mail removed + +A `krb5.conf' that does this looks like: + + [realms] + FOO.SE = { + v4_name_convert = { + host = { + ftp = ftp + pop = pop + rcmd = host + } + } + v4_instance_convert = { + foo = foo.se + ftp = ftp.bar.se + } + default_domain = foo.se + } + +The `v4_name_convert' section says which names should be considered +having an instance consisting of a hostname, and it also says how the +names should be converted (for instance `rcmd' should be converted to +`host'). The `v4_instance_convert' section says how a hostname should +be qualified (this is just a hosts-file in disguise). Host-instances +that aren't covered by `v4_instance_convert' are qualified by appending +the contents of the `default_domain'. + +Actually, this example doesn't work. Or rather, it works to well. Since +it has no way of knowing which hostnames are valid and which are not, it +will happily convert `rcmd.gone' to `host/gone.foo.se'. This isn't a +big problem, but if you have run your kerberos realm for a few years, +chances are big that you have quite a few `junk' principals. + +If you don't want this you can remove the `default_domain' statement, +but then you will have to add entries for _all_ your hosts in the +`v4_instance_convert' section. + +Instead of doing this you can use DNS to convert instances. This is not +a solution without problems, but it is probably easier than adding lots +of static host entries. + +To enable DNS lookup you should turn on `v4_instance_resolve' in the +`[libdefaults]' section. + +Converting a database +--------------------- + +The database conversion is done with `hprop'. You can run this command +to propagate the database to the machine called `slave-server' (which +should be running a `hpropd'). + + hprop --source=krb4-db --master-key=/.m slave-server + +This command can also be to use for converting the v4 database on the +server: + + hprop -n --source=krb4-db -d /var/kerberos/principal --master-key=/.m | hpropd -n + +Version 4 Kadmin +================ + +`kadmind' can act as a version 4 kadmind, and you can do most +operations, but with some restrictions (since the version 4 kadmin +protocol is, lets say, very ad hoc.) One example is that it only passes +des keys when creating principals and changing passwords (modern kpasswd +clients do send the password, so it's possible to to password quality +checks). Because of this you can only create principals with des keys, +and you can't set any flags or do any other fancy stuff. + +To get this to work, you have to add another entry to inetd (since +version 4 uses port 751, not 749). + +_And then there are a many more things you can do; more on this in a +later version of this manual. Until then, UTSL._ + + +File: heimdal.info, Node: kaserver, Prev: Converting a version 4 database, Up: Kerberos 4 issues + +kaserver +======== + +kaserver emulation +------------------ + +The Heimdal kdc can emulate a kaserver. The kaserver is a Kerberos 4 +server with pre-authentication using Rx as the on-wire protocol. The kdc +contains a minimalistic Rx implementation. + +There are three parts of the kaserver; KAA (Authentication), KAT (Ticket +Granting), and KAM (Maintenance). The KAA interface and KAT interface +both passes over DES encrypted data-blobs (just like the +Kerberos-protocol) and thus do not need any other protection. The KAM +interface uses `rxkad' (Kerberos authentication layer for Rx) for +security and data protection, and is used for example for changing +passwords. This part is not implemented in the kdc. + +Another difference between the ka-protocol and the Kerberos 4 protocol +is that the pass-phrase is salted with the cellname in the `string to +key' function in the ka-protocol, while in the Kerberos 4 protocol there +is no salting of the password at all. To make sure AFS-compatible keys +are added to each principals when they are created or their password are +changed, `afs3-salt' should be added to `[kadmin]default_keys'. + +Transarc AFS Windows client +--------------------------- + +The Transarc Windows client uses Kerberos 4 to obtain tokens, and thus +does not need a kaserver. The Windows client assumes that the Kerberos +server is on the same machine as the AFS-database server. If you do not +like to do that you can add a small program that runs on the database +servers that forward all kerberos requests to the real kerberos server. +A program that does this is `krb-forward' +(<ftp://ftp.stacken.kth.se/pub/projekts/krb-forward>). + + +File: heimdal.info, Node: Windows 2000 compatability, Next: Programming with Kerberos, Prev: Kerberos 4 issues, Up: Top + +Windows 2000 compatability +************************** + +Windows 2000 (formerly known as Windows NT 5) from Microsoft implements +Kerberos 5. Their implementation, however, has some quirks, +peculiarities, and bugs. This chapter is a short summary of the things +that we have found out while trying to test Heimdal against Windows +2000. Another big problem with the Kerberos implementation in Windows +2000 is that the available documentation is more focused on getting +things to work rather than how they work and not that useful in figuring +out how things really work. + +This information should apply to Heimdal 0.3a and Windows 2000 +Professional. It's of course subject all the time and mostly consists +of our not so inspired guesses. Hopefully it's still somewhat useful. + +* Menu: + +* Configuring Windows 2000 to use a Heimdal KDC:: +* Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC:: +* Create account mappings:: +* Encryption types:: +* Authorization data:: +* Quirks of Windows 2000 KDC:: +* Useful links when reading about the Windows 2000:: + + +File: heimdal.info, Node: Configuring Windows 2000 to use a Heimdal KDC, Next: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Prev: Windows 2000 compatability, Up: Windows 2000 compatability + +Configuring Windows 2000 to use a Heimdal KDC +============================================= + +You need the command line program called `ksetup.exe' which is available +in the file `SUPPORT/TOOLS/SUPPORT.CAB' on the Windows 2000 Professional +CD-ROM. This program is used to configure the Kerberos settings on a +Workstation. + +`Ksetup' store the domain information under the registry key: +`HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\Kerberos\Domains'. + +Use the kadmin program in Heimdal to create a host principal in the +Kerberos realm. + + unix% kadmin + kadmin> ank -pw password host/datan.my.domain + +You must configure the Workstation as a member of a workgroup, as +opposed to a member in an NT domain, and specify the KDC server of the +realm as follows: + C:> ksetup /setdomain MY.REALM + C:> ksetup /addkdc MY.REALM kdc.my.domain + +Set the machine password, i.e. create the local keytab: + C:> ksetup /setmachpassword password + +The workstation must now be rebooted. + +A mapping between local NT users and Kerberos principals must be +specified, you have two choices: + + C:> ksetup /mapuser user@MY.REALM nt_user + +This will map a user to a specific principal, this allows you to have +other usernames in the realm than in your NT user database. (Don't ask +me why on earth you would want that...) + +You can also say: + C:> ksetup /mapuser * * +The Windows machine will now map any user to the corresponding +principal, for example `nisse' to the principal `nisse@MY.REALM'. +(This is most likely what you want.) + diff --git a/kerberosV/src/doc/heimdal.info-2 b/kerberosV/src/doc/heimdal.info-2 new file mode 100644 index 00000000000..413453ada9b --- /dev/null +++ b/kerberosV/src/doc/heimdal.info-2 @@ -0,0 +1,606 @@ +This is heimdal.info, produced by makeinfo version 4.5 from +heimdal.texi. + +INFO-DIR-SECTION Heimdal +START-INFO-DIR-ENTRY +* Heimdal: (heimdal). The Kerberos 5 distribution from KTH +END-INFO-DIR-ENTRY + + +File: heimdal.info, Node: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Next: Create account mappings, Prev: Configuring Windows 2000 to use a Heimdal KDC, Up: Windows 2000 compatability + +Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC +=============================================================== + +See also the Step-by-Step guide from Microsoft, referenced below. + +Install Windows 2000, and create a new controller (Active Directory +Server) for the domain. + +By default the trust will be non-transitive. This means that only users +directly from the trusted domain may authenticate. This can be changed +to transitive by using the `netdom.exe' tool. + +You need to tell Windows 2000 on what hosts to find the KDCs for the +non-Windows realm with `ksetup', see *Note Configuring Windows 2000 to +use a Heimdal KDC::. + +This need to be done on all computers that want enable cross-realm +login with `Mapped Names'. + +Then you need to add the inter-realm keys on the Windows kdc. Start the +Domain Tree Management tool. (Found in Programs, Administrative tools, +Active Directory Domains and Trusts). + +Right click on Properties of your domain, select the Trust tab. Press +Add on the appropriate trust windows and enter domain name and +password. When prompted if this is a non-Windows Kerberos realm, press +OK. + +Do not forget to add trusts in both directions. + +You also need to add the inter-realm keys to the Heimdal KDC. There are +some tweaks that you need to do to `krb5.conf' beforehand. + + [libdefaults] + default_etypes = des-cbc-crc + default_etypes_des = des-cbc-crc + +since otherwise checksum types that are not understood by Windows 2000 +will be generated (*Note Quirks of Windows 2000 KDC::.). + +Another issue is salting. Since Windows 2000 does not seem to +understand Kerberos 4 salted hashes you might need to turn off anything +similar to the following if you have it, at least while adding the +principals that are going to share keys with Windows 2000. + + [kadmin]default_keys = v5 v4 + +You must also set: + +Once that is also done, you can add the required inter-realm keys: + + kadmin add krbtgt/NT.REALM.EXAMPLE.COM@EXAMPLE.COM + kadmin add krbtgt/REALM.EXAMPLE.COM@NT.EXAMPLE.COM + +Use the same passwords for both keys. + +Do not forget to reboot before trying the new realm-trust (after running +`ksetup'). It looks like it might work, but packets are never sent to +the non-Windows KDC. + + +File: heimdal.info, Node: Create account mappings, Next: Encryption types, Prev: Inter-Realm keys (trust) between Windows 2000 and a Heimdal KDC, Up: Windows 2000 compatability + +Create account mappings +======================= + +Start the `Active Directory Users and Computers' tool. Select the View +menu, that is in the left corner just below the real menu (or press +Alt-V), and select Advanced Features. Right click on the user that you +are going to do a name mapping for and choose Name mapping. + +Click on the Kerberos Names tab and add a new principal from the +non-Windows domain. + + +File: heimdal.info, Node: Encryption types, Next: Authorization data, Prev: Create account mappings, Up: Windows 2000 compatability + +Encryption types +================ + +Windows 2000 supports both the standard DES encryptions (des-cbc-crc and +des-cbc-md5) and its own proprietary encryption that is based on MD4 and +rc4 that is documented in and is supposed to be described in +`draft-brezak-win2k-krb-rc4-hmac-03.txt'. New users will get both MD4 +and DES keys. Users that are converted from a NT4 database, will only +have MD4 passwords and will need a password change to get a DES key. + +Heimdal implements both of these encryption types, but since DES is the +standard and the hmac-code is somewhat newer, it is likely to work +better. + + +File: heimdal.info, Node: Authorization data, Next: Quirks of Windows 2000 KDC, Prev: Encryption types, Up: Windows 2000 compatability + +Authorization data +================== + +The Windows 2000 KDC also adds extra authorization data in tickets. It +is at this point unclear what triggers it to do this. The format of +this data is only available under a "secret" license from Microsoft, +which prohibits you implementing it. + +A simple way of getting hold of the data to be able to understand it +better is described here. + + 1. Find the client example on using the SSPI in the SDK documentation. + + 2. Change "AuthSamp" in the source code to lowercase. + + 3. Build the program. + + 4. Add the "authsamp" principal with a known password to the + database. Make sure it has a DES key. + + 5. Run `ktutil add' to add the key for that principal to a keytab. + + 6. Run `appl/test/nt_gss_server -p 2000 -s authsamp --dump-auth=file' + where file is an appropriate file. + + 7. It should authenticate and dump for you the authorization data in + the file. + + 8. The tool `lib/asn1/asn1_print' is somewhat useful for analyzing + the data. + + +File: heimdal.info, Node: Quirks of Windows 2000 KDC, Next: Useful links when reading about the Windows 2000, Prev: Authorization data, Up: Windows 2000 compatability + +Quirks of Windows 2000 KDC +========================== + +There are some issues with salts and Windows 2000. Using an empty salt, +which is the only one that Kerberos 4 supported and is therefore known +as a Kerberos 4 compatible salt does not work, as far as we can tell +from out experiments and users reports. Therefore, you have to make +sure you keep around keys with all the different types of salts that are +required. + +Microsoft seems also to have forgotten to implement the checksum +algorithms `rsa-md4-des' and `rsa-md5-des'. This can make Name mapping +(*note Create account mappings::) fail if a `des-cbc-md5' key is used. +To make the KDC return only `des-cbc-crc' you must delete the +`des-cbc-md5' key from the kdc using the `kadmin del_enctype' command. + + kadmin del_enctype lha des-cbc-md5 + +You should also add the following entries to the `krb5.conf' file: + + [libdefaults] + default_etypes = des-cbc-crc + default_etypes_des = des-cbc-crc + +These configuration options will make sure that no checksums of the +unsupported types are generated. + + +File: heimdal.info, Node: Useful links when reading about the Windows 2000, Prev: Quirks of Windows 2000 KDC, Up: Windows 2000 compatability + +Useful links when reading about the Windows 2000 +================================================ + +See also our paper presented at the 2001 usenix Annual Technical +Conference, available in the proceedings or at +<http://www.usenix.org/publications/library/proceedings/usenix01/freenix01/westerlund.html>. + +There are lots of text about Kerberos on Microsoft's web site, here is a +short list of the interesting documents that we have managed to find. + + * Step-by-Step Guide to Kerberos 5 (krb5 1.0) Interoperability - + <http://www.microsoft.com/windows2000/library/planning/security/kerbsteps.asp> + Kerberos GSS-API (in Windows-ize SSPI), Windows as a client in a + non-Windows KDC realm, adding unix clients to a Windows 2000 KDC, + and adding cross-realm trust (*Note Inter-Realm keys (trust) + between Windows 2000 and a Heimdal KDC::.). + + * Windows 2000 Kerberos Authentication - + <http://www.microsoft.com/TechNet/win2000/win2ksrv/technote/kerberos.asp> + White paper that describes how Kerberos is used in Windows 2000. + + * Overview of kerberos - + <http://support.microsoft.com/support/kb/articles/Q248/7/58.ASP> + Links to useful other links. + + * Klist for windows - + <http://msdn.microsoft.com/library/periodic/period00/security0500.htm> + Describes where to get a klist for Windows 2000. + + * Event logging for kerberos - + <http://support.microsoft.com/support/kb/articles/Q262/1/77.ASP>. + Basicly it say that you can add a registry key + `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\LogLevel' + with value DWORD equal to 1, and then you'll get logging in the + Event Logger. + + * Access to the active directory through LDAP + <http://msdn.microsoft.com/library/techart/kerberossamp.htm> + + +Other useful programs include these: + + * pwdump2 <http://www.webspan.net/~tas/pwdump2/> + + +File: heimdal.info, Node: Programming with Kerberos, Next: Migration, Prev: Windows 2000 compatability, Up: Top + +Programming with Kerberos +************************* + +First you need to know how the Kerberos model works, go read the +introduction text (*note What is Kerberos?::). + +* Menu: + +* Kerberos 5 API Overview:: +* Walkthru a sample Kerberos 5 client:: +* Validating a password in a server application:: + + +File: heimdal.info, Node: Kerberos 5 API Overview, Next: Walkthru a sample Kerberos 5 client, Prev: Programming with Kerberos, Up: Programming with Kerberos + +Kerberos 5 API Overview +======================= + +Most functions are documenteded in manual pages. This overview only +tries to point to where to look for a specific function. + +Kerberos context +---------------- + +A kerberos context (`krb5_context') holds all per thread state. All +global variables that are context specific are stored in this struture, +including default encryption types, credential-cache (ticket file), and +default realms. + +See the manual pages for `krb5_context(3)' and `krb5_init_context(3)'. + +Kerberos authenication context +------------------------------ + +Kerberos authentication context (`krb5_auth_context') holds all context +related to an authenticated connection, in a similar way to the +kerberos context that holds the context for the thread or process. + +The `krb5_auth_context' is used by various functions that are directly +related to authentication between the server/client. Example of data +that this structure contains are various flags, addresses of client and +server, port numbers, keyblocks (and subkeys), sequence numbers, replay +cache, and checksum types. + +See the manual page for `krb5_auth_context(3)'. + +Keytab management +----------------- + +A keytab is a storage for locally stored keys. Heimdal includes keytab +support for Kerberos 5 keytabs, Kerberos 4 srvtab, AFS-KeyFile's, and +for storing keys in memory. + +See also manual page for `krb5_keytab(3)' + + +File: heimdal.info, Node: Walkthru a sample Kerberos 5 client, Next: Validating a password in a server application, Prev: Kerberos 5 API Overview, Up: Programming with Kerberos + +Walkthru a sample Kerberos 5 client +=================================== + +This example contains parts of a sample TCP Kerberos 5 clients, if you +want a real working client, please look in `appl/test' directory in the +Heimdal distribution. + +All Kerberos error-codes that are returned from kerberos functions in +this program are passed to `krb5_err', that will print a descriptive +text of the error code and exit. Graphical programs can convert +error-code to a humal readable error-string with the +`krb5_get_err_text(3)' function. + +Note that you should not use any Kerberos function before +`krb5_init_context()' have completed successfully. That is the reson +`err()' is used when `krb5_init_context()' fails. + +First the client needs to call `krb5_init_context' to initialize the +Kerberos 5 library. This is only needed once per thread in the program. +If the function returns a non-zero value it indicates that either the +Kerberos implemtation is failing or its disabled on this host. + + #include <krb5.h> + + int + main(int argc, char **argv) + { + krb5_context context; + + if (krb5_context(&context)) + errx (1, "krb5_context"); + +Now the client wants to connect to the host at the other end. The +preferred way of doing this is using `getaddrinfo(3)' (for operating +system that have this function implemented), since getaddrinfo is +neutral to the address type and can use any protocol that is available. + + struct addrinfo *ai, *a; + struct addrinfo hints; + int error; + + memset (&hints, 0, sizeof(hints)); + hints.ai_socktype = SOCK_STREAM; + hints.ai_protocol = IPPROTO_TCP; + + error = getaddrinfo (hostname, "pop3", &hints, &ai); + if (error) + errx (1, "%s: %s", hostname, gai_strerror(error)); + + for (a = ai; a != NULL; a = a->ai_next) { + int s; + + s = socket (a->ai_family, a->ai_socktype, a->ai_protocol); + if (s < 0) + continue; + if (connect (s, a->ai_addr, a->ai_addrlen) < 0) { + warn ("connect(%s)", hostname); + close (s); + continue; + } + freeaddrinfo (ai); + ai = NULL; + } + if (ai) { + freeaddrinfo (ai); + errx ("failed to contact %s", hostname); + } + +Before authenticating, an authentication context needs to be created. +This context keeps all information for one (to be) authenticated +connection (see `krb5_auth_context(3)'). + + status = krb5_auth_con_init (context, &auth_context); + if (status) + krb5_err (context, 1, status, "krb5_auth_con_init"); + +For setting the address in the authentication there is a help function +`krb5_auth_con_setaddrs_from_fd' that does everthing that is needed +when given a connected file descriptor to the socket. + + status = krb5_auth_con_setaddrs_from_fd (context, + auth_context, + &sock); + if (status) + krb5_err (context, 1, status, + "krb5_auth_con_setaddrs_from_fd"); + +The next step is to build a server principal for the service we want to +connect to. (See also `krb5_sname_to_principal(3)'.) + + status = krb5_sname_to_principal (context, + hostname, + service, + KRB5_NT_SRV_HST, + &server); + if (status) + krb5_err (context, 1, status, "krb5_sname_to_principal"); + +The client principal is not passed to `krb5_sendauth(3)' function, this +causes the `krb5_sendauth' function to try to figure it out itself. + +The server program is using the function `krb5_recvauth(3)' to receive +the Kerberos 5 authenticator. + +In this case, mutual authenication will be tried. That means that the +server will authenticate to the client. Using mutual authenication is +good since it enables the user to verify that they are talking to the +right server (a server that knows the key). + +If you are using a non-blocking socket you will need to do all work of +`krb5_sendauth' yourself. Basically you need to send over the +authenticator from `krb5_mk_req(3)' and, in case of mutual +authentication, verifying the result from the server with +`krb5_rd_rep(3)'. + + status = krb5_sendauth (context, + &auth_context, + &sock, + VERSION, + NULL, + server, + AP_OPTS_MUTUAL_REQUIRED, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL); + if (status) + krb5_err (context, 1, status, "krb5_sendauth"); + +Once authentication has been performed, it is time to send some data. +First we create a krb5_data structure, then we sign it with +`krb5_mk_safe(3)' using the `auth_context' that contains the +session-key that was exchanged in the +`krb5_sendauth(3)'/`krb5_recvauth(3)' authentication sequence. + + data.data = "hej"; + data.length = 3; + + krb5_data_zero (&packet); + + status = krb5_mk_safe (context, + auth_context, + &data, + &packet, + NULL); + if (status) + krb5_err (context, 1, status, "krb5_mk_safe"); + +And send it over the network. + + len = packet.length; + net_len = htonl(len); + + if (krb5_net_write (context, &sock, &net_len, 4) != 4) + err (1, "krb5_net_write"); + if (krb5_net_write (context, &sock, packet.data, len) != len) + err (1, "krb5_net_write"); + +To send encrypted (and signed) data `krb5_mk_priv(3)' should be used +instead. `krb5_mk_priv(3)' works the same way as `krb5_mk_safe(3)', +with the exception that it encrypts the data in addition to signing it. + + data.data = "hemligt"; + data.length = 7; + + krb5_data_free (&packet); + + status = krb5_mk_priv (context, + auth_context, + &data, + &packet, + NULL); + if (status) + krb5_err (context, 1, status, "krb5_mk_priv"); + +And send it over the network. + + len = packet.length; + net_len = htonl(len); + + if (krb5_net_write (context, &sock, &net_len, 4) != 4) + err (1, "krb5_net_write"); + if (krb5_net_write (context, &sock, packet.data, len) != len) + err (1, "krb5_net_write"); + +The server is using `krb5_rd_safe(3)' and `krb5_rd_priv(3)' to verify +the signature and decrypt the packet. + + +File: heimdal.info, Node: Validating a password in a server application, Prev: Walkthru a sample Kerberos 5 client, Up: Programming with Kerberos + +Validating a password in an application +======================================= + +See the manual page for `krb5_verify_user(3)'. + + +File: heimdal.info, Node: Migration, Next: Acknowledgments, Prev: Programming with Kerberos, Up: Top + +Migration +********* + +General issues +============== + +When migrating from a Kerberos 4 KDC. + +Order in what to do things: +=========================== + + * Convert the database, check all principals that hprop complains + about. + + `hprop -n --source=<NNN>| hpropd -n' + + Replace <NNN> with whatever source you have, like krb4-db or + krb4-dump. + + * Run a Kerberos 5 slave for a while. + + * Figure out if it does everything you want it to. + + Make sure that all things that you use works for you. + + * Let a small number of controlled users use Kerberos 5 tools. + + Find a sample population of your users and check what programs + they use, you can also check the kdc-log to check what ticket are + checked out. + + * Burn the bridge and change the master. + + * Let all users use the Kerberos 5 tools by default. + + * Turn off services that do not need Kerberos 4 authentication. + + Things that might be hard to get away is old programs with support + for Kerberos 4. Example applications are old Eudora installations + using KPOP, and Zephyr. Eudora can use the Kerberos 4 kerberos in + the Heimdal kdc. + + + +File: heimdal.info, Node: Acknowledgments, Prev: Migration, Up: Top + +Acknowledgments +*************** + +Eric Young wrote "libdes". + +The University of California at Berkeley initially wrote `telnet', and +`telnetd'. The authentication and encryption code of `telnet' and +`telnetd' was added by David Borman (then of Cray Research, Inc). The +encryption code was removed when this was exported and then added back +by Juha Eskelinen, <esc@magic.fi>. + +The `popper' was also a Berkeley program initially. + +Some of the functions in `libroken' also come from Berkeley by way of +NetBSD/FreeBSD. + +`editline' was written by Simmule Turner and Rich Salz. + +The `getifaddrs' implementation for Linux was written by Hideaki +YOSHIFUJI for the Usagi project. + +Bugfixes, documentation, encouragement, and code has been contributed +by: +Derrick J Brashear + <shadow@dementia.org> + +Ken Hornstein + <kenh@cmf.nrl.navy.mil> + +Johan Ihrén + <johani@pdc.kth.se> + +Love Hörnquist-Åstrand + <lha@stacken.kth.se> + +Magnus Ahltorp + <map@stacken.kth.se> + +Mark Eichin + <eichin@cygnus.com> + +Marc Horowitz + <marc@cygnus.com> + +Luke Howard + <lukeh@xedoc.com.au> + +Brandon S. Allbery KF8NH + <allbery@kf8nh.apk.net> + +Jun-ichiro itojun Hagino + <itojun@kame.net> + +Daniel Kouril + <kouril@informatics.muni.cz> + +Åke Sandgren + <ake@cs.umu.se> + +Michal Vocu + <michal@karlin.mff.cuni.cz> + +Miroslav Ruda + <ruda@ics.muni.cz> + +Brian A May + <bmay@snoopy.apana.org.au> + +Chaskiel M Grundman + <cg2v@andrew.cmu.edu> + +Richard Nyberg + <rnyberg@it.su.se> + +Frank van der Linden + <fvdl@netbsd.org> + +Cizzi Storm + <cizzi@it.su.se> + +and we hope that those not mentioned here will forgive us. + +All bugs were introduced by ourselves. + + diff --git a/kerberosV/src/doc/install.texi b/kerberosV/src/doc/install.texi index 4bd64bf064c..d886298d764 100644 --- a/kerberosV/src/doc/install.texi +++ b/kerberosV/src/doc/install.texi @@ -1,4 +1,4 @@ -@c $KTH: install.texi,v 1.17 2001/07/02 18:06:02 joda Exp $ +@c $KTH: install.texi,v 1.18 2002/09/04 03:18:48 assar Exp $ @node Building and Installing, Setting up a realm, What is Kerberos?, Top @comment node-name, next, previous, up @@ -98,4 +98,9 @@ On Irix there are three different ABIs that can be used (@samp{32}, @samp{n32}, or @samp{64}). This option allows you to override the automatic selection. +@item @kbd{--disable-mmap} +Do not use the mmap system call. Normally, configure detects if there +is a working mmap and it is only used if there is one. Only try this +option if it fails to work anyhow. + @end table diff --git a/kerberosV/src/doc/intro.texi b/kerberosV/src/doc/intro.texi index 4fb81f650b8..f4717d085bf 100644 --- a/kerberosV/src/doc/intro.texi +++ b/kerberosV/src/doc/intro.texi @@ -1,4 +1,4 @@ -@c $KTH: intro.texi,v 1.12 2001/01/28 22:11:22 assar Exp $ +@c $KTH: intro.texi,v 1.13 2003/03/15 13:42:16 lha Exp $ @node Introduction, What is Kerberos?, Top, Top @c @node Introduction, What is Kerberos?, Top, Top @@ -93,3 +93,9 @@ There are two mailing lists with talk about Heimdal. @email{heimdal-announce@@sics.se} is a low-volume announcement list, while @email{heimdal-discuss@@sics.se} is for general discussion. Send a message to @email{majordomo@@sics.se} to subscribe. + +@heading Heimdal source code, binaries and the manual + +The source code for heimdal, links to binaries and the manual (this +document) can be found on our web-page at +@url{http://www.pdc.kth.se/heimdal/}. diff --git a/kerberosV/src/doc/misc.texi b/kerberosV/src/doc/misc.texi index e772c4e9855..c53d6ba1f23 100644 --- a/kerberosV/src/doc/misc.texi +++ b/kerberosV/src/doc/misc.texi @@ -1,4 +1,4 @@ -@c $KTH: misc.texi,v 1.6 2001/02/24 05:09:24 assar Exp $ +@c $KTH: misc.texi,v 1.13 2003/03/30 21:30:59 lha Exp $ @node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top @chapter Things in search for a better place @@ -37,7 +37,7 @@ says that people with `admin' instances should be given `enabled' shells when logging in. The numbers after the principal on the `srvtab' line are principal type, -timestamp (in seconds since 1970), key version number (4), keytype (1 == +time stamp (in seconds since 1970), key version number (4), keytype (1 == des), key length (always 8 with des), and then the key. To make the Heimdal KDC produce tickets that the Cisco can decode you @@ -57,8 +57,70 @@ A working solution would be to hook up a machine with a real operating system to the console of the Cisco and then use it as a backwards terminal server. -@section Making things work on Transarc AFS +@section Making things work on Transarc/OpenAFS AFS @subsection How to get a KeyFile @file{ktutil -k AFSKEYFILE:KeyFile get afs@@MY.REALM} + +or you can extract it with kadmin + +@example +kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@@My.CELL.NAME +@end example + +You have to make sure you have a @code{des-cbc-md5} encryption type since that +is the key that will be converted. + +@subsection How to convert a srvtab to a KeyFile + +You need a @file{/usr/vice/etc/ThisCell} containing the cellname of you +AFS-cell. + +@file{ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile}. + +If keyfile already exists, this will add the new key in afs-srvtab to +KeyFile. + +@section Using 2b tokens with AFS + +@subsection What is 2b ? + +2b is the name of the proposal that was implemented to give basic +Kerberos 5 support to AFS in rxkad. Its not real Kerberos 5 support +since it still uses fcrypt for data encryption and not Kerberos +encryption types. + +Its only possible (in all cases) to do this for DES encryption types because +only then the token (the AFS equivalent of a ticket) will be be smaller +than the maximum size that can fit in the token cache in +OpenAFS/Transarc client. Its so tight fit that some extra wrapping on the ASN1/DER encoding is removed from the Kerberos ticket. + +2b uses a Kerberos 5 EncTicketPart instead of a Kerberos 4 ditto for +the part of the ticket that is encrypted with the service's key. The +client doesn't know what's inside the encrypted data so to the client it doesn't matter. + +To differentiate between Kerberos 4 tickets and Kerberos 5 tickets 2b +uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens. + +Its a requirement that all AFS servers that support 2b also support +native Kerberos 5 in rxkad. + +@subsection Configuring Heimdal to use 2b tokens + +Support for 2b tokens are turned on for specific principals by adding +them to the string list option @code{[kdc]use_2b} in the kdc's +@file{krb5.conf} file. + +@example +[kdc] + use_2b = @{ + afs@@SU.SE = yes + afs/it.su.se@@SU.SE = yes + @} +@end example + +@subsection Configuring AFS clients + +There is no need to configure AFS clients. The only software that +needs to be installed/upgrade is a Kerberos 5 enabled @file{afslog}. diff --git a/kerberosV/src/doc/programming.texi b/kerberosV/src/doc/programming.texi index bae9eeb6226..a78788f22e2 100644 --- a/kerberosV/src/doc/programming.texi +++ b/kerberosV/src/doc/programming.texi @@ -1,4 +1,4 @@ -@c $KTH: programming.texi,v 1.2 2001/05/16 22:11:00 assar Exp $ +@c $Id: programming.texi,v 1.1.1.2 2003/05/11 02:14:24 hin Exp $ @node Programming with Kerberos @chapter Programming with Kerberos @@ -45,7 +45,7 @@ replay cache, and checksum types. See the manual page for @manpage{krb5_auth_context,3}. -@subsection Keytab managment +@subsection Keytab management A keytab is a storage for locally stored keys. Heimdal includes keytab support for Kerberos 5 keytabs, Kerberos 4 srvtab, AFS-KeyFile's, diff --git a/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-crypto-03.txt b/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-crypto-03.txt new file mode 100644 index 00000000000..b1bee6fa491 --- /dev/null +++ b/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-crypto-03.txt @@ -0,0 +1,2690 @@ + + + + + + + + + +INTERNET DRAFT K. Raeburn +Kerberos Working Group MIT +Document: draft-ietf-krb-wg-crypto-03.txt February 24, 2003 + expires August 24, 2003 + + Encryption and Checksum Specifications + for Kerberos 5 + +Abstract + + This document describes a framework for defining encryption and + checksum mechanisms for use with the Kerberos protocol [Kerb], + defining an abstraction layer between the Kerberos protocol and + related protocols, and the actual mechanisms themselves. Several + mechanisms are also defined in this document. Some are taken from + RFC 1510, modified in form to fit this new framework, and + occasionally modified in content when the old specification was + incorrect. New mechanisms are presented here as well. This document + does NOT indicate which mechanisms may be considered "required to + implement". + + Comments should be sent to the editor, or to the IETF Kerberos + working group (ietf-krb-wg@anl.gov). + +Status + + This document is an Internet-Draft and is in full conformance with + all provisions of Section 10 of RFC2026 [RFC2026]. Internet-Drafts + are working documents of the Internet Engineering Task Force (IETF), + its areas, and its working groups. Note that other groups may also + distribute working documents as Internet-Drafts. Internet-Drafts are + draft documents valid for a maximum of six months and may be updated, + replaced, or obsoleted by other documents at any time. It is + inappropriate to use Internet-Drafts as reference material or to cite + them other than as "work in progress." + + The list of current Internet-Drafts can be accessed at + http://www.ietf.org/ietf/1id-abstracts.html. + + The list of Internet-Draft Shadow Directories can be accessed at + http://www.ietf.org/shadow.html. + + + + + + + +Raeburn [Page 1] + +INTERNET DRAFT February 2003 + + + Table of Contents + + +Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 +Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 +Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . 2 +Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 +1. Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 +2. Encryption algorithm profile . . . . . . . . . . . . . . . . . . 4 +3. Checksum algorithm profile . . . . . . . . . . . . . . . . . . . 9 +4. Simplified profile for CBC ciphers with key derivation . . . . . 10 +4.1. A key derivation function . . . . . . . . . . . . . . . . . . . 10 +4.2. Simplified profile parameters . . . . . . . . . . . . . . . . . 12 +4.3. Cryptosystem profile based on simplified profile . . . . . . . 14 +4.4. Checksum profiles based on simplified profile . . . . . . . . . 16 +5. Profiles for Kerberos encryption and checksum algorithms . . . . 16 +5.1. Unkeyed checksums . . . . . . . . . . . . . . . . . . . . . . . 16 +5.2. DES-based encryption and checksum types . . . . . . . . . . . . 18 +5.3. Triple-DES based encryption and checksum types . . . . . . . . 28 +6. Use of Kerberos encryption outside this specification . . . . . . 30 +7. Assigned Numbers . . . . . . . . . . . . . . . . . . . . . . . . 31 +8. Implementation Notes . . . . . . . . . . . . . . . . . . . . . . 32 +9. Security Considerations . . . . . . . . . . . . . . . . . . . . . 33 +10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 34 +11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . 35 +12. Editor's address . . . . . . . . . . . . . . . . . . . . . . . . 35 +13. Full Copyright Statement . . . . . . . . . . . . . . . . . . . . 36 +A. Test vectors . . . . . . . . . . . . . . . . . . . . . . . . . . 36 +A.1. n-fold . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 +A.2. mit_des_string_to_key . . . . . . . . . . . . . . . . . . . . . 38 +A.3. DES3 DR and DK . . . . . . . . . . . . . . . . . . . . . . . . 42 +A.4. DES3string_to_key . . . . . . . . . . . . . . . . . . . . . . . 43 +A.5. Modified CRC-32 . . . . . . . . . . . . . . . . . . . . . . . . 44 +B. Significant Changes from RFC 1510 . . . . . . . . . . . . . . . . 44 +Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 +Normative References . . . . . . . . . . . . . . . . . . . . . . . . 46 +Informative References . . . . . . . . . . . . . . . . . . . . . . . 48 + + + + + + + + + + + + + + +Raeburn [Page 2] + +INTERNET DRAFT February 2003 + + +Introduction + + The Kerberos protocols are designed to encrypt messages of arbitrary + sizes, using block encryption ciphers, or less commonly, stream + encryption ciphers. Encryption is used to prove the identities of + the network entities participating in message exchanges. However, + nothing in the Kerberos protocol requires any specific encryption + algorithm be used, as long as certain operations are available in the + algorithm that is used. + + The following sections specify the encryption and checksum mechanisms + currently defined for Kerberos, as well as a framework for defining + future mechanisms. The encoding, chaining, padding and other + requirements for each are described. Test vectors for several + functions are given in appendix A. + +1. Concepts + + Both encryption and checksum mechanisms are defined in terms of + profiles, detailed in later sections. Each specifies a collection of + operations and attributes that must be defined for a mechanism. A + Kerberos encryption or checksum mechanism specification is not + complete if it does not define all of these operations and + attributes. + + An encryption mechanism must provide for confidentiality and + integrity of the original plaintext. (Integrity checking may be + achieved by incorporating a checksum, if the encryption mode does not + provide an integrity check itself.) It must also provide non- + malleability [Bellare98, Dolev91]. Use of a random confounder + prepended to the plaintext is recommended. It should not be possible + to determine if two ciphertexts correspond to the same plaintext, + without knowledge of the key. + + A checksum mechanism [1] must provide proof of the integrity of the + associated message, and must preserve the confidentiality of the + message in case it is not sent in the clear. It should be infeasible + to find two plaintexts which have the same checksum. It is NOT + required that an eavesdropper be unable to determine if two checksums + are for the same message; it is assumed that the messages themselves + will be visible to any such eavesdropper. + + Due to advances in cryptography, it is considered unwise by some + cryptographers to use the same key for multiple purposes. Since keys + are used in performing a number of different functions in Kerberos, + it is desirable to use different keys for each of these purposes, + even though we start with a single long-term or session key. + + + + +Raeburn [Page 3] + +INTERNET DRAFT February 2003 + + + We do this by enumerating the different uses of keys within Kerberos, + and making the "usage number" an input to the encryption or checksum + mechanisms; this enumeration is outside the scope of this document. + Later sections of this document define simplified profile templates + for encryption and checksum mechanisms that use a key derivation + function applied to a CBC mode (or similar) cipher and a checksum or + hash algorithm. + + We distinguish the "base key" specified by other documents from the + "specific key" to be used for a particular instance of encryption or + checksum operations. It is expected but not required that the + specific key will be one or more separate keys derived from the + original protocol key and the key usage number. The specific key + should not be explicitly referenced outside of this document. The + typical language used in other documents should be something like, + "encrypt this octet string using this key and this usage number"; + generation of the specific key and cipher state (described in the + next section) are implicit. The creation of a new cipher-state + object, or the re-use of one from a previous encryption operation, + may also be explicit. + + New protocols defined in terms of the Kerberos encryption and + checksum types should use their own key usage values. Key usages are + unsigned 32 bit integers; zero is not permitted. + + All data is assumed to be in the form of strings of octets or 8-bit + bytes. Environments with other byte sizes will have to emulate this + behavior in order to get correct results. + + Each algorithm is assigned an encryption type (or "etype") or + checksum type number, for algorithm identification within the + Kerberos protocol. The full list of current type number assignments + is given in section 7. + +2. Encryption algorithm profile + + An encryption mechanism profile must define the following attributes + and operations. The operations must be defined as functions in the + mathematical sense: no additional or implicit inputs (such as + Kerberos principal names or message sequence numbers) are permitted. + + protocol key format + This describes what octet string values represent valid keys. For + encryption mechanisms that don't have perfectly dense key spaces, + this will describe the representation used for encoding keys. It + need not describe specific values that are not valid or desirable + for use; such values should be avoid by all key generation + routines. + + + +Raeburn [Page 4] + +INTERNET DRAFT February 2003 + + + specific key structure + This is not a protocol format at all, but a description of the + keying material derived from the chosen key and used to encrypt or + decrypt data or compute or verify a checksum. It may, for + example, be a single key, a set of keys, or a combination of the + original key with additional data. The authors recommend using + one or more keys derived from the original key via one-way + functions. + + required checksum mechanism + This indicates a checksum mechanism that must be available when + this encryption mechanism is used. Since Kerberos has no built in + mechanism for negotiating checksum mechanisms, once an encryption + mechanism has been decided upon, the corresponding checksum + mechanism can simply be used. + + key-generation seed length, K + This is the length of the random bitstring needed to generate a + key with the encryption scheme's random-to-key function (described + below). This must be a fixed value so that various techniques for + producing a random bitstring of a given length may be used with + key generation functions. + + key generation functions + Keys must be generated in a number of cases, from different types + of inputs. All function specifications must indicate how to + generate keys in the proper wire format, and must avoid generation + of keys that significantly compromise the confidentiality of + encrypted data, if the cryptosystem has such. Entropy from each + source should be preserved as much as possible. Many of the + inputs, while unknown, may be at least partly predictable (e.g., a + password string is likely to be entirely in the ASCII subset and + of fairly short length in many environments; a semi-random string + may include timestamps); the benefit of such predictability to an + attacker must be minimized. + + string-to-key (UTF-8 string, UTF-8 string, opaque)->(protocol-key) + This function generates a key from two UTF-8 strings and an + opaque octet string. One of the strings is normally the + principal's pass phrase, but is in general merely a secret + string. The other string is a "salt" string intended to + produce different keys from the same password for different + users or realms. While the strings provided will use UTF-8 + encoding, no specific version of Unicode should be assumed; all + valid UTF-8 strings should be allowed. + + The third argument, the octet string, may be used to pass + mechanism-specific parameters in to this function. Since doing + + + +Raeburn [Page 5] + +INTERNET DRAFT February 2003 + + + so implies knowledge of the specific encryption system, it is + intended that generating non-default parameter values be an + uncommon operation, and that normal Kerberos applications be + able to treat this parameter block as an opaque object supplied + by the KDC or defaulted to some mechanism-specific constant + value. + + This should be a one-way function, so that compromising a + user's key in one realm does not compromise the user's key in + another realm, even if the same password (but a different salt) + is used. + + random-to-key (bitstring[K])->(protocol-key) + This function generates a key from a random bit string of a + specific size. It may be assumed that all the bits of the + input string are equally random, even though the entropy + present in the random source may be limited. + + key-derivation (protocol-key, integer)->(specific-key) + In this function, the integer input is the key usage value as + described above; the usage values must be assumed to be known + to an attacker. The specific-key output value was described in + section 1. + + string-to-key parameter format + This describes the format of the block of data that can be passed + to the string-to-key function above to configure additional + parameters for that function. Along with the mechanism of + encoding parameter values, bounds on the allowed parameters should + also be described to avoid allowing a spoofed KDC to compromise + the user's password. It may be desirable to construct the + encoding such that values weakening the resulting key unacceptably + cannot be encoded, if practical. + + Tighter bounds might be permitted by local security policy, or to + avoid excess resource consumption; if so, recommended defaults for + those bounds should be given in the specification. The + description should also outline possible weaknesses that may be + caused by not applying bounds checks or other validation to a + parameter string received from the network. + + As mentioned above, this should be considered opaque to most + normal applications. + + default string-to-key parameters (octet string) + This default value for the "params" argument to the string-to-key + function is to be used when the application protocol (Kerberos or + otherwise) does not explicitly set the parameter value. As + + + +Raeburn [Page 6] + +INTERNET DRAFT February 2003 + + + indicated above, this parameter block should be treated as an + opaque object in most cases. + + cipher state + This describes any information that can be carried over from one + encryption or decryption operation to the next, for use in + conjunction with a given specific key. For example, a block + cipher used in CBC mode may put an initial vector of one block in + the cipher state. Other encryption modes may track nonces or + other data. + + This state must be non-empty, and must influence encryption so as + to require that messages be decrypted in the same order they were + encrypted, if the cipher state is carried over from one encryption + to the next. Distinguishing out-of-order or missing messages from + corrupted messages is not required; if desired, this can be done + at a higher level by including sequence numbers and not "chaining" + the cipher state between encryption operations. + + The cipher state may not be reused in multiple encryption or + decryption operations; these operations all generate a new cipher + state that may be used for following operations using the same key + and operation. + + The contents of the cipher state must be treated as opaque outside + of encryption system specifications. + + initial cipher state (specific-key, direction)->(state) + This describes the generation of the initial value for the cipher + state if it is not being carried over from a previous encryption + or decryption operation. + + This describes any initial state setup needed before encrypting + arbitrary amounts of data with a given specific key; the specific + key and the direction of operations to be performed (encrypt + versus decrypt) must be the only input needed for this + initialization. + + This state should be treated as opaque in any uses outside of an + encryption algorithm definition. + + IMPLEMENTATION NOTE: [Kerb1510] was vague on whether and to what + degree an application protocol could exercise control over the + initial vector used in DES CBC operations. Some existing + implementations permit the setting of the initial vector. This + new specification does not permit application control of the + cipher state (beyond "initialize" and "carry over from previous + encryption"), since the form and content of the initial cipher + + + +Raeburn [Page 7] + +INTERNET DRAFT February 2003 + + + state can vary between encryption systems, and may not always be a + single block of random data. + + New Kerberos application protocols should not assume that they can + control the initial vector, or that one even exists. However, a + general-purpose implementation may wish to provide the capability, + in case applications explicitly setting it are encountered. + + encrypt (specific-key, state, octet string)->(state, octet string) + This function takes the specific key, cipher state, and a non- + empty plaintext string as input, and generates ciphertext and a + new cipher state as outputs. If the basic encryption algorithm + itself does not provide for integrity protection (as DES in CBC + mode does not do), then some form of MAC or checksum must be + included that can be verified by the receiver. Some random factor + such as a confounder should be included so that an observer cannot + know if two messages contain the same plaintext, even if the + cipher state and specific keys are the same. The exact length of + the plaintext need not be encoded, but if it is not and if padding + is required, the padding must be added at the end of the string so + that the decrypted version may be parsed from the beginning. + + The specification of the encryption function must not only + indicate the precise contents of the output octet string, but also + the output cipher state. The application protocol may carry + forward the output cipher state from one encryption with a given + specific key to another; the effect of this "chaining" must be + defined. [2] + + Assuming correctly-produced values for the specific key and cipher + state, no input octet string may result in an error indication. + + decrypt (specific-key, state, octet string)->(state, octet string) + This function takes the specific key, cipher state, and ciphertext + as inputs, and verifies the integrity of the supplied ciphertext. + If the ciphertext's integrity is intact, this function produces + the plaintext and a new cipher state as outputs; otherwise, an + error indication must be returned, and the data discarded. + + The result of the decryption may be longer than the original + plaintext, for example if the encryption mode adds padding to + reach a multiple of a block size. If this is the case, any extra + octets must be after the decoded plaintext. An application + protocol which needs to know the exact length of the message must + encode a length or recognizable "end of message" marker within the + plaintext. [3] + + As with the encryption function, a correct specification for this + + + +Raeburn [Page 8] + +INTERNET DRAFT February 2003 + + + function must indicate not only the contents of the output octet + string, but also the resulting cipher state. + + pseudo-random (protocol-key, octet-string)->(octet-string) + This pseudo-random function should generate an octet string of + some size that independent of the octet string input. The PRF + output string should be suitable for use in key generation, even + if the octet string input is public. It should not reveal the + input key, even if the output is made public. + + These operations and attributes are all that should be required to + support Kerberos and various proposed preauthentication schemes. + + A document defining a new encryption type should also describe known + weaknesses or attacks, so that its security may be fairly assessed, + and should include test vectors or other validation procedures for + the operations defined. Specific references to information readily + available elsewhere are sufficient. + +3. Checksum algorithm profile + + A checksum mechanism profile must define the following attributes and + operations: + + associated encryption algorithm(s) + This indicates the types of encryption keys this checksum + mechanism can be used with. + + A keyed checksum mechanism may have more than one associated + encryption algorithm if they share the same wire key format, + string-to-key function, and key derivation function. (This + combination means that, for example, a checksum type, key usage + value and password are adequate to get the specific key used to + compute a checksum.) + + An unkeyed checksum mechanism can be used in conjunction with any + encryption type, since the key is ignored, but its use must be + limited to cases where the checksum itself is protected, to avoid + trivial attacks. + + get_mic function + This function generates a MIC token for a given specific key (see + section 2), and message (represented as an octet string), that may + be used to verify the integrity of the associated message. This + function is not required to return the same deterministic result + on every use; it need only generate a token that the verify_mic + routine can check. + + + + +Raeburn [Page 9] + +INTERNET DRAFT February 2003 + + + The output of this function will also dictate the size of the + checksum. + + verify_mic function + Given a specific key, message, and MIC token, this function + ascertains whether the message integrity has been compromised. + For a deterministic get_mic routine, the corresponding verify_mic + may simply generate another checksum and compare them. + + The get_mic and verify_mic operations must be able to handle inputs + of arbitrary length; if any padding is needed, the padding scheme + must be specified as part of these functions. + + These operations and attributes are all that should be required to + support Kerberos and various proposed preauthentication schemes. + + As with encryption mechanism definition documents, documents defining + new checksum mechanisms should indicate validation processes and + known weaknesses. + +4. Simplified profile for CBC ciphers with key derivation + + The profile outlines in sections 2 and 3 describes a large number of + operations that must be defined for encryption and checksum + algorithms to be used with Kerberos. We describe here a simpler + profile from which both encryption and checksum mechanism definitions + can be generated, filling in uses of key derivation in appropriate + places, providing integrity protection, and defining multiple + operations for the cryptosystem profile based on a smaller set of + operations given in the simplified profile. Not all of the existing + cryptosystems for Kerberos fit into this simplified profile, but we + recommend that future cryptosystems use it or something based on it. + [4] + + Not all of the operations in the complete profiles are defined + through this mechanism; several must still be defined for each new + algorithm pair. + +4.1. A key derivation function + + Rather than define some scheme by which a "protocol key" is composed + of a large number of encryption keys, we use keys derived from a base + key to perform cryptographic operations. The base key must be used + only for generating the derived keys, and this derivation must be + non-invertible and entropy-preserving. Given these restrictions, + compromise of one derived key does not compromise the other subkeys. + Attack of the base key is limited, since it is only used for + derivation, and is not exposed to any user data. + + + +Raeburn [Page 10] + +INTERNET DRAFT February 2003 + + + Since the derived key has as much entropy as the base keys (if the + cryptosystem is good), password-derived keys have the full benefit of + all the entropy in the password. + + To generate a derived key from a base key, we generate a pseudorandom + octet string, using an algorithm DR described below, and generate a + key from that octet string using a function dependent on the + encryption algorithm; the input length needed for that function, + which is also dependent on the encryption algorithm, dictates the + length of the string to be generated by the DR algorithm (the value + "k" below). These procedures are based on the key derivation in + [Blumenthal96]. + + Derived Key = DK(Base Key, Well-Known Constant) + + DK(Key, Constant) = random-to-key(DR(Key, Constant)) + + DR(Key, Constant) = k-truncate(E(Key, Constant, + initial-cipher-state)) + + Here DR is the random-octet generation function described below, and + DK is the key-derivation function produced from it. In this + construction, E(Key, Plaintext, CipherState) is a cipher, Constant is + a well-known constant determined by the specific usage of this + function, and k-truncate truncates its argument by taking the first k + bits. Here, k is the key generation seed length needed for the + encryption system. + + The output of the DR function is a string of bits; the actual key is + produced by applying the cryptosystem's random-to-key operation on + this bitstring. + + If the Constant is smaller than the cipher block size of E, then it + must be expanded with n-fold() so it can be encrypted. If the output + of E is shorter than k bits it is fed back into the encryption as + many times as necessary. The construct is as follows (where | + indicates concatentation): + + K1 = E(Key, n-fold(Constant), initial-cipher-state) + K2 = E(Key, K1, initial-cipher-state) + K3 = E(Key, K2, initial-cipher-state) + K4 = ... + + DR(Key, Constant) = k-truncate(K1 | K2 | K3 | K4 ...) + + n-fold is an algorithm which takes m input bits and ``stretches'' + them to form n output bits with equal contribution from each input + bit to the output, as described in [Blumenthal96]: + + + +Raeburn [Page 11] + +INTERNET DRAFT February 2003 + + + We first define a primitive called n-folding, which takes a + variable-length input block and produces a fixed-length output + sequence. The intent is to give each input bit approximately + equal weight in determining the value of each output bit. Note + that whenever we need to treat a string of octets as a number, the + assumed representation is Big-Endian -- Most Significant Byte + first. + + To n-fold a number X, replicate the input value to a length that + is the least common multiple of n and the length of X. Before + each repetition, the input is rotated to the right by 13 bit + positions. The successive n-bit chunks are added together using + 1's-complement addition (that is, with end-around carry) to yield + a n-bit result.... + + + Test vectors for n-fold are supplied in Appendix A. [5] + + In this section, n-fold is always used to produce c bits of output, + where c is the cipher block size of E. + + The size of the Constant must not be larger than c, because reducing + the length of the Constant by n-folding can cause collisions. + + If the size of the Constant is smaller than c, then the Constant must + be n-folded to length c. This string is used as input to E. If the + block size of E is less than the random-to-key input size, then the + output from E is taken as input to a second invocation of E. This + process is repeated until the number of bits accumulated is greater + than or equal to the random-to-key input size. When enough bits have + been computed, the first k are taken as the random data used to + create the key with the algorithm-dependent random-to-key function. + + Since the derived key is the result of one or more encryptions in the + base key, deriving the base key from the derived key is equivalent to + determining the key from a very small number of plaintext/ciphertext + pairs. Thus, this construction is as strong as the cryptosystem + itself. + +4.2. Simplified profile parameters + + These are the operations and attributes that must be defined: + + + + + + + + + +Raeburn [Page 12] + +INTERNET DRAFT February 2003 + + + protocol key format + string-to-key function + default string-to-key parameters + key-generation seed length, k + random-to-key function + As above for the normal encryption mechanism profile. + + unkeyed hash algorithm, H + This should be a collision-resistant hash algorithm with fixed- + size output, suitable for use in an HMAC [HMAC]. It must support + inputs of arbitrary length. Its output must be at least the + message block size (below). + + HMAC output size, h + This indicates the size of the leading substring output by the + HMAC function that should be used in transmitted messages. It + should be at least half the output size of the hash function H, + and at least 80 bits; it need not match the output size. + + message block size, m + This is the size of the smallest units the cipher can handle in + the mode in which it is being used. Messages will be padded to a + multiple of this size. If a block cipher is used in a mode that + can handle messages that are not multiples of the cipher block + size, such as CBC mode with cipher text stealing (CTS, see [RC5]), + this value would be one octet. For traditional CBC mode with + padding, it will be the underlying cipher's block size. + + This value must be a multiple of 8 bits (one octet). + + encryption/decryption functions, E and D + These are basic encryption and decryption functions for messages + of sizes that are multiples of the message block size. No + integrity checking or confounder should be included here. These + functions take as input the IV or similar data, a protocol-format + key, and a octet string, returning a new IV and octet string. + + The encryption function is not required to use CBC mode, but is + assumed to be using something with similar properties. In + particular, prepending a cipher-block-size confounder to the + plaintext should alter the entire ciphertext (comparable to + choosing and including a random initial vector for CBC mode). + + The result of encrypting one cipher block (of size c, above) must + be deterministic, for the random octet generation function DR in + the previous section to work. For best security, it should also + be no larger than c. + + + + +Raeburn [Page 13] + +INTERNET DRAFT February 2003 + + + cipher block size, c + This is the block size of the block cipher underlying the + encryption and decryption functions indicated above, used for key + derivation and for the size of the message confounder and initial + vector. (If a block cipher is not in use, some comparable + parameter should be determined.) It must be at least 5 octets. + + This is not actually an independent parameter; rather, it is a + property of the functions E and D. It is listed here to clarify + the distinction between it and the message block size, m. + + While there are still a number of properties to specify, they are + fewer and simpler than in the full profile. + +4.3. Cryptosystem profile based on simplified profile + + The above key derivation function is used to produce three + intermediate keys. One is used for computing checksums of + unencrypted data. The other two are used for encrypting and + checksumming plaintext to be sent encrypted. + + The ciphertext output is the concatenation of the output of the basic + encryption function E and a (possibly truncated) HMAC using the + specified hash function H, both applied to the plaintext with a + random confounder prefix and sufficient padding to bring it to a + multiple of the message block size. When the HMAC is computed, the + key is used in the protocol key form. + + Decryption is performed by removing the (partial) HMAC, decrypting + the remainder, and verifying the HMAC. The cipher state is an + initial vector, initialized to zero. + + The substring notation "[1..h]" in the following table should be read + as using 1-based indexing; leading substrings are used. + + + cryptosystem from simplified profile +---------------------------------------------------------------------------- +protocol key format As given. + +specific key structure Three protocol-format keys: { Kc, Ke, Ki }. + +key-generation seed As given. +length + +required checksum As defined below in section 4.4. +mechanism + + + + +Raeburn [Page 14] + +INTERNET DRAFT February 2003 + + + cryptosystem from simplified profile +---------------------------------------------------------------------------- + +cipher state initial vector (usually of length c) + +initial cipher state all bits zero + +encryption function conf = random string of length c + pad = shortest string to bring confounder + and plaintext to a length that's a + multiple of m + C1 = E(Ke, conf | plaintext | pad, + oldstate.ivec) + H1 = HMAC(Ki, conf | plaintext | pad) + ciphertext = C1 | H1[1..h] + newstate.ivec = last c of C1 + +decryption function (C1,H1) = ciphertext + P1 = D(Ke, C1, oldstate.ivec) + if (H1 != HMAC(Ki, P1)[1..h]) + report error + newstate.ivec = last c of C1 + +default string-to-key As given. +params + +pseudo-random function tmp1 = H(octet-string) + tmp2 = truncate tmp1 to multiple of m + PRF = E(protocol-key, tmp2, initial-cipher-state) + +key generation functions: + +string-to-key function As given. + +random-to-key function As given. + +key-derivation function The "well-known constant" used for the DK + function is the key usage number, expressed as + four octets in big-endian order, followed by one + octet indicated below. + + Kc = DK(base-key, usage | 0x99); + Ke = DK(base-key, usage | 0xAA); + Ki = DK(base-key, usage | 0x55); + + + + + + + +Raeburn [Page 15] + +INTERNET DRAFT February 2003 + + +4.4. Checksum profiles based on simplified profile + + When an encryption system is defined using the simplified profile + given in section 4.2, a checksum algorithm may be defined for it as + follows: + + + checksum mechanism from simplified profile + -------------------------------------------------- + associated cryptosystem as defined above + + get_mic HMAC(Kc, message)[1..h] + + verify_mic get_mic and compare + + The HMAC function and key Kc are as described in section 4.3. + +5. Profiles for Kerberos encryption and checksum algorithms + + These profiles describe the encryption and checksum systems defined + for Kerberos. The astute reader will notice that some of them do not + fulfull all of the requirements outlined in previous sections. These + systems are defined for backward compatibility; newer implementations + should (whenever possible) attempt to make use of encryption systems + which satisfy all of the profile requirements. + + The full list of current encryption and checksum type number + assignments, including values currently reserved but not defined in + this document, is given in section 7. + +5.1. Unkeyed checksums + + These checksum types use no encryption keys, and thus can be used in + combination with any encryption type, but may only be used with + caution, in limited circumstances where the lack of a key does not + provide a window for an attack, preferably as part of an encrypted + message. [6] Keyed checksum algorithms are recommended. + +5.1.1. The RSA MD5 Checksum + + The RSA-MD5 checksum calculates a checksum using the RSA MD5 + algorithm [MD5-92]. The algorithm takes as input an input message of + arbitrary length and produces as output a 128-bit (16 octet) + + + + + + + + +Raeburn [Page 16] + +INTERNET DRAFT February 2003 + + + checksum. RSA-MD5 is believed to be collision-proof. + + rsa-md5 + ---------------------------------------------- + associated cryptosystem any + + get_mic rsa-md5(msg) + + verify_mic get_mic and compare + + The rsa-md5 checksum algorithm is assigned a checksum type number of + seven (7). + +5.1.2. The RSA MD4 Checksum + + The RSA-MD4 checksum calculates a checksum using the RSA MD4 + algorithm [MD4-92]. The algorithm takes as input an input message of + arbitrary length and produces as output a 128-bit (16 octet) + checksum. RSA-MD4 is believed to be collision-proof. + + + rsa-md4 + ---------------------------------------------- + associated cryptosystem any + + get_mic md4(msg) + + verify_mic get_mic and compare + + + The rsa-md4 checksum algorithm is assigned a checksum type number of + two (2). + +5.1.3. CRC-32 Checksum + + This CRC-32 checksum calculates a checksum based on a cyclic + redundancy check as described in ISO 3309 [CRC], modified as + described below. The resulting checksum is four (4) octets in + length. The CRC-32 is neither keyed nor collision-proof; thus, the + use of this checksum is not recommended. An attacker using a + probabilistic chosen-plaintext attack as described in [SG92] might be + able to generate an alternative message that satisfies the checksum. + + The CRC-32 checksum used in the des-cbc-crc encryption mode is + identical to the 32-bit FCS described in ISO 3309 with two + exceptions: the sum with the all-ones polynomial times x**k is + omitted, and the final remainder is not ones-complemented. ISO 3309 + describes the FCS in terms of bits, while this document describes the + + + +Raeburn [Page 17] + +INTERNET DRAFT February 2003 + + + Kerberos protocol in terms of octets. To disambiguate the ISO 3309 + definition for the purpose of computing the CRC-32 in the des-cbc-crc + encryption mode, the ordering of bits in each octet shall be assumed + to be LSB-first. Given this assumed ordering of bits within an + octet, the mapping of bits to polynomial coefficients shall be + identical to that specified in ISO 3309. + + Test values for this modified CRC function are included in appendix + A.5. + + + crc32 + ---------------------------------------------- + associated cryptosystem any + + get_mic crc32(msg) + + verify_mic get_mic and compare + + + The crc32 checksum algorithm is assigned a checksum type number of + one (1). + +5.2. DES-based encryption and checksum types + + These encryption systems encrypt information under the Data + Encryption Standard [DES77] using the cipher block chaining mode + [DESM80]. A checksum is computed as described below and placed in + the cksum field. DES blocks are 8 bytes. As a result, the data to + be encrypted (the concatenation of confounder, checksum, and message) + must be padded to an 8 byte boundary before encryption. The values + of the padding bytes are unspecified. + + Plaintext and DES ciphertext are encoded as blocks of 8 octets which + are concatenated to make the 64-bit inputs for the DES algorithms. + The first octet supplies the 8 most significant bits (with the + octet's MSB used as the DES input block's MSB, etc.), the second + octet the next 8 bits, ..., and the eighth octet supplies the 8 least + significant bits. + + Encryption under DES using cipher block chaining requires an + additional input in the form of an initialization vector; this vector + is specified for each encryption system, below. + + The DES specifications [DESI81] identify four 'weak' and twelve + 'semi-weak' keys; those keys shall not be used for encrypting + messages for use in Kerberos. + + + + +Raeburn [Page 18] + +INTERNET DRAFT February 2003 + + + A DES key is 8 octets of data. This consists of 56 bits of actual + key data, and 8 parity bits, one per octet. The key is encoded as a + series of 8 octets written in MSB-first order. The bits within the + key are also encoded in MSB order. For example, if the encryption + key is (B1,B2,...,B7,P1,B8,...,B14,P2,B15,...,B49,P7,B50,...,B56,P8) + where B1,B2,...,B56 are the key bits in MSB order, and P1,P2,...,P8 + are the parity bits, the first octet of the key would be + B1,B2,...,B7,P1 (with B1 as the most significant bit). See the + [DESM80] introduction for reference. + + Encryption data format + + The format for the data to be encrypted includes a one-block + confounder, a checksum, the encoded plaintext, and any necessary + padding, as described in the following diagram. The msg-seq field + contains the part of the protocol message which is to be encrypted. + + +-----------+----------+---------+-----+ + |confounder | checksum | msg-seq | pad | + +-----------+----------+---------+-----+ + + One generates a random confounder of one block, placing it in + 'confounder'; zeroes out the 'checksum' field (of length appropriate + to exactly hold the checksum to be computed); calculates the + appropriate checksum over the whole sequence, placing the result in + 'checksum'; adds the necessary padding; then encrypts using the + specified encryption type and the appropriate key. + + String or random-data to key transformation + + To generate a DES key from two UTF-8 text strings (password and + salt), the two strings are concatenated, password first, and the + result is then padded with zero-valued octets to a multiple of 8 + octets. + + The top bit of each octet (always zero if the password is plain + ASCII, as was assumed when the original specification was written) is + discarded, and a bitstring is formed of the remaining seven bits of + each octet. This bitstring is then fan-folded and eXclusive-ORed + with itself to produce a 56-bit string. An eight-octet key is formed + from this string, each octet using seven bits from the bit string, + leaving the least significant bit unassigned. The key is then + "corrected" by correcting the parity on the key, and if the key + matches a 'weak' or 'semi-weak' key as described in the DES + specification, it is eXclusive-ORed with the constant + 0x00000000000000F0. This key is then used to generate a DES CBC + checksum on the initial string with the salt appended. The result of + the CBC checksum is then "corrected" as described above to form the + + + +Raeburn [Page 19] + +INTERNET DRAFT February 2003 + + + result which is returned as the key. + + For purposes of the string-to-key function, the DES CBC checksum is + calculated by CBC encrypting a string using the key as IV and using + the final 8 byte block as the checksum. + + Pseudocode follows: + + removeMSBits(8byteblock) { + /* Treats a 64 bit block as 8 octets and remove the MSB in + each octect (in big endian mode) and concatenates the + result. E.g., input octet string: + 01110000 01100001 11110011 01110011 11110111 01101111 + 11110010 01100100 + results in output bit string: + 1110000 1100001 1110011 1110011 1110111 1101111 + 1110010 1100100 */ + } + + reverse(56bitblock) { + /* Treats a 56-bit block as a binary string and reverse it. + E.g., input string: + 1000001 1010100 1001000 1000101 1001110 1000001 + 0101110 1001101 + results in output string: + 1011001 0111010 1000001 0111001 1010001 0001001 + 0010101 1000001 */ + } + + add_parity_bits(56bitblock) { + /* Copies a 56-bit block into a 64-bit block, left shift + content in each octet and add DES parity bit. + E.g., input string: + 1100000 0001111 0011100 0110100 1000101 1100100 + 0110110 0010111 + results in output string: + 11000001 00011111 00111000 01101000 10001010 11001000 + 01101101 00101111 */ + } + + key_correction(key) { + fixparity(key); + if (is_weak_key(key)) + key = key XOR 0xF0; + return(key); + } + + + + + +Raeburn [Page 20] + +INTERNET DRAFT February 2003 + + + mit_des_string_to_key(string,salt) { + odd = 1; + s = string | salt; + tempstring = 0; /* 56-bit string */ + pad(s); /* with nulls to 8 byte boundary */ + for (8byteblock in s) { + 56bitstring = removeMSBits(8byteblock); + if (odd == 0) reverse(56bitstring); + odd = ! odd; + tempstring = tempstring XOR 56bitstring; + } + tempkey = key_correction(add_parity_bits(tempstring)); + key = key_correction(DES-CBC-check(s,tempkey)); + return(key); + } + + des_string_to_key(string,salt,params) { + if (length(params) == 0) + type = 0; + else if (length(params) == 1) + type = params[0]; + else + error("invalid params"); + if (type == 0) + mit_des_string_to_key(string,salt); + else + error("invalid params"); + } + + One common extension is to support the "AFS string-to-key" algorithm, + which is not defined here, if the type value above is one (1). + + For generation of a key from a random bit-string, we start with a + 56-bit string, and as with the string-to-key operation above, insert + parity bits, and if the result is a weak or semi-weak key, modify it + by exclusive-OR with the constart 0x00000000000000F0: + + des_random_to_key(bitstring) { + return key_correction(add_parity_bits(bitstring)); + } + +5.2.1. DES with MD5 + + The des-cbc-md5 encryption mode encrypts information under DES in CBC + mode with an all-zero initial vector, with an MD5 checksum (described + in [MD5-92]) computed and placed in the checksum field. + + + + + +Raeburn [Page 21] + +INTERNET DRAFT February 2003 + + + The encryption system parameters for des-cbc-md5 are: + + des-cbc-md5 + -------------------------------------------------------------------- + protocol key format 8 bytes, parity in low bit of each + + specific key structure copy of original key + + required checksum rsa-md5-des + mechanism + + key-generation seed 8 bytes + length + + cipher state 8 bytes (CBC initial vector) + + initial cipher state all-zero + + encryption function des-cbc(confounder | checksum | msg | pad, + ivec=oldstate) + where + checksum = md5(confounder | 0000... + | msg | pad) + + newstate = last block of des-cbc output + + decryption function decrypt encrypted text and verify checksum + + newstate = last block of ciphertext + + default string-to-key empty string + params + + pseudo-random function des-cbc(md5(input-string), ivec=0) + + key generation functions: + + string-to-key des_string_to_key + + random-to-key des_random_to_key + + key-derivation identity + + The des-cbc-md5 encryption type is assigned the etype value three + (3). + + + + + + +Raeburn [Page 22] + +INTERNET DRAFT February 2003 + + +5.2.2. DES with MD4 + + The des-cbc-md4 encryption mode also encrypts information under DES + in CBC mode, with an all-zero initial vector. An MD4 checksum + (described in [MD4-92]) is computed and placed in the checksum field. + + des-cbc-md4 + -------------------------------------------------------------------- + protocol key format 8 bytes, parity in low bit of each + + specific key structure copy of original key + + required checksum rsa-md4-des + mechanism + + key-generation seed 8 bytes + length + + cipher state 8 bytes (CBC initial vector) + + initial cipher state all-zero + + encryption function des-cbc(confounder | checksum | msg | pad, + ivec=oldstate) + where + checksum = md4(confounder | 0000... + | msg | pad) + + newstate = last block of des-cbc output + + decryption function decrypt encrypted text and verify checksum + + newstate = last block of ciphertext + + default string-to-key empty string + params + + pseudo-random function des-cbc(md5(input-string), ivec=0) + + key generation functions: + + string-to-key des_string_to_key + + random-to-key copy input, then fix parity bits + + key-derivation identity + + + + + +Raeburn [Page 23] + +INTERNET DRAFT February 2003 + + + Note that des-cbc-md4 uses md5, not md4, in the PRF definition. + + The des-cbc-md4 encryption algorithm is assigned the etype value two + (2). + +5.2.3. DES with CRC + + The des-cbc-crc encryption type uses DES in CBC mode with the key + used as the initialization vector, with a 4-octet CRC-based checksum + computed as described in section 5.1.3. Note that this is not a + standard CRC-32 checksum, but a slightly modified one. + + + des-cbc-crc + -------------------------------------------------------------------- + protocol key format 8 bytes, parity in low bit of each + + specific key structure copy of original key + + required checksum rsa-md5-des + mechanism + + key-generation seed 8 bytes + length + + cipher state 8 bytes (CBC initial vector) + + initial cipher state copy of original key + + encryption function des-cbc(confounder | checksum | msg | pad, + ivec=oldstate) + where + checksum = crc(confounder | 00000000 + | msg | pad) + + newstate = last block of des-cbc output + + decryption function decrypt encrypted text and verify checksum + + newstate = last block of ciphertext + + default string-to-key empty string + params + + pseudo-random function des-cbc(md5(input-string), ivec=0) + + key generation functions: + + + + +Raeburn [Page 24] + +INTERNET DRAFT February 2003 + + + des-cbc-crc + -------------------------------------------------------------------- + + string-to-key des_string_to_key + + random-to-key copy input, then fix parity bits + + key-derivation identity + + The des-cbc-crc encryption algorithm is assigned the etype value one + (1). + +5.2.4. RSA MD5 Cryptographic Checksum Using DES + + The RSA-MD5-DES checksum calculates a keyed collision-proof checksum + by prepending an 8 octet confounder before the text, applying the RSA + MD5 checksum algorithm, and encrypting the confounder and the + checksum using DES in cipher-block-chaining (CBC) mode using a + variant of the key, where the variant is computed by eXclusive-ORing + the key with the hexadecimal constant 0xF0F0F0F0F0F0F0F0. The + initialization vector should be zero. The resulting checksum is 24 + octets long. This checksum is tamper-proof and believed to be + collision-proof. + + The DES specifications identify some 'weak keys' and 'semi-weak + keys'; those keys shall not be used for encrypting RSA-MD5 checksums + for use in Kerberos. + + + rsa-md5-des + ---------------------------------------------------------------- + associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc + + get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0, + conf | rsa-md5(conf | msg)) + + verify_mic decrypt and verify rsa-md5 checksum + + + The rsa-md5-des checksum algorithm is assigned a checksum type number + of eight (8). + +5.2.5. RSA MD4 Cryptographic Checksum Using DES + + The RSA-MD4-DES checksum calculates a keyed collision-proof checksum + by prepending an 8 octet confounder before the text, applying the RSA + MD4 checksum algorithm [MD4-92], and encrypting the confounder and + the checksum using DES in cipher-block-chaining (CBC) mode using a + + + +Raeburn [Page 25] + +INTERNET DRAFT February 2003 + + + variant of the key, where the variant is computed by eXclusive-ORing + the key with the constant 0xF0F0F0F0F0F0F0F0. [7] The initialization + vector should be zero. The resulting checksum is 24 octets long. + This checksum is tamper-proof and believed to be collision-proof. + + The DES specifications identify some "weak keys" and "semi-weak + keys"; those keys shall not be used for generating RSA-MD4 checksums + for use in Kerberos. + + rsa-md4-des + ---------------------------------------------------------------- + associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc + + get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0, + conf | rsa-md4(conf | msg), + ivec=0) + + verify_mic decrypt and verify rsa-md4 checksum + + The rsa-md4-des checksum algorithm is assigned a checksum type number + of three (3). + +5.2.6. RSA MD4 Cryptographic Checksum Using DES alternative + + The RSA-MD4-DES-K checksum calculates a keyed collision-proof + checksum by applying the RSA MD4 checksum algorithm and encrypting + the results using DES in cipher block chaining (CBC) mode using a DES + key as both key and initialization vector. The resulting checksum is + 16 octets long. This checksum is tamper-proof and believed to be + collision-proof. Note that this checksum type is the old method for + encoding the RSA-MD4-DES checksum and it is no longer recommended. + + + rsa-md4-des-k + ---------------------------------------------------------------- + associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc + + get_mic des-cbc(key, md4(msg), ivec=key) + + verify_mic decrypt, compute checksum and compare + + + The rsa-md4-des-k checksum algorithm is assigned a checksum type + number of six (6). + + + + + + + +Raeburn [Page 26] + +INTERNET DRAFT February 2003 + + +5.2.7. DES CBC checksum + + The DES-MAC checksum is computed by prepending an 8 octet confounder + to the plaintext, padding with zero-valued octets if necessary to + bring the length to a multiple of 8 octets, performing a DES CBC-mode + encryption on the result using the key and an initialization vector + of zero, taking the last block of the ciphertext, prepending the same + confounder and encrypting the pair using DES in cipher-block-chaining + (CBC) mode using a variant of the key, where the variant is computed + by eXclusive-ORing the key with the constant 0xF0F0F0F0F0F0F0F0. The + initialization vector should be zero. The resulting checksum is 128 + bits (16 octets) long, 64 bits of which are redundant. This checksum + is tamper-proof and collision-proof. + + + des-mac + ---------------------------------------------------------------------- + associated des-cbc-md5, des-cbc-md4, des-cbc-crc + cryptosystem + + get_mic des-cbc(key XOR 0xF0F0F0F0F0F0F0F0, + conf | des-mac(key, conf | msg | pad, ivec=0), + ivec=0) + + verify_mic decrypt, compute DES MAC using confounder, compare + + + The des-mac checksum algorithm is assigned a checksum type number of + four (4). + +5.2.8. DES CBC checksum alternative + + The DES-MAC-K checksum is computed by performing a DES CBC-mode + encryption of the plaintext, with zero-valued padding bytes if + necessary to bring the length to a multiple of 8 octets, and using + the last block of the ciphertext as the checksum value. It is keyed + with an encryption key which is also used as the initialization + vector. The resulting checksum is 64 bits (8 octets) long. This + checksum is tamper-proof and collision-proof. Note that this + checksum type is the old method for encoding the DESMAC checksum and + it is no longer recommended. + + + + + + + + + + +Raeburn [Page 27] + +INTERNET DRAFT February 2003 + + + des-mac-k + ---------------------------------------------------------------- + associated cryptosystem des-cbc-md5, des-cbc-md4, des-cbc-crc + + get_mic des-mac(key, msg | pad, ivec=key) + + verify_mic compute MAC and compare + + + The des-mac-k checksum algorithm is assigned a checksum type number + of five (5). + +5.3. Triple-DES based encryption and checksum types + + This encryption and checksum type pair is based on the Triple DES + cryptosystem in Outer-CBC mode, and the HMAC-SHA1 message + authentication algorithm. + + A Triple DES key is the concatenation of three DES keys as described + above for des-cbc-md5. A Triple DES key is generated from random + data by creating three DES keys from separate sequences of random + data. + + Encrypted data using this type must be generated as described in + section 4.3. If the length of the input data is not a multiple of + the block size, zero-valued octets must be used to pad the plaintext + to the next eight-octet boundary. The confounder must be eight + random octets (one block). + + The simplified profile for Triple DES, with key derivation as defined + in section 4, is as follows: + + des3-cbc-hmac-sha1-kd, hmac-sha1-des3-kd + ------------------------------------------------ + protocol key format 24 bytes, parity in low + bit of each + + key-generation seed 21 bytes + length + + hash function SHA-1 + + HMAC output size 160 bits + + message block size 8 bytes + + + + + + +Raeburn [Page 28] + +INTERNET DRAFT February 2003 + + + des3-cbc-hmac-sha1-kd, hmac-sha1-des3-kd + ------------------------------------------------ + default string-to-key empty string + params + + encryption and triple-DES encrypt and + decryption functions decrypt, in outer-CBC + mode (cipher block size + 8 octets) + + key generation functions: + + random-to-key DES3random-to-key (see + below) + + string-to-key DES3string-to-key (see + below) + + The des3-cbc-hmac-sha1-kd encryption type is assigned the value + sixteen (16). The hmac-sha1-des3-kd checksum algorithm is assigned a + checksum type number of twelve (12). + +5.3.1. Triple DES Key Production (random-to-key, string-to-key) + + The 168 bits of random key data are converted to a protocol key value + as follows. First, the 168 bits are divided into three groups of 56 + bits, which are expanded individually into 64 bits as follows: + + DES3random-to-key: + 1 2 3 4 5 6 7 p + 9 10 11 12 13 14 15 p + 17 18 19 20 21 22 23 p + 25 26 27 28 29 30 31 p + 33 34 35 36 37 38 39 p + 41 42 43 44 45 46 47 p + 49 50 51 52 53 54 55 p + 56 48 40 32 24 16 8 p + + The "p" bits are parity bits computed over the data bits. The output + of the three expansions are concatenated to form the protocol key + value. + + The string-to-key function is used to transform UTF-8 passwords into + DES3 keys. The DES3 string-to-key function relies on the "N-fold" + algorithm and DK function, described in section 4. + + The n-fold algorithm is applied to the password string concatenated + with a salt value. For 3-key triple DES, the operation will involve + + + +Raeburn [Page 29] + +INTERNET DRAFT February 2003 + + + a 168-fold of the input password string, to generate an intermediate + key, from which the user's long-term key will be derived with the DK + function. The DES3 string-to-key function is shown here in + pseudocode: + + DES3string-to-key(passwordString, salt, params) + if (params != emptyString) + error("invalid params"); + s = passwordString + salt + tmpKey = random-to-key(168-fold(s)) + key = DK (tmpKey, KerberosConstant) + + No weak-key checking is performed. The KerberosConstant value is the + byte string {0x6b 0x65 0x72 0x62 0x65 0x72 0x6f 0x73}. These values + correspond to the ASCII encoding for the string "kerberos". + +6. Use of Kerberos encryption outside this specification + + Several Kerberos-based application protocols and preauthentication + systems have been designed and deployed that perform encryption and + message integrity checks in various ways. While in some cases there + may be good reason for specifying these protocols in terms of + specific encryption or checksum algorithms, we anticipate that in + many cases this will not be true, and more generic approaches + independent of particular algorithms will be desirable. Rather than + having each protocol designer reinvent schemes for protecting data, + using multiple keys, etc, we have attempted to present in this + section a general framework that should be sufficient not only for + the Kerberos protocol itself but also for many preauthentication + systems and application protocols, while trying to avoid some of the + assumptions that can work their way into such protocol designs. + + Some problematic assumptions we've seen (and sometimes made) include: + that a random bitstring is always valid as a key (not true for DES + keys with parity); that the basic block encryption chaining mode + provides no integrity checking, or can easily be separated from such + checking (not true for many modes in development that do both + simultaneously); that a checksum for a message always results in the + same value (not true if a confounder is incorporated); that an + initial vector is used (may not be true if a block cipher in CBC mode + is not in use). + + Such assumptions, while they may hold for any given set of encryption + and checksum algorithms, may not be true of the next algorithms to be + defined, leaving the application protocol unable to make use of those + algorithms without updates to its specification. + + The Kerberos protocol uses only the attributes and operations + + + +Raeburn [Page 30] + +INTERNET DRAFT February 2003 + + + described in sections 2 and 3. Preauthentication systems and + application protocols making use of Kerberos are encouraged to use + them as well. The specific key and string-to-key parameters should + generally be treated as opaque. While the string-to-key parameters + are manipulated as an octet string, the representation for the + specific key structure is implementation-defined; it may not even be + a single object. + + While we don't recommend it, some application protocols will + undoubtedly continue to use the key data directly, even if only in + some of the currently existing protocol specifications. An + implementation intended to support general Kerberos applications may + therefore need to make the key data available, as well as the + attributes and operations described in sections 2 and 3. [8] + +7. Assigned Numbers + + The following encryption type numbers are already assigned or + reserved for use in Kerberos and related protocols. + + + encryption type etype section or comment + ----------------------------------------------------------------- + des-cbc-crc 1 5.2.3 + des-cbc-md4 2 5.2.2 + des-cbc-md5 3 5.2.1 + [reserved] 4 + des3-cbc-md5 5 + [reserved] 6 + des3-cbc-sha1 7 + dsaWithSHA1-CmsOID 9 (pkinit) + md5WithRSAEncryption-CmsOID 10 (pkinit) + sha1WithRSAEncryption-CmsOID 11 (pkinit) + rc2CBC-EnvOID 12 (pkinit) + rsaEncryption-EnvOID 13 (pkinit from PKCS#1 v1.5) + rsaES-OAEP-ENV-OID 14 (pkinit from PKCS#1 v2.0) + des-ede3-cbc-Env-OID 15 (pkinit) + des3-cbc-sha1-kd 16 5.3 + aes128-cts-hmac-sha1-96 17 [KRB5-AES] + aes256-cts-hmac-sha1-96 18 [KRB5-AES] + rc4-hmac 23 (Microsoft) + rc4-hmac-exp 24 (Microsoft) + subkey-keymaterial 65 (opaque; PacketCable) + + + (The "des3-cbc-sha1" assignment is a deprecated version using no key + derivation. It should not be confused with des3-cbc-sha1-kd.) + + + + +Raeburn [Page 31] + +INTERNET DRAFT February 2003 + + + Several numbers have been reserved for use in encryption systems not + defined here. Encryption type numbers have unfortunately been + overloaded on occasion in Kerberos-related protocols, so some of the + reserved numbers do not and will not correspond to encryption systems + fitting the profile presented here. + + The following checksum type numbers are assigned or reserved. As + with encryption type numbers, some overloading of checksum numbers + has occurred. + + + Checksum type sumtype checksum section or + value size reference + ---------------------------------------------------------------------- + CRC32 1 4 5.1.3 + rsa-md4 2 16 5.1.2 + rsa-md4-des 3 24 5.2.5 + des-mac 4 16 5.2.7 + des-mac-k 5 8 5.2.8 + rsa-md4-des-k 6 16 5.2.6 + rsa-md5 7 16 5.1.1 + rsa-md5-des 8 24 5.2.4 + rsa-md5-des3 9 24 ?? + sha1 (unkeyed) 10 20 ?? + hmac-sha1-des3-kd 12 20 5.3 + hmac-sha1-des3 13 20 ?? + sha1 (unkeyed) 14 20 ?? + hmac-sha1-96-aes128 15 20 [KRB5-AES] + hmac-sha1-96-aes256 16 20 [KRB5-AES] + [reserved] 0x8003 ? [GSS-KRB5] + + + Encryption and checksum type numbers are signed 32-bit values. Zero + is invalid, and negative numbers are reserved for local use. All + standardized values must be positive. + +8. Implementation Notes + + The "interface" described here is the minimal information that must + be defined to make a cryptosystem useful within Kerberos in an + interoperable fashion. Despite the functional notation used in some + places, it is not an attempt to define an API for cryptographic + functionality within Kerberos. Actual implementations providing + clean APIs will probably find it useful to make additional + information available, which should be possible to derive from a + specification written to the framework given here. For example, an + application designer may wish to determine the largest number of + bytes that can be encrypted without overflowing a certain size output + + + +Raeburn [Page 32] + +INTERNET DRAFT February 2003 + + + buffer, or conversely, the maximum number of bytes that might be + obtained by decrypting a ciphertext message of a given size. (In + fact, an implementation of the GSS-API Kerberos mechanism [GSS-KRB5] + will require some of these.) + + The presence of a mechanism in this document should not be taken as + an indication that it must be implemented for compliance with any + specification; required mechanisms will be specified elsewhere. + Indeed, some of the mechanisms described here for backwards + compatibility are now considered rather weak for protecting critical + data. + +9. Security Considerations + + Recent years have brought advancements in the ability to perform + large-scale attacks against DES, to such a degree that it is not + considered a strong encryption mechanism any longer; triple-DES is + generally preferred in its place, despite the poorer performance. + See [ESP-DES] for a summary of some of the potential attacks, and + [EFF-DES] for a detailed discussion of the implementation of + particular attack. However, most Kerberos implementations still have + DES as their primary interoperable encryption type. + + DES has four 'weak' keys and twelve 'semi-weak' keys, and the use of + single-DES here avoids them. However, DES also has 48 'possibly-weak' + keys [Schneier96] (note that the tables in many editions of the + reference contains errors) which are not avoided. + + DES weak keys are keys with the property that E1(E1(P)) = P (where E1 + denotes encryption of a single block with key 1). DES semi-weak keys + or "dual" keys are pairs of keys with the property that E1(P) = + D2(P), and thus E2(E1(P)) = P. Because of the use of CBC mode and + leading random confounder, however, these properties are unlikely to + present a security problem. + + The use of triple-DES in Kerberos makes no effort to avoid these + keys. The nature of the weak keys is such that it is extremely + unlikely that they will weaken the triple-DES encryption -- only + slightly more likely than having the middle of the three sub-keys + match one of the other two, which effectively converts the encryption + to single-DES, which is another case we make no effort to avoid. + + The true CRC-32 checksum is not collision-proof; an attacker could + use a probabilistic chosen-plaintext attack to generate a valid + message even if a confounder is used [SG92]. The use of collision- + proof checksums is of course recommended for environments where such + attacks represent a significant threat. The "simplifications" (read: + bugs) introduced when CRC-32 was implemented for Kerberos cause + + + +Raeburn [Page 33] + +INTERNET DRAFT February 2003 + + + leading zeros to effectively be ignored, so messages differing only + in leading zero bits will have the same checksum. + + [HMAC] and [IPSEC-HMAC] discuss weaknesses of the HMAC algorithm. + Unlike [IPSEC-HMAC], the triple-DES specification here does not use + the suggested truncation of the HMAC output. As pointed out in + [IPSEC-HMAC], SHA-1 was not developed to be used as a keyed hash + function, which is a criterion of HMAC. [HMAC-TEST] contains test + vectors for HMAC-SHA-1. + + The mit_des_string_to_key function was originally constructed with + the assumption that all input would be ASCII; it ignores the top bit + of each input byte. Folding with XOR is also not an especially good + mixing mechanism in terms of preserving randomness. + + The n-fold function used in the string-to-key operation for des3-cbc- + hmac-sha1-kd was designed to cause each bit of input to contribute + equally to the output; it was not designed to maximize or equally + distribute randomness in the input, and there are conceivable cases + of partially structured input where randomness may be lost. This + should only be an issue for highly structured passwords, however. + + [RFC1851] discusses the relative strength of triple-DES encryption. + The relative slow speed of triple-DES encryption may also be an issue + for some applications. + + This document, like the Kerberos protocol, completely ignores the + notion of limiting the amount of data a key may be used with to a + quantity based on the robustness of the algorithm or size of the key. + It is assumed that any defined algorithms and key sizes will be + strong enough to support very large amounts of data, or they will be + deprecated once significant attacks are known. + + This document also places no bounds on the amount of data that can be + handled in various operations. In order to avoid denial of service + attacks, implementations will probably want to restrict message sizes + at some higher level. + +10. IANA Considerations + + None at present. The management of encryption and checksum type + number assignments may be transferred to IANA at some future time. + + + + + + + + + +Raeburn [Page 34] + +INTERNET DRAFT February 2003 + + +11. Acknowledgments + + This document is an extension of the encryption specification + included in [Kerb1510] by B. Clifford Neuman and John Kohl, and much + of the text of the background, concepts, and DES specifications are + drawn directly from that document. + + The abstract framework presented in this document was put together by + Jeff Altman, Sam Hartman, Jeff Hutzelman, Cliff Neuman, Ken Raeburn, + and Tom Yu, and the details were refined several times based on + comments from John Brezak and others. + + Marc Horowitz wrote the original specification of triple-DES and key + derivation in a pair of Internet Drafts (under the names draft- + horowitz-key-derivation and draft-horowitz-kerb-key-derivation) which + were later folded into a draft revision of [Kerb1510], from which + this document was later split off. + + Tom Yu provided the text describing the modifications to the standard + CRC algorithm as Kerberos implementations actually use it. + + Miroslav Jurisic provided information for one of the UTF-8 test cases + for the string-to-key functions. + + Marcus Watts noticed some errors in earlier drafts, and pointed out + that the simplified profile could easily be modified to support + cipher text stealing modes. + + Simon Josefsson contributed some clarifications to the DES "CBC + checksum", string-to-key and weak key descriptions, and some test + vectors. + + Simon Josefsson, Louis LeVay and others also caught some errors in + earlier drafts. + +12. Editor's address + + Kenneth Raeburn + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139 + raeburn@mit.edu + + + + + + + + + +Raeburn [Page 35] + +INTERNET DRAFT February 2003 + + +13. Full Copyright Statement + + Copyright (C) The Internet Society (2003). All Rights Reserved. + + This document and translations of it may be copied and furnished to + others, and derivative works that comment on or otherwise explain it + or assist in its implementation may be prepared, copied, published + and distributed, in whole or in part, without restriction of any + kind, provided that the above copyright notice and this paragraph are + included on all such copies and derivative works. However, this + document itself may not be modified in any way, such as by removing + the copyright notice or references to the Internet Society or other + Internet organizations, except as needed for the purpose of + developing Internet standards in which case the procedures for + copyrights defined in the Internet Standards process must be + followed, or as required to translate it into languages other than + English. + + The limited permissions granted above are perpetual and will not be + revoked by the Internet Society or its successors or assigns. + + This document and the information contained herein is provided on an + "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING + TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING + BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION + HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF + MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." + +A. Test vectors + + This section provides test vectors for various functions defined or + described in this document. For convenience, most inputs are ASCII + strings, though some UTF-8 samples are be provided for string-to-key + functions. Keys and other binary data are specified as hexadecimal + strings. + +A.1. n-fold + + The n-fold function is defined in section 4.1. As noted there, the + sample vector in the original paper defining the algorithm appears to + be incorrect. Here are some test cases provided by Marc Horowitz and + Simon Josefsson: + + + + + + + + + +Raeburn [Page 36] + +INTERNET DRAFT February 2003 + + + 64-fold("012345") = + 64-fold(303132333435) = be072631276b1955 + + 56-fold("password") = + 56-fold(70617373776f7264) = 78a07b6caf85fa + + 64-fold("Rough Consensus, and Running Code") = + 64-fold(526f75676820436f6e73656e7375732c20616e642052756e + 6e696e6720436f6465) = bb6ed30870b7f0e0 + + 168-fold("password") = + 168-fold(70617373776f7264) = + 59e4a8ca7c0385c3c37b3f6d2000247cb6e6bd5b3e + + 192-fold("MASSACHVSETTS INSTITVTE OF TECHNOLOGY" + 192-fold(4d41535341434856534554545320494e5354495456544520 + 4f4620544543484e4f4c4f4759) = + db3b0d8f0b061e603282b308a50841229ad798fab9540c1b + + 168-fold("Q") = + 168-fold(51) = + 518a54a2 15a8452a 518a54a2 15a8452a + 518a54a2 15 + + 168-fold("ba") = + 168-fold(6261) = + fb25d531 ae897449 9f52fd92 ea9857c4 + ba24cf29 7e + + Here are some additional values corresponding to folded values of the + string "kerberos"; the 64-bit form is used in the des3 string-to-key + (section 5.3.1). + + 64-fold("kerberos") = + 6b657262 65726f73 + 128-fold("kerberos") = + 6b657262 65726f73 7b9b5b2b 93132b93 + 168-fold("kerberos") = + 8372c236 344e5f15 50cd0747 e15d62ca + 7a5a3bce a4 + 256-fold("kerberos") = + 6b657262 65726f73 7b9b5b2b 93132b93 + 5c9bdcda d95c9899 c4cae4de e6d6cae4 + + Note that the initial octets exactly match the input string when the + output length is a multiple of the input length. + + + + + +Raeburn [Page 37] + +INTERNET DRAFT February 2003 + + +A.2. mit_des_string_to_key + + The function mit_des_string_to_key is defined in section 5.2. We + present here several test values, with some of the intermediate + results. The fourth test demonstrates the use of UTF-8 with three + characters. The last two tests are specifically constructed so as to + trigger the weak-key fixups for the intermediate key produced by fan- + folding; we have no test cases that cause such fixups for the final + key. + + + UTF-8 encodings used in test vector: + eszett C3 9F s-caron C5 A1 c-acute C4 87 + g-clef F0 9D 84 9E + + + Test vector: + + + salt: "ATHENA.MIT.EDUraeburn" + 415448454e412e4d49542e4544557261656275726e + password: "password" 70617373776f7264 + fan-fold result: c01e38688ac86c2e + intermediate key: c11f38688ac86d2f + DES key: cbc22fae235298e3 + + + + salt: "WHITEHOUSE.GOVdanny" 5748495445484f5553452e474f5664616e6e79 + password: "potatoe" 706f7461746f65 + fan-fold result: a028944ee63c0416 + intermediate key: a129944fe63d0416 + DES key: df3d32a74fd92a01 + + + + salt: "EXAMPLE.COMpianist" 4558414D504C452E434F4D7069616E697374 + password: g-clef f09d849e + fan-fold result: 3c4a262c18fab090 + intermediate key: 3d4a262c19fbb091 + DES key: 4ffb26bab0cd9413 + + + + + + + + + + +Raeburn [Page 38] + +INTERNET DRAFT February 2003 + + + salt: "ATHENA.MIT.EDUJuri" + s-caron + "i" + c-acute + 415448454e412e4d49542e4544554a757269c5a169c487 + password: eszett c39f + fan-fold result: b8f6c40e305afc9e + intermediate key: b9f7c40e315bfd9e + DES key: 62c81a5232b5e69d + + + + salt: "AAAAAAAA" 4141414141414141 + password: "11119999" 3131313139393939 + fan-fold result: e0e0e0e0f0f0f0f0 + intermediate key: e0e0e0e0f1f1f101 + DES key: 984054d0f1a73e31 + + + + salt: "FFFFAAAA" 4646464641414141 + password: "NNNN6666" 4e4e4e4e36363636 + fan-fold result: 1e1e1e1e0e0e0e0e + intermediate key: 1f1f1f1f0e0e0efe + DES key: c4bf6b25adf7a4f8 + + + This trace provided by Simon Josefsson shows the intermediate + processing stages of one of the test inputs: + + string_to_key (des-cbc-md5, string, salt) + ;; string: + ;; `password' (length 8 bytes) + ;; 70 61 73 73 77 6f 72 64 + ;; salt: + ;; `ATHENA.MIT.EDUraeburn' (length 21 bytes) + ;; 41 54 48 45 4e 41 2e 4d 49 54 2e 45 44 55 72 61 + ;; 65 62 75 72 6e + des_string_to_key (string, salt) + ;; String: + ;; `password' (length 8 bytes) + ;; 70 61 73 73 77 6f 72 64 + ;; Salt: + ;; `ATHENA.MIT.EDUraeburn' (length 21 bytes) + ;; 41 54 48 45 4e 41 2e 4d 49 54 2e 45 44 55 72 61 + ;; 65 62 75 72 6e + odd = 1; + s = string | salt; + + + + + + +Raeburn [Page 39] + +INTERNET DRAFT February 2003 + + + tempstring = 0; /* 56-bit string */ + pad(s); /* with nulls to 8 byte boundary */ + ;; s = pad(string|salt): + ;; `passwordATHENA.MIT.EDUraeburn\x00\x00\x00' + ;; (length 32 bytes) + ;; 70 61 73 73 77 6f 72 64 41 54 48 45 4e 41 2e 4d + ;; 49 54 2e 45 44 55 72 61 65 62 75 72 6e 00 00 00 + for (8byteblock in s) { + ;; loop iteration 0 + ;; 8byteblock: + ;; `password' (length 8 bytes) + ;; 70 61 73 73 77 6f 72 64 + ;; 01110000 01100001 01110011 01110011 01110111 01101111 + ;; 01110010 01100100 + 56bitstring = removeMSBits(8byteblock); + ;; 56bitstring: + ;; 1110000 1100001 1110011 1110011 1110111 1101111 + ;; 1110010 1100100 + if (odd == 0) reverse(56bitstring); ;; odd=1 + odd = ! odd + tempstring = tempstring XOR 56bitstring; + ;; tempstring + ;; 1110000 1100001 1110011 1110011 1110111 1101111 + ;; 1110010 1100100 + + for (8byteblock in s) { + ;; loop iteration 1 + ;; 8byteblock: + ;; `ATHENA.M' (length 8 bytes) + ;; 41 54 48 45 4e 41 2e 4d + ;; 01000001 01010100 01001000 01000101 01001110 01000001 + ;; 00101110 01001101 + 56bitstring = removeMSBits(8byteblock); + ;; 56bitstring: + ;; 1000001 1010100 1001000 1000101 1001110 1000001 + ;; 0101110 1001101 + if (odd == 0) reverse(56bitstring); ;; odd=0 + reverse(56bitstring) + ;; 56bitstring after reverse + ;; 1011001 0111010 1000001 0111001 1010001 0001001 + ;; 0010101 1000001 + odd = ! odd + tempstring = tempstring XOR 56bitstring; + ;; tempstring + ;; 0101001 1011011 0110010 1001010 0100110 1100110 + ;; 1100111 0100101 + + + + + +Raeburn [Page 40] + +INTERNET DRAFT February 2003 + + + for (8byteblock in s) { + ;; loop iteration 2 + ;; 8byteblock: + ;; `IT.EDUra' (length 8 bytes) + ;; 49 54 2e 45 44 55 72 61 + ;; 01001001 01010100 00101110 01000101 01000100 01010101 + ;; 01110010 01100001 + 56bitstring = removeMSBits(8byteblock); + ;; 56bitstring: + ;; 1001001 1010100 0101110 1000101 1000100 1010101 + ;; 1110010 1100001 + if (odd == 0) reverse(56bitstring); ;; odd=1 + odd = ! odd + tempstring = tempstring XOR 56bitstring; + ;; tempstring + ;; 1100000 0001111 0011100 0001111 1100010 0110011 + ;; 0010101 1000100 + + for (8byteblock in s) { + ;; loop iteration 3 + ;; 8byteblock: + ;; `eburn\x00\x00\x00' (length 8 bytes) + ;; 65 62 75 72 6e 00 00 00 + ;; 01100101 01100010 01110101 01110010 01101110 00000000 + ;; 00000000 00000000 + 56bitstring = removeMSBits(8byteblock); + ;; 56bitstring: + ;; 1100101 1100010 1110101 1110010 1101110 0000000 + ;; 0000000 0000000 + if (odd == 0) reverse(56bitstring); ;; odd=0 + reverse(56bitstring) + ;; 56bitstring after reverse + ;; 0000000 0000000 0000000 0111011 0100111 1010111 + ;; 0100011 1010011 + odd = ! odd + tempstring = tempstring XOR 56bitstring; + ;; tempstring + ;; 1100000 0001111 0011100 0110100 1000101 1100100 + ;; 0110110 0010111 + + for (8byteblock in s) { + } + ;; for loop terminated + + + + + + + + +Raeburn [Page 41] + +INTERNET DRAFT February 2003 + + + tempkey = key_correction(add_parity_bits(tempstring)); + ;; tempkey + ;; `\xc1\x1f8h\x8a\xc8m\x2f' (length 8 bytes) + ;; c1 1f 38 68 8a c8 6d 2f + ;; 11000001 00011111 00111000 01101000 10001010 11001000 + ;; 01101101 00101111 + + key = key_correction(DES-CBC-check(s,tempkey)); + ;; key + ;; `\xcb\xc2\x2f\xae\x23R\x98\xe3' (length 8 bytes) + ;; cb c2 2f ae 23 52 98 e3 + ;; 11001011 11000010 00101111 10101110 00100011 01010010 + ;; 10011000 11100011 + + ;; string_to_key key: + ;; `\xcb\xc2\x2f\xae\x23R\x98\xe3' (length 8 bytes) + ;; cb c2 2f ae 23 52 98 e3 + + +A.3. DES3 DR and DK + + These tests show the derived-random and derived-key values for the + des3-hmac-sha1-kd encryption scheme, using the DR and DK functions + defined in section 5.3.1. The input keys were randomly generated; + the usage values are from this specification. + + + key: dce06b1f64c857a11c3db57c51899b2cc1791008ce973b92 + usage: 0000000155 + DR: 935079d14490a75c3093c4a6e8c3b049c71e6ee705 + DK: 925179d04591a79b5d3192c4a7e9c289b049c71f6ee604cd + + key: 5e13d31c70ef765746578531cb51c15bf11ca82c97cee9f2 + usage: 00000001aa + DR: 9f58e5a047d894101c469845d67ae3c5249ed812f2 + DK: 9e58e5a146d9942a101c469845d67a20e3c4259ed913f207 + + key: 98e6fd8a04a4b6859b75a176540b9752bad3ecd610a252bc + usage: 0000000155 + DR: 12fff90c773f956d13fc2ca0d0840349dbd39908eb + DK: 13fef80d763e94ec6d13fd2ca1d085070249dad39808eabf + + key: 622aec25a2fe2cad7094680b7c64940280084c1a7cec92b5 + usage: 00000001aa + DR: f8debf05b097e7dc0603686aca35d91fd9a5516a70 + DK: f8dfbf04b097e6d9dc0702686bcb3489d91fd9a4516b703e + + + + + +Raeburn [Page 42] + +INTERNET DRAFT February 2003 + + + key: d3f8298ccb166438dcb9b93ee5a7629286a491f838f802fb + usage: 6b65726265726f73 ("kerberos") + DR: 2270db565d2a3d64cfbfdc5305d4f778a6de42d9da + DK: 2370da575d2a3da864cebfdc5204d56df779a7df43d9da43 + + key: c1081649ada74362e6a1459d01dfd30d67c2234c940704da + usage: 0000000155 + DR: 348056ec98fcc517171d2b4d7a9493af482d999175 + DK: 348057ec98fdc48016161c2a4c7a943e92ae492c989175f7 + + key: 5d154af238f46713155719d55e2f1f790dd661f279a7917c + usage: 00000001aa + DR: a8818bc367dadacbe9a6c84627fb60c294b01215e5 + DK: a8808ac267dada3dcbe9a7c84626fbc761c294b01315e5c1 + + key: 798562e049852f57dc8c343ba17f2ca1d97394efc8adc443 + usage: 0000000155 + DR: c813f88b3be2b2f75424ce9175fbc8483b88c8713a + DK: c813f88a3be3b334f75425ce9175fbe3c8493b89c8703b49 + + key: 26dce334b545292f2feab9a8701a89a4b99eb9942cecd016 + usage: 00000001aa + DR: f58efc6f83f93e55e695fd252cf8fe59f7d5ba37ec + DK: f48ffd6e83f83e7354e694fd252cf83bfe58f7d5ba37ec5d + + +A.4. DES3string_to_key + + These are the keys generated for some of the above input strings for + triple-DES with key derivation as defined in section 5.3.1. + + salt: "ATHENA.MIT.EDUraeburn" + passwd: "password" + key: 850bb51358548cd05e86768c313e3bfef7511937dcf72c3e + + salt: "WHITEHOUSE.GOVdanny" + passwd: "potatoe" + key: dfcd233dd0a43204ea6dc437fb15e061b02979c1f74f377a + + salt: "EXAMPLE.COMbuckaroo" + passwd: "penny" + key: 6d2fcdf2d6fbbc3ddcadb5da5710a23489b0d3b69d5d9d4a + + salt: "ATHENA.MIT.EDUJuri" + s-caron + "i" + c-acute + passwd: eszett + key: 16d5a40e1ce3bacb61b9dce00470324c831973a7b952feb0 + + + + + +Raeburn [Page 43] + +INTERNET DRAFT February 2003 + + + salt: "EXAMPLE.COMpianist" + passwd: g-clef + key: 85763726585dbc1cce6ec43e1f751f07f1c4cbb098f40b19 + +A.5. Modified CRC-32 + + Below are modified-CRC32 values for various ASCII and octet strings. + Only the printable ASCII characters are checksummed, no C-style + trailing zero-valued octet. The 32-bit modified CRC and the sequence + of output bytes as used in Kerberos are shown. (The octet values are + separated here to emphasize that they are octet values and not 32-bit + numbers, which will be the most convenient form for manipulation in + some implementations. The bit and byte order used internally for + such a number is irrelevant; the octet sequence generated is what is + important.) + + + mod-crc-32("foo") = 33 bc 32 73 + mod-crc-32("test0123456789") = d6 88 3e b8 + mod-crc-32("MASSACHVSETTS INSTITVTE OF TECHNOLOGY") = f7 80 41 e3 + mod-crc-32(8000) = 4b 98 83 3b + mod-crc-32(0008) = 32 88 db 0e + mod-crc-32(0080) = 20 83 b8 ed + mod-crc-32(80) = 20 83 b8 ed + mod-crc-32(80000000) = 3b b6 59 ed + mod-crc-32(00000001) = 96 30 07 77 + + +B. Significant Changes from RFC 1510 + + The encryption and checksum mechanism profiles are new. The old + specification defined a few operations for various mechanisms, but + didn't outline what should be required of new mechanisms in terms of + abstract properties, nor how to ensure that a mechanism specification + is complete enough for interoperability between implementations. The + new profiles do differ from the old specification in a few ways: + + Some message definitions in [Kerb1510] could be read as permitting + the initial vector to be specified by the application; the text + was too vague. It is specifically not permitted in this + specification. Some encryption algorithms may not use + initialization vectors, so relying on chosen, secret + initialization vectors for security is unwise. Also, the + prepended confounder in the existing algorithms is roughly + equivalent to a per-message initialization vector that is revealed + in encrypted form. However, carrying state across from one + encryption to another is explicitly permitted through the opaque + "cipher state" object. + + + +Raeburn [Page 44] + +INTERNET DRAFT February 2003 + + + The use of key derivation is new. + + Several new methods are introduced, including generation of a key + in wire-protocol format from random input data. + + The means for influencing the string-to-key algorithm are laid out + more clearly. + + Triple-DES support is new. + + The pseudo-random function is new. + + The des-cbc-crc, DES string-to-key and CRC descriptions have been + updated to align them with existing implementations. + + [Kerb1510] had no indication what character set or encoding might be + used for pass phrases and salts. + + In [Kerb1510], key types, encryption algorithms and checksum + algorithms were only loosely associated, and the association was not + well described. In this specification, key types and encryption + algorithms have a one-to-one correspondence, and associations between + encryption and checksum algorithms are described so that checksums + can be computed given negotiated keys, without requiring further + negotiation for checksum types. + +Notes + + [1] While Message Authentication Code (MAC) or Message Integrity + Check (MIC) would be more appropriate terms for many of the + uses in this document, we continue to use the term "checksum" + for historical reasons. + + [2] Extending CBC mode across messages would be one obvious + example of this chaining. Another might be the use of + counter mode, with a counter randomly initialized and + attached to the ciphertext; a second message could continue + incrementing the counter when chaining the cipher state, thus + avoiding having to transmit another counter value. However, + this chaining is only useful for uninterrupted, ordered + sequences of messages. + + [3] In the case of Kerberos, the encrypted objects will generally + be ASN.1 DER encodings, which contain indications of their + length in the first few octets. + + [4] As of the time of this writing, some new modes of operation + have been proposed, some of which may permit encryption and + + + +Raeburn [Page 45] + +INTERNET DRAFT February 2003 + + + integrity protection simultaneously. After some of these + proposals have been subjected to adequate analysis, we may + wish to formulate a new simplified profile based on one of + them. + + [5] It should be noted that the sample vector in Appendix B.2 of + the original paper appears to be incorrect. Two independent + implementations from the specification (one in C by Marc + Horowitz, and another in Scheme by Bill Sommerfeld) agree on + a value different from that in [Blumenthal96]. + + [6] For example, in MIT's implementation of [Kerb1510], the rsa- + md5 unkeyed checksum of application data may be included in + an authenticator encrypted in a service's key; since rsa-md5 + is believed to be collision-proof, even if the application + data is exposed to an attacker, it cannot be modified without + causing the checksum verification to fail. + + [7] A variant of the key is used to limit the use of a key to a + particular function, separating the functions of generating a + checksum from other encryption performed using the session + key. The constant 0xF0F0F0F0F0F0F0F0 was chosen because it + maintains key parity. The properties of DES precluded the + use of the complement. The same constant is used for similar + purpose in the Message Integrity Check in the Privacy + Enhanced Mail standard. + + [8] Perhaps one of the more common reasons for directly + performing encryption is direct control over the negotiation + and to select a "sufficiently strong" encryption algorithm + (whatever that means in the context of a given application). + While Kerberos directly provides no facility for negotiating + encryption types between the application client and server, + there are other means for accomplishing similar goals. For + example, requesting only "strong" session key types from the + KDC, and assuming that the type actually returned by the KDC + will be understood and supported by the application server. + +Normative References + + [Bellare98] + Bellare, M., Desai, A., Pointcheval, D., and P. Rogaway, + "Relations Among Notions of Security for Public-Key Encryption + Schemes". Extended abstract published in Advances in Cryptology- + Crypto 98 Proceedings, Lecture Notes in Computer Science Vol. + 1462, H. Krawcyzk ed., Springer-Verlag, 1998. + + + + + +Raeburn [Page 46] + +INTERNET DRAFT February 2003 + + + [Blumenthal96] + Blumenthal, U., and S. Bellovin, "A Better Key Schedule for DES- + Like Ciphers", Proceedings of PRAGOCRYPT '96, 1996. + [CRC] + International Organization for Standardization, "ISO Information + Processing Systems - Data Communication - High-Level Data Link + Control Procedure - Frame Structure," IS 3309, 3rd Edition, + October 1984. + [DES77] + National Bureau of Standards, U.S. Department of Commerce, "Data + Encryption Standard," Federal Information Processing Standards + Publication 46, Washington, DC, 1977. + [DESI81] + National Bureau of Standards, U.S. Department of Commerce, + "Guidelines for implementing and using NBS Data Encryption + Standard," Federal Information Processing Standards Publication + 74, Washington, DC, 1981. + [DESM80] + National Bureau of Standards, U.S. Department of Commerce, "DES + Modes of Operation," Federal Information Processing Standards + Publication 81, Springfield, VA, December 1980. + [Dolev91] + Dolev, D., Dwork, C., Naor, M., "Non-malleable cryptography", + Proceedings of the 23rd Annual Symposium on Theory of Computing, + ACM, 1991. + [HMAC] + Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-Hashing + for Message Authentication", RFC 2104, February 1997. + [KRB5-AES] + Raeburn, K., "AES Encyrption for Kerberos 5", RFC XXXX, Xxxxxxxx + 2003. + [MD4-92] + Rivest, R., "The MD4 Message Digest Algorithm," RFC 1320, MIT + Laboratory for Computer Science, April 1992. + [MD5-92] + Rivest, R., "The MD5 Message Digest Algorithm," RFC 1321, MIT + Laboratory for Computer Science, April 1992. + [RFC2026] + Bradner, S., "The Internet Standards Process -- Revisions 3," RFC + 2026, October 1996. + [SG92] + Stubblebine, S., and V. D. Gligor, "On Message Integrity in + Cryptographic Protocols," in Proceedings of the IEEE Symposium on + Research in Security and Privacy, Oakland, California, May 1992. + + + + + + + +Raeburn [Page 47] + +INTERNET DRAFT February 2003 + + +Informative References + + [EFF-DES] + Electronic Frontier Foundation, "Cracking DES: Secrets of + Encryption Research, Wiretap Politics, and Chip Design", O'Reilly + & Associates, Inc., May 1998. + [ESP-DES] + Madson, C., and N. Doraswamy, "The ESP DES-CBC Cipher Algorithm + With Explicit IV", RFC 2405, November 1998. + [GSS-KRB5] + Linn, J., "The Kerberos Version 5 GSS-API Mechanism," RFC 1964, + June 1996. + [HMAC-TEST] + Cheng, P., and R. Glenn, "Test Cases for HMAC-MD5 and HMAC-SHA-1", + RFC 2202, September 1997. + [IPSEC-HMAC] + Madson, C., and R. Glenn, "The Use of HMAC-SHA-1-96 within ESP and + AH", RFC 2404, November 1998. + [Kerb] + Neuman, C., Kohl, J., Ts'o, T., Yu, T., Hartman, S., and K. + Raeburn, "The Kerberos Network Authentication Service (V5)", + draft-ietf-krb-wg-kerberos-clarifications-00.txt, February 22, + 2002. Work in progress. + [Kerb1510] + Kohl, J., and C. Neuman, "The Kerberos Network Authentication + Service (V5)", RFC 1510, September 1993. + [RC5] + Baldwin, R, and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-Pad, and + RC5-CTS Algorithms", RFC 2040, October 1996. + [Schneier96] + Schneier, B., "Applied Cryptography Second Edition", John Wiley & + Sons, New York, NY, 1996. ISBN 0-471-12845-7. + +Notes to RFC Editor + + Before publication of this document as an RFC, the following changes + are needed: + + Change the reference "[KRB5-AES]" in Normative References to indicate + the AES draft (draft-raeburn-krb-rijndael-krb-XX) that should be + advancing to RFC at the same time. The RFC number and publication + date are needed. + + If draft-ietf-krb-wg-kerberos-clarifications advances to RFC at the + same time as this document, change the information for [Kerb] in the + Informative References section as well. + + Delete this section. + + + +Raeburn [Page 48] diff --git a/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-kerberos-clarifications-03.txt b/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-kerberos-clarifications-03.txt new file mode 100644 index 00000000000..005ea86b0b7 --- /dev/null +++ b/kerberosV/src/doc/standardisation/draft-ietf-krb-wg-kerberos-clarifications-03.txt @@ -0,0 +1,7975 @@ + +INTERNET-DRAFT Clifford Neuman + USC-ISI + Tom Yu + Sam Hartman + Ken Raeburn + MIT + March 2, 2003 + Expires 2 September, 2003 + + The Kerberos Network Authentication Service (V5) + draft-ietf-krb-wg-kerberos-clarifications-03.txt + +STATUS OF THIS MEMO + + This document is an Internet-Draft and is in full conformance with + all provisions of Section 10 of RFC 2026. Internet-Drafts are working + documents of the Internet Engineering Task Force (IETF), its areas, + and its working groups. Note that other groups may also distribute + working documents as Internet-Drafts. + + Internet-Drafts are draft documents valid for a maximum of six months + and may be updated, replaced, or obsoleted by other documents at any + time. It is inappropriate to use Internet-Drafts as reference + material or to cite them other than as "work in progress." + + The list of current Internet-Drafts can be accessed at + http://www.ietf.org/ietf/1id-abstracts.txt + + The list of Internet-Draft Shadow Directories can be accessed at + http://www.ietf.org/shadow.html. + + To learn the current status of any Internet-Draft, please check the + "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow + Directories on ftp.ietf.org (US East Coast), nic.nordu.net (Europe), + ftp.isi.edu (US West Coast), or munnari.oz.au (Pacific Rim). + + The distribution of this memo is unlimited. It is filed as draft- + ietf-krb-wg-kerberos-clarifications-03.txt, and expires 2 September + 2003. Please send comments to: ietf-krb-wg@anl.gov + +ABSTRACT + + This document provides an overview and specification of Version 5 of + the Kerberos protocol, and updates RFC1510 to clarify aspects of the + protocol and its intended use that require more detailed or clearer + explanation than was provided in RFC1510. This document is intended + to provide a detailed description of the protocol, suitable for + implementation, together with descriptions of the appropriate use of + protocol messages and fields within those messages. + + + +March 2003 [Page 1] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This document contains a subset of the changes considered and + discussed in the Kerberos working group and is intended as an interim + description of Kerberos. Additional changes to the Kerberos protocol + have been proposed and will appear in a subsequent extensions + document. + + This document is not intended to describe Kerberos to the end user, + system administrator, or application developer. Higher level papers + describing Version 5 of the Kerberos system [NT94] and documenting + version 4 [SNS88], are available elsewhere. + +OVERVIEW + + This INTERNET-DRAFT describes the concepts and model upon which the + Kerberos network authentication system is based. It also specifies + Version 5 of the Kerberos protocol. + + The motivations, goals, assumptions, and rationale behind most design + decisions are treated cursorily; they are more fully described in a + paper available in IEEE communications [NT94] and earlier in the + Kerberos portion of the Athena Technical Plan [MNSS87]. The protocols + have been a proposed standard and are being considered for + advancement for draft standard through the IETF standard process. + Comments are encouraged on the presentation, but only minor + refinements to the protocol as implemented or extensions that fit + within current protocol framework will be considered at this time. + + Requests for addition to an electronic mailing list for discussion of + Kerberos, kerberos@MIT.EDU, may be addressed to kerberos- + request@MIT.EDU. This mailing list is gatewayed onto the Usenet as + the group comp.protocols.kerberos. Requests for further information, + including documents and code availability, may be sent to info- + kerberos@MIT.EDU. + +BACKGROUND + + The Kerberos model is based in part on Needham and Schroeder's + trusted third-party authentication protocol [NS78] and on + modifications suggested by Denning and Sacco [DS81]. The original + design and implementation of Kerberos Versions 1 through 4 was the + work of two former Project Athena staff members, Steve Miller of + Digital Equipment Corporation and Clifford Neuman (now at the + Information Sciences Institute of the University of Southern + California), along with Jerome Saltzer, Technical Director of Project + Athena, and Jeffrey Schiller, MIT Campus Network Manager. Many other + members of Project Athena have also contributed to the work on + Kerberos. + + + + +March 2003 [Page 2] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Version 5 of the Kerberos protocol (described in this document) has + evolved from Version 4 based on new requirements and desires for + features not available in Version 4. The design of Version 5 of the + Kerberos protocol was led by Clifford Neuman and John Kohl with much + input from the community. The development of the MIT reference + implementation was led at MIT by John Kohl and Theodore Ts'o, with + help and contributed code from many others. Since RFC1510 was issued, + extensions and revisions to the protocol have been proposed by many + individuals. Some of these proposals are reflected in this document. + Where such changes involved significant effort, the document cites + the contribution of the proposer. + + Reference implementations of both version 4 and version 5 of Kerberos + are publicly available and commercial implementations have been + developed and are widely used. Details on the differences between + Kerberos Versions 4 and 5 can be found in [KNT94]. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +March 2003 [Page 3] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + TTaabbllee ooff CCoonntteennttss + + +1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 7 +1.1. Cross-realm operation . . . . . . . . . . . . . . . . . . . . . 9 +1.2. Choosing a principal with which to communicate . . . . . . . . 10 +1.3. Authorization . . . . . . . . . . . . . . . . . . . . . . . . . 11 +1.4. Extending Kerberos Without Breaking Interoperability . . . . . 11 +1.4.1. Compatibility with RFC 1510 . . . . . . . . . . . . . . . . . 12 +1.4.2. Sending Extensible Messages . . . . . . . . . . . . . . . . . 13 +1.5. Environmental assumptions . . . . . . . . . . . . . . . . . . . 13 +1.6. Glossary of terms . . . . . . . . . . . . . . . . . . . . . . . 14 +2. Ticket flag uses and requests . . . . . . . . . . . . . . . . . . 16 +2.1. Initial, pre-authenticated, and hardware authenticated + tickets . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 +2.2. Invalid tickets . . . . . . . . . . . . . . . . . . . . . . . . 17 +2.3. Renewable tickets . . . . . . . . . . . . . . . . . . . . . . . 18 +2.4. Postdated tickets . . . . . . . . . . . . . . . . . . . . . . . 18 +2.5. Proxiable and proxy tickets . . . . . . . . . . . . . . . . . . 19 +2.6. Forwardable tickets . . . . . . . . . . . . . . . . . . . . . . 20 +2.7. Transited Policy Checking . . . . . . . . . . . . . . . . . . . 21 +2.8. OK as Delegate . . . . . . . . . . . . . . . . . . . . . . . . 21 +2.9. Other KDC options . . . . . . . . . . . . . . . . . . . . . . . 22 +2.9.1. Renewable-OK . . . . . . . . . . . . . . . . . . . . . . . . 22 +2.9.2. ENC-TKT-IN-SKEY . . . . . . . . . . . . . . . . . . . . . . . 22 +2.9.3. Passwordless Hardware Authentication . . . . . . . . . . . . 22 +3. Message Exchanges . . . . . . . . . . . . . . . . . . . . . . . . 23 +3.1. The Authentication Service Exchange . . . . . . . . . . . . . . 23 +3.1.1. Generation of KRB_AS_REQ message . . . . . . . . . . . . . . 24 +3.1.2. Receipt of KRB_AS_REQ message . . . . . . . . . . . . . . . . 24 +3.1.3. Generation of KRB_AS_REP message . . . . . . . . . . . . . . 25 +3.1.4. Generation of KRB_ERROR message . . . . . . . . . . . . . . . 27 +3.1.5. Receipt of KRB_AS_REP message . . . . . . . . . . . . . . . . 28 +3.1.6. Receipt of KRB_ERROR message . . . . . . . . . . . . . . . . 29 +3.2. The Client/Server Authentication Exchange . . . . . . . . . . . 29 +3.2.1. The KRB_AP_REQ message . . . . . . . . . . . . . . . . . . . 29 +3.2.2. Generation of a KRB_AP_REQ message . . . . . . . . . . . . . 29 +3.2.3. Receipt of KRB_AP_REQ message . . . . . . . . . . . . . . . . 30 +3.2.4. Generation of a KRB_AP_REP message . . . . . . . . . . . . . 32 +3.2.5. Receipt of KRB_AP_REP message . . . . . . . . . . . . . . . . 33 +3.2.6. Using the encryption key . . . . . . . . . . . . . . . . . . 33 +3.3. The Ticket-Granting Service (TGS) Exchange . . . . . . . . . . 34 +3.3.1. Generation of KRB_TGS_REQ message . . . . . . . . . . . . . . 35 +3.3.2. Receipt of KRB_TGS_REQ message . . . . . . . . . . . . . . . 37 +3.3.3. Generation of KRB_TGS_REP message . . . . . . . . . . . . . . 37 +3.3.3.1. Checking for revoked tickets . . . . . . . . . . . . . . . 40 +3.3.3.2. Encoding the transited field . . . . . . . . . . . . . . . 40 +3.3.4. Receipt of KRB_TGS_REP message . . . . . . . . . . . . . . . 42 + + + +March 2003 [Page 4] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +3.4. The KRB_SAFE Exchange . . . . . . . . . . . . . . . . . . . . . 42 +3.4.1. Generation of a KRB_SAFE message . . . . . . . . . . . . . . 42 +3.4.2. Receipt of KRB_SAFE message . . . . . . . . . . . . . . . . . 43 +3.5. The KRB_PRIV Exchange . . . . . . . . . . . . . . . . . . . . . 44 +3.5.1. Generation of a KRB_PRIV message . . . . . . . . . . . . . . 44 +3.5.2. Receipt of KRB_PRIV message . . . . . . . . . . . . . . . . . 44 +3.6. The KRB_CRED Exchange . . . . . . . . . . . . . . . . . . . . . 45 +3.6.1. Generation of a KRB_CRED message . . . . . . . . . . . . . . 45 +3.6.2. Receipt of KRB_CRED message . . . . . . . . . . . . . . . . . 46 +3.7. User to User Authentication Exchanges . . . . . . . . . . . . . 46 +4. Encryption and Checksum Specifications . . . . . . . . . . . . . 48 +5. Message Specifications . . . . . . . . . . . . . . . . . . . . . 49 +5.1. Specific Compatibility Notes on ASN.1 . . . . . . . . . . . . . 51 +5.1.1. ASN.1 Distinguished Encoding Rules . . . . . . . . . . . . . 51 +5.1.2. Optional Integer Fields . . . . . . . . . . . . . . . . . . . 51 +5.1.3. Empty SEQUENCE OF Types . . . . . . . . . . . . . . . . . . . 51 +5.1.4. Unrecognized Tag Numbers . . . . . . . . . . . . . . . . . . 52 +5.1.5. Tag Numbers Greater Than 30 . . . . . . . . . . . . . . . . . 52 +5.2. Basic Kerberos Types . . . . . . . . . . . . . . . . . . . . . 52 +5.2.1. KerberosString . . . . . . . . . . . . . . . . . . . . . . . 52 +5.2.2. Realm and PrincipalName . . . . . . . . . . . . . . . . . . . 54 +5.2.3. KerberosTime . . . . . . . . . . . . . . . . . . . . . . . . 54 +5.2.4. Constrained Integer types . . . . . . . . . . . . . . . . . . 55 +5.2.5. HostAddress and HostAddresses . . . . . . . . . . . . . . . . 55 +5.2.6. AuthorizationData . . . . . . . . . . . . . . . . . . . . . . 56 +5.2.6.1. IF-RELEVANT . . . . . . . . . . . . . . . . . . . . . . . . 57 +5.2.6.2. KDCIssued . . . . . . . . . . . . . . . . . . . . . . . . . 57 +5.2.6.3. AND-OR . . . . . . . . . . . . . . . . . . . . . . . . . . 59 +5.2.6.4. MANDATORY-FOR-KDC . . . . . . . . . . . . . . . . . . . . . 59 +5.2.7. PA-DATA . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 +5.2.7.1. PA-TGS-REQ . . . . . . . . . . . . . . . . . . . . . . . . 60 +5.2.7.2. Encrypted Timestamp Pre-authentication . . . . . . . . . . 60 +5.2.7.3. PA-PW-SALT . . . . . . . . . . . . . . . . . . . . . . . . 61 +5.2.7.4. PA-ETYPE-INFO . . . . . . . . . . . . . . . . . . . . . . . 61 +5.2.7.5. PA-ETYPE-INFO2 . . . . . . . . . . . . . . . . . . . . . . 62 +5.2.8. KerberosFlags . . . . . . . . . . . . . . . . . . . . . . . . 63 +5.2.9. Cryptosystem-related Types . . . . . . . . . . . . . . . . . 64 +5.3. Tickets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 +5.4. Specifications for the AS and TGS exchanges . . . . . . . . . . 73 +5.4.1. KRB_KDC_REQ definition . . . . . . . . . . . . . . . . . . . 73 +5.4.2. KRB_KDC_REP definition . . . . . . . . . . . . . . . . . . . 80 +5.5. Client/Server (CS) message specifications . . . . . . . . . . . 84 +5.5.1. KRB_AP_REQ definition . . . . . . . . . . . . . . . . . . . . 84 +5.5.2. KRB_AP_REP definition . . . . . . . . . . . . . . . . . . . . 87 +5.5.3. Error message reply . . . . . . . . . . . . . . . . . . . . . 88 +5.6. KRB_SAFE message specification . . . . . . . . . . . . . . . . 88 +5.6.1. KRB_SAFE definition . . . . . . . . . . . . . . . . . . . . . 88 +5.7. KRB_PRIV message specification . . . . . . . . . . . . . . . . 90 + + + +March 2003 [Page 5] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +5.7.1. KRB_PRIV definition . . . . . . . . . . . . . . . . . . . . . 90 +5.8. KRB_CRED message specification . . . . . . . . . . . . . . . . 91 +5.8.1. KRB_CRED definition . . . . . . . . . . . . . . . . . . . . . 91 +5.9. Error message specification . . . . . . . . . . . . . . . . . . 93 +5.9.1. KRB_ERROR definition . . . . . . . . . . . . . . . . . . . . 93 +5.10. Application Tag Numbers . . . . . . . . . . . . . . . . . . . 95 +6. Naming Constraints . . . . . . . . . . . . . . . . . . . . . . . 96 +6.1. Realm Names . . . . . . . . . . . . . . . . . . . . . . . . . . 96 +6.2. Principal Names . . . . . . . . . . . . . . . . . . . . . . . . 98 +6.2.1. Name of server principals . . . . . . . . . . . . . . . . . . 99 +7. Constants and other defined values . . . . . . . . . . . . . . . 100 +7.1. Host address types . . . . . . . . . . . . . . . . . . . . . . 100 +7.2. KDC messaging - IP Transports . . . . . . . . . . . . . . . . . 101 +7.2.1. UDP/IP transport . . . . . . . . . . . . . . . . . . . . . . 101 +7.2.2. TCP/IP transport . . . . . . . . . . . . . . . . . . . . . . 101 +7.2.3. KDC Discovery on IP Networks . . . . . . . . . . . . . . . . 103 +7.2.3.1. DNS vs. Kerberos - Case Sensitivity of Realm Names . . . . 103 +7.2.3.2. Specifying KDC Location information with DNS SRV + records . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 +7.2.3.3. KDC Discovery for Domain Style Realm Names on IP + Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 +7.3. Name of the TGS . . . . . . . . . . . . . . . . . . . . . . . . 104 +7.4. OID arc for KerberosV5 . . . . . . . . . . . . . . . . . . . . 104 +7.5. Protocol constants and associated values . . . . . . . . . . . 104 +7.5.1. Key usage numbers . . . . . . . . . . . . . . . . . . . . . . 105 +7.5.2. PreAuthentication Data Types . . . . . . . . . . . . . . . . 106 +7.5.3. Address Types . . . . . . . . . . . . . . . . . . . . . . . . 107 +7.5.4. Authorization Data Types . . . . . . . . . . . . . . . . . . 107 +7.5.5. Transited Encoding Types . . . . . . . . . . . . . . . . . . 107 +7.5.6. Protocol Version Number . . . . . . . . . . . . . . . . . . . 107 +7.5.7. Kerberos Message Types . . . . . . . . . . . . . . . . . . . 108 +7.5.8. Name Types . . . . . . . . . . . . . . . . . . . . . . . . . 108 +7.5.9. Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . 108 +8. Interoperability requirements . . . . . . . . . . . . . . . . . . 110 +8.1. Specification 2 . . . . . . . . . . . . . . . . . . . . . . . . 110 +8.2. Recommended KDC values . . . . . . . . . . . . . . . . . . . . 113 +9. IANA considerations . . . . . . . . . . . . . . . . . . . . . . . 113 +10. Security Considerations . . . . . . . . . . . . . . . . . . . . 113 +11. Author's Addresses . . . . . . . . . . . . . . . . . . . . . . . 117 +12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 117 +13. REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 +A. ASN.1 module . . . . . . . . . . . . . . . . . . . . . . . . . . 120 +B. Changes since RFC-1510 . . . . . . . . . . . . . . . . . . . . . 129 +END NOTES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 + + + + + + + +March 2003 [Page 6] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +1. Introduction + + Kerberos provides a means of verifying the identities of principals, + (e.g. a workstation user or a network server) on an open + (unprotected) network. This is accomplished without relying on + assertions by the host operating system, without basing trust on host + addresses, without requiring physical security of all the hosts on + the network, and under the assumption that packets traveling along + the network can be read, modified, and inserted at will[1]. Kerberos + performs authentication under these conditions as a trusted third- + party authentication service by using conventional (shared secret key + [2]) cryptography. Kerberos extensions (outside the scope of this + document) can provide for the use of public key cryptography during + certain phases of the authentication protocol [@RFCE: if PKINIT + advances concurrently include reference to the RFC here]. Such + extensions support Kerberos authentication for users registered with + public key certification authorities and provide certain benefits of + public key cryptography in situations where they are needed. + + The basic Kerberos authentication process proceeds as follows: A + client sends a request to the authentication server (AS) requesting + "credentials" for a given server. The AS responds with these + credentials, encrypted in the client's key. The credentials consist + of a "ticket" for the server and a temporary encryption key (often + called a "session key"). The client transmits the ticket (which + contains the client's identity and a copy of the session key, all + encrypted in the server's key) to the server. The session key (now + shared by the client and server) is used to authenticate the client, + and may optionally be used to authenticate the server. It may also be + used to encrypt further communication between the two parties or to + exchange a separate sub-session key to be used to encrypt further + communication. + + Implementation of the basic protocol consists of one or more + authentication servers running on physically secure hosts. The + authentication servers maintain a database of principals (i.e., users + and servers) and their secret keys. Code libraries provide encryption + and implement the Kerberos protocol. In order to add authentication + to its transactions, a typical network application adds one or two + calls to the Kerberos library directly or through the Generic + Security Services Application Programming Interface, GSSAPI, + described in separate document [ref to GSSAPI RFC]. These calls + result in the transmission of the necessary messages to achieve + authentication. + + The Kerberos protocol consists of several sub-protocols (or + exchanges). There are two basic methods by which a client can ask a + Kerberos server for credentials. In the first approach, the client + + + +March 2003 [Page 7] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + sends a cleartext request for a ticket for the desired server to the + AS. The reply is sent encrypted in the client's secret key. Usually + this request is for a ticket-granting ticket (TGT) which can later be + used with the ticket-granting server (TGS). In the second method, + the client sends a request to the TGS. The client uses the TGT to + authenticate itself to the TGS in the same manner as if it were + contacting any other application server that requires Kerberos + authentication. The reply is encrypted in the session key from the + TGT. Though the protocol specification describes the AS and the TGS + as separate servers, they are implemented in practice as different + protocol entry points within a single Kerberos server. + + Once obtained, credentials may be used to verify the identity of the + principals in a transaction, to ensure the integrity of messages + exchanged between them, or to preserve privacy of the messages. The + application is free to choose whatever protection may be necessary. + + To verify the identities of the principals in a transaction, the + client transmits the ticket to the application server. Since the + ticket is sent "in the clear" (parts of it are encrypted, but this + encryption doesn't thwart replay) and might be intercepted and reused + by an attacker, additional information is sent to prove that the + message originated with the principal to whom the ticket was issued. + This information (called the authenticator) is encrypted in the + session key, and includes a timestamp. The timestamp proves that the + message was recently generated and is not a replay. Encrypting the + authenticator in the session key proves that it was generated by a + party possessing the session key. Since no one except the requesting + principal and the server know the session key (it is never sent over + the network in the clear) this guarantees the identity of the client. + + The integrity of the messages exchanged between principals can also + be guaranteed using the session key (passed in the ticket and + contained in the credentials). This approach provides detection of + both replay attacks and message stream modification attacks. It is + accomplished by generating and transmitting a collision-proof + checksum (elsewhere called a hash or digest function) of the client's + message, keyed with the session key. Privacy and integrity of the + messages exchanged between principals can be secured by encrypting + the data to be passed using the session key contained in the ticket + or the sub-session key found in the authenticator. + + The authentication exchanges mentioned above require read-only access + to the Kerberos database. Sometimes, however, the entries in the + database must be modified, such as when adding new principals or + changing a principal's key. This is done using a protocol between a + client and a third Kerberos server, the Kerberos Administration + Server (KADM). There is also a protocol for maintaining multiple + + + +March 2003 [Page 8] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + copies of the Kerberos database. Neither of these protocols are + described in this document. + +1.1. Cross-realm operation + + The Kerberos protocol is designed to operate across organizational + boundaries. A client in one organization can be authenticated to a + server in another. Each organization wishing to run a Kerberos server + establishes its own "realm". The name of the realm in which a client + is registered is part of the client's name, and can be used by the + end-service to decide whether to honor a request. + + By establishing "inter-realm" keys, the administrators of two realms + can allow a client authenticated in the local realm to prove its + identity to servers in other realms[3]. The exchange of inter-realm + keys (a separate key may be used for each direction) registers the + ticket-granting service of each realm as a principal in the other + realm. A client is then able to obtain a ticket-granting ticket for + the remote realm's ticket-granting service from its local realm. When + that ticket-granting ticket is used, the remote ticket-granting + service uses the inter-realm key (which usually differs from its own + normal TGS key) to decrypt the ticket-granting ticket, and is thus + certain that it was issued by the client's own TGS. Tickets issued by + the remote ticket-granting service will indicate to the end-service + that the client was authenticated from another realm. + + A realm is said to communicate with another realm if the two realms + share an inter-realm key, or if the local realm shares an inter-realm + key with an intermediate realm that communicates with the remote + realm. An authentication path is the sequence of intermediate realms + that are transited in communicating from one realm to another. + + Realms may be organized hierarchically. Each realm shares a key with + its parent and a different key with each child. If an inter-realm key + is not directly shared by two realms, the hierarchical organization + allows an authentication path to be easily constructed. If a + hierarchical organization is not used, it may be necessary to consult + a database in order to construct an authentication path between + realms. + + Although realms are typically hierarchical, intermediate realms may + be bypassed to achieve cross-realm authentication through alternate + authentication paths (these might be established to make + communication between two realms more efficient). It is important for + the end-service to know which realms were transited when deciding how + much faith to place in the authentication process. To facilitate this + decision, a field in each ticket contains the names of the realms + that were involved in authenticating the client. + + + +March 2003 [Page 9] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + The application server is ultimately responsible for accepting or + rejecting authentication and SHOULD check the transited field. The + application server may choose to rely on the KDC for the application + server's realm to check the transited field. The application server's + KDC will set the TRANSITED-POLICY-CHECKED flag in this case. The KDCs + for intermediate realms may also check the transited field as they + issue ticket-granting tickets for other realms, but they are + encouraged not to do so. A client may request that the KDCs not check + the transited field by setting the DISABLE-TRANSITED-CHECK flag. KDCs + are encouraged but not required to honor this flag. + +1.2. Choosing a principal with which to communicate + + The Kerberos protocol provides the means for verifying (subject to + the assumptions in 1.5) that the entity with which one communicates + is the same entity that was registered with the KDC using the claimed + identity (principal name). It is still necessary to determine whether + that identity corresponds to the entity with which one intends to + communicate. + + When appropriate data has been exchanged in advance, this + determination may be performed syntactically by the application based + on the application protocol specification, information provided by + the user, and configuration files. For example, the server principal + name (including realm) for a telnet server might be derived from the + user specified host name (from the telnet command line), the "host/" + prefix specified in the application protocol specification, and a + mapping to a Kerberos realm derived syntactically from the domain + part of the specified hostname and information from the local + Kerberos realms database. + + One can also rely on trusted third parties to make this + determination, but only when the data obtained from the third party + is suitably integrity protected while resident on the third party + server and when transmitted. Thus, for example, one should not rely + on an unprotected domain name system record to map a host alias to + the primary name of a server, accepting the primary name as the party + one intends to contact, since an attacker can modify the mapping and + impersonate the party with which one intended to communicate. + + Implementations of Kerberos and protocols based on Kerberos MUST NOT + use insecure DNS queries to canonicalize the hostname components of + the service principal names. In an environment without secure name + service, application authors MAY append a statically configured + domain name to unqualified hostnames before passing the name to the + security mechanisms, but should do no more than that. Secure name + service facilities, if available, might be trusted for hostname + canonicalization, but such canonicalization by the client SHOULD NOT + + + +March 2003 [Page 10] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + be required by an KDC implementation. + + Implementation note: Many current implementations do some degree of + canonicalization of the provided service name, often using DNS even + though it creates security problems. However there is no consistency + among implementations about whether the service name is case folded + to lower case or whether reverse resolution is used. To maximize + interoperability and security, applications SHOULD provide security + mechanisms with names which result from folding the user-entered name + to lower case, without performing any other modifications or + canonicalization. + +1.3. Authorization + + As an authentication service, Kerberos provides a means of verifying + the identity of principals on a network. Authentication is usually + useful primarily as a first step in the process of authorization, + determining whether a client may use a service, which objects the + client is allowed to access, and the type of access allowed for each. + Kerberos does not, by itself, provide authorization. Possession of a + client ticket for a service provides only for authentication of the + client to that service, and in the absence of a separate + authorization procedure, it should not be considered by an + application as authorizing the use of that service. + + Such separate authorization methods MAY be implemented as application + specific access control functions and may utilize files on the + application server, or on separately issued authorization credentials + such as those based on proxies [Neu93], or on other authorization + services. Separately authenticated authorization credentials MAY be + embedded in a ticket's authorization data when encapsulated by the + KDC-issued authorization data element. + + Applications should not accept the mere issuance of a service ticket + by the Kerberos server (even by a modified Kerberos server) as + granting authority to use the service, since such applications may + become vulnerable to the bypass of this authorization check in an + environment if they interoperate with other KDCs or where other + options for application authentication (e.g. the PKTAPP proposal) + are provided. + +1.4. Extending Kerberos Without Breaking Interoperability + + As the deployed base of Kerberos implementations grows, extending + Kerberos becomes more important. Unfortunately some extensions to the + existing Kerberos protocol create interoperability issues because of + uncertainty regarding the treatment of certain extensibility options + by some implementations. This section includes guidelines that will + + + +March 2003 [Page 11] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + enable future implementations to maintain interoperability. + + Kerberos provides a general mechanism for protocol extensibility. + Some protocol messages contain typed holes -- sub-messages that + contain an octet-string along with an integer that defines how to + interpret the octet-string. The integer types are registered + centrally, but can be used both for vendor extensions and for + extensions standardized through the IETF. + +1.4.1. Compatibility with RFC 1510 + + It is important to note that existing Kerberos message formats can + not be readily extended by adding fields to the ASN.1 types. Sending + additional fields often results in the entire message being discarded + without an error indication. Future versions of this specification + will provide guidelines to ensure that ASN.1 fields can be added + without creating an interoperability problem. + + In the meantime, all new or modified implementations of Kerberos that + receive an unknown message extension SHOULD preserve the encoding of + the extension but otherwise ignore the presence of the extension. + Recipients MUST NOT decline a request simply because an extension is + present. + + There is one exception to this rule. If an unknown authorization data + element type is received by a server other than the ticket granting + service either in an AP-REQ or in a ticket contained in an AP-REQ, + then authentication MUST fail. One of the primary uses of + authorization data is to restrict the use of the ticket. If the + service cannot determine whether the restriction applies to that + service then a security weakness may result if the ticket can be used + for that service. Authorization elements that are optional SHOULD be + enclosed in the AD-IF-RELEVANT element. + + The ticket granting service MUST ignore but propagate to derivative + tickets any unknown authorization data types, unless those data types + are embedded in a MANDATORY-FOR-KDC element, in which case the + request will be rejected. This behavior is appropriate because + requiring that the ticket granting service understand unknown + authorization data types would require that KDC software be upgraded + to understand new application-level restrictions before applications + used these restrictions, decreasing the utility of authorization data + as a mechanism for restricting the use of tickets. No security + problem is created because services to which the tickets are issued + will verify the authorization data. + + Implementation note: Many RFC 1510 implementations ignore unknown + authorization data elements. Depending on these implementations to + + + +March 2003 [Page 12] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + honor authorization data restrictions may create a security weakness. + +1.4.2. Sending Extensible Messages + + Care must be taken to ensure that old implementations can understand + messages sent to them even if they do not understand an extension + that is used. Unless the sender knows an extension is supported, the + extension cannot change the semantics of the core message or + previously defined extensions. + + For example, an extension including key information necessary to + decrypt the encrypted part of a KDC-REP could only be used in + situations where the recipient was known to support the extension. + Thus when designing such extensions it is important to provide a way + for the recipient to notify the sender of support for the extension. + For example in the case of an extension that changes the KDC-REP + reply key, the client could indicate support for the extension by + including a padata element in the AS-REQ sequence. The KDC should + only use the extension if this padata element is present in the AS- + REQ. Even if policy requires the use of the extension, it is better + to return an error indicating that the extension is required than to + use the extension when the recipient may not support it; debugging + why implementations do not interoperate is easier when errors are + returned. + +1.5. Environmental assumptions + + Kerberos imposes a few assumptions on the environment in which it can + properly function: + + * "Denial of service" attacks are not solved with Kerberos. There + are places in the protocols where an intruder can prevent an + application from participating in the proper authentication steps. + Detection and solution of such attacks (some of which can appear + to be not-uncommon "normal" failure modes for the system) is + usually best left to the human administrators and users. + + * Principals MUST keep their secret keys secret. If an intruder + somehow steals a principal's key, it will be able to masquerade as + that principal or impersonate any server to the legitimate + principal. + + * "Password guessing" attacks are not solved by Kerberos. If a user + chooses a poor password, it is possible for an attacker to + successfully mount an offline dictionary attack by repeatedly + attempting to decrypt, with successive entries from a dictionary, + messages obtained which are encrypted under a key derived from the + user's password. + + + +March 2003 [Page 13] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + * Each host on the network MUST have a clock which is "loosely + synchronized" to the time of the other hosts; this synchronization + is used to reduce the bookkeeping needs of application servers + when they do replay detection. The degree of "looseness" can be + configured on a per-server basis, but is typically on the order of + 5 minutes. If the clocks are synchronized over the network, the + clock synchronization protocol MUST itself be secured from network + attackers. + + * Principal identifiers are not recycled on a short-term basis. A + typical mode of access control will use access control lists + (ACLs) to grant permissions to particular principals. If a stale + ACL entry remains for a deleted principal and the principal + identifier is reused, the new principal will inherit rights + specified in the stale ACL entry. By not re-using principal + identifiers, the danger of inadvertent access is removed. + +1.6. Glossary of terms + + Below is a list of terms used throughout this document. + + Authentication + Verifying the claimed identity of a principal. + + Authentication header + A record containing a Ticket and an Authenticator to be presented + to a server as part of the authentication process. + + Authentication path + A sequence of intermediate realms transited in the authentication + process when communicating from one realm to another. + + Authenticator + A record containing information that can be shown to have been + recently generated using the session key known only by the client + and server. + + Authorization + The process of determining whether a client may use a service, + which objects the client is allowed to access, and the type of + access allowed for each. + + Capability + A token that grants the bearer permission to access an object or + service. In Kerberos, this might be a ticket whose use is + restricted by the contents of the authorization data field, but + which lists no network addresses, together with the session key + necessary to use the ticket. + + + +March 2003 [Page 14] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Ciphertext + The output of an encryption function. Encryption transforms + plaintext into ciphertext. + + Client + A process that makes use of a network service on behalf of a user. + Note that in some cases a Server may itself be a client of some + other server (e.g. a print server may be a client of a file + server). + + Credentials + A ticket plus the secret session key necessary to successfully use + that ticket in an authentication exchange. + + Encryption Type (etype) + When associated with encrypted data, an encryption type identifies + the algorithm used to encrypt the data and is used to select the + appropriate algorithm for decrypting the data. Encryption type + tags are communicated in other messages to enumerate algorithms + that are desired, supported, preferred, or allowed to be used for + encryption of data between parties. This preference is combined + with local information and policy to select an algorithm to be + used. + + KDC + Key Distribution Center, a network service that supplies tickets + and temporary session keys; or an instance of that service or the + host on which it runs. The KDC services both initial ticket and + ticket-granting ticket requests. The initial ticket portion is + sometimes referred to as the Authentication Server (or service). + The ticket-granting ticket portion is sometimes referred to as the + ticket-granting server (or service). + + Kerberos + The name given to the Project Athena's authentication service, the + protocol used by that service, or the code used to implement the + authentication service. The name is adopted from the three-headed + dog which guards Hades. + + Key Version Number (kvno) + A tag associated with encrypted data identifies which key was used + for encryption when a long lived key associated with a principal + changes over time. It is used during the transition to a new key + so that the party decrypting a message can tell whether the data + was encrypted using the old or the new key. + + Plaintext + The input to an encryption function or the output of a decryption + + + +March 2003 [Page 15] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + function. Decryption transforms ciphertext into plaintext. + + Principal + A named client or server entity that participates in a network + communication, with one name that is considered canonical. + + Principal identifier + The canonical name used to uniquely identify each different + principal. + + Seal + To encipher a record containing several fields in such a way that + the fields cannot be individually replaced without either + knowledge of the encryption key or leaving evidence of tampering. + + Secret key + An encryption key shared by a principal and the KDC, distributed + outside the bounds of the system, with a long lifetime. In the + case of a human user's principal, the secret key MAY be derived + from a password. + + Server + A particular Principal which provides a resource to network + clients. The server is sometimes referred to as the Application + Server. + + Service + A resource provided to network clients; often provided by more + than one server (for example, remote file service). + + Session key + A temporary encryption key used between two principals, with a + lifetime limited to the duration of a single login "session". + + Sub-session key + A temporary encryption key used between two principals, selected + and exchanged by the principals using the session key, and with a + lifetime limited to the duration of a single association. + + Ticket + A record that helps a client authenticate itself to a server; it + contains the client's identity, a session key, a timestamp, and + other information, all sealed using the server's secret key. It + only serves to authenticate a client when presented along with a + fresh Authenticator. + + +2. Ticket flag uses and requests + + + +March 2003 [Page 16] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Each Kerberos ticket contains a set of flags which are used to + indicate attributes of that ticket. Most flags may be requested by a + client when the ticket is obtained; some are automatically turned on + and off by a Kerberos server as required. The following sections + explain what the various flags mean and give examples of reasons to + use them. With the exception of the INVALID flag clients MUST ignore + ticket flags that are not recognized. KDCs MUST ignore KDC options + that are not recognized. Some implementations of RFC 1510 are known + to reject unknown KDC options, so clients may need to resend a + request without KDC new options absent if the request was rejected + when sent with option added since RFC 1510. Since new KDCs will + ignore unknown options, clients MUST confirm that the ticket returned + by the KDC meets their needs. + + Note that it is not, in general, possible to determine whether an + option was not honored because it was not understood or because it + was rejected either through configuration or policy. When adding a + new option to the Kerberos protocol, designers should consider + whether the distinction is important for their option. In cases where + it is, a mechanism for the KDC to return an indication that the + option was understood but rejected needs to be provided in the + specification of the option. Often in such cases, the mechanism needs + to be broad enough to permit an error or reason to be returned. + +2.1. Initial, pre-authenticated, and hardware authenticated tickets + + The INITIAL flag indicates that a ticket was issued using the AS + protocol, rather than issued based on a ticket-granting ticket. + Application servers that want to require the demonstrated knowledge + of a client's secret key (e.g. a password-changing program) can + insist that this flag be set in any tickets they accept, and thus be + assured that the client's key was recently presented to the + application client. + + The PRE-AUTHENT and HW-AUTHENT flags provide additional information + about the initial authentication, regardless of whether the current + ticket was issued directly (in which case INITIAL will also be set) + or issued on the basis of a ticket-granting ticket (in which case the + INITIAL flag is clear, but the PRE-AUTHENT and HW-AUTHENT flags are + carried forward from the ticket-granting ticket). + +2.2. Invalid tickets + + The INVALID flag indicates that a ticket is invalid. Application + servers MUST reject tickets which have this flag set. A postdated + ticket will be issued in this form. Invalid tickets MUST be validated + by the KDC before use, by presenting them to the KDC in a TGS request + with the VALIDATE option specified. The KDC will only validate + + + +March 2003 [Page 17] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + tickets after their starttime has passed. The validation is required + so that postdated tickets which have been stolen before their + starttime can be rendered permanently invalid (through a hot-list + mechanism) (see section 3.3.3.1). + +2.3. Renewable tickets + + Applications may desire to hold tickets which can be valid for long + periods of time. However, this can expose their credentials to + potential theft for equally long periods, and those stolen + credentials would be valid until the expiration time of the + ticket(s). Simply using short-lived tickets and obtaining new ones + periodically would require the client to have long-term access to its + secret key, an even greater risk. Renewable tickets can be used to + mitigate the consequences of theft. Renewable tickets have two + "expiration times": the first is when the current instance of the + ticket expires, and the second is the latest permissible value for an + individual expiration time. An application client must periodically + (i.e. before it expires) present a renewable ticket to the KDC, with + the RENEW option set in the KDC request. The KDC will issue a new + ticket with a new session key and a later expiration time. All other + fields of the ticket are left unmodified by the renewal process. When + the latest permissible expiration time arrives, the ticket expires + permanently. At each renewal, the KDC MAY consult a hot-list to + determine if the ticket had been reported stolen since its last + renewal; it will refuse to renew such stolen tickets, and thus the + usable lifetime of stolen tickets is reduced. + + The RENEWABLE flag in a ticket is normally only interpreted by the + ticket-granting service (discussed below in section 3.3). It can + usually be ignored by application servers. However, some particularly + careful application servers MAY disallow renewable tickets. + + If a renewable ticket is not renewed by its expiration time, the KDC + will not renew the ticket. The RENEWABLE flag is reset by default, + but a client MAY request it be set by setting the RENEWABLE option in + the KRB_AS_REQ message. If it is set, then the renew-till field in + the ticket contains the time after which the ticket may not be + renewed. + +2.4. Postdated tickets + + Applications may occasionally need to obtain tickets for use much + later, e.g. a batch submission system would need tickets to be valid + at the time the batch job is serviced. However, it is dangerous to + hold valid tickets in a batch queue, since they will be on-line + longer and more prone to theft. Postdated tickets provide a way to + obtain these tickets from the KDC at job submission time, but to + + + +March 2003 [Page 18] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + leave them "dormant" until they are activated and validated by a + further request of the KDC. If a ticket theft were reported in the + interim, the KDC would refuse to validate the ticket, and the thief + would be foiled. + + The MAY-POSTDATE flag in a ticket is normally only interpreted by the + ticket-granting service. It can be ignored by application servers. + This flag MUST be set in a ticket-granting ticket in order to issue a + postdated ticket based on the presented ticket. It is reset by + default; it MAY be requested by a client by setting the ALLOW- + POSTDATE option in the KRB_AS_REQ message. This flag does not allow + a client to obtain a postdated ticket-granting ticket; postdated + ticket-granting tickets can only by obtained by requesting the + postdating in the KRB_AS_REQ message. The life (endtime-starttime) of + a postdated ticket will be the remaining life of the ticket-granting + ticket at the time of the request, unless the RENEWABLE option is + also set, in which case it can be the full life (endtime-starttime) + of the ticket-granting ticket. The KDC MAY limit how far in the + future a ticket may be postdated. + + The POSTDATED flag indicates that a ticket has been postdated. The + application server can check the authtime field in the ticket to see + when the original authentication occurred. Some services MAY choose + to reject postdated tickets, or they may only accept them within a + certain period after the original authentication. When the KDC issues + a POSTDATED ticket, it will also be marked as INVALID, so that the + application client MUST present the ticket to the KDC to be validated + before use. + +2.5. Proxiable and proxy tickets + + At times it may be necessary for a principal to allow a service to + perform an operation on its behalf. The service must be able to take + on the identity of the client, but only for a particular purpose. A + principal can allow a service to take on the principal's identity for + a particular purpose by granting it a proxy. + + The process of granting a proxy using the proxy and proxiable flags + is used to provide credentials for use with specific services. Though + conceptually also a proxy, users wishing to delegate their identity + in a form usable for all purpose MUST use the ticket forwarding + mechanism described in the next section to forward a ticket-granting + ticket. + + The PROXIABLE flag in a ticket is normally only interpreted by the + ticket-granting service. It can be ignored by application servers. + When set, this flag tells the ticket-granting server that it is OK to + issue a new ticket (but not a ticket-granting ticket) with a + + + +March 2003 [Page 19] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + different network address based on this ticket. This flag is set if + requested by the client on initial authentication. By default, the + client will request that it be set when requesting a ticket-granting + ticket, and reset when requesting any other ticket. + + This flag allows a client to pass a proxy to a server to perform a + remote request on its behalf (e.g. a print service client can give + the print server a proxy to access the client's files on a particular + file server in order to satisfy a print request). + + In order to complicate the use of stolen credentials, Kerberos + tickets are usually valid from only those network addresses + specifically included in the ticket[4]. When granting a proxy, the + client MUST specify the new network address from which the proxy is + to be used, or indicate that the proxy is to be issued for use from + any address. + + The PROXY flag is set in a ticket by the TGS when it issues a proxy + ticket. Application servers MAY check this flag and at their option + they MAY require additional authentication from the agent presenting + the proxy in order to provide an audit trail. + +2.6. Forwardable tickets + + Authentication forwarding is an instance of a proxy where the service + granted is complete use of the client's identity. An example where it + might be used is when a user logs in to a remote system and wants + authentication to work from that system as if the login were local. + + The FORWARDABLE flag in a ticket is normally only interpreted by the + ticket-granting service. It can be ignored by application servers. + The FORWARDABLE flag has an interpretation similar to that of the + PROXIABLE flag, except ticket-granting tickets may also be issued + with different network addresses. This flag is reset by default, but + users MAY request that it be set by setting the FORWARDABLE option in + the AS request when they request their initial ticket-granting + ticket. + + This flag allows for authentication forwarding without requiring the + user to enter a password again. If the flag is not set, then + authentication forwarding is not permitted, but the same result can + still be achieved if the user engages in the AS exchange specifying + the requested network addresses and supplies a password. + + The FORWARDED flag is set by the TGS when a client presents a ticket + with the FORWARDABLE flag set and requests a forwarded ticket by + specifying the FORWARDED KDC option and supplying a set of addresses + for the new ticket. It is also set in all tickets issued based on + + + +March 2003 [Page 20] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + tickets with the FORWARDED flag set. Application servers may choose + to process FORWARDED tickets differently than non-FORWARDED tickets. + + If addressless tickets are forwarded from one system to another, + clients SHOULD still use this option to obtain a new TGT in order to + have different session keys on the different systems. + +2.7. Transited Policy Checking + + In Kerberos, the application server is ultimately responsible for + accepting or rejecting authentication and SHOULD check that only + suitably trusted KDCs are relied upon to authenticate a principal. + The transited field in the ticket identifies which realms (and thus + which KDCs) were involved in the authentication process and an + application server would normally check this field. If any of these + are untrusted to authenticate the indicated client principal + (probably determined by a realm-based policy), the authentication + attempt MUST be rejected. The presence of trusted KDCs in this list + does not provide any guarantee; an untrusted KDC may have fabricated + the list. + + While the end server ultimately decides whether authentication is + valid, the KDC for the end server's realm MAY apply a realm specific + policy for validating the transited field and accepting credentials + for cross-realm authentication. When the KDC applies such checks and + accepts such cross-realm authentication it will set the TRANSITED- + POLICY-CHECKED flag in the service tickets it issues based on the + cross-realm TGT. A client MAY request that the KDCs not check the + transited field by setting the DISABLE-TRANSITED-CHECK flag. KDCs are + encouraged but not required to honor this flag. + + Application servers MUST either do the transited-realm checks + themselves, or reject cross-realm tickets without TRANSITED-POLICY- + CHECKED set. + +2.8. OK as Delegate + + For some applications a client may need to delegate authority to a + server to act on its behalf in contacting other services. This + requires that the client forward credentials to an intermediate + server. The ability for a client to obtain a service ticket to a + server conveys no information to the client about whether the server + should be trusted to accept delegated credentials. The OK-AS- + DELEGATE provides a way for a KDC to communicate local realm policy + to a client regarding whether an intermediate server is trusted to + accept such credentials. + + The OK-AS-DELEGATE flag from the copy of the ticket flags in the + + + +March 2003 [Page 21] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + encrypted part of the KDC reply indicates to the client that the + server (not the client) specified in the ticket has been determined + by policy of the realm to be a suitable recipient of delegation. A + client can use the presence of this flag to help it make a decision + whether to delegate credentials (either grant a proxy or a forwarded + ticket-granting ticket) to this server. Ignore the value of this + flag. When setting this flag, an administrator should consider the + Security and placement of the server on which the service will run, + as well as whether the service requires the use of delegated + credentials. + +2.9. Other KDC options + + There are three additional options which MAY be set in a client's + request of the KDC. + +2.9.1. Renewable-OK + + The RENEWABLE-OK option indicates that the client will accept a + renewable ticket if a ticket with the requested life cannot otherwise + be provided. If a ticket with the requested life cannot be provided, + then the KDC MAY issue a renewable ticket with a renew-till equal to + the requested endtime. The value of the renew-till field MAY still be + adjusted by site-determined limits or limits imposed by the + individual principal or server. + +2.9.2. ENC-TKT-IN-SKEY + + In its basic form the Kerberos protocol supports authentication in a + client-server + setting and is not well suited to authentication in a peer-to-peer + environment because the long term key of the user does not remain on + the workstation after initial login. Authentication of such peers may + be supported by Kerberos in its user-to-user variant. The ENC-TKT-IN- + SKEY option supports user-to-user authentication by allowing the KDC + to issue a service ticket encrypted using the session key from + another ticket-granting ticket issued to another user. The ENC-TKT- + IN-SKEY option is honored only by the ticket-granting service. It + indicates that the ticket to be issued for the end server is to be + encrypted in the session key from the additional second ticket- + granting ticket provided with the request. See section 3.3.3 for + specific details. + +2.9.3. Passwordless Hardware Authentication + + The OPT-HARDWARE-AUTH option indicates that the client wishes to use + some form of hardware authentication instead of or in addition to the + client's password or other long-lived encryption key. OPT-HARDWARE- + + + +March 2003 [Page 22] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + AUTH is honored only by the authentication service. If supported and + allowed by policy, the KDC will return an errorcode + KDC_ERR_PREAUTH_REQUIRED and include the required METHOD-DATA to + perform such authentication. + +3. Message Exchanges + + The following sections describe the interactions between network + clients and servers and the messages involved in those exchanges. + +3.1. The Authentication Service Exchange + + Summary + + Message direction Message type Section + 1. Client to Kerberos KRB_AS_REQ 5.4.1 + 2. Kerberos to client KRB_AS_REP or 5.4.2 + KRB_ERROR 5.9.1 + + The Authentication Service (AS) Exchange between the client and the + Kerberos Authentication Server is initiated by a client when it + wishes to obtain authentication credentials for a given server but + currently holds no credentials. In its basic form, the client's + secret key is used for encryption and decryption. This exchange is + typically used at the initiation of a login session to obtain + credentials for a Ticket-Granting Server which will subsequently be + used to obtain credentials for other servers (see section 3.3) + without requiring further use of the client's secret key. This + exchange is also used to request credentials for services which must + not be mediated through the Ticket-Granting Service, but rather + require a principal's secret key, such as the password-changing + service[5]. This exchange does not by itself provide any assurance of + the identity of the user[6]. + + The exchange consists of two messages: KRB_AS_REQ from the client to + Kerberos, and KRB_AS_REP or KRB_ERROR in reply. The formats for these + messages are described in sections 5.4.1, 5.4.2, and 5.9.1. + + In the request, the client sends (in cleartext) its own identity and + the identity of the server for which it is requesting credentials, + other information about the credentials it is requesting, and a + randomly generated nonce which can be used to detect replays, and to + associate replies with the matching requests. This nonce MUST be + generated randomly by the client and remembered for checking against + the nonce in the expected reply. The response, KRB_AS_REP, contains a + ticket for the client to present to the server, and a session key + that will be shared by the client and the server. The session key + and additional information are encrypted in the client's secret key. + + + +March 2003 [Page 23] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + The encrypted part of the KRB_AS_REP message also contains the nonce + which MUST be matched with the nonce from the KRB_AS_REQ message. + + Without pre-authentication, the authentication server does not know + whether the client is actually the principal named in the request. It + simply sends a reply without knowing or caring whether they are the + same. This is acceptable because nobody but the principal whose + identity was given in the request will be able to use the reply. Its + critical information is encrypted in that principal's key. However, + an attacker can send a KRB_AS_REQ message to get known plaintext in + order to attack the principal's key. Especially if the key is based + on a password, this may create a security exposure. So, the initial + request supports an optional field that can be used to pass + additional information that might be needed for the initial exchange. + This field SHOULD be used for pre-authentication as described in + sections 3.1.1 and 5.2.7. + + Various errors can occur; these are indicated by an error response + (KRB_ERROR) instead of the KRB_AS_REP response. The error message is + not encrypted. The KRB_ERROR message contains information which can + be used to associate it with the message to which it replies. The + contents of the KRB_ERROR message are not integrity-protected. As + such, the client cannot detect replays, fabrications or + modifications. A solution to this problem will be included in a + future version of the protocol. + +3.1.1. Generation of KRB_AS_REQ message + + The client may specify a number of options in the initial request. + Among these options are whether pre-authentication is to be + performed; whether the requested ticket is to be renewable, + proxiable, or forwardable; whether it should be postdated or allow + postdating of derivative tickets; and whether a renewable ticket will + be accepted in lieu of a non-renewable ticket if the requested ticket + expiration date cannot be satisfied by a non-renewable ticket (due to + configuration constraints). + + The client prepares the KRB_AS_REQ message and sends it to the KDC. + +3.1.2. Receipt of KRB_AS_REQ message + + If all goes well, processing the KRB_AS_REQ message will result in + the creation of a ticket for the client to present to the server. The + format for the ticket is described in section 5.3. The contents of + the ticket are determined as follows. + + Because Kerberos can run over unreliable transports such as UDP, the + KDC MUST be prepared to retransmit responses in case they are lost. + + + +March 2003 [Page 24] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + If a KDC receives a request identical to one it has recently + successfully processed, the KDC MUST respond with a KRB_AS_REP + message rather than a replay error. In order to reduce ciphertext + given to a potential attacker, KDCs MAY send the same response + generated when the request was first handled. KDCs MUST obey this + replay behavior even if the actual transport in use is reliable. + +3.1.3. Generation of KRB_AS_REP message + + The authentication server looks up the client and server principals + named in the KRB_AS_REQ in its database, extracting their respective + keys. If the requested client principal named in the request is not + known because it doesn't exist in the KDC's principal database, then + an error message with a KDC_ERR_C_PRINCIPAL_UNKNOWN is returned. + + If required, the server pre-authenticates the request, and if the + pre-authentication check fails, an error message with the code + KDC_ERR_PREAUTH_FAILED is returned. If pre-authentication is + required, but was not present in the request, an error message with + the code KDC_ERR_PREAUTH_REQUIRED is returned and a METHOD-DATA + object will be stored in the e-data field of the KRB-ERROR message to + specify which pre-authentication mechanisms are acceptable. Usually + this will include PA-ETYPE-INFO and/or PA-ETYPE-INFO2 elements as + described below. If the server cannot accommodate any encryption type + requested by the client, an error message with code + KDC_ERR_ETYPE_NOSUPP is returned. Otherwise the KDC generates a + 'random' session key[7]. + + When responding to an AS request, if there are multiple encryption + keys registered for a client in the Kerberos database, then the etype + field from the AS request is used by the KDC to select the encryption + method to be used to protect the encrypted part of the KRB_AS_REP + message which is sent to the client. If there is more than one + supported strong encryption type in the etype list, the KDC SHOULD + use the first valid strong etype for which an encryption key is + available. + + When the user's key is generated from a password or pass phrase, the + string-to-key function for the particular encryption key type is + used, as specified in [@KCRYPTO]. The salt value and additional + parameters for the string-to-key function have default values + (specified by section 4 and by the encryption mechanism + specification, respectively) that may be overridden by pre- + authentication data (PA-PW-SALT, PA-AFS3-SALT, PA-ETYPE-INFO, PA- + ETYPE-INFO2, etc). Since the KDC is presumed to store a copy of the + resulting key only, these values should not be changed for password- + based keys except when changing the principal's key. + + + + +March 2003 [Page 25] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + When the AS server is to include pre-authentication data in a KRB- + ERROR or in an AS-REP, it MUST use PA-ETYPE-INFO2, not PA-ETYPE-INFO, + if the etype field of the client's AS-REQ lists at least one "newer" + encryption type. Otherwise (when the etype field of the client's AS- + REQ does not list any "newer" encryption types) it MUST send both, + PA-ETYPE-INFO2 and PA-ETYPE-INFO (both with an entry for each + enctype). A "newer" enctype is any enctype first officially + specified concurrently with or subsequent to the issue of this RFC. + The enctypes DES, 3DES or RC4 and any defined in [RFC1510] are not + newer enctypes. + + It is not possible to reliably generate a user's key given a pass + phrase without contacting the KDC, since it will not be known whether + alternate salt or parameter values are required. + + The KDC will attempt to assign the type of the random session key + from the list of methods in the etype field. The KDC will select the + appropriate type using the list of methods provided together with + information from the Kerberos database indicating acceptable + encryption methods for the application server. The KDC will not issue + tickets with a weak session key encryption type. + + If the requested start time is absent, indicates a time in the past, + or is within the window of acceptable clock skew for the KDC and the + POSTDATE option has not been specified, then the start time of the + ticket is set to the authentication server's current time. If it + indicates a time in the future beyond the acceptable clock skew, but + the POSTDATED option has not been specified then the error + KDC_ERR_CANNOT_POSTDATE is returned. Otherwise the requested start + time is checked against the policy of the local realm (the + administrator might decide to prohibit certain types or ranges of + postdated tickets), and if acceptable, the ticket's start time is set + as requested and the INVALID flag is set in the new ticket. The + postdated ticket MUST be validated before use by presenting it to the + KDC after the start time has been reached. + + The expiration time of the ticket will be set to the earlier of the + requested endtime and a time determined by local policy, possibly + determined using realm or principal specific factors. For example, + the expiration time MAY be set to the earliest of the following: + + * The expiration time (endtime) requested in the KRB_AS_REQ + message. + + * The ticket's start time plus the maximum allowable lifetime + associated with the client principal from the authentication + server's database. + + + + +March 2003 [Page 26] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + * The ticket's start time plus the maximum allowable lifetime + associated with the server principal. + + * The ticket's start time plus the maximum lifetime set by the + policy of the local realm. + + If the requested expiration time minus the start time (as determined + above) is less than a site-determined minimum lifetime, an error + message with code KDC_ERR_NEVER_VALID is returned. If the requested + expiration time for the ticket exceeds what was determined as above, + and if the 'RENEWABLE-OK' option was requested, then the 'RENEWABLE' + flag is set in the new ticket, and the renew-till value is set as if + the 'RENEWABLE' option were requested (the field and option names are + described fully in section 5.4.1). + + If the RENEWABLE option has been requested or if the RENEWABLE-OK + option has been set and a renewable ticket is to be issued, then the + renew-till field MAY be set to the earliest of: + + * Its requested value. + + * The start time of the ticket plus the minimum of the two + maximum renewable lifetimes associated with the principals' + database entries. + + * The start time of the ticket plus the maximum renewable + lifetime set by the policy of the local realm. + + The flags field of the new ticket will have the following options set + if they have been requested and if the policy of the local realm + allows: FORWARDABLE, MAY-POSTDATE, POSTDATED, PROXIABLE, RENEWABLE. + If the new ticket is postdated (the start time is in the future), its + INVALID flag will also be set. + + If all of the above succeed, the server will encrypt the ciphertext + part of the ticket using the encryption key extracted from the server + principal's record in the Kerberos database using the encryption type + associated with the server principal's key (this choice is NOT + affected by the etype field in the request). It then formats a + KRB_AS_REP message (see section 5.4.2), copying the addresses in the + request into the caddr of the response, placing any required pre- + authentication data into the padata of the response, and encrypts the + ciphertext part in the client's key using an acceptable encryption + method requested in the etype field of the request, or in some key + specified by pre-authentication mechanisms being used. + +3.1.4. Generation of KRB_ERROR message + + + + +March 2003 [Page 27] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Several errors can occur, and the Authentication Server responds by + returning an error message, KRB_ERROR, to the client, with the error- + code and e-text fields set to appropriate values. The error message + contents and details are described in Section 5.9.1. + +3.1.5. Receipt of KRB_AS_REP message + + If the reply message type is KRB_AS_REP, then the client verifies + that the cname and crealm fields in the cleartext portion of the + reply match what it requested. If any padata fields are present, they + may be used to derive the proper secret key to decrypt the message. + The client decrypts the encrypted part of the response using its + secret key, verifies that the nonce in the encrypted part matches the + nonce it supplied in its request (to detect replays). It also + verifies that the sname and srealm in the response match those in the + request (or are otherwise expected values), and that the host address + field is also correct. It then stores the ticket, session key, start + and expiration times, and other information for later use. The last- + req field (and the deprecated key-expiration field) from the + encrypted part of the response MAY be checked to notify the user of + impending key expiration. This enables the client program to suggest + remedial action, such as a password change. + + Upon validation of the KRB_AS_REP message (by checking the returned + nonce against that sent in the KRB_AS_REQ message) the client knows + that the current time on the KDC is that read from the authtime field + of the encrypted part of the reply. The client can optionally use + this value for clock synchronization in subsequent messages by + recording with the ticket the difference (offset) between the + authtime value and the local clock. This offset can then be used by + the same user to adjust the time read from the system clock when + generating messages [DGT96]. + + This technique MUST be used when adjusting for clock skew instead of + directly changing the system clock because the KDC reply is only + authenticated to the user whose secret key was used, but not to the + system or workstation. If the clock were adjusted, an attacker + colluding with a user logging into a workstation could agree on a + password, resulting in a KDC reply that would be correctly validated + even though it did not originate from a KDC trusted by the + workstation. + + Proper decryption of the KRB_AS_REP message is not sufficient for the + host to verify the identity of the user; the user and an attacker + could cooperate to generate a KRB_AS_REP format message which + decrypts properly but is not from the proper KDC. If the host wishes + to verify the identity of the user, it MUST require the user to + present application credentials which can be verified using a + + + +March 2003 [Page 28] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + securely-stored secret key for the host. If those credentials can be + verified, then the identity of the user can be assured. + +3.1.6. Receipt of KRB_ERROR message + + If the reply message type is KRB_ERROR, then the client interprets it + as an error and performs whatever application-specific tasks are + necessary to recover. + +3.2. The Client/Server Authentication Exchange + + Summary + Message direction Message type Section + Client to Application server KRB_AP_REQ 5.5.1 + [optional] Application server to client KRB_AP_REP or 5.5.2 + KRB_ERROR 5.9.1 + + The client/server authentication (CS) exchange is used by network + applications to authenticate the client to the server and vice versa. + The client MUST have already acquired credentials for the server + using the AS or TGS exchange. + +3.2.1. The KRB_AP_REQ message + + The KRB_AP_REQ contains authentication information which SHOULD be + part of the first message in an authenticated transaction. It + contains a ticket, an authenticator, and some additional bookkeeping + information (see section 5.5.1 for the exact format). The ticket by + itself is insufficient to authenticate a client, since tickets are + passed across the network in cleartext[8], so the authenticator is + used to prevent invalid replay of tickets by proving to the server + that the client knows the session key of the ticket and thus is + entitled to use the ticket. The KRB_AP_REQ message is referred to + elsewhere as the 'authentication header.' + +3.2.2. Generation of a KRB_AP_REQ message + + When a client wishes to initiate authentication to a server, it + obtains (either through a credentials cache, the AS exchange, or the + TGS exchange) a ticket and session key for the desired service. The + client MAY re-use any tickets it holds until they expire. To use a + ticket the client constructs a new Authenticator from the system + time, its name, and optionally an application specific checksum, an + initial sequence number to be used in KRB_SAFE or KRB_PRIV messages, + and/or a session subkey to be used in negotiations for a session key + unique to this particular session. Authenticators MAY NOT be re-used + and will be rejected if replayed to a server[9]. If a sequence number + is to be included, it SHOULD be randomly chosen so that even after + + + +March 2003 [Page 29] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + many messages have been exchanged it is not likely to collide with + other sequence numbers in use. + + The client MAY indicate a requirement of mutual authentication or the + use of a session-key based ticket (for user to user authentication - + see section 3.7) by setting the appropriate flag(s) in the ap-options + field of the message. + + The Authenticator is encrypted in the session key and combined with + the ticket to form the KRB_AP_REQ message which is then sent to the + end server along with any additional application-specific + information. + +3.2.3. Receipt of KRB_AP_REQ message + + Authentication is based on the server's current time of day (clocks + MUST be loosely synchronized), the authenticator, and the ticket. + Several errors are possible. If an error occurs, the server is + expected to reply to the client with a KRB_ERROR message. This + message MAY be encapsulated in the application protocol if its 'raw' + form is not acceptable to the protocol. The format of error messages + is described in section 5.9.1. + + The algorithm for verifying authentication information is as follows. + If the message type is not KRB_AP_REQ, the server returns the + KRB_AP_ERR_MSG_TYPE error. If the key version indicated by the Ticket + in the KRB_AP_REQ is not one the server can use (e.g., it indicates + an old key, and the server no longer possesses a copy of the old + key), the KRB_AP_ERR_BADKEYVER error is returned. If the USE-SESSION- + KEY flag is set in the ap-options field, it indicates to the server + that user-to-user authentication is in use, and that the ticket is + encrypted in the session key from the server's ticket-granting ticket + rather than in the server's secret key. See section 3.7 for a more + complete description of the affect of user to user authentication on + all messages in the Kerberos protocol. + + Since it is possible for the server to be registered in multiple + realms, with different keys in each, the srealm field in the + unencrypted portion of the ticket in the KRB_AP_REQ is used to + specify which secret key the server should use to decrypt that + ticket. The KRB_AP_ERR_NOKEY error code is returned if the server + doesn't have the proper key to decipher the ticket. + + The ticket is decrypted using the version of the server's key + specified by the ticket. If the decryption routines detect a + modification of the ticket (each encryption system MUST provide + safeguards to detect modified ciphertext; see section 6), the + KRB_AP_ERR_BAD_INTEGRITY error is returned (chances are good that + + + +March 2003 [Page 30] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + different keys were used to encrypt and decrypt). + + The authenticator is decrypted using the session key extracted from + the decrypted ticket. If decryption shows it to have been modified, + the KRB_AP_ERR_BAD_INTEGRITY error is returned. The name and realm of + the client from the ticket are compared against the same fields in + the authenticator. If they don't match, the KRB_AP_ERR_BADMATCH + error is returned; this normally is caused by a client error or + attempted attack. The addresses in the ticket (if any) are then + searched for an address matching the operating-system reported + address of the client. If no match is found or the server insists on + ticket addresses but none are present in the ticket, the + KRB_AP_ERR_BADADDR error is returned. If the local (server) time and + the client time in the authenticator differ by more than the + allowable clock skew (e.g., 5 minutes), the KRB_AP_ERR_SKEW error is + returned. + + Unless the application server provides its own suitable means to + protect against replay (for example, a challenge-response sequence + initiated by the server after authentication, or use of a server- + generated encryption subkey), the server MUST utilize a replay cache + to remember any authenticator presented within the allowable clock + skew. Careful analysis of the application protocol and implementation + is recommended before eliminating this cache. The replay cache will + store at least the server name, along with the client name, time and + microsecond fields from the recently-seen authenticators and if a + matching tuple is found, the KRB_AP_ERR_REPEAT error is returned + [10]. If a server loses track of authenticators presented within the + allowable clock skew, it MUST reject all requests until the clock + skew interval has passed, providing assurance that any lost or + replayed authenticators will fall outside the allowable clock skew + and can no longer be successfully replayed [11]. + + Implementation note: If a client generates multiple requests to the + KDC with the same timestamp, including the microsecond field, all but + the first of the requests received will be rejected as replays. This + might happen, for example, if the resolution of the client's clock is + too coarse. Implementations SHOULD ensure that the timestamps are + not reused, possibly by incrementing the microseconds field in the + time stamp when the clock returns the same time for multiple + requests. + + If multiple servers (for example, different services on one machine, + or a single service implemented on multiple machines) share a service + principal (a practice we do not recommend in general, but acknowledge + will be used in some cases), they should also share this replay + cache, or the application protocol should be designed so as to + eliminate the need for it. Note that this applies to all of the + + + +March 2003 [Page 31] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + services, if any of the application protocols does not have replay + protection built in; an authenticator used with such a service could + later be replayed to a different service with the same service + principal but no replay protection, if the former doesn't record the + authenticator information in the common replay cache. + + If a sequence number is provided in the authenticator, the server + saves it for later use in processing KRB_SAFE and/or KRB_PRIV + messages. If a subkey is present, the server either saves it for + later use or uses it to help generate its own choice for a subkey to + be returned in a KRB_AP_REP message. + + The server computes the age of the ticket: local (server) time minus + the start time inside the Ticket. If the start time is later than the + current time by more than the allowable clock skew or if the INVALID + flag is set in the ticket, the KRB_AP_ERR_TKT_NYV error is returned. + Otherwise, if the current time is later than end time by more than + the allowable clock skew, the KRB_AP_ERR_TKT_EXPIRED error is + returned. + + If all these checks succeed without an error, the server is assured + that the client possesses the credentials of the principal named in + the ticket and thus, the client has been authenticated to the server. + + Passing these checks provides only authentication of the named + principal; it does not imply authorization to use the named service. + Applications MUST make a separate authorization decisions based upon + the authenticated name of the user, the requested operation, local + access control information such as that contained in a .k5login or + .k5users file, and possibly a separate distributed authorization + service. + +3.2.4. Generation of a KRB_AP_REP message + + Typically, a client's request will include both the authentication + information and its initial request in the same message, and the + server need not explicitly reply to the KRB_AP_REQ. However, if + mutual authentication (not only authenticating the client to the + server, but also the server to the client) is being performed, the + KRB_AP_REQ message will have MUTUAL-REQUIRED set in its ap-options + field, and a KRB_AP_REP message is required in response. As with the + error message, this message MAY be encapsulated in the application + protocol if its "raw" form is not acceptable to the application's + protocol. The timestamp and microsecond field used in the reply MUST + be the client's timestamp and microsecond field (as provided in the + authenticator) [12]. If a sequence number is to be included, it + SHOULD be randomly chosen as described above for the authenticator. A + subkey MAY be included if the server desires to negotiate a different + + + +March 2003 [Page 32] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + subkey. The KRB_AP_REP message is encrypted in the session key + extracted from the ticket. + +3.2.5. Receipt of KRB_AP_REP message + + If a KRB_AP_REP message is returned, the client uses the session key + from the credentials obtained for the server [13] to decrypt the + message, and verifies that the timestamp and microsecond fields match + those in the Authenticator it sent to the server. If they match, then + the client is assured that the server is genuine. The sequence number + and subkey (if present) are retained for later use. + +3.2.6. Using the encryption key + + After the KRB_AP_REQ/KRB_AP_REP exchange has occurred, the client and + server share an encryption key which can be used by the application. + In some cases, the use of this session key will be implicit in the + protocol; in others the method of use must be chosen from several + alternatives. The 'true session key' to be used for KRB_PRIV, + KRB_SAFE, or other application-specific uses MAY be chosen by the + application based on the session key from the ticket and subkeys in + the KRB_AP_REP message and the authenticator [14]. To mitigate the + effect of failures in random number generation on the client it is + strongly encouraged that any key derived by an application for + subsequent use include the full key entropy derived from the KDC + generated session key carried in the ticket. We leave the protocol + negotiations of how to use the key (e.g. selecting an encryption or + checksum type) to the application programmer; the Kerberos protocol + does not constrain the implementation options, but an example of how + this might be done follows. + + One way that an application may choose to negotiate a key to be used + for subsequent integrity and privacy protection is for the client to + propose a key in the subkey field of the authenticator. The server + can then choose a key using the proposed key from the client as + input, returning the new subkey in the subkey field of the + application reply. This key could then be used for subsequent + communication. + + To make this example more concrete, if the communication patterns of + an application dictates the use of encryption modes of operation + incompatible with the encryption system used for the authenticator, + then a key compatible with the required encryption system may be + generated by either the client, the server, or collaboratively by + both and exchanged using the subkey field. This generation might + involve the use of a random number as a pre-key, initially generated + by either party, which could then be encrypted using the session key + from the ticket, and the result exchanged and used for subsequent + + + +March 2003 [Page 33] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + encryption. By encrypting the pre-key with the session key from the + ticket, randomness from the KDC generated key is assured of being + present in the negotiated key. Application developers must be careful + however, to use a means of introducing this entropy that does not + allow an attacker to learn the session key from the ticket if it + learns the key generated and used for subsequent communication. The + reader should note that this is only an example, and that an analysis + of the particular cryptosystem to be used, must be made before + deciding how to generate values for the subkey fields, and the key to + be used for subsequent communication. + + With both the one-way and mutual authentication exchanges, the peers + should take care not to send sensitive information to each other + without proper assurances. In particular, applications that require + privacy or integrity SHOULD use the KRB_AP_REP response from the + server to client to assure both client and server of their peer's + identity. If an application protocol requires privacy of its + messages, it can use the KRB_PRIV message (section 3.5). The KRB_SAFE + message (section 3.4) can be used to assure integrity. + +3.3. The Ticket-Granting Service (TGS) Exchange + + Summary + Message direction Message type Section + 1. Client to Kerberos KRB_TGS_REQ 5.4.1 + 2. Kerberos to client KRB_TGS_REP or 5.4.2 + KRB_ERROR 5.9.1 + + The TGS exchange between a client and the Kerberos Ticket-Granting + Server is initiated by a client when it wishes to obtain + authentication credentials for a given server (which might be + registered in a remote realm), when it wishes to renew or validate an + existing ticket, or when it wishes to obtain a proxy ticket. In the + first case, the client must already have acquired a ticket for the + Ticket-Granting Service using the AS exchange (the ticket-granting + ticket is usually obtained when a client initially authenticates to + the system, such as when a user logs in). The message format for the + TGS exchange is almost identical to that for the AS exchange. The + primary difference is that encryption and decryption in the TGS + exchange does not take place under the client's key. Instead, the + session key from the ticket-granting ticket or renewable ticket, or + sub-session key from an Authenticator is used. As is the case for all + application servers, expired tickets are not accepted by the TGS, so + once a renewable or ticket-granting ticket expires, the client must + use a separate exchange to obtain valid tickets. + + The TGS exchange consists of two messages: A request (KRB_TGS_REQ) + from the client to the Kerberos Ticket-Granting Server, and a reply + + + +March 2003 [Page 34] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + (KRB_TGS_REP or KRB_ERROR). The KRB_TGS_REQ message includes + information authenticating the client plus a request for credentials. + The authentication information consists of the authentication header + (KRB_AP_REQ) which includes the client's previously obtained ticket- + granting, renewable, or invalid ticket. In the ticket-granting + ticket and proxy cases, the request MAY include one or more of: a + list of network addresses, a collection of typed authorization data + to be sealed in the ticket for authorization use by the application + server, or additional tickets (the use of which are described later). + The TGS reply (KRB_TGS_REP) contains the requested credentials, + encrypted in the session key from the ticket-granting ticket or + renewable ticket, or if present, in the sub-session key from the + Authenticator (part of the authentication header). The KRB_ERROR + message contains an error code and text explaining what went wrong. + The KRB_ERROR message is not encrypted. The KRB_TGS_REP message + contains information which can be used to detect replays, and to + associate it with the message to which it replies. The KRB_ERROR + message also contains information which can be used to associate it + with the message to which it replies. The same comments about + integrity protection of KRB_ERROR messages mentioned in section 3.1 + apply to the TGS exchange. + +3.3.1. Generation of KRB_TGS_REQ message + + Before sending a request to the ticket-granting service, the client + MUST determine in which realm the application server is believed to + be registered [15]. If the client knows the service principal name + and realm and it does not already possess a ticket-granting ticket + for the appropriate realm, then one must be obtained. This is first + attempted by requesting a ticket-granting ticket for the destination + realm from a Kerberos server for which the client possesses a ticket- + granting ticket (using the KRB_TGS_REQ message recursively). The + Kerberos server MAY return a TGT for the desired realm in which case + one can proceed. Alternatively, the Kerberos server MAY return a TGT + for a realm which is 'closer' to the desired realm (further along the + standard hierarchical path between the client's realm and the + requested realm server's realm). It should be noted in this case that + misconfiguration of the Kerberos servers may cause loops in the + resulting authentication path, which the client should be careful to + detect and avoid. + + If the Kerberos server returns a TGT for a 'closer' realm other than + the desired realm, the client MAY use local policy configuration to + verify that the authentication path used is an acceptable one. + Alternatively, a client MAY choose its own authentication path, + rather than relying on the Kerberos server to select one. In either + case, any policy or configuration information used to choose or + validate authentication paths, whether by the Kerberos server or + + + +March 2003 [Page 35] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + client, MUST be obtained from a trusted source. + + When a client obtains a ticket-granting ticket that is 'closer' to + the destination realm, the client MAY cache this ticket and reuse it + in future KRB-TGS exchanges with services in the 'closer' realm. + However, if the client were to obtain a ticket-granting ticket for + the 'closer' realm by starting at the initial KDC rather than as part + of obtaining another ticket, then a shorter path to the 'closer' + realm might be used. This shorter path may be desirable because fewer + intermediate KDCs would know the session key of the ticket involved. + For this reason, clients SHOULD evaluate whether they trust the + realms transited in obtaining the 'closer' ticket when making a + decision to use the ticket in future. + + Once the client obtains a ticket-granting ticket for the appropriate + realm, it determines which Kerberos servers serve that realm, and + contacts one. The list might be obtained through a configuration file + or network service or it MAY be generated from the name of the realm; + as long as the secret keys exchanged by realms are kept secret, only + denial of service results from using a false Kerberos server. + + (This paragraph changed) As in the AS exchange, the client MAY + specify a number of options in the KRB_TGS_REQ message. One of these + options is the ENC-TKT-IN-SKEY option used for user-to-user + authentication. An overview of user to user authentication can be + found in section 3.7. When generating the KRB_TGS_REQ message, this + option indicates that the client is including a ticket-granting + ticket obtained from the application server in the additional tickets + field of the request and that the KDC SHOULD encrypt the ticket for + the application server using the session key from this additional + ticket, instead of using a server key from the principal database. + + The client prepares the KRB_TGS_REQ message, providing an + authentication header as an element of the padata field, and + including the same fields as used in the KRB_AS_REQ message along + with several optional fields: the enc-authorizatfion-data field for + application server use and additional tickets required by some + options. + + In preparing the authentication header, the client can select a sub- + session key under which the response from the Kerberos server will be + encrypted [16]. If the sub-session key is not specified, the session + key from the ticket-granting ticket will be used. If the enc- + authorization-data is present, it MUST be encrypted in the sub- + session key, if present, from the authenticator portion of the + authentication header, or if not present, using the session key from + the ticket-granting ticket. + + + + +March 2003 [Page 36] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Once prepared, the message is sent to a Kerberos server for the + destination realm. + +3.3.2. Receipt of KRB_TGS_REQ message + + The KRB_TGS_REQ message is processed in a manner similar to the + KRB_AS_REQ message, but there are many additional checks to be + performed. First, the Kerberos server MUST determine which server the + accompanying ticket is for and it MUST select the appropriate key to + decrypt it. For a normal KRB_TGS_REQ message, it will be for the + ticket granting service, and the TGS's key will be used. If the TGT + was issued by another realm, then the appropriate inter-realm key + MUST be used. If the accompanying ticket is not a ticket-granting + ticket for the current realm, but is for an application server in the + current realm, the RENEW, VALIDATE, or PROXY options are specified in + the request, and the server for which a ticket is requested is the + server named in the accompanying ticket, then the KDC will decrypt + the ticket in the authentication header using the key of the server + for which it was issued. If no ticket can be found in the padata + field, the KDC_ERR_PADATA_TYPE_NOSUPP error is returned. + + Once the accompanying ticket has been decrypted, the user-supplied + checksum in the Authenticator MUST be verified against the contents + of the request, and the message rejected if the checksums do not + match (with an error code of KRB_AP_ERR_MODIFIED) or if the checksum + is not keyed or not collision-proof (with an error code of + KRB_AP_ERR_INAPP_CKSUM). If the checksum type is not supported, the + KDC_ERR_SUMTYPE_NOSUPP error is returned. If the authorization-data + are present, they are decrypted using the sub-session key from the + Authenticator. + + If any of the decryptions indicate failed integrity checks, the + KRB_AP_ERR_BAD_INTEGRITY error is returned. + + As discussed in section 3.1.2, the KDC MUST send a valid KRB_TGS_REP + message if it receives a KRB_TGS_REQ message identical to one it has + recently processed. However, if the authenticator is a replay, but + the rest of the request is not identical, then the KDC SHOULD return + KRB_AP_ERR_REPEAT. + +3.3.3. Generation of KRB_TGS_REP message + + The KRB_TGS_REP message shares its format with the KRB_AS_REP + (KRB_KDC_REP), but with its type field set to KRB_TGS_REP. The + detailed specification is in section 5.4.2. + + The response will include a ticket for the requested server or for a + ticket granting server of an intermediate KDC to be contacted to + + + +March 2003 [Page 37] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + obtain the requested ticket. The Kerberos database is queried to + retrieve the record for the appropriate server (including the key + with which the ticket will be encrypted). If the request is for a + ticket-granting ticket for a remote realm, and if no key is shared + with the requested realm, then the Kerberos server will select the + realm 'closest' to the requested realm with which it does share a + key, and use that realm instead. If the requested server cannot be + found in the TGS database, then a TGT for another trusted realm MAY + be returned instead of a ticket for the service. This TGT is a + referral mechanism to cause the client to retry the request to the + realm of the TGT. These are the only cases where the response for + the KDC will be for a different server than that requested by the + client. + + By default, the address field, the client's name and realm, the list + of transited realms, the time of initial authentication, the + expiration time, and the authorization data of the newly-issued + ticket will be copied from the ticket-granting ticket (TGT) or + renewable ticket. If the transited field needs to be updated, but the + transited type is not supported, the KDC_ERR_TRTYPE_NOSUPP error is + returned. + + If the request specifies an endtime, then the endtime of the new + ticket is set to the minimum of (a) that request, (b) the endtime + from the TGT, and (c) the starttime of the TGT plus the minimum of + the maximum life for the application server and the maximum life for + the local realm (the maximum life for the requesting principal was + already applied when the TGT was issued). If the new ticket is to be + a renewal, then the endtime above is replaced by the minimum of (a) + the value of the renew_till field of the ticket and (b) the starttime + for the new ticket plus the life (endtime-starttime) of the old + ticket. + + If the FORWARDED option has been requested, then the resulting ticket + will contain the addresses specified by the client. This option will + only be honored if the FORWARDABLE flag is set in the TGT. The PROXY + option is similar; the resulting ticket will contain the addresses + specified by the client. It will be honored only if the PROXIABLE + flag in the TGT is set. The PROXY option will not be honored on + requests for additional ticket-granting tickets. + + If the requested start time is absent, indicates a time in the past, + or is within the window of acceptable clock skew for the KDC and the + POSTDATE option has not been specified, then the start time of the + ticket is set to the authentication server's current time. If it + indicates a time in the future beyond the acceptable clock skew, but + the POSTDATED option has not been specified or the MAY-POSTDATE flag + is not set in the TGT, then the error KDC_ERR_CANNOT_POSTDATE is + + + +March 2003 [Page 38] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + returned. Otherwise, if the ticket-granting ticket has the MAY- + POSTDATE flag set, then the resulting ticket will be postdated and + the requested starttime is checked against the policy of the local + realm. If acceptable, the ticket's start time is set as requested, + and the INVALID flag is set. The postdated ticket MUST be validated + before use by presenting it to the KDC after the starttime has been + reached. However, in no case may the starttime, endtime, or renew- + till time of a newly-issued postdated ticket extend beyond the renew- + till time of the ticket-granting ticket. + + If the ENC-TKT-IN-SKEY option has been specified and an additional + ticket has been included in the request, it indicates that the client + is using user- to-user authentication to prove its identity to a + server that does not have access to a persistent key. Section 3.7 + describes the affect of this option on the entire Kerberos protocol. + When generating the KRB_TGS_REP message, this option in the + KRB_TGS_REQ message tells the KDC to decrypt the additional ticket + using the key for the server to which the additional ticket was + issued and verify that it is a ticket-granting ticket. If the name of + the requested server is missing from the request, the name of the + client in the additional ticket will be used. Otherwise the name of + the requested server will be compared to the name of the client in + the additional ticket and if different, the request will be rejected. + If the request succeeds, the session key from the additional ticket + will be used to encrypt the new ticket that is issued instead of + using the key of the server for which the new ticket will be used. + + If the name of the server in the ticket that is presented to the KDC + as part of the authentication header is not that of the ticket- + granting server itself, the server is registered in the realm of the + KDC, and the RENEW option is requested, then the KDC will verify that + the RENEWABLE flag is set in the ticket, that the INVALID flag is not + set in the ticket, and that the renew_till time is still in the + future. If the VALIDATE option is requested, the KDC will check that + the starttime has passed and the INVALID flag is set. If the PROXY + option is requested, then the KDC will check that the PROXIABLE flag + is set in the ticket. If the tests succeed, and the ticket passes the + hotlist check described in the next section, the KDC will issue the + appropriate new ticket. + + The ciphertext part of the response in the KRB_TGS_REP message is + encrypted in the sub-session key from the Authenticator, if present, + or the session key from the ticket-granting ticket. It is not + encrypted using the client's secret key. Furthermore, the client's + key's expiration date and the key version number fields are left out + since these values are stored along with the client's database + record, and that record is not needed to satisfy a request based on a + ticket-granting ticket. + + + +March 2003 [Page 39] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +3.3.3.1. Checking for revoked tickets + + Whenever a request is made to the ticket-granting server, the + presented ticket(s) is(are) checked against a hot-list of tickets + which have been canceled. This hot-list might be implemented by + storing a range of issue timestamps for 'suspect tickets'; if a + presented ticket had an authtime in that range, it would be rejected. + In this way, a stolen ticket-granting ticket or renewable ticket + cannot be used to gain additional tickets (renewals or otherwise) + once the theft has been reported to the KDC for the realm in which + the server resides. Any normal ticket obtained before it was reported + stolen will still be valid (because they require no interaction with + the KDC), but only until their normal expiration time. If TGT's have + been issued for cross-realm authentication, use of the cross-realm + TGT will not be affected unless the hot-list is propagated to the + KDCs for the realms for which such cross-realm tickets were issued. + +3.3.3.2. Encoding the transited field + + If the identity of the server in the TGT that is presented to the KDC + as part of the authentication header is that of the ticket-granting + service, but the TGT was issued from another realm, the KDC will look + up the inter-realm key shared with that realm and use that key to + decrypt the ticket. If the ticket is valid, then the KDC will honor + the request, subject to the constraints outlined above in the section + describing the AS exchange. The realm part of the client's identity + will be taken from the ticket-granting ticket. The name of the realm + that issued the ticket-granting ticket, if it is not the realm of the + client principal, will be added to the transited field of the ticket + to be issued. This is accomplished by reading the transited field + from the ticket-granting ticket (which is treated as an unordered set + of realm names), adding the new realm to the set, then constructing + and writing out its encoded (shorthand) form (this may involve a + rearrangement of the existing encoding). + + Note that the ticket-granting service does not add the name of its + own realm. Instead, its responsibility is to add the name of the + previous realm. This prevents a malicious Kerberos server from + intentionally leaving out its own name (it could, however, omit other + realms' names). + + The names of neither the local realm nor the principal's realm are to + be included in the transited field. They appear elsewhere in the + ticket and both are known to have taken part in authenticating the + principal. Since the endpoints are not included, both local and + single-hop inter-realm authentication result in a transited field + that is empty. + + + + +March 2003 [Page 40] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Because the name of each realm transited is added to this field, it + might potentially be very long. To decrease the length of this field, + its contents are encoded. The initially supported encoding is + optimized for the normal case of inter-realm communication: a + hierarchical arrangement of realms using either domain or X.500 style + realm names. This encoding (called DOMAIN-X500-COMPRESS) is now + described. + + Realm names in the transited field are separated by a ",". The ",", + "\", trailing "."s, and leading spaces (" ") are special characters, + and if they are part of a realm name, they MUST be quoted in the + transited field by preceding them with a "\". + + A realm name ending with a "." is interpreted as being prepended to + the previous realm. For example, we can encode traversal of EDU, + MIT.EDU, ATHENA.MIT.EDU, WASHINGTON.EDU, and CS.WASHINGTON.EDU as: + + "EDU,MIT.,ATHENA.,WASHINGTON.EDU,CS.". + + Note that if ATHENA.MIT.EDU, or CS.WASHINGTON.EDU were end-points, + that they would not be included in this field, and we would have: + + "EDU,MIT.,WASHINGTON.EDU" + + A realm name beginning with a "/" is interpreted as being appended to + the previous realm. For the purpose of appending, the realm + preceding the first listed realm is considered to be the null realm + (""). If a realm name beginning with a "/" is to stand by itself, + then it SHOULD be preceded by a space (" "). For example, we can + encode traversal of /COM/HP/APOLLO, /COM/HP, /COM, and /COM/DEC as: + + "/COM,/HP,/APOLLO, /COM/DEC". + + Like the example above, if /COM/HP/APOLLO and /COM/DEC are endpoints, + they would not be included in this field, and we would have: + + "/COM,/HP" + + A null subfield preceding or following a "," indicates that all + realms between the previous realm and the next realm have been + traversed. For the purpose of interpreting null subfields, the + client's realm is considered to precede those in the transited field, + and the server's realm is considered to follow them. Thus, "," means + that all realms along the path between the client and the server have + been traversed. ",EDU, /COM," means that all realms from the client's + realm up to EDU (in a domain style hierarchy) have been traversed, + and that everything from /COM down to the server's realm in an X.500 + style has also been traversed. This could occur if the EDU realm in + + + +March 2003 [Page 41] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + one hierarchy shares an inter-realm key directly with the /COM realm + in another hierarchy. + +3.3.4. Receipt of KRB_TGS_REP message + + When the KRB_TGS_REP is received by the client, it is processed in + the same manner as the KRB_AS_REP processing described above. The + primary difference is that the ciphertext part of the response must + be decrypted using the sub-session key from the Authenticator, if it + was specified in the request, or the session key from the ticket- + granting ticket, rather than the client's secret key. The server name + returned in the reply is the true principal name of the service. + +3.4. The KRB_SAFE Exchange + + The KRB_SAFE message MAY be used by clients requiring the ability to + detect modifications of messages they exchange. It achieves this by + including a keyed collision-proof checksum of the user data and some + control information. The checksum is keyed with an encryption key + (usually the last key negotiated via subkeys, or the session key if + no negotiation has occurred). + +3.4.1. Generation of a KRB_SAFE message + + When an application wishes to send a KRB_SAFE message, it collects + its data and the appropriate control information and computes a + checksum over them. The checksum algorithm should be the keyed + checksum mandated to be implemented along with the crypto system used + for the sub-session or session key. The checksum is generated using + the sub-session key if present, and the session key. Some + implementations use a different checksum algorithm for the KRB_SAFE + messages but doing so in a interoperable manner is not always + possible. + + Implementations SHOULD accept any checksum algorithm they implement + that both have adequate security and that have keys compatible with + the sub-session or session key. Unkeyed or non-collision-proof + checksums are not suitable for this use. + + The control information for the KRB_SAFE message includes both a + timestamp and a sequence number. The designer of an application using + the KRB_SAFE message MUST choose at least one of the two mechanisms. + This choice SHOULD be based on the needs of the application protocol. + + Sequence numbers are useful when all messages sent will be received + by one's peer. Connection state is presently required to maintain the + session key, so maintaining the next sequence number should not + present an additional problem. + + + +March 2003 [Page 42] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + If the application protocol is expected to tolerate lost messages + without them being resent, the use of the timestamp is the + appropriate replay detection mechanism. Using timestamps is also the + appropriate mechanism for multi-cast protocols where all of one's + peers share a common sub-session key, but some messages will be sent + to a subset of one's peers. + + After computing the checksum, the client then transmits the + information and checksum to the recipient in the message format + specified in section 5.6.1. + +3.4.2. Receipt of KRB_SAFE message + + When an application receives a KRB_SAFE message, it verifies it as + follows. If any error occurs, an error code is reported for use by + the application. + + The message is first checked by verifying that the protocol version + and type fields match the current version and KRB_SAFE, respectively. + A mismatch generates a KRB_AP_ERR_BADVERSION or KRB_AP_ERR_MSG_TYPE + error. The application verifies that the checksum used is a + collision-proof keyed checksum that uses keys compatible with the + sub-session or session key as appropriate (or with the application + key derived from the session or sub-session keys), and if it is not, + a KRB_AP_ERR_INAPP_CKSUM error is generated. The sender's address + MUST be included in the control information; the recipient verifies + that the operating system's report of the sender's address matches + the sender's address in the message, and (if a recipient address is + specified or the recipient requires an address) that one of the + recipient's addresses appears as the recipient's address in the + message. To work with network address translation, senders MAY use + the directional address type specified in section 8.1 for the sender + address and not include recipient addresses. A failed match for + either case generates a KRB_AP_ERR_BADADDR error. Then the timestamp + and usec and/or the sequence number fields are checked. If timestamp + and usec are expected and not present, or they are present but not + current, the KRB_AP_ERR_SKEW error is generated. If the server name, + along with the client name, time and microsecond fields from the + Authenticator match any recently-seen (sent or received) such tuples, + the KRB_AP_ERR_REPEAT error is generated. If an incorrect sequence + number is included, or a sequence number is expected but not present, + the KRB_AP_ERR_BADORDER error is generated. If neither a time-stamp + and usec or a sequence number is present, a KRB_AP_ERR_MODIFIED error + is generated. Finally, the checksum is computed over the data and + control information, and if it doesn't match the received checksum, a + KRB_AP_ERR_MODIFIED error is generated. + + If all the checks succeed, the application is assured that the + + + +March 2003 [Page 43] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + message was generated by its peer and was not modified in transit. + +3.5. The KRB_PRIV Exchange + + The KRB_PRIV message MAY be used by clients requiring confidentiality + and the ability to detect modifications of exchanged messages. It + achieves this by encrypting the messages and adding control + information. + +3.5.1. Generation of a KRB_PRIV message + + When an application wishes to send a KRB_PRIV message, it collects + its data and the appropriate control information (specified in + section 5.7.1) and encrypts them under an encryption key (usually the + last key negotiated via subkeys, or the session key if no negotiation + has occurred). As part of the control information, the client MUST + choose to use either a timestamp or a sequence number (or both); see + the discussion in section 3.4.1 for guidelines on which to use. After + the user data and control information are encrypted, the client + transmits the ciphertext and some 'envelope' information to the + recipient. + +3.5.2. Receipt of KRB_PRIV message + + When an application receives a KRB_PRIV message, it verifies it as + follows. If any error occurs, an error code is reported for use by + the application. + + The message is first checked by verifying that the protocol version + and type fields match the current version and KRB_PRIV, respectively. + A mismatch generates a KRB_AP_ERR_BADVERSION or KRB_AP_ERR_MSG_TYPE + error. The application then decrypts the ciphertext and processes the + resultant plaintext. If decryption shows the data to have been + modified, a KRB_AP_ERR_BAD_INTEGRITY error is generated. + + The sender's address MUST be included in the control information; the + recipient verifies that the operating system's report of the sender's + address matches the sender's address in the message. If a recipient + address is specified or the recipient requires an address then one of + the recipient's addresses MUST also appear as the recipient's address + in the message. Where a sender's or receiver's address might not + otherwise match the address in a message because of network address + translation, an application MAY be written to use addresses of the + directional address type in place of the actual network address. + + A failed match for either case generates a KRB_AP_ERR_BADADDR error. + To work with network address translation, implementations MAY use the + directional address type defined in section 7.1 for the sender + + + +March 2003 [Page 44] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + address and include no recipient address. Then the timestamp and usec + and/or the sequence number fields are checked. If timestamp and usec + are expected and not present, or they are present but not current, + the KRB_AP_ERR_SKEW error is generated. If the server name, along + with the client name, time and microsecond fields from the + Authenticator match any recently-seen such tuples, the + KRB_AP_ERR_REPEAT error is generated. If an incorrect sequence number + is included, or a sequence number is expected but not present, the + KRB_AP_ERR_BADORDER error is generated. If neither a time-stamp and + usec or a sequence number is present, a KRB_AP_ERR_MODIFIED error is + generated. + + If all the checks succeed, the application can assume the message was + generated by its peer, and was securely transmitted (without + intruders able to see the unencrypted contents). + +3.6. The KRB_CRED Exchange + + The KRB_CRED message MAY be used by clients requiring the ability to + send Kerberos credentials from one host to another. It achieves this + by sending the tickets together with encrypted data containing the + session keys and other information associated with the tickets. + +3.6.1. Generation of a KRB_CRED message + + When an application wishes to send a KRB_CRED message it first (using + the KRB_TGS exchange) obtains credentials to be sent to the remote + host. It then constructs a KRB_CRED message using the ticket or + tickets so obtained, placing the session key needed to use each + ticket in the key field of the corresponding KrbCredInfo sequence of + the encrypted part of the KRB_CRED message. + + Other information associated with each ticket and obtained during the + KRB_TGS exchange is also placed in the corresponding KrbCredInfo + sequence in the encrypted part of the KRB_CRED message. The current + time and, if specifically required by the application (and + communicated from the recipient to the sender by application specific + means) the nonce, s-address, and r-address fields, are placed in the + encrypted part of the KRB_CRED message which is then encrypted under + an encryption key previously exchanged in the KRB_AP exchange + (usually the last key negotiated via subkeys, or the session key if + no negotiation has occurred). + + Implementation note: When constructing a KRB_CRED message for + inclusion in a GSSAPI initial context token, the MIT implementation + of Kerberos will not encrypt the KRB_CRED message if the session key + is a DES or triple DES key. For interoperability with MIT, the + Microsoft implementation will not encrypt the KRB_CRED in a GSSAPI + + + +March 2003 [Page 45] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + token if it is using a DES session key. Starting at version 1.2.5, + MIT Kerberos can receive and decode either encrypted or unencrypted + KRB_CRED tokens in the GSSAPI exchange. The Heimdal implementation of + Kerberos can also accept either encrypted or unencrypted KRB_CRED + messages. Since the KRB_CRED message in a GSSAPI token is encrypted + in the authenticator, the MIT behavior does not present a security + problem, although it is a violation of the Kerberos specification. + +3.6.2. Receipt of KRB_CRED message + + When an application receives a KRB_CRED message, it verifies it. If + any error occurs, an error code is reported for use by the + application. The message is verified by checking that the protocol + version and type fields match the current version and KRB_CRED, + respectively. A mismatch generates a KRB_AP_ERR_BADVERSION or + KRB_AP_ERR_MSG_TYPE error. The application then decrypts the + ciphertext and processes the resultant plaintext. If decryption shows + the data to have been modified, a KRB_AP_ERR_BAD_INTEGRITY error is + generated. + + If present or required, the recipient MAY verify that the operating + system's report of the sender's address matches the sender's address + in the message, and that one of the recipient's addresses appears as + the recipient's address in the message. The address check does not + provide any added security, since the address if present has already + been checked in the KRB_AP_REQ message and there is not any benefit + to be gained by an attacker in reflecting a KRB_CRED message back to + its originator. Thus, the recipient MAY ignore the address even if + present in order to work better in NAT environments. A failed match + for either case generates a KRB_AP_ERR_BADADDR error. Recipients MAY + skip the address check as the KRB_CRED message cannot generally be + reflected back to the originator. The timestamp and usec fields (and + the nonce field if required) are checked next. If the timestamp and + usec are not present, or they are present but not current, the + KRB_AP_ERR_SKEW error is generated. + + If all the checks succeed, the application stores each of the new + tickets in its credentials cache together with the session key and + other information in the corresponding KrbCredInfo sequence from the + encrypted part of the KRB_CRED message. + +3.7. User to User Authentication Exchanges + + User to User authentication provides a method to perform + authentication when the verifier does not have a access to long term + service key. This might be the case when running a server (for + example a window server) as a user on a workstation. In such cases, + the server may have access to the ticket-granting ticket obtained + + + +March 2003 [Page 46] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + when the user logged in to the workstation, but because the server is + running as an unprivileged user it might not have access to system + keys. Similar situations may arise when running peer-to-peer + applications. + + Summary + Message direction Message type Sections + 0. Message from application server Not Specified + 1. Client to Kerberos KRB_TGS_REQ 3.3 + 5.4.1 + 2. Kerberos to client KRB_TGS_REP or 3.3 + 5.4.2 + KRB_ERROR 5.9.1 + 3. Client to Application server KRB_AP_REQ 3.2 + 5.5.1 + + To address this problem, the Kerberos protocol allows the client to + request that the ticket issued by the KDC be encrypted using a + session key from a ticket-granting ticket issued to the party that + will verify the authentication. This ticket-granting ticket must be + obtained from the verifier by means of an exchange external to the + Kerberos protocol, usually as part of the application protocol. This + message is shown in the summary above as message 0. Note that because + the ticket-granting ticket is encrypted in the KDC's secret key, it + can not be used for authentication without posession of the + corresponding secret key. Furthermore, because the verifier does not + reveal the corresponding secret key, providing a copy of the + verifier's ticket-granting ticket does not allow impersonation of the + verifier. + + Message 0 in the table above represents an application specific + negotation between the client and server, at the end of which both + have determined that they will use user to user authentication and + the client has obtained the server's TGT. + + Next, the client includes the server's TGT as an additional ticket in + its KRB_TGS_REQ request to the KDC (message 1 in the table above) and + specifyies the ENC-TKT-IN-SKEY option in its request. + + If validated according to the instructions in 3.3.3, the application + ticket returned to the client (message 2 in the table above) will be + encrypted using the session key from the additional ticket and the + client will note this when it uses or stores the application ticket. + + When contacting the server using a ticket obtained for user to user + authentication (message 3 in the table above), the client MUST + specify the USE-SESSION-KEY flag in the ap-options field. This tells + the application server to use the session key associated with its + ticket-granting ticket to decrypt the server ticket provided in the + application request. + + + + +March 2003 [Page 47] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +4. Encryption and Checksum Specifications + + The Kerberos protocols described in this document are designed to + encrypt messages of arbitrary sizes, using stream or block encryption + ciphers. Encryption is used to prove the identities of the network + entities participating in message exchanges. The Key Distribution + Center for each realm is trusted by all principals registered in that + realm to store a secret key in confidence. Proof of knowledge of this + secret key is used to verify the authenticity of a principal. + + The KDC uses the principal's secret key (in the AS exchange) or a + shared session key (in the TGS exchange) to encrypt responses to + ticket requests; the ability to obtain the secret key or session key + implies the knowledge of the appropriate keys and the identity of the + KDC. The ability of a principal to decrypt the KDC response and + present a Ticket and a properly formed Authenticator (generated with + the session key from the KDC response) to a service verifies the + identity of the principal; likewise the ability of the service to + extract the session key from the Ticket and prove its knowledge + thereof in a response verifies the identity of the service. + + [@KCRYPTO] defines a framework for defining encryption and checksum + mechanisms for use with Kerberos. It also defines several such + mechanisms, and more may be added in future updates to that document. + + The string-to-key operation provided by [@KCRYPTO] is used to produce + a long-term key for a principal (generally for a user). The default + salt string, if none is provided via pre-authentication data, is the + concatenation of the principal's realm and name components, in order, + with no separators. Unless otherwise indicated, the default string- + to-key opaque parameter set as defined in [@KCRYPTO] is used. + + Encrypted data, keys and checksums are transmitted using the + EncryptedData, EncryptionKey and Checksum data objects defined in + section 5.2.9. The encryption, decryption, and checksum operations + described in this document use the corresponding encryption, + decryption, and get_mic operations described in [@KCRYPTO], with + implicit "specific key" generation using the "key usage" values + specified in the description of each EncryptedData or Checksum object + to vary the key for each operation. Note that in some cases, the + value to be used is dependent on the method of choosing the key or + the context of the message. + + Key usages are unsigned 32 bit integers; zero is not permitted. The + key usage values for encrypting or checksumming Kerberos messages are + indicated in section 5 along with the message definitions. Key usage + values 512-1023 are reserved for uses internal to a Kerberos + implementation. (For example, seeding a pseudo-random number + + + +March 2003 [Page 48] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + generator with a value produced by encrypting something with a + session key and a key usage value not used for any other purpose.) + Key usage values between 1024 and 2047 (inclusive) are reserved for + application use; applications SHOULD use even values for encryption + and odd values for checksums within this range. Key usage values are + also summarized in a table in section 7.5.1. + + There might exist other documents which define protocols in terms of + the RFC1510 encryption types or checksum types. Such documents would + not know about key usages. In order that these specifications + continue to be meaningful until they are updated, if not key usage + values are specified then key usages 1024 and 1025 must be used to + derive keys for encryption and checksums, respectively (this does not + apply to protocols that do their own encryption independent of this + framework, directly using the key resulting from the Kerberos + authentication exchange.) New protocols defined in terms of the + Kerberos encryption and checksum types SHOULD use their own key usage + values. + + Unless otherwise indicated, no cipher state chaining is done from one + encryption operation to another. + + Implementation note: While not recommended, some application + protocols will continue to use the key data directly, even if only in + currently existing protocol specifications. An implementation + intended to support general Kerberos applications may therefore need + to make key data available, as well as the attributes and operations + described in [@KCRYPTO]. One of the more common reasons for directly + performing encryption is direct control over negotiation and + selection of a "sufficiently strong" encryption algorithm (in the + context of a given application). While Kerberos does not directly + provide a facility for negotiating encryption types between the + application client and server, there are approaches for using + Kerberos to facilitate this negotiation - for example, a client may + request only "sufficiently strong" session key types from the KDC and + expect that any type returned by the KDC will be understood and + supported by the application server. + +5. Message Specifications + + NOTE: The ASN.1 collected here should be identical to the contents of + Appendix A. In case of conflict, the contents of Appendix A shall + take precedence. + + The Kerberos protocol is defined here in terms of Abstract Syntax + Notation One (ASN.1) [X680], which provides a syntax for specifying + both the abstract layout of protocol messages as well as their + encodings. Implementors not utilizing an existing ASN.1 compiler or + + + +March 2003 [Page 49] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + support library are cautioned to thoroughly understand the actual + ASN.1 specification to ensure correct implementation behavior, as + there is more complexity in the notation than is immediately obvious, + and some tutorials and guides to ASN.1 are misleading or erroneous. + + Note that in several places, there have been changes here from RFC + 1510 that change the abstract types. This is in part to address + widespread assumptions that various implementors have made, in some + cases resulting in unintentional violations of the ASN.1 standard. + These are clearly flagged where they occur. The differences between + the abstract types in RFC 1510 and abstract types in this document + can cause incompatible encodings to be emitted when certain encoding + rules, e.g. the Packed Encoding Rules (PER), are used. This + theoretical incompatibility should not be relevant for Kerberos, + since Kerberos explicitly specifies the use of the Distinguished + Encoding Rules (DER). It might be an issue for protocols wishing to + use Kerberos types with other encoding rules. (This practice is not + recommended.) With very few exceptions (most notably the usages of + BIT STRING), the encodings resulting from using the DER remain + identical between the types defined in RFC 1510 and the types defined + in this document. + + The type definitions in this section assume an ASN.1 module + definition of the following form: + + KerberosV5Spec2 { + iso(1) identified-organization(3) dod(6) internet(1) + security(5) kerberosV5(2) modules(4) krb5spec2(2) + } DEFINITIONS EXPLICIT TAGS ::= BEGIN + + -- rest of definitions here + + END + + This specifies that the tagging context for the module will be + explicit and non-automatic. + + Note that in some other publications [RFC1510] [RFC1964], the "dod" + portion of the object identifier is erroneously specified as having + the value "5". In the case of RFC 1964, use of the "correct" OID + value would result in a change in the wire protocol; therefore, it + remains unchanged for now. + + Note that elsewhere in this document, nomenclature for various + message types is inconsistent, but seems to largely follow C language + conventions, including use of underscore (_) characters and all-caps + spelling of names intended to be numeric constants. Also, in some + places, identifiers (especially ones refering to constants) are + + + +March 2003 [Page 50] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + written in all-caps in order to distinguish them from surrounding + explanatory text. + + The ASN.1 notation does not permit underscores in identifiers, so in + actual ASN.1 definitions, underscores are replaced with hyphens (-). + Additionally, structure member names and defined values in ASN.1 MUST + begin with a lowercase letter, while type names MUST begin with an + uppercase letter. + +5.1. Specific Compatibility Notes on ASN.1 + + For compatibility purposes, implementors should heed the following + specific notes regarding the use of ASN.1 in Kerberos. These notes do + not describe deviations from standard usage of ASN.1. The purpose of + these notes is to instead describe some historical quirks and non- + compliance of various implementations, as well as historical + ambiguities, which, while being valid ASN.1, can lead to confusion + during implementation. + +5.1.1. ASN.1 Distinguished Encoding Rules + + The encoding of Kerberos protocol messages shall obey the + Distinguished Encoding Rules (DER) of ASN.1 as described in [X690]. + Some implementations (believed to be primarly ones derived from DCE + 1.1 and earlier) are known to use the more general Basic Encoding + Rules (BER); in particular, these implementations send indefinite + encodings of lengths. Implementations MAY accept such encodings in + the interests of backwards compatibility, though implementors are + warned that decoding fully-general BER is fraught with peril. + +5.1.2. Optional Integer Fields + + Some implementations do not internally distinguish between an omitted + optional integer value and a transmitted value of zero. The places in + the protocol where this is relevant include various microseconds + fields, nonces, and sequence numbers. Implementations SHOULD treat + omitted optional integer values as having been transmitted with a + value of zero, if the application is expecting this. + +5.1.3. Empty SEQUENCE OF Types + + There are places in the protocol where a message contains a SEQUENCE + OF type as an optional member. This can result in an encoding that + contains an empty SEQUENCE OF encoding. The Kerberos protocol does + not semantically distinguish between an absent optional SEQUENCE OF + type and a present optional but empty SEQUENCE OF type. + Implementations SHOULD NOT send empty SEQUENCE OF encodings that are + marked OPTIONAL, but SHOULD accept them as being equivalent to an + + + +March 2003 [Page 51] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + omitted OPTIONAL type. In the ASN.1 syntax describing Kerberos + messages, instances of these problematic optional SEQUENCE OF types + are indicated with a comment. + +5.1.4. Unrecognized Tag Numbers + + Future revisions to this protocol may include new message types with + different APPLICATION class tag numbers. Such revisions should + protect older implementations by only sending the message types to + parties that are known to understand them, e.g. by means of a flag + bit set by the receiver in a preceding request. In the interest of + robust error handling, implementations SHOULD gracefully handle + receiving a message with an unrecognized tag anyway, and return an + error message if appropriate. + +5.1.5. Tag Numbers Greater Than 30 + + A naive implementation of a DER ASN.1 decoder may experience problems + with ASN.1 tag numbers greater than 30, due to such tag numbers being + encoded using more than one byte. Future revisions of this protocol + may utilize tag numbers greater than 30, and implementations SHOULD + be prepared to gracefully return an error, if appropriate, if they do + not recognize the tag. + +5.2. Basic Kerberos Types + + This section defines a number of basic types that are potentially + used in multiple Kerberos protocol messages. + +5.2.1. KerberosString + + The original specification of the Kerberos protocol in RFC 1510 uses + GeneralString in numerous places for human-readable string data. + Historical implementations of Kerberos cannot utilize the full power + of GeneralString. This ASN.1 type requires the use of designation + and invocation escape sequences as specified in ISO-2022/ECMA-35 + [ISO-2022/ECMA-35] to switch character sets, and the default + character set that is designated as G0 is the ISO-646/ECMA-6 + [ISO-646,ECMA-6] International Reference Version (IRV) (aka U.S. + ASCII), which mostly works. + + ISO-2022/ECMA-35 defines four character-set code elements (G0..G3) + and two Control-function code elements (C0..C1). DER prohibits the + designation of character sets as any but the G0 and C0 sets. + Unfortunately, this seems to have the side effect of prohibiting the + use of ISO-8859 (ISO Latin) [ISO-8859] character-sets or any other + character-sets that utilize a 96-character set, since it is + prohibited by ISO-2022/ECMA-35 to designate them as the G0 code + + + +March 2003 [Page 52] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + element. This side effect is being investigated in the ASN.1 + standards community. + + In practice, many implementations treat GeneralStrings as if they + were 8-bit strings of whichever character set the implementation + defaults to, without regard for correct usage of character-set + designation escape sequences. The default character set is often + determined by the current user's operating system dependent locale. + At least one major implementation places unescaped UTF-8 encoded + Unicode characters in the GeneralString. This failure to adhere to + the GeneralString specifications results in interoperability issues + when conflicting character encodings are utilized by the Kerberos + clients, services, and KDC. + + This unfortunate situation is the result of improper documentation of + the restrictions of the ASN.1 GeneralString type in prior Kerberos + specifications. + + The new (post-RFC 1510) type KerberosString, defined below, is a + GeneralString that is constrained to only contain characters in + IA5String + + KerberosString ::= GeneralString (IA5String) + + US-ASCII control characters should in general not be used in + KerberosString, except for cases such as newlines in lengthy error + messages. Control characters SHOULD NOT be used in principal names or + realm names. + + For compatibility, implementations MAY choose to accept GeneralString + values that contain characters other than those permitted by + IA5String, but they should be aware that character set designation + codes will likely be absent, and that the encoding should probably be + treated as locale-specific in almost every way. Implementations MAY + also choose to emit GeneralString values that are beyond those + permitted by IA5String, but should be aware that doing so is + extraordinarily risky from an interoperability perspective. + + Some existing implementations use GeneralString to encode unescaped + locale-specific characters. This is a violation of the ASN.1 + standard. Most of these implementations encode US-ASCII in the left- + hand half, so as long the implementation transmits only US-ASCII, the + ASN.1 standard is not violated in this regard. As soon as such an + implementation encodes unescaped locale-specific characters with the + high bit set, it violates the ASN.1 standard. + + Other implementations have been known to use GeneralString to contain + a UTF-8 encoding. This also violates the ASN.1 standard, since UTF-8 + + + +March 2003 [Page 53] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + is a different encoding, not a 94 or 96 character "G" set as defined + by ISO 2022. It is believed that these implementations do not even + use the ISO 2022 escape sequence to change the character encoding. + Even if implementations were to announce the change of encoding by + using that escape sequence, the ASN.1 standard prohibits the use of + any escape sequences other than those used to designate/invoke "G" or + "C" sets allowed by GeneralString. + + Future revisions to this protocol will almost certainly allow for a + more interoperable representation of principal names, probably + including UTF8String. + + Note that applying a new constraint to a previously unconstrained + type constitutes creation of a new ASN.1 type. In this particular + case, the change does not result in a changed encoding under DER. + +5.2.2. Realm and PrincipalName + + Realm ::= KerberosString + + PrincipalName ::= SEQUENCE { + name-type [0] Int32, + name-string [1] SEQUENCE OF KerberosString + } + + Kerberos realm names are encoded as KerberosStrings. Realms shall not + contain a character with the code 0 (the US-ASCII NUL). Most realms + will usually consist of several components separated by periods (.), + in the style of Internet Domain Names, or separated by slashes (/) in + the style of X.500 names. Acceptable forms for realm names are + specified in section 6.1.. A PrincipalName is a typed sequence of + components consisting of the following sub-fields: + + name-type + This field specifies the type of name that follows. Pre-defined + values for this field are specified in section 6.2. The name-type + SHOULD be treated as a hint. Ignoring the name type, no two names + can be the same (i.e. at least one of the components, or the + realm, must be different). + + name-string + This field encodes a sequence of components that form a name, each + component encoded as a KerberosString. Taken together, a + PrincipalName and a Realm form a principal identifier. Most + PrincipalNames will have only a few components (typically one or + two). + +5.2.3. KerberosTime + + + +March 2003 [Page 54] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + KerberosTime ::= GeneralizedTime -- with no fractional seconds + + The timestamps used in Kerberos are encoded as GeneralizedTimes. A + KerberosTime value shall not include any fractional portions of the + seconds. As required by the DER, it further shall not include any + separators, and it shall specify the UTC time zone (Z). Example: The + only valid format for UTC time 6 minutes, 27 seconds after 9 pm on 6 + November 1985 is 19851106210627Z. + +5.2.4. Constrained Integer types + + Some integer members of types SHOULD be constrained to values + representable in 32 bits, for compatibility with reasonable + implementation limits. + + Int32 ::= INTEGER (-2147483648..2147483647) + -- signed values representable in 32 bits + + UInt32 ::= INTEGER (0..4294967295) + -- unsigned 32 bit values + + Microseconds ::= INTEGER (0..999999) + -- microseconds + + While this results in changes to the abstract types from the RFC 1510 + version, the encoding in DER should be unaltered. Historical + implementations were typically limited to 32-bit integer values + anyway, and assigned numbers SHOULD fall in the space of integer + values representable in 32 bits in order to promote interoperability + anyway. + + There are several integer fields in messages that are constrained to + fixed values. + + pvno + also TKT-VNO or AUTHENTICATOR-VNO, this recurring field is always + the constant integer 5. There is no easy way to make this field + into a useful protocol version number, so its value is fixed. + + msg-type + this integer field is usually identical to the application tag + number of the containing message type. + +5.2.5. HostAddress and HostAddresses + + HostAddress ::= SEQUENCE { + addr-type [0] Int32, + address [1] OCTET STRING + + + +March 2003 [Page 55] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + } + + -- NOTE: HostAddresses is always used as an OPTIONAL field and + -- should not be empty. + HostAddresses -- NOTE: subtly different from rfc1510, + -- but has a value mapping and encodes the same + ::= SEQUENCE OF HostAddress + + The host address encodings consists of two fields: + + addr-type + This field specifies the type of address that follows. Pre-defined + values for this field are specified in section 7.5.3. + + address + This field encodes a single address of type addr-type. + +5.2.6. AuthorizationData + + -- NOTE: AuthorizationData is always used as an OPTIONAL field and + -- should not be empty. + AuthorizationData ::= SEQUENCE OF SEQUENCE { + ad-type [0] Int32, + ad-data [1] OCTET STRING + } + + ad-data + This field contains authorization data to be interpreted according + to the value of the corresponding ad-type field. + + ad-type + This field specifies the format for the ad-data subfield. All + negative values are reserved for local use. Non-negative values + are reserved for registered use. + + Each sequence of type and data is referred to as an authorization + element. Elements MAY be application specific, however, there is a + common set of recursive elements that should be understood by all + implementations. These elements contain other elements embedded + within them, and the interpretation of the encapsulating element + determines which of the embedded elements must be interpreted, and + which may be ignored. + + These common authorization data elements are recursively defined, + meaning the ad-data for these types will itself contain a sequence of + authorization data whose interpretation is affected by the + encapsulating element. Depending on the meaning of the encapsulating + element, the encapsulated elements may be ignored, might be + + + +March 2003 [Page 56] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + interpreted as issued directly by the KDC, or they might be stored in + a separate plaintext part of the ticket. The types of the + encapsulating elements are specified as part of the Kerberos + specification because the behavior based on these values should be + understood across implementations whereas other elements need only be + understood by the applications which they affect. + + Authorization data elements are considered critical if present in a + ticket or authenticator. Unless encapsulated in a known authorization + data element amending the criticality of the elements it contains, if + an unknown authorization data element type is received by a server + either in an AP-REQ or in a ticket contained in an AP-REQ, then + authentication MUST fail. Authorization data is intended to restrict + the use of a ticket. If the service cannot determine whether the + restriction applies to that service then a security weakness may + result if the ticket can be used for that service. Authorization + elements that are optional can be enclosed in AD-IF-RELEVANT element. + + In the definitions that follow, the value of the ad-type for the + element will be specified as the least significant part of the + subsection number, and the value of the ad-data will be as shown in + the ASN.1 structure that follows the subsection heading. + + contents of ad-data ad-type + + DER encoding of AD-IF-RELEVANT 1 + + DER encoding of AD-KDCIssued 4 + + DER encoding of AD-AND-OR 5 + + DER encoding of AD-MANDATORY-FOR-KDC 8 + +5.2.6.1. IF-RELEVANT + + AD-IF-RELEVANT ::= AuthorizationData + + AD elements encapsulated within the if-relevant element are intended + for interpretation only by application servers that understand the + particular ad-type of the embedded element. Application servers that + do not understand the type of an element embedded within the if- + relevant element MAY ignore the uninterpretable element. This element + promotes interoperability across implementations which may have local + extensions for authorization. The ad-type for AD-IF-RELEVANT is (1). + +5.2.6.2. KDCIssued + + AD-KDCIssued ::= SEQUENCE { + + + +March 2003 [Page 57] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + ad-checksum [0] Checksum, + i-realm [1] Realm OPTIONAL, + i-sname [2] PrincipalName OPTIONAL, + elements [3] AuthorizationData + } + + ad-checksum + A checksum over the elements field using a cryptographic checksum + method that is identical to the checksum used to protect the + ticket itself (i.e. using the same hash function and the same + encryption algorithm used to encrypt the ticket) using the key + used to protect the ticket, and a key usage value of 19. + + i-realm, i-sname + The name of the issuing principal if different from the KDC + itself. This field would be used when the KDC can verify the + authenticity of elements signed by the issuing principal and it + allows this KDC to notify the application server of the validity + of those elements. + + elements + A sequence of authorization data elements issued by the KDC. + + The KDC-issued ad-data field is intended to provide a means for + Kerberos principal credentials to embed within themselves privilege + attributes and other mechanisms for positive authorization, + amplifying the privileges of the principal beyond what can be done + using a credentials without such an a-data element. + + This can not be provided without this element because the definition + of the authorization-data field allows elements to be added at will + by the bearer of a TGT at the time that they request service tickets + and elements may also be added to a delegated ticket by inclusion in + the authenticator. + + For KDC-issued elements this is prevented because the elements are + signed by the KDC by including a checksum encrypted using the + server's key (the same key used to encrypt the ticket - or a key + derived from that key). Elements encapsulated with in the KDC-issued + element will be ignored by the application server if this "signature" + is not present. Further, elements encapsulated within this element + from a ticket-granting ticket MAY be interpreted by the KDC, and used + as a basis according to policy for including new signed elements + within derivative tickets, but they will not be copied to a + derivative ticket directly. If they are copied directly to a + derivative ticket by a KDC that is not aware of this element, the + signature will not be correct for the application ticket elements, + and the field will be ignored by the application server. + + + +March 2003 [Page 58] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This element and the elements it encapulates MAY be safely ignored by + applications, application servers, and KDCs that do not implement + this element. + + The ad-type for AD-KDC-ISSUED is (4). + +5.2.6.3. AND-OR + + AD-AND-OR ::= SEQUENCE { + condition-count [0] INTEGER, + elements [1] AuthorizationData + } + + + When restrictive AD elements are encapsulated within the and-or + element, the and-or element is considered satisfied if and only if at + least the number of encapsulated elements specified in condition- + count are satisifed. Therefore, this element MAY be used to + implement an "or" operation by setting the condition-count field to + 1, and it MAY specify an "and" operation by setting the condition + count to the number of embedded elements. Application servers that do + not implement this element MUST reject tickets that contain + authorization data elements of this type. + + The ad-type for AD-AND-OR is (5). + +5.2.6.4. MANDATORY-FOR-KDC + + AD-MANDATORY-FOR-KDC ::= AuthorizationData + + AD elements encapsulated within the mandatory-for-kdc element are to + be interpreted by the KDC. KDCs that do not understand the type of an + element embedded within the mandatory-for-kdc element MUST reject the + request. + + The ad-type for AD-MANDATORY-FOR-KDC is (8). + +5.2.7. PA-DATA + + Historically, PA-DATA have been known as "pre-authentication data", + meaning that they were used to augment the initial authentication + with the KDC. Since that time, they have also been used as a typed + hole with which to extend protocol exchanges with the KDC. + + PA-DATA ::= SEQUENCE { + -- NOTE: first tag is [1], not [0] + padata-type [1] Int32, + padata-value [2] OCTET STRING -- might be encoded AP-REQ + + + +March 2003 [Page 59] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + } + + padata-type + indicates the way that the padata-value element is to be + interpreted. Negative values of padata-type are reserved for + unregistered use; non-negative values are used for a registered + interpretation of the element type. + + padata-value + Usually contains the DER encoding of another type; the padata-type + field identifies which type is encoded here. + + padata-type name contents of padata-value + + 1 pa-tgs-req DER encoding of AP-REQ + + 2 pa-enc-timestamp DER encoding of PA-ENC-TIMESTAMP + + 3 pa-pw-salt salt (not ASN.1 encoded) + + 11 pa-etype-info DER encoding of ETYPE-INFO + + 19 pa-etype-info2 DER encoding of ETYPE-INFO2 + + This field MAY also contain information needed by certain + extensions to the Kerberos protocol. For example, it might be used + to initially verify the identity of a client before any response + is returned. + + The padata field can also contain information needed to help the + KDC or the client select the key needed for generating or + decrypting the response. This form of the padata is useful for + supporting the use of certain token cards with Kerberos. The + details of such extensions are specified in separate documents. + See [Pat92] for additional uses of this field. + +5.2.7.1. PA-TGS-REQ + + In the case of requests for additional tickets (KRB_TGS_REQ), padata- + value will contain an encoded AP-REQ. The checksum in the + authenticator (which MUST be collision-proof) is to be computed over + the KDC-REQ-BODY encoding. + +5.2.7.2. Encrypted Timestamp Pre-authentication + + There are pre-authentication types that may be used to pre- + authenticate a client by means of an encrypted timestamp. + + + + +March 2003 [Page 60] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + PA-ENC-TIMESTAMP ::= EncryptedData -- PA-ENC-TS-ENC + + PA-ENC-TS-ENC ::= SEQUENCE { + patimestamp [0] KerberosTime -- client's time --, + pausec [1] Microseconds OPTIONAL + } + + Patimestamp contains the client's time, and pausec contains the + microseconds, which MAY be omitted if a client will not generate more + than one request per second. The ciphertext (padata-value) consists + of the PA-ENC-TS-ENC encoding, encrypted using the client's secret + key and a key usage value of 1. + + This pre-authentication type was not present in RFC 1510, but many + implementations support it. + +5.2.7.3. PA-PW-SALT + + The padata-value for this pre-authentication type contains the salt + for the string-to-key to be used by the client to obtain the key for + decrypting the encrypted part of an AS-REP message. Unfortunately, + for historical reasons, the character set to be used is unspecified + and probably locale-specific. + + This pre-authentication type was not present in RFC 1510, but many + implementations support it. It is necessary in any case where the + salt for the string-to-key algorithm is not the default. + + In the trivial example, a zero-length salt string is very commonplace + for realms that have converted their principal databases from + Kerberos 4. + + A KDC SHOULD NOT send PA-PW-SALT when issuing a KRB-ERROR message + that requests additional pre-authentication. Implementation note: + some KDC implementations issue an erroneous PA-PW-SALT when issuing a + KRB-ERROR message that requests additional pre-authentication. + Therefore, clients SHOULD ignore a PA-PW-SALT accompanying a KRB- + ERROR message that requests additional pre-authentication. + +5.2.7.4. PA-ETYPE-INFO + + The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB- + ERROR indicating a requirement for additional pre-authentication. It + is usually used to notify a client of which key to use for the + encryption of an encrypted timestamp for the purposes of sending a + PA-ENC-TIMESTAMP pre-authentication value. It MAY also be sent in an + AS-REP to provide information to the client about which key salt to + use for the string-to-key to be used by the client to obtain the key + + + +March 2003 [Page 61] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + for decrypting the encrypted part the AS-REP. + + ETYPE-INFO-ENTRY ::= SEQUENCE { + etype [0] Int32, + salt [1] OCTET STRING OPTIONAL + } + + ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY + + The salt, like that of PA-PW-SALT, is also completely unspecified + with respect to character set and is probably locale-specific. + + If ETYPE-INFO is sent in an AS-REP, there shall be exactly one ETYPE- + INFO-ENTRY, and its etype shall match that of the enc-part in the AS- + REP. + + This pre-authentication type was not present in RFC 1510, but many + implementations that support encrypted timestamps for pre- + authentication need to support ETYPE-INFO as well. + +5.2.7.5. PA-ETYPE-INFO2 + + The ETYPE-INFO2 pre-authentication type is sent by the KDC in a KRB- + ERROR indicating a requirement for additional pre-authentication. It + is usually used to notify a client of which key to use for the + encryption of an encrypted timestamp for the purposes of sending a + PA-ENC-TIMESTAMP pre-authentication value. It MAY also be sent in an + AS-REP to provide information to the client about which key salt to + use for the string-to-key to be used by the client to obtain the key + for decrypting the encrypted part the AS-REP. + + ETYPE-INFO2-ENTRY ::= SEQUENCE { + etype [0] Int32, + salt [1] KerberosString OPTIONAL, + s2kparams [2] OCTET STRING OPTIONAL + } + + ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO-ENTRY + + The type of the salt is KerberosString, but existing installations + might have locale-specific characters stored in salt strings, and + implementors MAY choose to handle them. + + The interpretation of s2kparams is specified in the cryptosystem + description associated with the etype. Each cryptosystem has a + default interpretation of s2kparams that will hold if that element is + omitted from the encoding of ETYPE-INFO2-ENTRY. + + + + +March 2003 [Page 62] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + If ETYPE-INFO2 is sent in an AS-REP, there shall be exactly one + ETYPE-INFO2-ENTRY, and its etype shall match that of the enc-part in + the AS-REP. + + The preferred ordering of pre-authentication data that modify client + key selection is: ETYPE-INFO2, followed by ETYPE-INFO, followed by + PW-SALT. A KDC shall send all of these pre-authentication data that + it supports, in the preferred ordering, when issuing an AS-REP or + when issuing a KRB-ERROR requesting additional pre-authentication. + + The ETYPE-INFO2 pre-authentication type was not present in RFC 1510. + +5.2.8. KerberosFlags + + For several message types, a specific constrained bit string type, + KerberosFlags, is used. + + KerberosFlags ::= BIT STRING (SIZE (32..MAX)) -- minimum number of bits + -- shall be sent, but no fewer than 32 + + Compatibility note: the following paragraphs describe a change from + the RFC1510 description of bit strings that would result in + incompatility in the case of an implementation that strictly + conformed to ASN.1 DER and RFC1510. + + ASN.1 bit strings have multiple uses. The simplest use of a bit + string is to contain a vector of bits, with no particular meaning + attached to individual bits. This vector of bits is not necessarily a + multiple of eight bits long. The use in Kerberos of a bit string as + a compact boolean vector wherein each element has a distinct meaning + poses some problems. The natural notation for a compact boolean + vector is the ASN.1 "NamedBit" notation, and the DER require that + encodings of a bit string using "NamedBit" notation exclude any + trailing zero bits. This truncation is easy to neglect, especially + given C language implementations that naturally choose to store + boolean vectors as 32 bit integers. + + For example, if the notation for KDCOptions were to include the + "NamedBit" notation, as in RFC 1510, and a KDCOptions value to be + encoded had only the "forwardable" (bit number one) bit set, the DER + encoding MUST include only two bits: the first reserved bit + ("reserved", bit number zero, value zero) and the one-valued bit (bit + number one) for "forwardable". + + Most existing implementations of Kerberos unconditionally send 32 + bits on the wire when encoding bit strings used as boolean vectors. + This behavior violates the ASN.1 syntax used for flag values in RFC + 1510, but occurs on such a widely installed base that the protocol + + + +March 2003 [Page 63] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + description is being modified to accomodate it. + + Consequently, this document removes the "NamedBit" notations for + individual bits, relegating them to comments. The size constraint on + the KerberosFlags type requires that at least 32 bits be encoded at + all times, though a lenient implementation MAY choose to accept fewer + than 32 bits and to treat the missing bits as set to zero. + + Currently, no uses of KerberosFlags specify more than 32 bits worth + of flags, although future revisions of this document may do so. When + more than 32 bits are to be transmitted in a KerberosFlags value, + future revisions to this document will likely specify that the + smallest number of bits needed to encode the highest-numbered one- + valued bit should be sent. This is somewhat similar to the DER + encoding of a bit string that is declared with the "NamedBit" + notation. + +5.2.9. Cryptosystem-related Types + + Many Kerberos protocol messages contain an EncryptedData as a + container for arbitrary encrypted data, which is often the encrypted + encoding of another data type. Fields within EncryptedData assist the + recipient in selecting a key with which to decrypt the enclosed data. + + EncryptedData ::= SEQUENCE { + etype [0] Int32 -- EncryptionType --, + kvno [1] UInt32 OPTIONAL, + cipher [2] OCTET STRING -- ciphertext + } + + etype + This field identifies which encryption algorithm was used to + encipher the cipher. + + kvno + This field contains the version number of the key under which data + is encrypted. It is only present in messages encrypted under long + lasting keys, such as principals' secret keys. + + cipher + This field contains the enciphered text, encoded as an OCTET + STRING. (Note that the encryption mechanisms defined in + [@KCRYPTO] MUST incorporate integrity protection as well, so no + additional checksum is required.) + + The EncryptionKey type is the means by which cryptographic keys used + for encryption are transfered. + + + + +March 2003 [Page 64] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + EncryptionKey ::= SEQUENCE { + keytype [0] Int32 -- actually encryption type --, + keyvalue [1] OCTET STRING + } + + keytype + This field specifies the encryption type of the encryption key + that follows in the keyvalue field. While its name is "keytype", + it actually specifies an encryption type. Previously, multiple + cryptosystems that performed encryption differently but were + capable of using keys with the same characteristics were permitted + to share an assigned number to designate the type of key; this + usage is now deprecated. + + keyvalue + This field contains the key itself, encoded as an octet string. + + Messages containing cleartext data to be authenticated will usually + do so by using a member of type Checksum. Most instances of Checksum + use a keyed hash, though exceptions will be noted. + + Checksum ::= SEQUENCE { + cksumtype [0] Int32, + checksum [1] OCTET STRING + } + + cksumtype + This field indicates the algorithm used to generate the + accompanying checksum. + + checksum + This field contains the checksum itself, encoded as an octet + string. + + See section 4 for a brief description of the use of encryption and + checksums in Kerberos. + +5.3. Tickets + + This section describes the format and encryption parameters for + tickets and authenticators. When a ticket or authenticator is + included in a protocol message it is treated as an opaque object. A + ticket is a record that helps a client authenticate to a service. A + Ticket contains the following information: + + Ticket ::= [APPLICATION 1] SEQUENCE { + tkt-vno [0] INTEGER (5), + realm [1] Realm, + + + +March 2003 [Page 65] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + sname [2] PrincipalName, + enc-part [3] EncryptedData -- EncTicketPart + } + + -- Encrypted part of ticket + EncTicketPart ::= [APPLICATION 3] SEQUENCE { + flags [0] TicketFlags, + key [1] EncryptionKey, + crealm [2] Realm, + cname [3] PrincipalName, + transited [4] TransitedEncoding, + authtime [5] KerberosTime, + starttime [6] KerberosTime OPTIONAL, + endtime [7] KerberosTime, + renew-till [8] KerberosTime OPTIONAL, + caddr [9] HostAddresses OPTIONAL, + authorization-data [10] AuthorizationData OPTIONAL + } + + -- encoded Transited field + TransitedEncoding ::= SEQUENCE { + tr-type [0] Int32 -- must be registered --, + contents [1] OCTET STRING + } + + TicketFlags ::= KerberosFlags + -- reserved(0), + -- forwardable(1), + -- forwarded(2), + -- proxiable(3), + -- proxy(4), + -- may-postdate(5), + -- postdated(6), + -- invalid(7), + -- renewable(8), + -- initial(9), + -- pre-authent(10), + -- hw-authent(11), + -- the following are new since 1510 + -- transited-policy-checked(12), + -- ok-as-delegate(13) + + tkt-vno + This field specifies the version number for the ticket format. + This document describes version number 5. + + realm + This field specifies the realm that issued a ticket. It also + + + +March 2003 [Page 66] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + serves to identify the realm part of the server's principal + identifier. Since a Kerberos server can only issue tickets for + servers within its realm, the two will always be identical. + + sname + This field specifies all components of the name part of the + server's identity, including those parts that identify a specific + instance of a service. + + enc-part + This field holds the encrypted encoding of the EncTicketPart + sequence. It is encrypted in the key shared by Kerberos and the + end server (the server's secret key), using a key usage value of + 2. + + flags + This field indicates which of various options were used or + requested when the ticket was issued. The meanings of the flags + are: + + Bit(s) Name Description + + 0 reserved Reserved for future expansion of this + field. + + The FORWARDABLE flag is normally only + interpreted by the TGS, and can be + ignored by end servers. When set, this + 1 forwardable flag tells the ticket-granting server + that it is OK to issue a new + ticket-granting ticket with a + different network address based on the + presented ticket. + + When set, this flag indicates that the + ticket has either been forwarded or + 2 forwarded was issued based on authentication + involving a forwarded ticket-granting + ticket. + + The PROXIABLE flag is normally only + interpreted by the TGS, and can be + ignored by end servers. The PROXIABLE + flag has an interpretation identical + 3 proxiable to that of the FORWARDABLE flag, + except that the PROXIABLE flag tells + the ticket-granting server that only + non-ticket-granting tickets may be + + + +March 2003 [Page 67] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + issued with different network + addresses. + + 4 proxy When set, this flag indicates that a + ticket is a proxy. + + The MAY-POSTDATE flag is normally only + interpreted by the TGS, and can be + 5 may-postdate ignored by end servers. This flag + tells the ticket-granting server that + a post-dated ticket MAY be issued + based on this ticket-granting ticket. + + This flag indicates that this ticket + has been postdated. The end-service + 6 postdated can check the authtime field to see + when the original authentication + occurred. + + This flag indicates that a ticket is + invalid, and it must be validated by + 7 invalid the KDC before use. Application + servers must reject tickets which have + this flag set. + + The RENEWABLE flag is normally only + interpreted by the TGS, and can + usually be ignored by end servers + 8 renewable (some particularly careful servers MAY + disallow renewable tickets). A + renewable ticket can be used to obtain + a replacement ticket that expires at a + later date. + + This flag indicates that this ticket + 9 initial was issued using the AS protocol, and + not issued based on a ticket-granting + ticket. + + This flag indicates that during + initial authentication, the client was + authenticated by the KDC before a + 10 pre-authent ticket was issued. The strength of the + pre-authentication method is not + indicated, but is acceptable to the + KDC. + + This flag indicates that the protocol + + + +March 2003 [Page 68] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + employed for initial authentication + required the use of hardware expected + 11 hw-authent to be possessed solely by the named + client. The hardware authentication + method is selected by the KDC and the + strength of the method is not + indicated. + + This flag indicates that the KDC for + the realm has checked the transited + field against a realm defined policy + for trusted certifiers. If this flag + is reset (0), then the application + server must check the transited field + itself, and if unable to do so it must + reject the authentication. If the flag + 12 transited- is set (1) then the application server + policy-checked MAY skip its own validation of the + transited field, relying on the + validation performed by the KDC. At + its option the application server MAY + still apply its own validation based + on a separate policy for acceptance. + + This flag is new since RFC 1510. + + This flag indicates that the server + (not the client) specified in the + ticket has been determined by policy + of the realm to be a suitable + recipient of delegation. A client can + use the presence of this flag to help + it make a decision whether to delegate + credentials (either grant a proxy or a + forwarded ticket-granting ticket) to + 13 ok-as-delegate this server. The client is free to + ignore the value of this flag. When + setting this flag, an administrator + should consider the Security and + placement of the server on which the + service will run, as well as whether + the service requires the use of + delegated credentials. + + This flag is new since RFC 1510. + + 14-31 reserved Reserved for future use. + + + + +March 2003 [Page 69] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + key + This field exists in the ticket and the KDC response and is used + to pass the session key from Kerberos to the application server + and the client. + + crealm + This field contains the name of the realm in which the client is + registered and in which initial authentication took place. + + cname + This field contains the name part of the client's principal + identifier. + + transited + This field lists the names of the Kerberos realms that took part + in authenticating the user to whom this ticket was issued. It does + not specify the order in which the realms were transited. See + section 3.3.3.2 for details on how this field encodes the + traversed realms. When the names of CA's are to be embedded in + the transited field (as specified for some extensions to the + protocol), the X.500 names of the CA's SHOULD be mapped into items + in the transited field using the mapping defined by RFC2253. + + authtime + This field indicates the time of initial authentication for the + named principal. It is the time of issue for the original ticket + on which this ticket is based. It is included in the ticket to + provide additional information to the end service, and to provide + the necessary information for implementation of a `hot list' + service at the KDC. An end service that is particularly paranoid + could refuse to accept tickets for which the initial + authentication occurred "too far" in the past. This field is also + returned as part of the response from the KDC. When returned as + part of the response to initial authentication (KRB_AS_REP), this + is the current time on the Kerberos server. It is NOT recommended + that this time value be used to adjust the workstation's clock + since the workstation cannot reliably determine that such a + KRB_AS_REP actually came from the proper KDC in a timely manner. + + + starttime + + This field in the ticket specifies the time after which the ticket + is valid. Together with endtime, this field specifies the life of + the ticket. If the starttime field is absent from the ticket, then + the authtime field SHOULD be used in its place to determine the + life of the ticket. + + + + +March 2003 [Page 70] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + endtime + This field contains the time after which the ticket will not be + honored (its expiration time). Note that individual services MAY + place their own limits on the life of a ticket and MAY reject + tickets which have not yet expired. As such, this is really an + upper bound on the expiration time for the ticket. + + renew-till + This field is only present in tickets that have the RENEWABLE flag + set in the flags field. It indicates the maximum endtime that may + be included in a renewal. It can be thought of as the absolute + expiration time for the ticket, including all renewals. + + caddr + This field in a ticket contains zero (if omitted) or more (if + present) host addresses. These are the addresses from which the + ticket can be used. If there are no addresses, the ticket can be + used from any location. The decision by the KDC to issue or by the + end server to accept addressless tickets is a policy decision and + is left to the Kerberos and end-service administrators; they MAY + refuse to issue or accept such tickets. Because of the wide + deployment of network address translation, it is recommended that + policy allow the issue and acceptance of such tickets. + + Network addresses are included in the ticket to make it harder for + an attacker to use stolen credentials. Because the session key is + not sent over the network in cleartext, credentials can't be + stolen simply by listening to the network; an attacker has to gain + access to the session key (perhaps through operating system + security breaches or a careless user's unattended session) to make + use of stolen tickets. + + It is important to note that the network address from which a + connection is received cannot be reliably determined. Even if it + could be, an attacker who has compromised the client's workstation + could use the credentials from there. Including the network + addresses only makes it more difficult, not impossible, for an + attacker to walk off with stolen credentials and then use them + from a "safe" location. + + authorization-data + The authorization-data field is used to pass authorization data + from the principal on whose behalf a ticket was issued to the + application service. If no authorization data is included, this + field will be left out. Experience has shown that the name of this + field is confusing, and that a better name for this field would be + restrictions. Unfortunately, it is not possible to change the name + of this field at this time. + + + +March 2003 [Page 71] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This field contains restrictions on any authority obtained on the + basis of authentication using the ticket. It is possible for any + principal in posession of credentials to add entries to the + authorization data field since these entries further restrict what + can be done with the ticket. Such additions can be made by + specifying the additional entries when a new ticket is obtained + during the TGS exchange, or they MAY be added during chained + delegation using the authorization data field of the + authenticator. + + Because entries may be added to this field by the holder of + credentials, except when an entry is separately authenticated by + encapsulation in the KDC-issued element, it is not allowable for + the presence of an entry in the authorization data field of a + ticket to amplify the privileges one would obtain from using a + ticket. + + The data in this field may be specific to the end service; the + field will contain the names of service specific objects, and the + rights to those objects. The format for this field is described in + section 5.2.6. Although Kerberos is not concerned with the format + of the contents of the sub-fields, it does carry type information + (ad-type). + + By using the authorization_data field, a principal is able to + issue a proxy that is valid for a specific purpose. For example, a + client wishing to print a file can obtain a file server proxy to + be passed to the print server. By specifying the name of the file + in the authorization_data field, the file server knows that the + print server can only use the client's rights when accessing the + particular file to be printed. + + A separate service providing authorization or certifying group + membership may be built using the authorization-data field. In + this case, the entity granting authorization (not the authorized + entity), may obtain a ticket in its own name (e.g. the ticket is + issued in the name of a privilege server), and this entity adds + restrictions on its own authority and delegates the restricted + authority through a proxy to the client. The client would then + present this authorization credential to the application server + separately from the authentication exchange. Alternatively, such + authorization credentials MAY be embedded in the ticket + authenticating the authorized entity, when the authorization is + separately authenticated using the KDC-issued authorization data + element (see 5.2.6.2). + + Similarly, if one specifies the authorization-data field of a + proxy and leaves the host addresses blank, the resulting ticket + + + +March 2003 [Page 72] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + and session key can be treated as a capability. See [Neu93] for + some suggested uses of this field. + + The authorization-data field is optional and does not have to be + included in a ticket. + +5.4. Specifications for the AS and TGS exchanges + + This section specifies the format of the messages used in the + exchange between the client and the Kerberos server. The format of + possible error messages appears in section 5.9.1. + +5.4.1. KRB_KDC_REQ definition + + The KRB_KDC_REQ message has no application tag number of its own. + Instead, it is incorporated into one of KRB_AS_REQ or KRB_TGS_REQ, + which each have an application tag, depending on whether the request + is for an initial ticket or an additional ticket. In either case, the + message is sent from the client to the KDC to request credentials for + a service. + + The message fields are: + + AS-REQ ::= [APPLICATION 10] KDC-REQ + + TGS-REQ ::= [APPLICATION 12] KDC-REQ + + KDC-REQ ::= SEQUENCE { + -- NOTE: first tag is [1], not [0] + pvno [1] INTEGER (5) , + msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), + padata [3] SEQUENCE OF PA-DATA OPTIONAL + -- NOTE: not empty --, + req-body [4] KDC-REQ-BODY + } + + KDC-REQ-BODY ::= SEQUENCE { + kdc-options [0] KDCOptions, + cname [1] PrincipalName OPTIONAL + -- Used only in AS-REQ --, + realm [2] Realm + -- Server's realm + -- Also client's in AS-REQ --, + sname [3] PrincipalName OPTIONAL, + from [4] KerberosTime OPTIONAL, + till [5] KerberosTime, + rtime [6] KerberosTime OPTIONAL, + nonce [7] UInt32, + + + +March 2003 [Page 73] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + etype [8] SEQUENCE OF Int32 -- EncryptionType + -- in preference order --, + addresses [9] HostAddresses OPTIONAL, + enc-authorization-data [10] EncryptedData -- AuthorizationData --, + additional-tickets [11] SEQUENCE OF Ticket OPTIONAL + -- NOTE: not empty + } + + KDCOptions ::= KerberosFlags + -- reserved(0), + -- forwardable(1), + -- forwarded(2), + -- proxiable(3), + -- proxy(4), + -- allow-postdate(5), + -- postdated(6), + -- unused7(7), + -- renewable(8), + -- unused9(9), + -- unused10(10), + -- opt-hardware-auth(11), + -- unused12(12), + -- unused13(13), + -- 15 is reserved for canonicalize + -- unused15(15), + -- 26 was unused in 1510 + -- disable-transited-check(26), + -- + -- renewable-ok(27), + -- enc-tkt-in-skey(28), + -- renew(30), + -- validate(31) + + The fields in this message are: + + pvno + This field is included in each message, and specifies the protocol + version number. This document specifies protocol version 5. + + msg-type + This field indicates the type of a protocol message. It will + almost always be the same as the application identifier associated + with a message. It is included to make the identifier more readily + accessible to the application. For the KDC-REQ message, this type + will be KRB_AS_REQ or KRB_TGS_REQ. + + padata + Contains pre-authentication data. Requests for additional tickets + + + +March 2003 [Page 74] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + (KRB_TGS_REQ) MUST contain a padata of PA-TGS-REQ. + + The padata (pre-authentication data) field contains a sequence of + authentication information which may be needed before credentials + can be issued or decrypted. + + req-body + This field is a placeholder delimiting the extent of the remaining + fields. If a checksum is to be calculated over the request, it is + calculated over an encoding of the KDC-REQ-BODY sequence which is + enclosed within the req-body field. + + kdc-options + This field appears in the KRB_AS_REQ and KRB_TGS_REQ requests to + the KDC and indicates the flags that the client wants set on the + tickets as well as other information that is to modify the + behavior of the KDC. Where appropriate, the name of an option may + be the same as the flag that is set by that option. Although in + most case, the bit in the options field will be the same as that + in the flags field, this is not guaranteed, so it is not + acceptable to simply copy the options field to the flags field. + There are various checks that must be made before honoring an + option anyway. + + The kdc_options field is a bit-field, where the selected options + are indicated by the bit being set (1), and the unselected options + and reserved fields being reset (0). The encoding of the bits is + specified in section 5.2. The options are described in more detail + above in section 2. The meanings of the options are: + + Bits Name Description + + 0 RESERVED Reserved for future expansion of + this field. + + The FORWARDABLE option indicates + that the ticket to be issued is to + have its forwardable flag set. It + 1 FORWARDABLE may only be set on the initial + request, or in a subsequent request + if the ticket-granting ticket on + which it is based is also + forwardable. + + The FORWARDED option is only + specified in a request to the + ticket-granting server and will only + be honored if the ticket-granting + + + +March 2003 [Page 75] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + ticket in the request has its + 2 FORWARDED FORWARDABLE bit set. This option + indicates that this is a request for + forwarding. The address(es) of the + host from which the resulting ticket + is to be valid are included in the + addresses field of the request. + + The PROXIABLE option indicates that + the ticket to be issued is to have + its proxiable flag set. It may only + 3 PROXIABLE be set on the initial request, or in + a subsequent request if the + ticket-granting ticket on which it + is based is also proxiable. + + The PROXY option indicates that this + is a request for a proxy. This + option will only be honored if the + ticket-granting ticket in the + 4 PROXY request has its PROXIABLE bit set. + The address(es) of the host from + which the resulting ticket is to be + valid are included in the addresses + field of the request. + + The ALLOW-POSTDATE option indicates + that the ticket to be issued is to + have its MAY-POSTDATE flag set. It + 5 ALLOW-POSTDATE may only be set on the initial + request, or in a subsequent request + if the ticket-granting ticket on + which it is based also has its + MAY-POSTDATE flag set. + + The POSTDATED option indicates that + this is a request for a postdated + ticket. This option will only be + honored if the ticket-granting + ticket on which it is based has its + 6 POSTDATED MAY-POSTDATE flag set. The resulting + ticket will also have its INVALID + flag set, and that flag may be reset + by a subsequent request to the KDC + after the starttime in the ticket + has been reached. + + 7 RESERVED This option is presently unused. + + + +March 2003 [Page 76] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + The RENEWABLE option indicates that + the ticket to be issued is to have + its RENEWABLE flag set. It may only + be set on the initial request, or + when the ticket-granting ticket on + 8 RENEWABLE which the request is based is also + renewable. If this option is + requested, then the rtime field in + the request contains the desired + absolute expiration time for the + ticket. + + 9 RESERVED Reserved for PK-Cross + + 10 RESERVED Reserved for future use. + + 11 RESERVED Reserved for opt-hardware-auth. + + 12-25 RESERVED Reserved for future use. + + By default the KDC will check the + transited field of a + ticket-granting-ticket against the + policy of the local realm before it + will issue derivative tickets based + on the ticket-granting ticket. If + this flag is set in the request, + checking of the transited field is + disabled. Tickets issued without the + 26 DISABLE-TRANSITED-CHECK performance of this check will be + noted by the reset (0) value of the + TRANSITED-POLICY-CHECKED flag, + indicating to the application server + that the tranisted field must be + checked locally. KDCs are + encouraged but not required to honor + the DISABLE-TRANSITED-CHECK option. + + This flag is new since RFC 1510 + + The RENEWABLE-OK option indicates + that a renewable ticket will be + acceptable if a ticket with the + requested life cannot otherwise be + provided. If a ticket with the + requested life cannot be provided, + 27 RENEWABLE-OK then a renewable ticket may be + issued with a renew-till equal to + + + +March 2003 [Page 77] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + the requested endtime. The value + of the renew-till field may still be + limited by local limits, or limits + selected by the individual principal + or server. + + This option is used only by the + ticket-granting service. The + ENC-TKT-IN-SKEY option indicates + 28 ENC-TKT-IN-SKEY that the ticket for the end server + is to be encrypted in the session + key from the additional + ticket-granting ticket provided. + + 29 RESERVED Reserved for future use. + + This option is used only by the + ticket-granting service. The RENEW + option indicates that the present + request is for a renewal. The ticket + provided is encrypted in the secret + key for the server on which it is + 30 RENEW valid. This option will only be + honored if the ticket to be renewed + has its RENEWABLE flag set and if + the time in its renew-till field has + not passed. The ticket to be renewed + is passed in the padata field as + part of the authentication header. + + This option is used only by the + ticket-granting service. The + VALIDATE option indicates that the + request is to validate a postdated + ticket. It will only be honored if + the ticket presented is postdated, + presently has its INVALID flag set, + 31 VALIDATE and would be otherwise usable at + this time. A ticket cannot be + validated before its starttime. The + ticket presented for validation is + encrypted in the key of the server + for which it is valid and is passed + in the padata field as part of the + authentication header. + cname and sname + These fields are the same as those described for the ticket in + section 5.3. The sname may only be absent when the ENC-TKT-IN-SKEY + + + +March 2003 [Page 78] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + option is specified. If absent, the name of the server is taken + from the name of the client in the ticket passed as additional- + tickets. + + enc-authorization-data + The enc-authorization-data, if present (and it can only be present + in the TGS_REQ form), is an encoding of the desired authorization- + data encrypted under the sub-session key if present in the + Authenticator, or alternatively from the session key in the + ticket-granting ticket (both the Authenticator and ticket-granting + ticket come from the padata field in the KRB_TGS_REQ). The key + usage value used when encrypting is 5 if a sub-session key is + used, or 4 if the session key is used. + + realm + This field specifies the realm part of the server's principal + identifier. In the AS exchange, this is also the realm part of the + client's principal identifier. + + from + This field is included in the KRB_AS_REQ and KRB_TGS_REQ ticket + requests when the requested ticket is to be postdated. It + specifies the desired start time for the requested ticket. If this + field is omitted then the KDC SHOULD use the current time instead. + + till + This field contains the expiration date requested by the client in + a ticket request. It is not optional, but if the requested endtime + is "19700101000000Z", the requested ticket is to have the maximum + endtime permitted according to KDC policy. Implementation note: + This special timestamp corresponds to a UNIX time_t value of zero + on most systems. + + rtime + This field is the requested renew-till time sent from a client to + the KDC in a ticket request. It is optional. + + nonce + This field is part of the KDC request and response. It is intended + to hold a random number generated by the client. If the same + number is included in the encrypted response from the KDC, it + provides evidence that the response is fresh and has not been + replayed by an attacker. Nonces MUST NEVER be reused. + + etype + This field specifies the desired encryption algorithm to be used + in the response. + + + + +March 2003 [Page 79] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + addresses + This field is included in the initial request for tickets, and + optionally included in requests for additional tickets from the + ticket-granting server. It specifies the addresses from which the + requested ticket is to be valid. Normally it includes the + addresses for the client's host. If a proxy is requested, this + field will contain other addresses. The contents of this field are + usually copied by the KDC into the caddr field of the resulting + ticket. + + additional-tickets + Additional tickets MAY be optionally included in a request to the + ticket-granting server. If the ENC-TKT-IN-SKEY option has been + specified, then the session key from the additional ticket will be + used in place of the server's key to encrypt the new ticket. When + the ENC-TKT-IN-SKEY option is used for user-to-user + authentication, this addional ticket MAY be a TGT issued by the + local realm or an inter-realm TGT issued for the current KDC's + realm by a remote KDC. If more than one option which requires + additional tickets has been specified, then the additional tickets + are used in the order specified by the ordering of the options + bits (see kdc-options, above). + + The application tag number will be either ten (10) or twelve (12) + depending on whether the request is for an initial ticket (AS-REQ) or + for an additional ticket (TGS-REQ). + + The optional fields (addresses, authorization-data and additional- + tickets) are only included if necessary to perform the operation + specified in the kdc-options field. + + It should be noted that in KRB_TGS_REQ, the protocol version number + appears twice and two different message types appear: the KRB_TGS_REQ + message contains these fields as does the authentication header + (KRB_AP_REQ) that is passed in the padata field. + +5.4.2. KRB_KDC_REP definition + + The KRB_KDC_REP message format is used for the reply from the KDC for + either an initial (AS) request or a subsequent (TGS) request. There + is no message type for KRB_KDC_REP. Instead, the type will be either + KRB_AS_REP or KRB_TGS_REP. The key used to encrypt the ciphertext + part of the reply depends on the message type. For KRB_AS_REP, the + ciphertext is encrypted in the client's secret key, and the client's + key version number is included in the key version number for the + encrypted data. For KRB_TGS_REP, the ciphertext is encrypted in the + sub-session key from the Authenticator, or if absent, the session key + from the ticket-granting ticket used in the request. In that case, + + + +March 2003 [Page 80] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + no version number will be present in the EncryptedData sequence. + + The KRB_KDC_REP message contains the following fields: + + AS-REP ::= [APPLICATION 11] KDC-REP + + TGS-REP ::= [APPLICATION 13] KDC-REP + + KDC-REP ::= SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (11 -- AS -- | 13 -- TGS --), + padata [2] SEQUENCE OF PA-DATA OPTIONAL + -- NOTE: not empty --, + crealm [3] Realm, + cname [4] PrincipalName, + ticket [5] Ticket, + enc-part [6] EncryptedData + -- EncASRepPart or EncTGSRepPart, + -- as appropriate + } + + EncASRepPart ::= [APPLICATION 25] EncKDCRepPart + + EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart + + EncKDCRepPart ::= SEQUENCE { + key [0] EncryptionKey, + last-req [1] LastReq, + nonce [2] UInt32, + key-expiration [3] KerberosTime OPTIONAL, + flags [4] TicketFlags, + authtime [5] KerberosTime, + starttime [6] KerberosTime OPTIONAL, + endtime [7] KerberosTime, + renew-till [8] KerberosTime OPTIONAL, + srealm [9] Realm, + sname [10] PrincipalName, + caddr [11] HostAddresses OPTIONAL + } + + LastReq ::= SEQUENCE OF SEQUENCE { + lr-type [0] Int32, + lr-value [1] KerberosTime + } + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + either KRB_AS_REP or KRB_TGS_REP. + + + +March 2003 [Page 81] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + padata + This field is described in detail in section 5.4.1. One possible + use for this field is to encode an alternate "salt" string to be + used with a string-to-key algorithm. This ability is useful to + ease transitions if a realm name needs to change (e.g. when a + company is acquired); in such a case all existing password-derived + entries in the KDC database would be flagged as needing a special + salt string until the next password change. + + crealm, cname, srealm and sname + These fields are the same as those described for the ticket in + section 5.3. + + ticket + The newly-issued ticket, from section 5.3. + + enc-part + This field is a place holder for the ciphertext and related + information that forms the encrypted part of a message. The + description of the encrypted part of the message follows each + appearance of this field. + + The key usage value for encrypting this field is 3 in an AS-REP + message, using the client's long-term key or another key selected + via pre-authentication mechanisms. In a TGS-REP message, the key + usage value is 8 if the TGS session key is used, or 9 if a TGS + authenticator subkey is used. + + Compatibility note: Some implementations unconditionally send an + encrypted EncTGSRepPart (application tag number 26) in this field + regardless of whether the reply is a AS-REP or a TGS-REP. In the + interests of compatibility, implementors MAY relax the check on + the tag number of the decrypted ENC-PART. + + key + This field is the same as described for the ticket in section 5.3. + + last-req + This field is returned by the KDC and specifies the time(s) of the + last request by a principal. Depending on what information is + available, this might be the last time that a request for a + ticket-granting ticket was made, or the last time that a request + based on a ticket-granting ticket was successful. It also might + cover all servers for a realm, or just the particular server. Some + implementations MAY display this information to the user to aid in + discovering unauthorized use of one's identity. It is similar in + spirit to the last login time displayed when logging into + timesharing systems. + + + +March 2003 [Page 82] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + lr-type + This field indicates how the following lr-value field is to be + interpreted. Negative values indicate that the information + pertains only to the responding server. Non-negative values + pertain to all servers for the realm. + + If the lr-type field is zero (0), then no information is + conveyed by the lr-value subfield. If the absolute value of the + lr-type field is one (1), then the lr-value subfield is the + time of last initial request for a TGT. If it is two (2), then + the lr-value subfield is the time of last initial request. If + it is three (3), then the lr-value subfield is the time of + issue for the newest ticket-granting ticket used. If it is four + (4), then the lr-value subfield is the time of the last + renewal. If it is five (5), then the lr-value subfield is the + time of last request (of any type). If it is (6), then the lr- + value subfield is the time when the password will expire. If + it is (7), then the lr-value subfield is the time when the + account will expire. + + lr-value + This field contains the time of the last request. The time MUST + be interpreted according to the contents of the accompanying + lr-type subfield. + + nonce + This field is described above in section 5.4.1. + + key-expiration + The key-expiration field is part of the response from the KDC and + specifies the time that the client's secret key is due to expire. + The expiration might be the result of password aging or an account + expiration. If present, it SHOULD be set to the earliest of the + user's key expiration and account expiration. The use of this + field is deprecated and the last-req field SHOULD be used to + convey this information instead. This field will usually be left + out of the TGS reply since the response to the TGS request is + encrypted in a session key and no client information need be + retrieved from the KDC database. It is up to the application + client (usually the login program) to take appropriate action + (such as notifying the user) if the expiration time is imminent. + + flags, authtime, starttime, endtime, renew-till and caddr + These fields are duplicates of those found in the encrypted + portion of the attached ticket (see section 5.3), provided so the + client MAY verify they match the intended request and to assist in + proper ticket caching. If the message is of type KRB_TGS_REP, the + caddr field will only be filled in if the request was for a proxy + + + +March 2003 [Page 83] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + or forwarded ticket, or if the user is substituting a subset of + the addresses from the ticket-granting ticket. If the client- + requested addresses are not present or not used, then the + addresses contained in the ticket will be the same as those + included in the ticket-granting ticket. + +5.5. Client/Server (CS) message specifications + + This section specifies the format of the messages used for the + authentication of the client to the application server. + +5.5.1. KRB_AP_REQ definition + + The KRB_AP_REQ message contains the Kerberos protocol version number, + the message type KRB_AP_REQ, an options field to indicate any options + in use, and the ticket and authenticator themselves. The KRB_AP_REQ + message is often referred to as the 'authentication header'. + + AP-REQ ::= [APPLICATION 14] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (14), + ap-options [2] APOptions, + ticket [3] Ticket, + authenticator [4] EncryptedData -- Authenticator + } + + APOptions ::= KerberosFlags + -- reserved(0), + -- use-session-key(1), + -- mutual-required(2) + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + KRB_AP_REQ. + + ap-options + This field appears in the application request (KRB_AP_REQ) and + affects the way the request is processed. It is a bit-field, where + the selected options are indicated by the bit being set (1), and + the unselected options and reserved fields being reset (0). The + encoding of the bits is specified in section 5.2. The meanings of + the options are: + + Bit(s) Name Description + + 0 reserved Reserved for future expansion of this field. + + The USE-SESSION-KEY option indicates that the + + + +March 2003 [Page 84] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + ticket the client is presenting to a server + 1 use-session-key is encrypted in the session key from the + server's ticket-granting ticket. When this + option is not specified, the ticket is + encrypted in the server's secret key. + + The MUTUAL-REQUIRED option tells the server + 2 mutual-required that the client requires mutual + authentication, and that it must respond with + a KRB_AP_REP message. + + 3-31 reserved Reserved for future use. + + ticket + This field is a ticket authenticating the client to the server. + + authenticator + This contains the encrypted authenticator, which includes the + client's choice of a subkey. + + The encrypted authenticator is included in the AP-REQ; it certifies + to a server that the sender has recent knowledge of the encryption + key in the accompanying ticket, to help the server detect replays. It + also assists in the selection of a "true session key" to use with the + particular session. The DER encoding of the following is encrypted + in the ticket's session key, with a key usage value of 11 in normal + application exchanges, or 7 when used as the PA-TGS-REQ PA-DATA field + of a TGS-REQ exchange (see section 5.4.1): + + -- Unencrypted authenticator + Authenticator ::= [APPLICATION 2] SEQUENCE { + authenticator-vno [0] INTEGER (5), + crealm [1] Realm, + cname [2] PrincipalName, + cksum [3] Checksum OPTIONAL, + cusec [4] Microseconds, + ctime [5] KerberosTime, + subkey [6] EncryptionKey OPTIONAL, + seq-number [7] UInt32 OPTIONAL, + authorization-data [8] AuthorizationData OPTIONAL + } + + authenticator-vno + This field specifies the version number for the format of the + authenticator. This document specifies version 5. + + crealm and cname + These fields are the same as those described for the ticket in + + + +March 2003 [Page 85] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + section 5.3. + + cksum + This field contains a checksum of the application data that + accompanies the KRB_AP_REQ, computed using a key usage value of 10 + in normal application exchanges, or 6 when used in the TGS-REQ PA- + TGS-REQ AP-DATA field. + + cusec + This field contains the microsecond part of the client's + timestamp. Its value (before encryption) ranges from 0 to 999999. + It often appears along with ctime. The two fields are used + together to specify a reasonably accurate timestamp. + + ctime + This field contains the current time on the client's host. + + subkey + This field contains the client's choice for an encryption key + which is to be used to protect this specific application session. + Unless an application specifies otherwise, if this field is left + out the session key from the ticket will be used. + + seq-number + This optional field includes the initial sequence number to be + used by the KRB_PRIV or KRB_SAFE messages when sequence numbers + are used to detect replays (It may also be used by application + specific messages). When included in the authenticator this field + specifies the initial sequence number for messages from the client + to the server. When included in the AP-REP message, the initial + sequence number is that for messages from the server to the + client. When used in KRB_PRIV or KRB_SAFE messages, it is + incremented by one after each message is sent. Sequence numbers + fall in the range of 0 through 2^32 - 1 and wrap to zero following + the value 2^32 - 1. + + For sequence numbers to adequately support the detection of + replays they SHOULD be non-repeating, even across connection + boundaries. The initial sequence number SHOULD be random and + uniformly distributed across the full space of possible sequence + numbers, so that it cannot be guessed by an attacker and so that + it and the successive sequence numbers do not repeat other + sequences. + + Implmentation note: historically, some implementations transmit + signed twos-complement numbers for sequence numbers. In the + interests of compatibility, implementations MAY accept the + equivalent negative number where a positive number greater than + + + +March 2003 [Page 86] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + 2^31 - 1 is expected. + + Implementation note: as noted before, some implementations omit + the optional sequence number when its value would be zero. + Implementations MAY accept an omitted sequence number when + expecting a value of zero, and SHOULD NOT transmit an + Authenticator with a initial sequence number of zero. + + authorization-data + This field is the same as described for the ticket in section 5.3. + It is optional and will only appear when additional restrictions + are to be placed on the use of a ticket, beyond those carried in + the ticket itself. + +5.5.2. KRB_AP_REP definition + + The KRB_AP_REP message contains the Kerberos protocol version number, + the message type, and an encrypted time-stamp. The message is sent in + response to an application request (KRB_AP_REQ) where the mutual + authentication option has been selected in the ap-options field. + + AP-REP ::= [APPLICATION 15] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (15), + enc-part [2] EncryptedData -- EncAPRepPart + } + + EncAPRepPart ::= [APPLICATION 27] SEQUENCE { + ctime [0] KerberosTime, + cusec [1] Microseconds, + subkey [2] EncryptionKey OPTIONAL, + seq-number [3] UInt32 OPTIONAL + } + + The encoded EncAPRepPart is encrypted in the shared session key of + the ticket. The optional subkey field can be used in an application- + arranged negotiation to choose a per association session key. + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + KRB_AP_REP. + + enc-part + This field is described above in section 5.4.2. It is computed + with a key usage value of 12. + + ctime + This field contains the current time on the client's host. + + + +March 2003 [Page 87] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + cusec + This field contains the microsecond part of the client's + timestamp. + + subkey + This field contains an encryption key which is to be used to + protect this specific application session. See section 3.2.6 for + specifics on how this field is used to negotiate a key. Unless an + application specifies otherwise, if this field is left out, the + sub-session key from the authenticator, or if also left out, the + session key from the ticket will be used. + + seq-number + This field is described above in section 5.3.2. + +5.5.3. Error message reply + + If an error occurs while processing the application request, the + KRB_ERROR message will be sent in response. See section 5.9.1 for the + format of the error message. The cname and crealm fields MAY be left + out if the server cannot determine their appropriate values from the + corresponding KRB_AP_REQ message. If the authenticator was + decipherable, the ctime and cusec fields will contain the values from + it. + +5.6. KRB_SAFE message specification + + This section specifies the format of a message that can be used by + either side (client or server) of an application to send a tamper- + proof message to its peer. It presumes that a session key has + previously been exchanged (for example, by using the + KRB_AP_REQ/KRB_AP_REP messages). + +5.6.1. KRB_SAFE definition + + The KRB_SAFE message contains user data along with a collision-proof + checksum keyed with the last encryption key negotiated via subkeys, + or the session key if no negotiation has occurred. The message fields + are: + + KRB-SAFE ::= [APPLICATION 20] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (20), + safe-body [2] KRB-SAFE-BODY, + cksum [3] Checksum + } + + KRB-SAFE-BODY ::= SEQUENCE { + + + +March 2003 [Page 88] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + user-data [0] OCTET STRING, + timestamp [1] KerberosTime OPTIONAL, + usec [2] Microseconds OPTIONAL, + seq-number [3] UInt32 OPTIONAL, + s-address [4] HostAddress, + r-address [5] HostAddress OPTIONAL + } + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + KRB_SAFE. + + safe-body + This field is a placeholder for the body of the KRB-SAFE message. + + cksum + This field contains the checksum of the application data, computed + with a key usage value of 15. + + The checksum is computed over the encoding of the KRB-SAFE + sequence. First, the cksum is set to a type zero, zero-length + value and the checksum is computed over the encoding of the KRB- + SAFE sequence, then the checksum is set to the result of that + computation, and finally the KRB-SAFE sequence is encoded again. + This method, while different than the one specified in RFC 1510, + corresponds to existing practice. + + user-data + This field is part of the KRB_SAFE and KRB_PRIV messages and + contain the application specific data that is being passed from + the sender to the recipient. + + timestamp + This field is part of the KRB_SAFE and KRB_PRIV messages. Its + contents are the current time as known by the sender of the + message. By checking the timestamp, the recipient of the message + is able to make sure that it was recently generated, and is not a + replay. + + usec + This field is part of the KRB_SAFE and KRB_PRIV headers. It + contains the microsecond part of the timestamp. + + seq-number + This field is described above in section 5.3.2. + + s-address + Sender's address. + + + +March 2003 [Page 89] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This field specifies the address in use by the sender of the + message. It MAY be omitted if not required by the application + protocol. + + r-address + This field specifies the address in use by the recipient of the + message. It MAY be omitted for some uses (such as broadcast + protocols), but the recipient MAY arbitrarily reject such + messages. This field, along with s-address, can be used to help + detect messages which have been incorrectly or maliciously + delivered to the wrong recipient. + +5.7. KRB_PRIV message specification + + This section specifies the format of a message that can be used by + either side (client or server) of an application to securely and + privately send a message to its peer. It presumes that a session key + has previously been exchanged (for example, by using the + KRB_AP_REQ/KRB_AP_REP messages). + +5.7.1. KRB_PRIV definition + + The KRB_PRIV message contains user data encrypted in the Session Key. + The message fields are: + + KRB-PRIV ::= [APPLICATION 21] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (21), + -- NOTE: there is no [2] tag + enc-part [3] EncryptedData -- EncKrbPrivPart + } + + EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE { + user-data [0] OCTET STRING, + timestamp [1] KerberosTime OPTIONAL, + usec [2] Microseconds OPTIONAL, + seq-number [3] UInt32 OPTIONAL, + s-address [4] HostAddress -- sender's addr --, + r-address [5] HostAddress OPTIONAL -- recip's addr + } + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + KRB_PRIV. + + enc-part + This field holds an encoding of the EncKrbPrivPart sequence + encrypted under the session key, with a key usage value of 13. + + + +March 2003 [Page 90] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This encrypted encoding is used for the enc-part field of the KRB- + PRIV message. + + user-data, timestamp, usec, s-address and r-address + These fields are described above in section 5.6.1. + + seq-number + This field is described above in section 5.3.2. + +5.8. KRB_CRED message specification + + This section specifies the format of a message that can be used to + send Kerberos credentials from one principal to another. It is + presented here to encourage a common mechanism to be used by + applications when forwarding tickets or providing proxies to + subordinate servers. It presumes that a session key has already been + exchanged perhaps by using the KRB_AP_REQ/KRB_AP_REP messages. + +5.8.1. KRB_CRED definition + + The KRB_CRED message contains a sequence of tickets to be sent and + information needed to use the tickets, including the session key from + each. The information needed to use the tickets is encrypted under + an encryption key previously exchanged or transferred alongside the + KRB_CRED message. The message fields are: + + KRB-CRED ::= [APPLICATION 22] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (22), + tickets [2] SEQUENCE OF Ticket, + enc-part [3] EncryptedData -- EncKrbCredPart + } + + EncKrbCredPart ::= [APPLICATION 29] SEQUENCE { + ticket-info [0] SEQUENCE OF KrbCredInfo, + nonce [1] UInt32 OPTIONAL, + timestamp [2] KerberosTime OPTIONAL, + usec [3] Microseconds OPTIONAL, + s-address [4] HostAddress OPTIONAL, + r-address [5] HostAddress OPTIONAL + } + + KrbCredInfo ::= SEQUENCE { + key [0] EncryptionKey, + prealm [1] Realm OPTIONAL, + pname [2] PrincipalName OPTIONAL, + flags [3] TicketFlags OPTIONAL, + authtime [4] KerberosTime OPTIONAL, + + + +March 2003 [Page 91] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + starttime [5] KerberosTime OPTIONAL, + endtime [6] KerberosTime OPTIONAL, + renew-till [7] KerberosTime OPTIONAL, + srealm [8] Realm OPTIONAL, + sname [9] PrincipalName OPTIONAL, + caddr [10] HostAddresses OPTIONAL + } + + pvno and msg-type + These fields are described above in section 5.4.1. msg-type is + KRB_CRED. + + tickets + These are the tickets obtained from the KDC specifically for use + by the intended recipient. Successive tickets are paired with the + corresponding KrbCredInfo sequence from the enc-part of the KRB- + CRED message. + + enc-part + This field holds an encoding of the EncKrbCredPart sequence + encrypted under the session key shared between the sender and the + intended recipient, with a key usage value of 14. This encrypted + encoding is used for the enc-part field of the KRB-CRED message. + + Implementation note: implementations of certain applications, most + notably certain implementations of the Kerberos GSS-API mechanism, + do not separately encrypt the contents of the EncKrbCredPart of + the KRB-CRED message when sending it. In the case of those GSS- + API mechanisms, this is not a security vulnerability, as the + entire KRB-CRED message is itself embedded in an encrypted + message. + + nonce + If practical, an application MAY require the inclusion of a nonce + generated by the recipient of the message. If the same value is + included as the nonce in the message, it provides evidence that + the message is fresh and has not been replayed by an attacker. A + nonce MUST NEVER be reused; it SHOULD be generated randomly by the + recipient of the message and provided to the sender of the message + in an application specific manner. + + timestamp and usec + These fields specify the time that the KRB-CRED message was + generated. The time is used to provide assurance that the message + is fresh. + + s-address and r-address + These fields are described above in section 5.6.1. They are used + + + +March 2003 [Page 92] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + optionally to provide additional assurance of the integrity of the + KRB-CRED message. + + key + This field exists in the corresponding ticket passed by the KRB- + CRED message and is used to pass the session key from the sender + to the intended recipient. The field's encoding is described in + section 5.2.9. + + The following fields are optional. If present, they can be associated + with the credentials in the remote ticket file. If left out, then it + is assumed that the recipient of the credentials already knows their + value. + + prealm and pname + The name and realm of the delegated principal identity. + + flags, authtime, starttime, endtime, renew-till, srealm, sname, and + caddr + These fields contain the values of the corresponding fields from + the ticket found in the ticket field. Descriptions of the fields + are identical to the descriptions in the KDC-REP message. + +5.9. Error message specification + + This section specifies the format for the KRB_ERROR message. The + fields included in the message are intended to return as much + information as possible about an error. It is not expected that all + the information required by the fields will be available for all + types of errors. If the appropriate information is not available when + the message is composed, the corresponding field will be left out of + the message. + + Note that since the KRB_ERROR message is not integrity protected, it + is quite possible for an intruder to synthesize or modify such a + message. In particular, this means that the client SHOULD NOT use any + fields in this message for security-critical purposes, such as + setting a system clock or generating a fresh authenticator. The + message can be useful, however, for advising a user on the reason for + some failure. + +5.9.1. KRB_ERROR definition + + The KRB_ERROR message consists of the following fields: + + KRB-ERROR ::= [APPLICATION 30] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (30), + + + +March 2003 [Page 93] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + ctime [2] KerberosTime OPTIONAL, + cusec [3] Microseconds OPTIONAL, + stime [4] KerberosTime, + susec [5] Microseconds, + error-code [6] Int32, + crealm [7] Realm OPTIONAL, + cname [8] PrincipalName OPTIONAL, + realm [9] Realm -- service realm --, + sname [10] PrincipalName -- service name --, + e-text [11] KerberosString OPTIONAL, + e-data [12] OCTET STRING OPTIONAL + } + + pvno and msg-type + These fields are described above in section 5.4.1. +A msg-type is + KRB_ERROR. + + ctime + This field is described above in section 5.4.1. + + cusec + This field is described above in section 5.5.2. + + stime + This field contains the current time on the server. It is of type + KerberosTime. + + susec + This field contains the microsecond part of the server's + timestamp. Its value ranges from 0 to 999999. It appears along + with stime. The two fields are used in conjunction to specify a + reasonably accurate timestamp. + + error-code + This field contains the error code returned by Kerberos or the + server when a request fails. To interpret the value of this field + see the list of error codes in section 7.5.9. Implementations are + encouraged to provide for national language support in the display + of error messages. + + crealm, cname, srealm and sname + These fields are described above in section 5.3. + + e-text + This field contains additional text to help explain the error code + associated with the failed request (for example, it might include + a principal name which was unknown). + + + + +March 2003 [Page 94] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + e-data + This field contains additional data about the error for use by the + application to help it recover from or handle the error. If the + errorcode is KDC_ERR_PREAUTH_REQUIRED, then the e-data field will + contain an encoding of a sequence of padata fields, each + corresponding to an acceptable pre-authentication method and + optionally containing data for the method: + + METHOD-DATA ::= SEQUENCE OF PA-DATA + + For error codes defined in this document other than + KDC_ERR_PREAUTH_REQUIRED, the format and contents of the e-data field + are implementation-defined. Similarly, for future error codes, the + format and contents of the e-data field are implementation-defined + unless specified. Whether defined by the implementation or in a + future document, the e-data field MAY take the form of TYPED-DATA: + + TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE { + data-type [0] INTEGER, + data-value [1] OCTET STRING OPTIONAL + } + +5.10. Application Tag Numbers + + The following table lists the application class tag numbers used by + various data types defined in this section. + + Tag Number(s) Type Name Comments + + 0 unused + + 1 Ticket PDU + + 2 Authenticator non-PDU + + 3 EncTicketPart non-PDU + + 4-9 unused + + 10 AS-REQ PDU + + 11 AS-REP PDU + + 12 TGS-REQ PDU + + 13 TGS-REP PDU + + 14 AP-REQ PDU + + + +March 2003 [Page 95] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + 15 AP-REP PDU + + 16 RESERVED16 TGT-REQ (for user-to-user) + + 17 RESERVED17 TGT-REP (for user-to-user) + + 18-19 unused + + 20 KRB-SAFE PDU + + 21 KRB-PRIV PDU + + 22 KRB-CRED PDU + + 23-24 unused + + 25 EncASRepPart non-PDU + + 26 EncTGSRepPart non-PDU + + 27 EncApRepPart non-PDU + + 28 EncKrbPrivPart non-PDU + + 29 EncKrbCredPart non-PDU + + 30 KRB-ERROR PDU + + The ASN.1 types marked as "PDU" (Protocol Data Unit) in the above are + the only ASN.1 types intended as top-level types of the Kerberos + protcol, and are the only types that may be used as elements in + another protocol that makes use of Kerberos. + +6. Naming Constraints + +6.1. Realm Names + + Although realm names are encoded as GeneralStrings and although a + realm can technically select any name it chooses, interoperability + across realm boundaries requires agreement on how realm names are to + be assigned, and what information they imply. + + To enforce these conventions, each realm MUST conform to the + conventions itself, and it MUST require that any realms with which + inter-realm keys are shared also conform to the conventions and + require the same from its neighbors. + + Kerberos realm names are case sensitive. Realm names that differ only + + + +March 2003 [Page 96] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + in the case of the characters are not equivalent. There are presently + three styles of realm names: domain, X500, and other. Examples of + each style follow: + + domain: ATHENA.MIT.EDU + X500: C=US/O=OSF + other: NAMETYPE:rest/of.name=without-restrictions + + Domain syle realm names MUST look like domain names: they consist of + components separated by periods (.) and they contain neither colons + (:) nor slashes (/). Though domain names themselves are case + insensitive, in order for realms to match, the case must match as + well. When establishing a new realm name based on an internet domain + name it is recommended by convention that the characters be converted + to upper case. + + X.500 names contain an equal (=) and cannot contain a colon (:) + before the equal. The realm names for X.500 names will be string + representations of the names with components separated by slashes. + Leading and trailing slashes will not be included. Note that the + slash separator is consistent with Kerberos implementations based on + RFC1510, but it is different from the separator recommended in + RFC2253. + + Names that fall into the other category MUST begin with a prefix that + contains no equal (=) or period (.) and the prefix MUST be followed + by a colon (:) and the rest of the name. All prefixes must be + assigned before they may be used. Presently none are assigned. + + The reserved category includes strings which do not fall into the + first three categories. All names in this category are reserved. It + is unlikely that names will be assigned to this category unless there + is a very strong argument for not using the 'other' category. + + These rules guarantee that there will be no conflicts between the + various name styles. The following additional constraints apply to + the assignment of realm names in the domain and X.500 categories: the + name of a realm for the domain or X.500 formats must either be used + by the organization owning (to whom it was assigned) an Internet + domain name or X.500 name, or in the case that no such names are + registered, authority to use a realm name MAY be derived from the + authority of the parent realm. For example, if there is no domain + name for E40.MIT.EDU, then the administrator of the MIT.EDU realm can + authorize the creation of a realm with that name. + + This is acceptable because the organization to which the parent is + assigned is presumably the organization authorized to assign names to + its children in the X.500 and domain name systems as well. If the + + + +March 2003 [Page 97] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + parent assigns a realm name without also registering it in the domain + name or X.500 hierarchy, it is the parent's responsibility to make + sure that there will not in the future exist a name identical to the + realm name of the child unless it is assigned to the same entity as + the realm name. + +6.2. Principal Names + + As was the case for realm names, conventions are needed to ensure + that all agree on what information is implied by a principal name. + The name-type field that is part of the principal name indicates the + kind of information implied by the name. The name-type SHOULD be + treated only as a hint to interpreting the meaning of a name. It is + not significant when checking for equivalence. Principal names that + differ only in the name-type identify the same principal. The name + type does not partition the name space. Ignoring the name type, no + two names can be the same (i.e. at least one of the components, or + the realm, MUST be different). The following name types are defined: + + name-type value meaning + + name types + + NT-UNKNOWN 0 Name type not known + NT-PRINCIPAL 1 Just the name of the principal as in DCE, or for users + NT-SRV-INST 2 Service and other unique instance (krbtgt) + NT-SRV-HST 3 Service with host name as instance (telnet, rcommands) + NT-SRV-XHST 4 Service with host as remaining components + NT-UID 5 Unique ID + NT-X500-PRINCIPAL 6 Encoded X.509 Distingished name [RFC 2253] + NT-SMTP-NAME 7 Name in form of SMTP email name (e.g. user@foo.com) + NT-ENTERPRISE 10 Enterprise name - may be mapped to principal name + + When a name implies no information other than its uniqueness at a + particular time the name type PRINCIPAL SHOULD be used. The principal + name type SHOULD be used for users, and it might also be used for a + unique server. If the name is a unique machine generated ID that is + guaranteed never to be reassigned then the name type of UID SHOULD be + used (note that it is generally a bad idea to reassign names of any + type since stale entries might remain in access control lists). + + If the first component of a name identifies a service and the + remaining components identify an instance of the service in a server + specified manner, then the name type of SRV-INST SHOULD be used. An + example of this name type is the Kerberos ticket-granting service + whose name has a first component of krbtgt and a second component + identifying the realm for which the ticket is valid. + + + + +March 2003 [Page 98] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + If the first component of a name identifies a service and there is a + single component following the service name identifying the instance + as the host on which the server is running, then the name type SRV- + HST SHOULD be used. This type is typically used for Internet services + such as telnet and the Berkeley R commands. If the separate + components of the host name appear as successive components following + the name of the service, then the name type SRV-XHST SHOULD be used. + This type might be used to identify servers on hosts with X.500 names + where the slash (/) might otherwise be ambiguous. + + A name type of NT-X500-PRINCIPAL SHOULD be used when a name from an + X.509 certificate is translated into a Kerberos name. The encoding of + the X.509 name as a Kerberos principal shall conform to the encoding + rules specified in RFC 2253. + + A name type of SMTP allows a name to be of a form that resembles a + SMTP email name. This name, including an "@" and a domain name, is + used as the one component of the principal name. + + A name type of UNKNOWN SHOULD be used when the form of the name is + not known. When comparing names, a name of type UNKNOWN will match + principals authenticated with names of any type. A principal + authenticated with a name of type UNKNOWN, however, will only match + other names of type UNKNOWN. + + Names of any type with an initial component of 'krbtgt' are reserved + for the Kerberos ticket granting service. See section 7.5.8 for the + form of such names. + +6.2.1. Name of server principals + + The principal identifier for a server on a host will generally be + composed of two parts: (1) the realm of the KDC with which the server + is registered, and (2) a two-component name of type NT-SRV-HST if the + host name is an Internet domain name or a multi-component name of + type NT-SRV-XHST if the name of the host is of a form such as X.500 + that allows slash (/) separators. The first component of the two- or + multi-component name will identify the service and the latter + components will identify the host. Where the name of the host is not + case sensitive (for example, with Internet domain names) the name of + the host MUST be lower case. If specified by the application protocol + for services such as telnet and the Berkeley R commands which run + with system privileges, the first component MAY be the string 'host' + instead of a service specific identifier. When a host has an official + name and one or more aliases and the official name can be reliably + determined, the official name of the host SHOULD be used when + constructing the name of the server principal. + + + + +March 2003 [Page 99] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +7. Constants and other defined values + +7.1. Host address types + + All negative values for the host address type are reserved for local + use. All non-negative values are reserved for officially assigned + type fields and interpretations. + + Internet (IPv4) Addresses + + Internet (IPv4) addresses are 32-bit (4-octet) quantities, encoded + in MSB order. The IPv4 loopback address SHOULD NOT appear in a + Kerberos packet. The type of IPv4 addresses is two (2). + + Internet (IPv6) Addresses + + IPv6 addresses [RFC2373] are 128-bit (16-octet) quantities, + encoded in MSB order. The type of IPv6 addresses is twenty-four + (24). The following addresses MUST NOT appear in any Kerberos + packet: + + * the Unspecified Address + * the Loopback Address + * Link-Local addresses + + IPv4-mapped IPv6 addresses MUST be represented as addresses of + type 2. + + DECnet Phase IV addresses + + DECnet Phase IV addresses are 16-bit addresses, encoded in LSB + order. The type of DECnet Phase IV addresses is twelve (12). + + Netbios addresses + + Netbios addresses are 16-octet addresses typically composed of 1 + to 15 alphanumeric characters and padded with the US-ASCII SPC + character (code 32). The 16th octet MUST be the US-ASCII NUL + character (code 0). The type of Netbios addresses is twenty (20). + + Directional Addresses + + In many environments, including the sender address in KRB_SAFE and + KRB_PRIV messages is undesirable because the addresses may be + changed in transport by network address translators. However, if + these addresses are removed, the messages may be subject to a + reflection attack in which a message is reflected back to its + originator. The directional address type provides a way to avoid + + + +March 2003 [Page 100] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + transport addresses and reflection attacks. Directional addresses + are encoded as four byte unsigned integers in network byte order. + If the message is originated by the party sending the original + KRB_AP_REQ message, then an address of 0 SHOULD be used. If the + message is originated by the party to whom that KRB_AP_REQ was + sent, then the address 1 SHOULD be used. Applications involving + multiple parties can specify the use of other addresses. + + Directional addresses MUST only be used for the sender address + field in the KRB_SAFE or KRB_PRIV messages. They MUST NOT be used + as a ticket address or in a KRB_AP_REQ message. This address type + SHOULD only be used in situations where the sending party knows + that the receiving party supports the address type. This generally + means that directional addresses may only be used when the + application protocol requires their support. Directional addresses + are type (3). + +7.2. KDC messaging - IP Transports + + Kerberos defines two IP transport mechanisms for communication + between clients and servers: UDP/IP and TCP/IP. + +7.2.1. UDP/IP transport + + Kerberos servers (KDCs) supporting IP transports MUST accept UDP + requests and SHOULD listen for such requests on port 88 (decimal) + unless specifically configured to listen on an alternative UDP port. + Alternate ports MAY be used when running multiple KDCs for multiple + realms on the same host. + + Kerberos clients supporting IP transports SHOULD support the sending + of UDP requests. Clients SHOULD use KDC discovery [7.2.3] to identify + the IP address and port to which they will send their request. + + When contacting a KDC for a KRB_KDC_REQ request using UDP/IP + transport, the client shall send a UDP datagram containing only an + encoding of the request to the KDC. The KDC will respond with a reply + datagram containing only an encoding of the reply message (either a + KRB_ERROR or a KRB_KDC_REP) to the sending port at the sender's IP + address. The response to a request made through UDP/IP transport MUST + also use UDP/IP transport. If the response can not be handled using + UDP (for example because it is too large), the KDC MUST return + KRB_ERR_RESPONSE_TOO_BIG, forcing the client to retry the request + using the TCP transport. + +7.2.2. TCP/IP transport + + Kerberos servers (KDCs) supporting IP transports MUST accept TCP + + + +March 2003 [Page 101] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + requests and SHOULD listen for such requests on port 88 (decimal) + unless specifically configured to listen on an alternate TCP port. + Alternate ports MAY be used when running multiple KDCs for multiple + realms on the same host. + + Clients MUST support the sending of TCP requests, but MAY choose to + intially try a request using the UDP transport. Clients SHOULD use + KDC discovery [7.2.3] to identify the IP address and port to which + they will send their request. + + Implementation note: Some extensions to the Kerberos protocol will + not succeed if any client or KDC not supporting the TCP transport is + involved. Implementations of RFC 1510 were not required to support + TCP/IP transports. + + When the KRB_KDC_REQ message is sent to the KDC over a TCP stream, + the response (KRB_KDC_REP or KRB_ERROR message) MUST be returned to + the client on the same TCP stream that was established for the + request. The KDC MAY close the TCP stream after sending a response, + but MAY leave the stream open for a reasonable period of time if it + expects a followup. Care must be taken in managing TCP/IP connections + on the KDC to prevent denial of service attacks based on the number + of open TCP/IP connections. + + The client MUST be prepared to have the stream closed by the KDC at + anytime after the receipt of a response. A stream closure SHOULD NOT + be treated as a fatal error. Instead, if multiple exchanges are + required (e.g., certain forms of pre-authentication) the client may + need to establish a new connection when it is ready to send + subsequent messages. A client MAY close the stream after receiving a + response, and SHOULD close the stream if it does not expect to send + followup messages. + + A client MAY send multiple requests before receiving responses, + though it must be prepared to handle the connection being closed + after the first response. + + Each request (KRB_KDC_REQ) and response (KRB_KDC_REP or KRB_ERROR) + sent over the TCP stream is preceded by the length of the request as + 4 octets in network byte order. The high bit of the length is + reserved for future expansion and MUST currently be set to zero. + + If multiple requests are sent over a single TCP connection, and the + KDC sends multiple responses, the KDC is not required to send the + responses in the order of the corresponding requests. This may permit + some implementations to send each response as soon as it is ready + even if earlier requests are still being processed (for example, + waiting for a response from an external device or database). + + + +March 2003 [Page 102] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + +7.2.3. KDC Discovery on IP Networks + + Kerberos client implementations MUST provide a means for the client + to determine the location of the Kerberos Key Distribution Centers + (KDCs). Traditionally, Kerberos implementations have stored such + configuration information in a file on each client machine. + Experience has shown this method of storing configuration information + presents problems with out-of-date information and scaling problems, + especially when using cross-realm authentication. This section + describes a method for using the Domain Name System [RFC 1035] for + storing KDC location information. + +7.2.3.1. DNS vs. Kerberos - Case Sensitivity of Realm Names + + In Kerberos, realm names are case sensitive. While it is strongly + encouraged that all realm names be all upper case this recommendation + has not been adopted by all sites. Some sites use all lower case + names and other use mixed case. DNS on the other hand is case + insensitive for queries. Since "MYREALM", "myrealm", and "MyRealm" + are all different it is necessary that only one of the possible + combinations of upper and lower case characters be used. This + restriction may be lifted in the future as the DNS naming scheme is + expanded to support non-US-ASCII names. + +7.2.3.2. Specifying KDC Location information with DNS SRV records + + KDC location information is to be stored using the DNS SRV RR [RFC + 2052]. The format of this RR is as follows: + + Service.Proto.Realm TTL Class SRV Priority Weight Port Target + + The Service name for Kerberos is always "_kerberos". + + The Proto can be one of "_udp", "_tcp". If these SRV records are to + be used, both "_udp" and "_tcp" records MUST be specified for all KDC + deployments. + + The Realm is the Kerberos realm that this record corresponds to. + + TTL, Class, SRV, Priority, Weight, and Target have the standard + meaning as defined in RFC 2052. + + As per RFC 2052 the Port number used for "_udp" and "_tcp" SRV + records SHOULD be the value assigned to "kerberos" by the Internet + Assigned Number Authority: 88 (decimal) unless the KDC is configured + to listen on an alternate TCP port. + + Implementation note: Many existing client implementations do not + + + +March 2003 [Page 103] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + support KDC Discovery and are configured to send requests to the IANA + assigned port (88 decimal), so it is strongly recommended that KDCs + be configured to listen on that port. + +7.2.3.3. KDC Discovery for Domain Style Realm Names on IP Networks + + These are DNS records for a Kerberos realm EXAMPLE.COM. It has two + Kerberos servers, kdc1.example.com and kdc2.example.com. Queries + should be directed to kdc1.example.com first as per the specified + priority. Weights are not used in these sample records. + + _kerberos._udp.EXAMPLE.COM. IN SRV 0 0 88 kdc1.example.com. + _kerberos._udp.EXAMPLE.COM. IN SRV 1 0 88 kdc2.example.com. + _kerberos._tcp.EXAMPLE.COM. IN SRV 0 0 88 kdc1.example.com. + _kerberos._tcp.EXAMPLE.COM. IN SRV 1 0 88 kdc2.example.com. + +7.3. Name of the TGS + + The principal identifier of the ticket-granting service shall be + composed of three parts: (1) the realm of the KDC issuing the TGS + ticket (2) a two-part name of type NT-SRV-INST, with the first part + "krbtgt" and the second part the name of the realm which will accept + the ticket-granting ticket. For example, a ticket-granting ticket + issued by the ATHENA.MIT.EDU realm to be used to get tickets from the + ATHENA.MIT.EDU KDC has a principal identifier of "ATHENA.MIT.EDU" + (realm), ("krbtgt", "ATHENA.MIT.EDU") (name). A ticket-granting + ticket issued by the ATHENA.MIT.EDU realm to be used to get tickets + from the MIT.EDU realm has a principal identifier of "ATHENA.MIT.EDU" + (realm), ("krbtgt", "MIT.EDU") (name). + +7.4. OID arc for KerberosV5 + + This OID MAY be used to identify Kerberos protocol messages + encapsulated in other protocols. It also designates the OID arc for + KerberosV5-related OIDs assigned by future IETF action. + Implementation note:: RFC 1510 had an incorrect value (5) for "dod" + in its OID. + + id-krb5 OBJECT IDENTIFIER ::= { + iso(1) identified-organization(3) dod(6) internet(1) + security(5) kerberosV5(2) + } + + Assignment of OIDs beneath the id-krb5 arc must be obtained by + contacting krb5-oid-registrar@mit.edu. + +7.5. Protocol constants and associated values + + + + +March 2003 [Page 104] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + The following tables list constants used in the protocol and define + their meanings. Ranges are specified in the "specification" section + that limit the values of constants for which values are defined here. + This allows implementations to make assumptions about the maximum + values that will be received for these constants. Implementation + receiving values outside the range specified in the "specification" + section MAY reject the request, but they MUST recover cleanly. + +7.5.1. Key usage numbers + + The encryption and checksum specifications in [@KCRYPTO] require as + input a "key usage number", to alter the encryption key used in any + specific message, to make certain types of cryptographic attack more + difficult. These are the key usage values assigned in this document: + + 1. AS-REQ PA-ENC-TIMESTAMP padata timestamp, encrypted + with the client key (section 5.2.7.2) + 2. AS-REP Ticket and TGS-REP Ticket (includes TGS session + key or application session key), encrypted with the + service key (section 5.3) + 3. AS-REP encrypted part (includes TGS session key or + application session key), encrypted with the client key + (section 5.4.2) + 4. TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with + the TGS session key (section 5.4.1) + 5. TGS-REQ KDC-REQ-BODY AuthorizationData, encrypted with + the TGS authenticator subkey (section 5.4.1) + 6. TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator cksum, + keyed with the TGS session key (sections 5.5.1) + 7. TGS-REQ PA-TGS-REQ padata AP-REQ Authenticator + (includes TGS authenticator subkey), encrypted with the + TGS session key (section 5.5.1) + 8. TGS-REP encrypted part (includes application session + key), encrypted with the TGS session key (section + 5.4.2) + 9. TGS-REP encrypted part (includes application session + key), encrypted with the TGS authenticator subkey + (section 5.4.2) + 10. AP-REQ Authenticator cksum, keyed with the application + session key (section 5.5.1) + 11. AP-REQ Authenticator (includes application + authenticator subkey), encrypted with the application + session key (section 5.5.1) + 12. AP-REP encrypted part (includes application session + subkey), encrypted with the application session key + (section 5.5.2) + 13. KRB-PRIV encrypted part, encrypted with a key chosen by + the application (section 5.7.1) + + + +March 2003 [Page 105] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + 14. KRB-CRED encrypted part, encrypted with a key chosen by + the application (section 5.8.1) + 15. KRB-SAFE cksum, keyed with a key chosen by the + application (section 5.6.1) + 19. AD-KDC-ISSUED checksum (ad-checksum in 5.2.6.4) + 22-24. Reserved for use in GSSAPI mechanisms derived from RFC + 1964. (raeburn/MIT) + 16-18,20-21,25-511. Reserved for future use in Kerberos and related + protocols. + 512-1023. Reserved for uses internal to a Kerberos + implementation. + 1024. Encryption for application use in protocols that + do not specify key usage values + 1025. Checksums for application use in protocols that + do not specify key usage values + 1026-2047. Reserved for application use. + + +7.5.2. PreAuthentication Data Types + + padata and data types padata-type value comment + + PA-TGS-REQ 1 + PA-ENC-TIMESTAMP 2 + PA-PW-SALT 3 + [reserved] 4 + PA-ENC-UNIX-TIME 5 (deprecated) + PA-SANDIA-SECUREID 6 + PA-SESAME 7 + PA-OSF-DCE 8 + PA-CYBERSAFE-SECUREID 9 + PA-AFS3-SALT 10 + PA-ETYPE-INFO 11 + PA-SAM-CHALLENGE 12 (sam/otp) + PA-SAM-RESPONSE 13 (sam/otp) + PA-PK-AS-REQ 14 (pkinit) + PA-PK-AS-REP 15 (pkinit) + PA-ETYPE-INFO2 19 (replaces pa-etype-info) + PA-USE-SPECIFIED-KVNO 20 + PA-SAM-REDIRECT 21 (sam/otp) + PA-GET-FROM-TYPED-DATA 22 (embedded in typed data) + TD-PADATA 22 (embeds padata) + PA-SAM-ETYPE-INFO 23 (sam/otp) + PA-ALT-PRINC 24 (crawdad@fnal.gov) + PA-SAM-CHALLENGE2 30 (kenh@pobox.com) + PA-SAM-RESPONSE2 31 (kenh@pobox.com) + PA-EXTRA-TGT 41 Reserved extra TGT + TD-PKINIT-CMS-CERTIFICATES 101 CertificateSet from CMS + + + +March 2003 [Page 106] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + TD-KRB-PRINCIPAL 102 PrincipalName + TD-KRB-REALM 103 Realm + TD-TRUSTED-CERTIFIERS 104 from PKINIT + TD-CERTIFICATE-INDEX 105 from PKINIT + TD-APP-DEFINED-ERROR 106 application specific + TD-REQ-NONCE 107 INTEGER + TD-REQ-SEQ 108 INTEGER + PA-PAC-REQUEST 128 (jbrezak@exchange.microsoft.com) + +7.5.3. Address Types + + Address type value + + IPv4 2 + Directional 3 + ChaosNet 5 + XNS 6 + ISO 7 + DECNET Phase IV 12 + AppleTalk DDP 16 + NetBios 20 + IPv6 24 + +7.5.4. Authorization Data Types + + authorization data type ad-type value + AD-IF-RELEVANT 1 + AD-INTENDED-FOR-SERVER 2 + AD-INTENDED-FOR-APPLICATION-CLASS 3 + AD-KDC-ISSUED 4 + AD-AND-OR 5 + AD-MANDATORY-TICKET-EXTENSIONS 6 + AD-IN-TICKET-EXTENSIONS 7 + AD-MANDATORY-FOR-KDC 8 + reserved values 9-63 + OSF-DCE 64 + SESAME 65 + AD-OSF-DCE-PKI-CERTID 66 (hemsath@us.ibm.com) + AD-WIN2K-PAC 128 (jbrezak@exchange.microsoft.com) + +7.5.5. Transited Encoding Types + + transited encoding type tr-type value + DOMAIN-X500-COMPRESS 1 + reserved values all others + +7.5.6. Protocol Version Number + + + + +March 2003 [Page 107] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Label Value Meaning or MIT code + + pvno 5 current Kerberos protocol version number + +7.5.7. Kerberos Message Types + + message types + + KRB_AS_REQ 10 Request for initial authentication + KRB_AS_REP 11 Response to KRB_AS_REQ request + KRB_TGS_REQ 12 Request for authentication based on TGT + KRB_TGS_REP 13 Response to KRB_TGS_REQ request + KRB_AP_REQ 14 application request to server + KRB_AP_REP 15 Response to KRB_AP_REQ_MUTUAL + KRB_RESERVED16 16 Reserved for user-to-user krb_tgt_request + KRB_RESERVED17 17 Reserved for user-to-user krb_tgt_reply + KRB_SAFE 20 Safe (checksummed) application message + KRB_PRIV 21 Private (encrypted) application message + KRB_CRED 22 Private (encrypted) message to forward credentials + KRB_ERROR 30 Error response + +7.5.8. Name Types + + name types + + KRB_NT_UNKNOWN 0 Name type not known + KRB_NT_PRINCIPAL 1 Just the name of the principal as in DCE, or for users + KRB_NT_SRV_INST 2 Service and other unique instance (krbtgt) + KRB_NT_SRV_HST 3 Service with host name as instance (telnet, rcommands) + KRB_NT_SRV_XHST 4 Service with host as remaining components + KRB_NT_UID 5 Unique ID + KRB_NT_X500_PRINCIPAL 6 Encoded X.509 Distingished name [RFC 2253] + KRB_NT_SMTP_NAME 7 Name in form of SMTP email name (e.g. user@foo.com) + KRB_NT_ENTERPRISE 10 Enterprise name - may be mapped to principal name + +7.5.9. Error Codes + + error codes + + KDC_ERR_NONE 0 No error + KDC_ERR_NAME_EXP 1 Client's entry in database has expired + KDC_ERR_SERVICE_EXP 2 Server's entry in database has expired + KDC_ERR_BAD_PVNO 3 Requested protocol version number + not supported + KDC_ERR_C_OLD_MAST_KVNO 4 Client's key encrypted in old master key + KDC_ERR_S_OLD_MAST_KVNO 5 Server's key encrypted in old master key + KDC_ERR_C_PRINCIPAL_UNKNOWN 6 Client not found in Kerberos database + KDC_ERR_S_PRINCIPAL_UNKNOWN 7 Server not found in Kerberos database + + + +March 2003 [Page 108] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + KDC_ERR_PRINCIPAL_NOT_UNIQUE 8 Multiple principal entries in database + KDC_ERR_NULL_KEY 9 The client or server has a null key + KDC_ERR_CANNOT_POSTDATE 10 Ticket not eligible for postdating + KDC_ERR_NEVER_VALID 11 Requested start time is later than end time + KDC_ERR_POLICY 12 KDC policy rejects request + KDC_ERR_BADOPTION 13 KDC cannot accommodate requested option + KDC_ERR_ETYPE_NOSUPP 14 KDC has no support for encryption type + KDC_ERR_SUMTYPE_NOSUPP 15 KDC has no support for checksum type + KDC_ERR_PADATA_TYPE_NOSUPP 16 KDC has no support for padata type + KDC_ERR_TRTYPE_NOSUPP 17 KDC has no support for transited type + KDC_ERR_CLIENT_REVOKED 18 Clients credentials have been revoked + KDC_ERR_SERVICE_REVOKED 19 Credentials for server have been revoked + KDC_ERR_TGT_REVOKED 20 TGT has been revoked + KDC_ERR_CLIENT_NOTYET 21 Client not yet valid - try again later + KDC_ERR_SERVICE_NOTYET 22 Server not yet valid - try again later + KDC_ERR_KEY_EXPIRED 23 Password has expired + - change password to reset + KDC_ERR_PREAUTH_FAILED 24 Pre-authentication information was invalid + KDC_ERR_PREAUTH_REQUIRED 25 Additional pre-authenticationrequired + KDC_ERR_SERVER_NOMATCH 26 Requested server and ticket don't match + KDC_ERR_MUST_USE_USER2USER 27 Server principal valid for user2user only + KDC_ERR_PATH_NOT_ACCPETED 28 KDC Policy rejects transited path + KDC_ERR_SVC_UNAVAILABLE 29 A service is not available + KRB_AP_ERR_BAD_INTEGRITY 31 Integrity check on decrypted field failed + KRB_AP_ERR_TKT_EXPIRED 32 Ticket expired + KRB_AP_ERR_TKT_NYV 33 Ticket not yet valid + KRB_AP_ERR_REPEAT 34 Request is a replay + KRB_AP_ERR_NOT_US 35 The ticket isn't for us + KRB_AP_ERR_BADMATCH 36 Ticket and authenticator don't match + KRB_AP_ERR_SKEW 37 Clock skew too great + KRB_AP_ERR_BADADDR 38 Incorrect net address + KRB_AP_ERR_BADVERSION 39 Protocol version mismatch + KRB_AP_ERR_MSG_TYPE 40 Invalid msg type + KRB_AP_ERR_MODIFIED 41 Message stream modified + KRB_AP_ERR_BADORDER 42 Message out of order + KRB_AP_ERR_BADKEYVER 44 Specified version of key is not available + KRB_AP_ERR_NOKEY 45 Service key not available + KRB_AP_ERR_MUT_FAIL 46 Mutual authentication failed + KRB_AP_ERR_BADDIRECTION 47 Incorrect message direction + KRB_AP_ERR_METHOD 48 Alternative authentication method required + KRB_AP_ERR_BADSEQ 49 Incorrect sequence number in message + KRB_AP_ERR_INAPP_CKSUM 50 Inappropriate type of checksum in message + KRB_AP_PATH_NOT_ACCEPTED 51 Policy rejects transited path + KRB_ERR_RESPONSE_TOO_BIG 52 Response too big for UDP, retry with TCP + KRB_ERR_GENERIC 60 Generic error (description in e-text) + KRB_ERR_FIELD_TOOLONG 61 Field is too long for this implementation + KDC_ERROR_CLIENT_NOT_TRUSTED 62 Reserved for PKINIT + KDC_ERROR_KDC_NOT_TRUSTED 63 Reserved for PKINIT + + + +March 2003 [Page 109] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + KDC_ERROR_INVALID_SIG 64 Reserved for PKINIT + KDC_ERR_KEY_TOO_WEAK 65 Reserved for PKINIT + KDC_ERR_CERTIFICATE_MISMATCH 66 Reserved for PKINIT + KRB_AP_ERR_NO_TGT 67 No TGT available to validate USER-TO-USER + KDC_ERR_WRONG_REALM 68 USER-TO-USER TGT issued different KDC + KRB_AP_ERR_USER_TO_USER_REQUIRED 69 Ticket must be for USER-TO-USER + KDC_ERR_CANT_VERIFY_CERTIFICATE 70 Reserved for PKINIT + KDC_ERR_INVALID_CERTIFICATE 71 Reserved for PKINIT + KDC_ERR_REVOKED_CERTIFICATE 72 Reserved for PKINIT + KDC_ERR_REVOCATION_STATUS_UNKNOWN 73 Reserved for PKINIT + KDC_ERR_REVOCATION_STATUS_UNAVAILABLE 74 Reserved for PKINIT + KDC_ERR_CLIENT_NAME_MISMATCH 75 Reserved for PKINIT + KDC_ERR_KDC_NAME_MISMATCH 76 Reserved for PKINIT + +8. Interoperability requirements + + Version 5 of the Kerberos protocol supports a myriad of options. + Among these are multiple encryption and checksum types, alternative + encoding schemes for the transited field, optional mechanisms for + pre-authentication, the handling of tickets with no addresses, + options for mutual authentication, user to user authentication, + support for proxies, forwarding, postdating, and renewing tickets, + the format of realm names, and the handling of authorization data. + + In order to ensure the interoperability of realms, it is necessary to + define a minimal configuration which must be supported by all + implementations. This minimal configuration is subject to change as + technology does. For example, if at some later date it is discovered + that one of the required encryption or checksum algorithms is not + secure, it will be replaced. + +8.1. Specification 2 + + This section defines the second specification of these options. + Implementations which are configured in this way can be said to + support Kerberos Version 5 Specification 2 (5.2). Specification 1 + (deprecated) may be found in RFC1510. + + Transport + + TCP/IP and UDP/IP transport MUST be supported by clients and KDCs + claiming conformance to specification 2. + + Encryption and checksum methods + + The following encryption and checksum mechanisms MUST be + supported. + + + + +March 2003 [Page 110] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Encryption: AES256-CTS-HMAC-SHA1-96 + Checksums: HMAC-SHA1-96-AES256 + + Implementations SHOULD support other mechanisms as well, but the + additional mechanisms may only be used when communicating with + principals known to also support them. The mechanisms that SHOULD + be supported are: + + Encryption: DES-CBC-MD5, DES3-CBC-SHA1-KD + Checksums: DES-MD5, HMAC-SHA1-DES3-KD + + Implementations MAY support other mechanisms as well, but the + additional mechanisms may only be used when communicating with + principals known to also support them. + + Implementation note: earlier implementations of Kerberos generate + messages using the CRC-32, RSA-MD5 checksum methods. For + interoperability with these earlier releases implementors MAY + consider supporting these checksum methods but should carefully + analyze the security impplications to limit the situations within + which these methods are accepted. + + Realm Names + + All implementations MUST understand hierarchical realms in both + the Internet Domain and the X.500 style. When a ticket-granting + ticket for an unknown realm is requested, the KDC MUST be able to + determine the names of the intermediate realms between the KDCs + realm and the requested realm. + + Transited field encoding + + DOMAIN-X500-COMPRESS (described in section 3.3.3.2) MUST be + supported. Alternative encodings MAY be supported, but they may + be used only when that encoding is supported by ALL intermediate + realms. + + Pre-authentication methods + + The TGS-REQ method MUST be supported. The TGS-REQ method is not + used on the initial request. The PA-ENC-TIMESTAMP method MUST be + supported by clients but whether it is enabled by default MAY be + determined on a realm by realm basis. If not used in the initial + request and the error KDC_ERR_PREAUTH_REQUIRED is returned + specifying PA-ENC-TIMESTAMP as an acceptable method, the client + SHOULD retry the initial request using the PA-ENC-TIMESTAMP pre- + authentication method. Servers need not support the PA-ENC- + TIMESTAMP method, but if not supported the server SHOULD ignore + + + +March 2003 [Page 111] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + the presence of PA-ENC-TIMESTAMP pre-authentication in a request. + + The ETYPE-INFO2 method MUST be supported; this method is used to + communicate the set of supported encryption types, and + corresponding salt and string to key paramters. The ETYPE-INFO + method SHOULD be supported for interoperability with older + implementation. + + Mutual authentication + + Mutual authentication (via the KRB_AP_REP message) MUST be + supported. + + Ticket addresses and flags + + All KDCs MUST pass through tickets that carry no addresses (i.e. + if a TGT contains no addresses, the KDC will return derivative + tickets). Implementations SHOULD default to requesting + addressless tickets as this significantly increases + interoperability with network address translation. In some cases + realms or application servers MAY require that tickets have an + address. + + Implementations SHOULD accept directional address type for the + KRB_SAFE and KRB_PRIV message and SHOULD include directional + addresses in these messages when other address types are not + available. + + Proxies and forwarded tickets MUST be supported. Individual realms + and application servers can set their own policy on when such + tickets will be accepted. + + All implementations MUST recognize renewable and postdated + tickets, but need not actually implement them. If these options + are not supported, the starttime and endtime in the ticket shall + specify a ticket's entire useful life. When a postdated ticket is + decoded by a server, all implementations shall make the presence + of the postdated flag visible to the calling server. + + User-to-user authentication + + Support for user to user authentication (via the ENC-TKT-IN-SKEY + KDC option) MUST be provided by implementations, but individual + realms MAY decide as a matter of policy to reject such requests on + a per-principal or realm-wide basis. + + Authorization data + + + + +March 2003 [Page 112] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Implementations MUST pass all authorization data subfields from + ticket-granting tickets to any derivative tickets unless directed + to suppress a subfield as part of the definition of that + registered subfield type (it is never incorrect to pass on a + subfield, and no registered subfield types presently specify + suppression at the KDC). + + Implementations MUST make the contents of any authorization data + subfields available to the server when a ticket is used. + Implementations are not required to allow clients to specify the + contents of the authorization data fields. + + Constant ranges + + All protocol constants are constrained to 32 bit (signed) values + unless further constrained by the protocol definition. This limit + is provided to allow implementations to make assumptions about the + maximum values that will be received for these constants. + Implementation receiving values outside this range MAY reject the + request, but they MUST recover cleanly. + +8.2. Recommended KDC values + + Following is a list of recommended values for a KDC configuration. + + minimum lifetime 5 minutes + maximum renewable lifetime 1 week + maximum ticket lifetime 1 day + acceptable clock skew 5 minutes + empty addresses Allowed. + proxiable, etc. Allowed. + +9. IANA considerations + + Section 7 of this document specifies protocol constants and other + defined values required for the interoperability of multiple + implementations. Until otherwise specified in a subsequent RFC, + allocations of additional protocol constants and other defined values + required for extensions to the Kerberos protocol will be administered + by the Kerberos Working Group. + +10. Security Considerations + + As an authentication service, Kerberos provides a means of verifying + the identity of principals on a network. Kerberos does not, by + itself, provide authorization. Applications should not accept the + issuance of a service ticket by the Kerberos server as granting + authority to use the service, since such applications may become + + + +March 2003 [Page 113] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + vulnerable to the bypass of this authorization check in an + environment if they inter-operate with other KDCs or where other + options for application authentication are provided. + + Denial of service attacks are not solved with Kerberos. There are + places in the protocols where an intruder can prevent an application + from participating in the proper authentication steps. Because + authentication is a required step for the use of many services, + successful denial of service attacks on a Kerberos server might + result in the denial of other network services that rely on Kerberos + for authentication. Kerberos is vulnerable to many kinds of denial of + service attacks: denial of service attacks on the network which would + prevent clients from contacting the KDC; denial of service attacks on + the domain name system which could prevent a client from finding the + IP address of the Kerberos server; and denial of service attack by + overloading the Kerberos KDC itself with repeated requests. + + Interoperability conflicts caused by incompatible character-set usage + (see 5.2.1) can result in denial of service for clients that utilize + character-sets in Kerberos strings other than those stored in the KDC + database. + + Authentication servers maintain a database of principals (i.e., users + and servers) and their secret keys. The security of the + authentication server machines is critical. The breach of security of + an authentication server will compromise the security of all servers + that rely upon the compromised KDC, and will compromise the + authentication of any principals registered in the realm of the + compromised KDC. + + Principals must keep their secret keys secret. If an intruder somehow + steals a principal's key, it will be able to masquerade as that + principal or impersonate any server to the legitimate principal. + + Password guessing attacks are not solved by Kerberos. If a user + chooses a poor password, it is possible for an attacker to + successfully mount an off-line dictionary attack by repeatedly + attempting to decrypt, with successive entries from a dictionary, + messages obtained which are encrypted under a key derived from the + user's password. + + Unless pre-authentication options are required by the policy of a + realm, the KDC will not know whether a request for authentication + succeeds. An attacker can request a reply with credentials for any + principal. These credentials will likely not be of much use to the + attacker unless it knows the client's secret key, but the + availability of the response encrypted in the client's secret key + provides the attacker with ciphertext that may be used to mount brute + + + +March 2003 [Page 114] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + force or dictionary attacks to decrypt the credentials, by guessing + the user's password. For this reason it is strongly encouraged that + Kerberos realms require the use of pre-authentication. Even with pre- + authentication, attackers may try brute force or dictionary attacks + against credentials that are observed by eavesdropping on the + network. + + Because a client can request a ticket for any server principal and + can attempt a brute force or dictionary attack against the server + principal's key using that ticket, it is strongly encouraged that + keys be randomly generated (rather than generated from passwords) for + any principals that are usable as the target principal for a + KRB_TGS_REQ or KRB_AS_REQ messages. + + Each host on the network must have a clock which is loosely + synchronized to the time of the other hosts; this synchronization is + used to reduce the bookkeeping needs of application servers when they + do replay detection. The degree of "looseness" can be configured on a + per-server basis, but is typically on the order of 5 minutes. If the + clocks are synchronized over the network, the clock synchronization + protocol must itself be secured from network attackers. + + Principal identifiers must not recycled on a short-term basis. A + typical mode of access control will use access control lists (ACLs) + to grant permissions to particular principals. If a stale ACL entry + remains for a deleted principal and the principal identifier is + reused, the new principal will inherit rights specified in the stale + ACL entry. By not reusing principal identifiers, the danger of + inadvertent access is removed. + + Proper decryption of an KRB_AS_REP message from the KDC is not + sufficient for the host to verify the identity of the user; the user + and an attacker could cooperate to generate a KRB_AS_REP format + message which decrypts properly but is not from the proper KDC. To + authenticate a user logging on to a local system, the credentials + obtained in the AS exchange may first be used in a TGS exchange to + obtain credentials for a local server. Those credentials must then be + verified by a local server through successful completion of the + Client/Server exchange. + + Kerberos credentials contain clear-text information identifying the + principals to which they apply. If privacy of this information is + needed, this exchange should itself be encapsulated in a protocol + providing for confidentiality on the exchange of these credentials. + + Applications must take care to protect communications subsequent to + authentication either by using the KRB_PRIV or KRB_SAFE messages as + appropriate, or by applying their own confidentiality or integrity + + + +March 2003 [Page 115] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + mechanisms on such communications. Completion of the KRB_AP_REQ and + KRB_AP_REP exchange without subsequent use of confidentiality and + integrity mechanisms provides only for authentication of the parties + to the communication and not confidentiality and integrity of the + subsequent communication. Application applying confidentiality and + protections mechanisms other than KRB_PRIV and KRB_SAFE must make + sure that the authentication step is appropriately linked with the + protected communication channel that is established by the + application. + + Unless the application server provides its own suitable means to + protect against replay (for example, a challenge-response sequence + initiated by the server after authentication, or use of a server- + generated encryption subkey), the server must utilize a replay cache + to remember any authenticator presented within the allowable clock + skew. All services sharing a key need to use the same replay cache. + If separate replay caches are used, then and authenticator used with + one such service could later be replayed to a different service with + the same service principal. + + If a server loses track of authenticators presented within the + allowable clock skew, it must reject all requests until the clock + skew interval has passed, providing assurance that any lost or + replayed authenticators will fall outside the allowable clock skew + and can no longer be successfully replayed. + + Implementations of Kerberos should not use untrusted directory + servers to determine the realm of a host. To allow such would allow + the compromise of the directory server to enable an attacker to + direct the client to accept authentication with the wrong principal + (i.e. one with a similar name, but in a realm with which the + legitimate host was not registered). + + Implementations of Kerberos must not use DNS to canonicalize the host + components of service principal names. To allow such canonicalization + would allow a compromise of the DNS to result in a client obtaining + credentials and correctly authenticating to the wrong principal. + Though the client will know who it is communicating with, it will not + be the principal with which it intended to communicate. + + If the Kerberos server returns a TGT for a 'closer' realm other than + the desired realm, the client may use local policy configuration to + verify that the authentication path used is an acceptable one. + Alternatively, a client may choose its own authentication path, + rather than relying on the Kerberos server to select one. In either + case, any policy or configuration information used to choose or + validate authentication paths, whether by the Kerberos server or + client, must be obtained from a trusted source. + + + +March 2003 [Page 116] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + The Kerberos protocol in its basic form does not provide perfect + forward secrecy for communications. If traffic has been recorded by + an eavesdropper, then messages encrypted using the KRB_PRIV message, + or messages encrypted using application specific encryption under + keys exchanged using Kerberos can be decrypted if any of the user's, + application server's, or KDC's key is subsequently discovered. This + is because the session key use to encrypt such messages is + transmitted over the network encrypted in the key of the application + server, and also encrypted under the session key from the user's + ticket-granting ticket when returned to the user in the KRB_TGS_REP + message. The session key from the ticket-granting ticket was sent to + the user in the KRB_AS_REP message encrypted in the user's secret + key, and embedded in the ticket-granting ticket, which was encrypted + in the key of the KDC. Application requiring perfect forward secrecy + must exchange keys through mechanisms that provide such assurance, + but may use Kerberos for authentication of the encrypted channel + established through such other means. + +11. Author's Addresses + + + Clifford Neuman + Information Sciences Institute + University of Southern California + 4676 Admiralty Way + Marina del Rey, CA 90292, USA + Email: bcn@isi.edu + + Tom Yu + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139, USA + Email: tlyu@mit.edu + + Sam Hartman + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139, USA + Email: hartmans@mit.edu + + Kenneth Raeburn + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139, USA + Email: raeburn@MIT.EDU + + +12. Acknowledgements + + + +March 2003 [Page 117] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + This document is a revision to RFC1510 which was co-authored with + John Kohl. The specification of the Kerberos protocol described in + this document is the result of many years of effort. Over this + period many individuals have contributed to the definition of the + protocol and to the writing of the specification. Unfortunately it is + not possible to list all contributors as authors of this document, + though there are many not listed who are authors in spirit, because + they contributed text for parts of some sections, because they + contributed to the design of parts of the protocol, or because they + contributed significantly to the discussion of the protocol in the + IETF common authentication technology (CAT) and Kerberos working + groups. + + Among those contributing to the development and specification of + Kerberos were Jeffrey Altman, John Brezak, Marc Colan, Johan + Danielsson, Don Davis, Doug Engert, Dan Geer, Paul Hill, John Kohl, + Marc Horowitz, Matt Hur, Jeffrey Hutzelman, Paul Leach, John Linn, + Ari Medvinsky, Sasha Medvinsky, Steve Miller, Jon Rochlis, Jerome + Saltzer, Jeffrey Schiller, Jennifer Steiner, Ralph Swick, Mike Swift, + Jonathan Trostle, Theodore Ts'o, Brian Tung, Jacques Vidrine, Assar + Westerlund, and Nicolas Williams. Many other members of MIT Project + Athena, the MIT networking group, and the Kerberos and CAT working + groups of the IETF contributed but are not listed. + +13. REFERENCES + + [@KRYPTO] + RFC-Editor: To be replaced by RFC number for draft-ietf-krb-wg- + crypto. + + [@AES] + RFC-Editor: To be replaced by RFC number for draft-raeburn0krb- + rijndael-krb. + + [DGT96] + Don Davis, Daniel Geer, and Theodore Ts'0, "Kerberos With Clocks + Adrift: History, Protocols, and Implementation", USENIX Computing + Systems 9:1 (Januart 1996). + + [DS81] + Dorothy E. Denning and Giovanni Maria Sacco, "Time-stamps in Key + Distribution Protocols," Communications of the ACM, Vol. 24(8), + pp. 533-536 (August 1981). + + [ISO-646/ECMA-6] + 7-bit Coded Character Set + + [ISO-2022/ECMA-35] + + + +March 2003 [Page 118] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Character Code Structure and Extension Techniques + + [ISO-4873/ECMA-43] + 8-bit Coded Character Set Structure and Rules + + [KNT94] + + John T. Kohl, B. Clifford Neuman, and Theodore Y. Ts'o, "The + Evolution of the Kerberos Authentication System". In Distributed + Open Systems, pages 78-94. IEEE Computer Society Press, 1994. + + [MNSS87] + S. P. Miller, B. C. Neuman, J. I. Schiller, and J. H. Saltzer, + Section E.2.1: Kerberos Authentication and Authorization System, + M.I.T. Project Athena, Cambridge, Massachusetts (December 21, + 1987). + + [Neu93] + B. Clifford Neuman, "Proxy-Based Authorization and Accounting for + Distributed Systems," in Proceedings of the 13th International + Conference on Distributed Computing Systems, Pittsburgh, PA (May, + 1993). + + [NS78] + Roger M. Needham and Michael D. Schroeder, "Using Encryption for + Authentication in Large Networks of Computers," Communications of + the ACM, Vol. 21(12), pp. 993-999 (December, 1978). + + [NT94] + B. Clifford Neuman and Theodore Y. Ts'o, "An Authentication + Service for Computer Networks," IEEE Communications Magazine, Vol. + 32(9), pp. 33-38 (September 1994). + + [Pat92]. + J. Pato, Using Pre-Authentication to Avoid Password Guessing + Attacks, Open Software Foundation DCE Request for Comments 26 + (December 1992). + + [RFC1035] + P.V. Mockapetris, RFC1035: "Domain Names - Implementations and + Specification," November 1, 1987, Obsoletes - RFC973, RFC882, + RFC883. Updated by RFC1101, RFC1183, RFC1348, RFCRFC1876, RFC1982, + RFC1995, RFC1996, RFC2065, RFC2136, RFC2137, RFC2181, RFC2308, + RFC2535, RFC2845, and RFC3425. Status: Standard. + + [RFC1510] + J. Kohl and B. C. Neuman, RFC1510: "The Kerberos Network + Authentication Service (v5)," September 1993, Status: Proposed + + + +March 2003 [Page 119] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + Standard. + + [RFC2026] + S. Bradner, RFC2026: "The Internet Standard Process - Revision + 3," October 1996, Obsoletes - RFC 1602, Status: Best Current + Practice. + + [RFC2052] + A. Gulbrandsen and P. Vixie, RFC2052: "A DNS RR for Specifying the + Location of Services (DNS SRV)," October 1996, Obseleted by + RFC2782, Status: Experimental + + [RFC2253] + M. Wahl, S. Killie, and T. Howes, RFC2253: "Lightweight Directory + Access Protocol (v3): UTF-8 String Representation or Distinguished + Names," December 1997, Obsoletes - RFC1779, Updated by RFC3377, + Status: Proposed Standard. + + [RFC2273] + D. Levi, P. Meyer, and B. Stewart, RFC2273: "SNMPv3 Applications," + January 1998, Obsoletes - RFC2263, Obsoleted by RFC2573, Status: + Proposed Standard. + + [RFC2373] + R. Hinden, S. Deering, RFC2373: "IP Version 6 Addressing + Architecture," July 1998, Status: Proposed Standard. + + [SNS88] + J. G. Steiner, B. C. Neuman, and J. I. Schiller, "Kerberos: An + Authentication Service for Open Network Systems," pp. 191-202 in + Usenix Conference Proceedings, Dallas, Texas (February, 1988). + + [X680] + Abstract Syntax Notation One (ASN.1): Specification of Basic + Notation, ITU-T Recommendation X.680 (1997) | ISO/IEC + International Standard 8824-1:1998. + + [X690] + ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), + Canonical Encoding Rules (CER) and Distinguished Encoding Rules + (DER), ITU-T Recommendation X.690 (1997)| ISO/IEC International + Standard 8825-1:1998. + +A. ASN.1 module + + KerberosV5Spec2 { + iso(1) identified-organization(3) dod(6) internet(1) + security(5) kerberosV5(2) modules(4) krb5spec2(2) + + + +March 2003 [Page 120] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + } DEFINITIONS EXPLICIT TAGS ::= BEGIN + + -- OID arc for KerberosV5 + -- + -- This OID may be used to identify Kerberos protocol messages + -- encapsulated in other protocols. + -- + -- This OID also designates the OID arc for KerberosV5-related OIDs. + -- + -- NOTE: RFC 1510 had an incorrect value (5) for "dod" in its OID. + id-krb5 OBJECT IDENTIFIER ::= { + iso(1) identified-organization(3) dod(6) internet(1) + security(5) kerberosV5(2) + } + + Int32 ::= INTEGER (-2147483648..2147483647) + -- signed values representable in 32 bits + + UInt32 ::= INTEGER (0..4294967295) + -- unsigned 32 bit values + + Microseconds ::= INTEGER (0..999999) + -- microseconds + + KerberosString ::= GeneralString (IA5String) + + Realm ::= KerberosString + + PrincipalName ::= SEQUENCE { + name-type [0] Int32, + name-string [1] SEQUENCE OF KerberosString + } + + KerberosTime ::= GeneralizedTime -- with no fractional seconds + + HostAddress ::= SEQUENCE { + addr-type [0] Int32, + address [1] OCTET STRING + } + + -- NOTE: HostAddresses is always used as an OPTIONAL field and + -- should not be empty. + HostAddresses -- NOTE: subtly different from rfc1510, + -- but has a value mapping and encodes the same + ::= SEQUENCE OF HostAddress + + -- NOTE: AuthorizationData is always used as an OPTIONAL field and + -- should not be empty. + + + +March 2003 [Page 121] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + AuthorizationData ::= SEQUENCE OF SEQUENCE { + ad-type [0] Int32, + ad-data [1] OCTET STRING + } + + PA-DATA ::= SEQUENCE { + -- NOTE: first tag is [1], not [0] + padata-type [1] Int32, + padata-value [2] OCTET STRING -- might be encoded AP-REQ + } + + KerberosFlags ::= BIT STRING (SIZE (32..MAX)) -- minimum number of bits + -- shall be sent, but no fewer than 32 + + EncryptedData ::= SEQUENCE { + etype [0] Int32 -- EncryptionType --, + kvno [1] UInt32 OPTIONAL, + cipher [2] OCTET STRING -- ciphertext + } + + EncryptionKey ::= SEQUENCE { + keytype [0] Int32 -- actually encryption type --, + keyvalue [1] OCTET STRING + } + + Checksum ::= SEQUENCE { + cksumtype [0] Int32, + checksum [1] OCTET STRING + } + + Ticket ::= [APPLICATION 1] SEQUENCE { + tkt-vno [0] INTEGER (5), + realm [1] Realm, + sname [2] PrincipalName, + enc-part [3] EncryptedData -- EncTicketPart + } + + -- Encrypted part of ticket + EncTicketPart ::= [APPLICATION 3] SEQUENCE { + flags [0] TicketFlags, + key [1] EncryptionKey, + crealm [2] Realm, + cname [3] PrincipalName, + transited [4] TransitedEncoding, + authtime [5] KerberosTime, + starttime [6] KerberosTime OPTIONAL, + endtime [7] KerberosTime, + renew-till [8] KerberosTime OPTIONAL, + + + +March 2003 [Page 122] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + caddr [9] HostAddresses OPTIONAL, + authorization-data [10] AuthorizationData OPTIONAL + } + + -- encoded Transited field + TransitedEncoding ::= SEQUENCE { + tr-type [0] Int32 -- must be registered --, + contents [1] OCTET STRING + } + + TicketFlags ::= KerberosFlags + -- reserved(0), + -- forwardable(1), + -- forwarded(2), + -- proxiable(3), + -- proxy(4), + -- may-postdate(5), + -- postdated(6), + -- invalid(7), + -- renewable(8), + -- initial(9), + -- pre-authent(10), + -- hw-authent(11), + -- the following are new since 1510 + -- transited-policy-checked(12), + -- ok-as-delegate(13) + + AS-REQ ::= [APPLICATION 10] KDC-REQ + + TGS-REQ ::= [APPLICATION 12] KDC-REQ + + KDC-REQ ::= SEQUENCE { + -- NOTE: first tag is [1], not [0] + pvno [1] INTEGER (5) , + msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), + padata [3] SEQUENCE OF PA-DATA OPTIONAL + -- NOTE: not empty --, + req-body [4] KDC-REQ-BODY + } + + KDC-REQ-BODY ::= SEQUENCE { + kdc-options [0] KDCOptions, + cname [1] PrincipalName OPTIONAL + -- Used only in AS-REQ --, + realm [2] Realm + -- Server's realm + -- Also client's in AS-REQ --, + sname [3] PrincipalName OPTIONAL, + + + +March 2003 [Page 123] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + from [4] KerberosTime OPTIONAL, + till [5] KerberosTime, + rtime [6] KerberosTime OPTIONAL, + nonce [7] UInt32, + etype [8] SEQUENCE OF Int32 -- EncryptionType + -- in preference order --, + addresses [9] HostAddresses OPTIONAL, + enc-authorization-data [10] EncryptedData -- AuthorizationData --, + additional-tickets [11] SEQUENCE OF Ticket OPTIONAL + -- NOTE: not empty + } + + KDCOptions ::= KerberosFlags + -- reserved(0), + -- forwardable(1), + -- forwarded(2), + -- proxiable(3), + -- proxy(4), + -- allow-postdate(5), + -- postdated(6), + -- unused7(7), + -- renewable(8), + -- unused9(9), + -- unused10(10), + -- opt-hardware-auth(11), + -- unused12(12), + -- unused13(13), + -- 15 is reserved for canonicalize + -- unused15(15), + -- 26 was unused in 1510 + -- disable-transited-check(26), + -- + -- renewable-ok(27), + -- enc-tkt-in-skey(28), + -- renew(30), + -- validate(31) + + AS-REP ::= [APPLICATION 11] KDC-REP + + TGS-REP ::= [APPLICATION 13] KDC-REP + + KDC-REP ::= SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (11 -- AS -- | 13 -- TGS --), + padata [2] SEQUENCE OF PA-DATA OPTIONAL + -- NOTE: not empty --, + crealm [3] Realm, + cname [4] PrincipalName, + + + +March 2003 [Page 124] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + ticket [5] Ticket, + enc-part [6] EncryptedData + -- EncASRepPart or EncTGSRepPart, + -- as appropriate + } + + EncASRepPart ::= [APPLICATION 25] EncKDCRepPart + + EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart + + EncKDCRepPart ::= SEQUENCE { + key [0] EncryptionKey, + last-req [1] LastReq, + nonce [2] UInt32, + key-expiration [3] KerberosTime OPTIONAL, + flags [4] TicketFlags, + authtime [5] KerberosTime, + starttime [6] KerberosTime OPTIONAL, + endtime [7] KerberosTime, + renew-till [8] KerberosTime OPTIONAL, + srealm [9] Realm, + sname [10] PrincipalName, + caddr [11] HostAddresses OPTIONAL + } + + LastReq ::= SEQUENCE OF SEQUENCE { + lr-type [0] Int32, + lr-value [1] KerberosTime + } + + AP-REQ ::= [APPLICATION 14] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (14), + ap-options [2] APOptions, + ticket [3] Ticket, + authenticator [4] EncryptedData -- Authenticator + } + + APOptions ::= KerberosFlags + -- reserved(0), + -- use-session-key(1), + -- mutual-required(2) + + -- Unencrypted authenticator + Authenticator ::= [APPLICATION 2] SEQUENCE { + authenticator-vno [0] INTEGER (5), + crealm [1] Realm, + cname [2] PrincipalName, + + + +March 2003 [Page 125] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + cksum [3] Checksum OPTIONAL, + cusec [4] Microseconds, + ctime [5] KerberosTime, + subkey [6] EncryptionKey OPTIONAL, + seq-number [7] UInt32 OPTIONAL, + authorization-data [8] AuthorizationData OPTIONAL + } + + AP-REP ::= [APPLICATION 15] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (15), + enc-part [2] EncryptedData -- EncAPRepPart + } + + EncAPRepPart ::= [APPLICATION 27] SEQUENCE { + ctime [0] KerberosTime, + cusec [1] Microseconds, + subkey [2] EncryptionKey OPTIONAL, + seq-number [3] UInt32 OPTIONAL + } + + KRB-SAFE ::= [APPLICATION 20] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (20), + safe-body [2] KRB-SAFE-BODY, + cksum [3] Checksum + } + + KRB-SAFE-BODY ::= SEQUENCE { + user-data [0] OCTET STRING, + timestamp [1] KerberosTime OPTIONAL, + usec [2] Microseconds OPTIONAL, + seq-number [3] UInt32 OPTIONAL, + s-address [4] HostAddress, + r-address [5] HostAddress OPTIONAL + } + + KRB-PRIV ::= [APPLICATION 21] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (21), + -- NOTE: there is no [2] tag + enc-part [3] EncryptedData -- EncKrbPrivPart + } + + EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE { + user-data [0] OCTET STRING, + timestamp [1] KerberosTime OPTIONAL, + usec [2] Microseconds OPTIONAL, + + + +March 2003 [Page 126] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + seq-number [3] UInt32 OPTIONAL, + s-address [4] HostAddress -- sender's addr --, + r-address [5] HostAddress OPTIONAL -- recip's addr + } + + KRB-CRED ::= [APPLICATION 22] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (22), + tickets [2] SEQUENCE OF Ticket, + enc-part [3] EncryptedData -- EncKrbCredPart + } + + EncKrbCredPart ::= [APPLICATION 29] SEQUENCE { + ticket-info [0] SEQUENCE OF KrbCredInfo, + nonce [1] UInt32 OPTIONAL, + timestamp [2] KerberosTime OPTIONAL, + usec [3] Microseconds OPTIONAL, + s-address [4] HostAddress OPTIONAL, + r-address [5] HostAddress OPTIONAL + } + + KrbCredInfo ::= SEQUENCE { + key [0] EncryptionKey, + prealm [1] Realm OPTIONAL, + pname [2] PrincipalName OPTIONAL, + flags [3] TicketFlags OPTIONAL, + authtime [4] KerberosTime OPTIONAL, + starttime [5] KerberosTime OPTIONAL, + endtime [6] KerberosTime OPTIONAL, + renew-till [7] KerberosTime OPTIONAL, + srealm [8] Realm OPTIONAL, + sname [9] PrincipalName OPTIONAL, + caddr [10] HostAddresses OPTIONAL + } + + KRB-ERROR ::= [APPLICATION 30] SEQUENCE { + pvno [0] INTEGER (5), + msg-type [1] INTEGER (30), + ctime [2] KerberosTime OPTIONAL, + cusec [3] Microseconds OPTIONAL, + stime [4] KerberosTime, + susec [5] Microseconds, + error-code [6] Int32, + crealm [7] Realm OPTIONAL, + cname [8] PrincipalName OPTIONAL, + realm [9] Realm -- service realm --, + sname [10] PrincipalName -- service name --, + e-text [11] KerberosString OPTIONAL, + + + +March 2003 [Page 127] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + e-data [12] OCTET STRING OPTIONAL + } + + METHOD-DATA ::= SEQUENCE OF PA-DATA + + TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE { + data-type [0] INTEGER, + data-value [1] OCTET STRING OPTIONAL + } + + -- preauth stuff follows + + PA-ENC-TIMESTAMP ::= EncryptedData -- PA-ENC-TS-ENC + + PA-ENC-TS-ENC ::= SEQUENCE { + patimestamp [0] KerberosTime -- client's time --, + pausec [1] Microseconds OPTIONAL + } + + ETYPE-INFO-ENTRY ::= SEQUENCE { + etype [0] Int32, + salt [1] OCTET STRING OPTIONAL + } + + ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY + + ETYPE-INFO2-ENTRY ::= SEQUENCE { + etype [0] Int32, + salt [1] KerberosString OPTIONAL, + s2kparams [2] OCTET STRING OPTIONAL + } + + ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO-ENTRY + + AD-IF-RELEVANT ::= AuthorizationData + + AD-KDCIssued ::= SEQUENCE { + ad-checksum [0] Checksum, + i-realm [1] Realm OPTIONAL, + i-sname [2] PrincipalName OPTIONAL, + elements [3] AuthorizationData + } + + AD-AND-OR ::= SEQUENCE { + condition-count [0] INTEGER, + elements [1] AuthorizationData + } + + + + +March 2003 [Page 128] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + AD-MANDATORY-FOR-KDC ::= AuthorizationData + + END + +B. Changes since RFC-1510 + + This document replaces RFC-1510 and clarifies specification of items + that were not completely specified. Where changes to recommended + implementation choices were made, or where new options were added, + those changes are described within the document and listed in this + section. More significantly, "Specification 2" in section 8 changes + the required encryption and checksum methods to bring them in line + with the best current practices and to deprecate methods that are no + longer considered sufficiently strong. + + Discussion was added to section 1 regarding the ability to rely on + the KDC to check the transited field, and on the inclusion of a flag + in a ticket indicating that this check has occurred. This is a new + capability not present in RFC1510. Pre-existing implementations may + ignore or not set this flag without negative security implications. + + The definition of the secret key says that in the case of a user the + key may be derived from a password. In 1510, it said that the key was + derived from the password. This change was made to accommodate + situations where the user key might be stored on a smart-card, or + otherwise obtained independent of a password. + + The introduction mentions the use of public key cryptography for + initial authentication in Kerberos by reference. RFC1510 did not + include such a reference. + + Section 1.2 was added to explain that while Kerberos provides + authentication of a named principal, it is still the responsibility + of the application to ensure that the authenticated name is the + entity with which the application wishes to communicate. + + Discussion of extensibility has been added to the introduction. + + Discussion of how extensibility affects ticket flags and KDC options + was added to the introduction of section 2. No changes were made to + existing options and flags specified in RFC1510, though some of the + sections in the specification were renumbered, and text was revised + to make the description and intent of existing options clearer, + especially with respect to the ENC-TKT-IN-SKEY option (now section + 2.9.2) which is used for user-to-user authentication. The new option + and ticket flag transited policy checking (section 2.7) was added. + + A warning regarding generation of session keys for application use + + + +March 2003 [Page 129] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + was added to section 3, urging the inclusion of key entropy from the + KDC generated session key in the ticket. An example regarding use of + the sub-session key was added to section 3.2.6. Descriptions of the + pa-etype-info, pa-etype-info2, and pa-pw-salt pre-authentication data + items were added. The recommendation for use of pre-authentication + was changed from "may" to "should" and a note was added regarding + known plaintext attacks. + + In RFC 1510, section 4 described the database in the KDC. This + discussion was not necessary for interoperability and unnecessarily + constrained implementation. The old section 4 was removed. + + The current section 4 was formerly section 6 on encryption and + checksum specifications. The major part of this section was brought + up to date to support new encryption methods, and move to a separate + document. Those few remaining aspects of the encryption and checksum + specification specific to Kerberos are now specified in section 4. + + Significant changes were made to the layout of section 5 to clarify + the correct behavior for optional fields. Many of these changes were + made necessary because of improper ASN.1 description in the original + Kerberos specification which left the correct behavior + underspecified. Additionally, the wording in this section was + tightened wherever possible to ensure that implementations conforming + to this specification will be extensible with the addition of new + fields in future specifications. + + Text was added describing time_t=0 issues in the ASN.1. Text was also + added, clarifying issues with implementations treating omitted + optional integers as zero. Text was added clarifying behavior for + optional SEQUENCE or SEQUENCE OF that may be empty. Discussion was + added regarding sequence numbers and behavior of some + implementations, including "zero" behavior and negative numbers. A + compatibility note was added regarding the unconditional sending of + EncTGSRepPart regardless of the enclosing reply type. Minor changes + were made to the description of the HostAddresses type. Integer types + were constrained. KerberosString was defined as a (significantly) + constrained GeneralString. KerberosFlags was defined to reflect + existing implementation behavior that departs from the definition in + RFC 1510. The transited-policy-checked(12) and the ok-as-delegate(13) + ticket flags were added. The disable-transited-check(26) KDC option + was added. + + Descriptions of commonly implemented PA-DATA were added to section 5. + The description of KRB-SAFE has been updated to note the existing + implementation behavior of double-encoding. + + There were two definitions of METHOD-DATA in RFC 1510. The second + + + +March 2003 [Page 130] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + one, intended for use with KRB_AP_ERR_METHOD was removed leaving the + SEQUENCE OF PA-DATA definition. + + Section 7, naming constraints, from RFC1510 was moved to section 6. + + Words were added describing the convention that domain based realm + names for newly created realms should be specified as upper case. + This recommendation does not make lower case realm names illegal. + Words were added highlighting that the slash separated components in + the X500 style of realm names is consistent with existing RFC1510 + based implementations, but that it conflicts with the general + recommendation of X.500 name representation specified in RFC2253. + + Section 8, network transport, constants and defined values, from + RFC1510 was moved to section 7. Since RFC1510, the definition of the + TCP transport for Kerberos messages was added, and the encryption and + checksum number assignments have been moved into a separate document. + + "Specification 2" in section 8 of the current document changes the + required encryption and checksum methods to bring them in line with + the best current practices and to deprecate methods that are no + longer considered sufficiently strong. + + Two new sections, on IANA considerations and security considerations + were added. + + The pseudo-code has been removed from the appendix. The pseudo-code + was sometimes misinterpreted to limit implementation choices and in + RFC 1510, it was not always consistent with the words in the + specification. Effort was made to clear up any ambiguities in the + specification, rather than to rely on the pseudo-code. + + An appendix was added containing the complete ASN.1 module drawn from + the discussion in section 5 of the current document. + + An appendix was added defining those authorization data elements that + must be understood by all Kerberos implementations. + +END NOTES + + [TM] Project Athena, Athena, and Kerberos are trademarks of the + Massachusetts Institute of Technology (MIT). No commercial use of + these trademarks may be made without prior written permission of MIT. + + [1] Note, however, that many applications use Kerberos' functions + only upon the initiation of a stream-based network connection. Unless + an application subsequently provides integrity protection for the + data stream, the identity verification applies only to the initiation + + + +March 2003 [Page 131] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + of the connection, and does not guarantee that subsequent messages on + the connection originate from the same principal. + + [2] Secret and private are often used interchangeably in the + literature. In our usage, it takes two (or more) to share a secret, + thus a shared DES key is a secret key. Something is only private when + no one but its owner knows it. Thus, in public key cryptosystems, one + has a public and a private key. + + [3] Of course, with appropriate permission the client could arrange + registration of a separately-named principal in a remote realm, and + engage in normal exchanges with that realm's services. However, for + even small numbers of clients this becomes cumbersome, and more + automatic methods as described here are necessary. + + [4] Though it is permissible to request or issue tickets with no + network addresses specified. + + [5] The password-changing request must not be honored unless the + requester can provide the old password (the user's current secret + key). Otherwise, it would be possible for someone to walk up to an + unattended session and change another user's password. + + [6] To authenticate a user logging on to a local system, the + credentials obtained in the AS exchange may first be used in a TGS + exchange to obtain credentials for a local server. Those credentials + must then be verified by a local server through successful completion + of the Client/Server exchange. + + [7] "Random" means that, among other things, it should be impossible + to guess the next session key based on knowledge of past session + keys. This can only be achieved in a pseudo-random number generator + if it is based on cryptographic principles. It is more desirable to + use a truly random number generator, such as one based on + measurements of random physical phenomena. + + [8] Tickets contain both an encrypted and unencrypted portion, so + cleartext here refers to the entire unit, which can be copied from + one message and replayed in another without any cryptographic skill. + + [9] Note that this can make applications based on unreliable + transports difficult to code correctly. If the transport might + deliver duplicated messages, either a new authenticator must be + generated for each retry, or the application server must match + requests and replies and replay the first reply in response to a + detected duplicate. + + [10] Note also that the rejection here is restricted to + + + +March 2003 [Page 132] + + + + + +Neuman, et al. draft-ietf-krb-wg-kerberos-clarifications-03.txt DRAFT + + + authenticators from the same principal to the same server. Other + client principals communicating with the same server principal should + not be have their authenticators rejected if the time and microsecond + fields happen to match some other client's authenticator. + + [11] If this is not done, an attacker could subvert the + authentication by recording the ticket and authenticator sent over + the network to a server and replaying them following an event that + caused the server to lose track of recently seen authenticators. + + [12] In the Kerberos version 4 protocol, the timestamp in the reply + was the client's timestamp plus one. This is not necessary in version + 5 because version 5 messages are formatted in such a way that it is + not possible to create the reply by judicious message surgery (even + in encrypted form) without knowledge of the appropriate encryption + keys. + + [13] Note that for encrypting the KRB_AP_REP message, the sub-session + key is not used, even if present in the Authenticator. + + [14] Implementations of the protocol may provide routines to choose + subkeys based on session keys and random numbers and to generate a + negotiated key to be returned in the KRB_AP_REP message. + + [15]This can be accomplished in several ways. It might be known + beforehand (since the realm is part of the principal identifier), it + might be stored in a nameserver, or it might be obtained from a + configuration file. If the realm to be used is obtained from a + nameserver, there is a danger of being spoofed if the nameservice + providing the realm name is not authenticated. This might result in + the use of a realm which has been compromised, and would result in an + attacker's ability to compromise the authentication of the + application server to the client. + + [16] If the client selects a sub-session key, care must be taken to + ensure the randomness of the selected sub-session key. One approach + would be to generate a random number and XOR it with the session key + from the ticket-granting ticket. + + + + + + + + + + + + + +March 2003 [Page 133] + diff --git a/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-02.txt b/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-02.txt new file mode 100644 index 00000000000..6b9989f871a --- /dev/null +++ b/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-02.txt @@ -0,0 +1,618 @@ + + + + + + + + + +Kerberos Working Group K. Raeburn +Document: draft-raeburn-krb-rijndael-krb-02.txt MIT + November 1, 2002 + expires May 1, 2003 + + AES Encryption for Kerberos 5 + +Abstract + + Recently the US National Institute of Standards and Technology chose + a new Advanced Encryption Standard [AES], which is significantly + faster and (it is believed) more secure than the old DES algorithm. + This document is a specification for the addition of this algorithm + to the Kerberos cryptosystem suite [KCRYPTO]. + + Comments should be sent to the author, or to the IETF Kerberos + working group (ietf-krb-wg@anl.gov). + +Status of this Memo + + This document is an Internet-Draft and is in full conformance with + all provisions of Section 10 of RFC2026 [RFC2026]. Internet-Drafts + are working documents of the Internet Engineering Task Force (IETF), + its areas, and its working groups. Note that other groups may also + distribute working documents as Internet-Drafts. Internet-Drafts are + draft documents valid for a maximum of six months and may be updated, + replaced, or obsoleted by other documents at any time. It is + inappropriate to use Internet-Drafts as reference material or to cite + them other than as "work in progress." + + The list of current Internet-Drafts can be accessed at + http://www.ietf.org/ietf/1id-abstracts.txt + + The list of Internet-Draft Shadow Directories can be accessed at + http://www.ietf.org/shadow.html. + +1. Introduction + + This document defines encryption key and checksum types for Kerberos + 5 using the AES algorithm recently chosen by NIST. These new types + support 128-bit block encryption, and key sizes of 128 or 256 bits. + + Using the "simplified profile" of [KCRYPTO], we can define a pair of + encryption and checksum schemes. AES is used with cipher text + stealing to avoid message expansion, and SHA-1 [SHA1] is the + + + +Raeburn [Page 1] + +INTERNET DRAFT November 2002 + + + associated checksum function. + +2. Conventions Used in this Document + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in RFC 2119. + +3. Protocol Key Representation + + The profile in [KCRYPTO] treats keys and random octet strings as + conceptually different. But since the AES key space is dense, we can + use any bit string as a key. We use the byte representation for the + key described in [AES], where the first bit of the bit string is the + high bit of the first byte of the byte string (octet string) + representation. + +4. Key Generation From Pass Phrases or Random Data + + Given the above format for keys, we can generate keys from the + appropriate amounts of random data (128 or 256 bits) by simply + copying the input string. + + To generate an encryption key from a pass phrase and salt string, we + use the PBKDF2 function from PKCS #5 v2.0 ([PKCS5]), with parameters + indicated below, to generate an intermediate key (of the same length + as the desired final key), which is then passed into the DK function + with the 8-octet ASCII string "kerberos" as is done for des3-cbc- + hmac-sha1-kd in [KCRYPTO]. (In [KCRYPTO] terms, the PBKDF2 function + produces a "random octet string", hence the application of the + random-to-key function even though it's effectively a simple identity + operation.) The resulting key is the user's long-term key for use + with the encryption algorithm in question. + + tkey = random2key(PBKDF2(passphrase, salt, iter_count, keylength)) + key = DK(tkey, "kerberos") + + The pseudorandom function used by PBKDF2 will be a SHA-1 HMAC of the + passphrase and salt, as described in Appendix B.1 to PKCS#5. + + The number of iterations is specified by the string-to-key parameters + supplied. The parameter string is four octets indicating an unsigned + number in big-endian order. This is the number of iterations to be + performed. If the value is 00 00 00 00, the number of iterations to + be performed is 4294967296 (2**32). (Thus the minimum expressable + iteration count is 1.) + + For environments where slower hardware is the norm, implementations + + + +Raeburn [Page 2] + +INTERNET DRAFT November 2002 + + + may wish to limit the number of iterations to prevent a spoofed + response from consuming lots of client-side CPU time; it is + recommended that this bound be no less than 50000. Even for + environments with fast hardware, 4 billion iterations is likely to + take a fairly long time; much larger bounds might still be enforced, + and it might be wise for implementations to permit interruption of + this operation by the user if the environment allows for it. + + If the string-to-key parameters are not supplied, the default value + to be used is 00 00 b0 00 (decimal 45056, indicating 45056 + iterations, which takes slightly under 1 second on a 300MHz Pentium + II in tests run by the author). + + Sample test vectors are given in the appendix. + +5. Cipher Text Stealing + + Cipher block chaining is used to encrypt messages. Unlike previous + Kerberos cryptosystems, we use cipher text stealing to handle the + possibly partial final block of the message. + + Cipher text stealing is described on pages 195-196 of [AC], and + section 8 of [RC5]; it has the advantage that no message expansion is + done during encryption of messages of arbitrary sizes as is typically + done in CBC mode with padding. + + Cipher text stealing, as defined in [RC5], assumes that more than one + block of plain text is available. Since a one-block confounder is + added in the simplified profile of [KCRYPTO], and [KCRYPTO] requires + that the message to be encrypted cannot be empty, the minimum length + to be encrypted is one block plus one byte. Thus we do not need to + do anything special to meet this constraint. + + For consistency, cipher text stealing is always used for the last two + blocks of the data to be encrypted, as in [RC5]. If the data length + is a multiple of the block size, this is equivalent to plain CBC mode + with the last two cipher text blocks swapped. + + A test vector is given in the appendix. + +6. Kerberos Algorithm Profile Parameters + + This is a summary of the parameters to be used with the simplified + algorithm profile described in [KCRYPTO]: + + + + + + + +Raeburn [Page 3] + +INTERNET DRAFT November 2002 + + + +--------------------------------------------------------------------+ + | protocol key format 128- or 256-bit string | + | | + | string-to-key function PBKDF2+DK with variable | + | iteration count (see | + | above) | + | | + | default string-to-key parameters 00 09 | + | | + | key-generation seed length key size | + | | + | random-to-key function identity function | + | | + | hash function, H SHA-1 | + | | + | HMAC output size, h 12 octets (96 bits) | + | | + | confounder size, c 16 octets | + | | + | message block size, m 1 octet | + | | + | encryption/decryption functions, AES in CBC-CTS mode with | + | E and D zero ivec | + +--------------------------------------------------------------------+ + + Using this profile with each key size gives us two each of encryption + and checksum algorithm definitions. + +7. Assigned Numbers + + The following encryption type numbers are assigned: + + +--------------------------------------------------------------------+ + | encryption types | + +--------------------------------------------------------------------+ + | type name etype value key size | + +--------------------------------------------------------------------+ + | aes128-cts-hmac-sha1-96 17 128 | + | aes256-cts-hmac-sha1-96 18 256 | + +--------------------------------------------------------------------+ + + The following checksum type numbers are assigned: + + + + + + + + + +Raeburn [Page 4] + +INTERNET DRAFT November 2002 + + + +--------------------------------------------------------------------+ + | checksum types | + +--------------------------------------------------------------------+ + | type name sumtype value length | + +--------------------------------------------------------------------+ + | hmac-sha1-96-aes128 10 96 | + | hmac-sha1-96-aes256 11 96 | + +--------------------------------------------------------------------+ + + These checksum types will be used with the corresponding encryption + types defined above. + +8. Recommendations + + Both new cryptosystems are RECOMMENDED. They should be more secure + than DES cryptosystems, and much faster than triple-DES. + +9. Security Considerations + + This new algorithm has not been around long enough to receive the + decades of intense analysis that DES has received. It is possible + that some weakness exists that has not been found by the + cryptographers analyzing these algorithms before and during the AES + selection process. + + The use of the HMAC function has drawbacks for certain pass phrase + lengths. For example, a pass phrase longer than the hash function + block size (64 bytes, for SHA-1) is hashed to a smaller size (20 + bytes) before applying the main HMAC algorithm. However, entropy is + generally sparse in pass phrases, especially in long ones, so this + may not be a problem in the rare cases of users with long pass + phrases. + + Also, generating a 256-bit key from a pass phrase of any length may + be deceptive, since the effective entropy in pass-phrase-derived key + cannot be nearly that large. + + The iteration count in PBKDF2 appears to be useful primarily as a + constant multiplier for the amount of work required for an attacker + using brute-force methods. Unfortunately, it also multiplies, by the + same amount, the work needed by a legitimate user with a valid + password. Thus the work factor imposed on an attacker (who may have + many powerful workstations at his disposal) must be balanced against + the work factor imposed on the legitimate user (who may have a PDA or + cell phone); the available computing power on either side increases + as time goes on, as well. A better way to deal with the brute-force + attack is through preauthentication mechanisms that provide better + protection of, the user's long-term key. Use of such mechanisms is + + + +Raeburn [Page 5] + +INTERNET DRAFT November 2002 + + + out of scope for this document. + + Any benefit against other attacks specific to the HMAC or SHA-1 + algorithms is probably achieved with a fairly small number of + iterations. + + Cipher text stealing mode, since it requires no additional padding, + will reveal the exact length of each message being encrypted, rather + than merely bounding it to a small range of possible lengths as in + CBC mode. Such obfuscation should not be relied upon at higher + levels in any case; if the length must be obscured from an outside + observer, it should be done by intentionally varying the length of + the message to be encrypted. + + The author is not a cryptographer. Caveat emptor. + +10. IANA Considerations + + None. + +11. Acknowledgements + + Thanks to John Brezak, Gerardo Diaz Cuellar and Marcus Watts for + feedback on earlier versions of this document. + +12. Normative References + + [AC] Schneier, B., "Applied Cryptography", second edition, John Wiley + and Sons, New York, 1996. + + [AES] National Institute of Standards and Technology, U.S. Department + of Commerce, "Advanced Encryption Standard", Federal Information + Processing Standards Publication 197, Washington, DC, November 2001. + + [KCRYPTO] Raeburn, K., "Encryption and Checksum Specifications for + Kerberos 5", draft-ietf-krb-wg-crypto-01.txt, May, 2002. Work in + progress. + + [PKCS5] Kaliski, B., "PKCS #5: Password-Based Cryptography + Specification Version 2.0", RFC 2898, September 2000. + + [RC5] Baldwin, R, and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-Pad, and + RC5-CTS Algorithms", RFC 2040, October 1996. + + [RFC2026] Bradner, S., "The Internet Standards Process -- Revision + 3", RFC 2026, October 1996. + + [SHA1] National Institute of Standards and Technology, U.S. + + + +Raeburn [Page 6] + +INTERNET DRAFT November 2002 + + + Department of Commerce, "Secure Hash Standard", Federal Information + Processing Standards Publication 180-1, Washington, DC, April 1995. + +13. Informative References + + [PECMS] Gutmann, P., "Password-based Encryption for CMS", RFC 3211, + December 2001. + +14. Author's Address + + Kenneth Raeburn + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139 + raeburn@mit.edu + +15. Full Copyright Statement + + Copyright (C) The Internet Society (2002). All Rights Reserved. + + This document and translations of it may be copied and furnished to + others, and derivative works that comment on or otherwise explain it + or assist in its implementation may be prepared, copied, published + and distributed, in whole or in part, without restriction of any + kind, provided that the above copyright notice and this paragraph are + included on all such copies and derivative works. However, this + document itself may not be modified in any way, such as by removing + the copyright notice or references to the Internet Society or other + Internet organizations, except as needed for the purpose of + developing Internet standards in which case the procedures for + copyrights defined in the Internet Standards process must be + followed, or as required to translate it into languages other than + English. + + The limited permissions granted above are perpetual and will not be + revoked by the Internet Society or its successors or assigns. + + This document and the information contained herein is provided on an + "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING + TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING + BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION + HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF + MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." + +A. Sample test vectors + + Sample values for the string-to-key function are included below. + + + + +Raeburn [Page 7] + +INTERNET DRAFT November 2002 + + + Iteration count = 1 + Pass phrase = "password" + Salt = "ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15 + 128-bit AES key: + 42 26 3c 6e 89 f4 fc 28 b8 df 68 ee 09 79 9f 15 + 256-bit PBKDF2 output: + cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15 + 0a d1 f7 a0 4b b9 f3 a3 33 ec c0 e2 e1 f7 08 37 + 256-bit AES key: + fe 69 7b 52 bc 0d 3c e1 44 32 ba 03 6a 92 e6 5b + bb 52 28 09 90 a2 fa 27 88 39 98 d7 2a f3 01 61 + + Iteration count = 2 + Pass phrase = "password" + Salt="ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + 01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d + 128-bit AES key: + c6 51 bf 29 e2 30 0a c2 7f a4 69 d6 93 bd da 13 + 256-bit PBKDF2 output: + 01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d + a0 53 78 b9 32 44 ec 8f 48 a9 9e 61 ad 79 9d 86 + 256-bit AES key: + a2 e1 6d 16 b3 60 69 c1 35 d5 e9 d2 e2 5f 89 61 + 02 68 56 18 b9 59 14 b4 67 c6 76 22 22 58 24 ff + + Iteration count = 1200 + Pass phrase = "password" + Salt = "ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + 5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b + 128-bit AES key: + 4c 01 cd 46 d6 32 d0 1e 6d be 23 0a 01 ed 64 2a + 256-bit PBKDF2 output: + 5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b + a7 e5 2d db c5 e5 14 2f 70 8a 31 e2 e6 2b 1e 13 + 256-bit AES key: + 55 a6 ac 74 0a d1 7b 48 46 94 10 51 e1 e8 b0 a7 + 54 8d 93 b0 ab 30 a8 bc 3f f1 62 80 38 2b 8c 2a + + + + + + + + + + +Raeburn [Page 8] + +INTERNET DRAFT November 2002 + + + Iteration count = 5 + Pass phrase = "password" + Salt=0x1234567878563412 + 128-bit PBKDF2 output: + d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49 + 128-bit AES key: + e9 b2 3d 52 27 37 47 dd 5c 35 cb 55 be 61 9d 8e + 256-bit PBKDF2 output: + d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49 + 3f 98 d2 03 e6 be 49 a6 ad f4 fa 57 4b 6e 64 ee + 256-bit AES key: + 97 a4 e7 86 be 20 d8 1a 38 2d 5e bc 96 d5 90 9c + ab cd ad c8 7c a4 8f 57 45 04 15 9f 16 c3 6e 31 + (This test is based on values given in [PECMS].) + + Iteration count = 1200 + Pass phrase = (64 characters) + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + Salt="pass phrase equals block size" + 128-bit PBKDF2 output: + 13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9 + 128-bit AES key: + 59 d1 bb 78 9a 82 8b 1a a5 4e f9 c2 88 3f 69 ed + 256-bit PBKDF2 output: + 13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9 + c5 ec 59 f1 a4 52 f5 cc 9a d9 40 fe a0 59 8e d1 + 256-bit AES key: + 89 ad ee 36 08 db 8b c7 1f 1b fb fe 45 94 86 b0 + 56 18 b7 0c ba e2 20 92 53 4e 56 c5 53 ba 4b 34 + + Iteration count = 1200 + Pass phrase = (65 characters) + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + Salt = "pass phrase exceeds block size" + 128-bit PBKDF2 output: + 9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61 + 128-bit AES key: + cb 80 05 dc 5f 90 17 9a 7f 02 10 4c 00 18 75 1d + 256-bit PBKDF2 output: + 9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61 + 1a 8b 4d 28 26 01 db 3b 36 be 92 46 91 5e c8 2a + 256-bit AES key: + d7 8c 5c 9c b8 72 a8 c9 da d4 69 7f 0b b5 b2 d2 + 14 96 c8 2b eb 2c ae da 21 12 fc ee a0 57 40 1b + + + + + + + +Raeburn [Page 9] + +INTERNET DRAFT November 2002 + + + Iteration count = 50 + Pass phrase = g-clef (0xf09d849e) + Salt = "EXAMPLE.COMpianist" + 128-bit PBKDF2 output: + 6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39 + 128-bit AES key: + f1 49 c1 f2 e1 54 a7 34 52 d4 3e 7f e6 2a 56 e5 + 256-bit PBKDF2 output: + 6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39 + e7 fe 37 a0 c4 1e 02 c2 81 ff 30 69 e1 e9 4f 52 + 256-bit AES key: + 4b 6d 98 39 f8 44 06 df 1f 09 cc 16 6d b4 b8 3c + 57 18 48 b7 84 a3 d6 bd c3 46 58 9a 3e 39 3f 9e + + Some test vectors for CBC with cipher text stealing, using an initial + vector of all-zero. + + AES 128-bit key: + 63 68 69 63 6b 65 6e 20 74 65 72 69 79 61 6b 69 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 + Output: + c6 35 35 68 f2 bf 8c b4 d8 a5 80 36 2d a7 ff 7f + 97 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 + Output: + fc 00 78 3e 0e fd b2 c1 d4 45 d4 c8 ef f7 ed 22 + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + Output: + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + + + + + + + + + + + +Raeburn [Page 10] + +INTERNET DRAFT November 2002 + + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + b3 ff fd 94 0c 16 a1 8c 1b 55 49 d2 f8 38 02 9e + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20 + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + 9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8 + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20 + 61 6e 64 20 77 6f 6e 74 6f 6e 20 73 6f 75 70 2e + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + 48 07 ef e8 36 ee 89 a5 26 73 0d bc 2f 7b c8 40 + 9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8 + + + + + + + + + + + + + + + + + + + + + + + +Raeburn [Page 11] diff --git a/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-03.txt b/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-03.txt new file mode 100644 index 00000000000..70395f2ba8d --- /dev/null +++ b/kerberosV/src/doc/standardisation/draft-raeburn-krb-rijndael-krb-03.txt @@ -0,0 +1,674 @@ + + + + + + + + + +Kerberos Working Group K. Raeburn +Document: draft-raeburn-krb-rijndael-krb-03.txt MIT + February 24, 2003 + expires August 24, 2003 + + AES Encryption for Kerberos 5 + +Abstract + + Recently the US National Institute of Standards and Technology chose + a new Advanced Encryption Standard [AES], which is significantly + faster and (it is believed) more secure than the old DES algorithm. + This document is a specification for the addition of this algorithm + to the Kerberos cryptosystem suite [KCRYPTO]. + + Comments should be sent to the author, or to the IETF Kerberos + working group (ietf-krb-wg@anl.gov). + +Status of this Memo + + This document is an Internet-Draft and is in full conformance with + all provisions of Section 10 of RFC2026 [RFC2026]. Internet-Drafts + are working documents of the Internet Engineering Task Force (IETF), + its areas, and its working groups. Note that other groups may also + distribute working documents as Internet-Drafts. Internet-Drafts are + draft documents valid for a maximum of six months and may be updated, + replaced, or obsoleted by other documents at any time. It is + inappropriate to use Internet-Drafts as reference material or to cite + them other than as "work in progress." + + The list of current Internet-Drafts can be accessed at + http://www.ietf.org/ietf/1id-abstracts.txt + + The list of Internet-Draft Shadow Directories can be accessed at + http://www.ietf.org/shadow.html. + +1. Introduction + + This document defines encryption key and checksum types for Kerberos + 5 using the AES algorithm recently chosen by NIST. These new types + support 128-bit block encryption, and key sizes of 128 or 256 bits. + + Using the "simplified profile" of [KCRYPTO], we can define a pair of + encryption and checksum schemes. AES is used with cipher text + stealing to avoid message expansion, and SHA-1 [SHA1] is the + + + +Raeburn [Page 1] + +INTERNET DRAFT February 2003 + + + associated checksum function. + +2. Conventions Used in this Document + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in RFC 2119. + +3. Protocol Key Representation + + The profile in [KCRYPTO] treats keys and random octet strings as + conceptually different. But since the AES key space is dense, we can + use any bit string of appropriate length as a key. We use the byte + representation for the key described in [AES], where the first bit of + the bit string is the high bit of the first byte of the byte string + (octet string) representation. + +4. Key Generation From Pass Phrases or Random Data + + Given the above format for keys, we can generate keys from the + appropriate amounts of random data (128 or 256 bits) by simply + copying the input string. + + To generate an encryption key from a pass phrase and salt string, we + use the PBKDF2 function from PKCS #5 v2.0 ([PKCS5]), with parameters + indicated below, to generate an intermediate key (of the same length + as the desired final key), which is then passed into the DK function + with the 8-octet ASCII string "kerberos" as is done for des3-cbc- + hmac-sha1-kd in [KCRYPTO]. (In [KCRYPTO] terms, the PBKDF2 function + produces a "random octet string", hence the application of the + random-to-key function even though it's effectively a simple identity + operation.) The resulting key is the user's long-term key for use + with the encryption algorithm in question. + + tkey = random2key(PBKDF2(passphrase, salt, iter_count, keylength)) + key = DK(tkey, "kerberos") + + The pseudorandom function used by PBKDF2 will be a SHA-1 HMAC of the + passphrase and salt, as described in Appendix B.1 to PKCS#5. + + The number of iterations is specified by the string-to-key parameters + supplied. The parameter string is four octets indicating an unsigned + number in big-endian order. This is the number of iterations to be + performed. If the value is 00 00 00 00, the number of iterations to + be performed is 4294967296 (2**32). (Thus the minimum expressable + iteration count is 1.) + + For environments where slower hardware is the norm, implementations + + + +Raeburn [Page 2] + +INTERNET DRAFT February 2003 + + + may wish to limit the number of iterations to prevent a spoofed + response from consuming lots of client-side CPU time; it is + recommended that this bound be no less than 50000. Even for + environments with fast hardware, 4 billion iterations is likely to + take a fairly long time; much larger bounds might still be enforced, + and it might be wise for implementations to permit interruption of + this operation by the user if the environment allows for it. + + If the string-to-key parameters are not supplied, the default value + to be used is 00 00 b0 00 (decimal 45056, indicating 45056 + iterations, which takes slightly under 1 second on a 300MHz Pentium + II in tests run by the author). + + Sample test vectors are given in the appendix. + +5. Cipher Text Stealing + + Cipher block chaining is used to encrypt messages. Unlike previous + Kerberos cryptosystems, we use cipher text stealing to handle the + possibly partial final block of the message. + + Cipher text stealing is described on pages 195-196 of [AC], and + section 8 of [RC5]; it has the advantage that no message expansion is + done during encryption of messages of arbitrary sizes as is typically + done in CBC mode with padding. + + Cipher text stealing, as defined in [RC5], assumes that more than one + block of plain text is available. If exactly one block is to be + encrypted, that block is simply encrypted with AES (also known as ECB + mode). Input of less than one block is padded at the end to one + block; the values of the padding bits are unspecified. + (Implementations may use all-zero padding, but protocols should not + rely on the result being deterministic. Implementations may use + random padding, but protocols should not rely on the result not being + deterministic. Note that in most cases, the Kerberos encryption + profile will add a random confounder independent of this padding.) + + For consistency, cipher text stealing is always used for the last two + blocks of the data to be encrypted, as in [RC5]. If the data length + is a multiple of the block size, this is equivalent to plain CBC mode + with the last two cipher text blocks swapped. + + A test vector is given in the appendix. + + + + + + + + +Raeburn [Page 3] + +INTERNET DRAFT February 2003 + + +6. Kerberos Algorithm Profile Parameters + + This is a summary of the parameters to be used with the simplified + algorithm profile described in [KCRYPTO]: + + +--------------------------------------------------------------------+ + | protocol key format 128- or 256-bit string | + | | + | string-to-key function PBKDF2+DK with variable | + | iteration count (see | + | above) | + | | + | default string-to-key parameters 00 00 b0 00 | + | | + | key-generation seed length key size | + | | + | random-to-key function identity function | + | | + | hash function, H SHA-1 | + | | + | HMAC output size, h 12 octets (96 bits) | + | | + | message block size, m 1 octet | + | | + | encryption/decryption functions, AES in CBC-CTS mode with | + | E and D zero ivec (cipher block | + | size 16 octets) | + +--------------------------------------------------------------------+ + + Using this profile with each key size gives us two each of encryption + and checksum algorithm definitions. + +7. Assigned Numbers + + The following encryption type numbers are assigned: + + +--------------------------------------------------------------------+ + | encryption types | + +--------------------------------------------------------------------+ + | type name etype value key size | + +--------------------------------------------------------------------+ + | aes128-cts-hmac-sha1-96 17 128 | + | aes256-cts-hmac-sha1-96 18 256 | + +--------------------------------------------------------------------+ + + The following checksum type numbers are assigned: + + + + + +Raeburn [Page 4] + +INTERNET DRAFT February 2003 + + + +--------------------------------------------------------------------+ + | checksum types | + +--------------------------------------------------------------------+ + | type name sumtype value length | + +--------------------------------------------------------------------+ + | hmac-sha1-96-aes128 15 96 | + | hmac-sha1-96-aes256 16 96 | + +--------------------------------------------------------------------+ + + These checksum types will be used with the corresponding encryption + types defined above. + +8. Security Considerations + + This new algorithm has not been around long enough to receive the + decades of intense analysis that DES has received. It is possible + that some weakness exists that has not been found by the + cryptographers analyzing these algorithms before and during the AES + selection process. + + The use of the HMAC function has drawbacks for certain pass phrase + lengths. For example, a pass phrase longer than the hash function + block size (64 bytes, for SHA-1) is hashed to a smaller size (20 + bytes) before applying the main HMAC algorithm. However, entropy is + generally sparse in pass phrases, especially in long ones, so this + may not be a problem in the rare cases of users with long pass + phrases. + + Also, generating a 256-bit key from a pass phrase of any length may + be deceptive, since the effective entropy in pass-phrase-derived key + cannot be nearly that large. + + The iteration count in PBKDF2 appears to be useful primarily as a + constant multiplier for the amount of work required for an attacker + using brute-force methods. Unfortunately, it also multiplies, by the + same amount, the work needed by a legitimate user with a valid + password. Thus the work factor imposed on an attacker (who may have + many powerful workstations at his disposal) must be balanced against + the work factor imposed on the legitimate user (who may have a PDA or + cell phone); the available computing power on either side increases + as time goes on, as well. A better way to deal with the brute-force + attack is through preauthentication mechanisms that provide better + protection of, the user's long-term key. Use of such mechanisms is + out of scope for this document. + + If the PBKDF2 iteration count can be spoofed by an intruder on the + network, and the limit on the accepted iteration count is very high, + the intruder may be able to introduce a form of denial of service + + + +Raeburn [Page 5] + +INTERNET DRAFT February 2003 + + + attack against the client by sending a very high iteration count, + causing the client to spend a great deal of CPU time computing an + incorrect key. + + Any benefit against other attacks specific to the HMAC or SHA-1 + algorithms is probably achieved with a fairly small number of + iterations. + + Cipher text stealing mode, since it requires no additional padding in + most cases, will reveal the exact length of each message being + encrypted, rather than merely bounding it to a small range of + possible lengths as in CBC mode. Such obfuscation should not be + relied upon at higher levels in any case; if the length must be + obscured from an outside observer, it should be done by intentionally + varying the length of the message to be encrypted. + + The author is not a cryptographer. Caveat emptor. + +9. IANA Considerations + + None. + +10. Acknowledgements + + Thanks to John Brezak, Gerardo Diaz Cuellar and Marcus Watts for + feedback on earlier versions of this document. + +11. Normative References + + [AC] Schneier, B., "Applied Cryptography", second edition, John Wiley + and Sons, New York, 1996. + + [AES] National Institute of Standards and Technology, U.S. Department + of Commerce, "Advanced Encryption Standard", Federal Information + Processing Standards Publication 197, Washington, DC, November 2001. + + [KCRYPTO] Raeburn, K., "Encryption and Checksum Specifications for + Kerberos 5", draft-ietf-krb-wg-crypto-01.txt, May, 2002. Work in + progress. + + [PKCS5] Kaliski, B., "PKCS #5: Password-Based Cryptography + Specification Version 2.0", RFC 2898, September 2000. + + [RC5] Baldwin, R, and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-Pad, and + RC5-CTS Algorithms", RFC 2040, October 1996. + + [RFC2026] Bradner, S., "The Internet Standards Process -- Revision + 3", RFC 2026, October 1996. + + + +Raeburn [Page 6] + +INTERNET DRAFT February 2003 + + + [SHA1] National Institute of Standards and Technology, U.S. + Department of Commerce, "Secure Hash Standard", Federal Information + Processing Standards Publication 180-1, Washington, DC, April 1995. + +12. Informative References + + [PECMS] Gutmann, P., "Password-based Encryption for CMS", RFC 3211, + December 2001. + +13. Author's Address + + Kenneth Raeburn + Massachusetts Institute of Technology + 77 Massachusetts Avenue + Cambridge, MA 02139 + raeburn@mit.edu + +14. Full Copyright Statement + + Copyright (C) The Internet Society (2003). All Rights Reserved. + + This document and translations of it may be copied and furnished to + others, and derivative works that comment on or otherwise explain it + or assist in its implementation may be prepared, copied, published + and distributed, in whole or in part, without restriction of any + kind, provided that the above copyright notice and this paragraph are + included on all such copies and derivative works. However, this + document itself may not be modified in any way, such as by removing + the copyright notice or references to the Internet Society or other + Internet organizations, except as needed for the purpose of + developing Internet standards in which case the procedures for + copyrights defined in the Internet Standards process must be + followed, or as required to translate it into languages other than + English. + + The limited permissions granted above are perpetual and will not be + revoked by the Internet Society or its successors or assigns. + + This document and the information contained herein is provided on an + "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING + TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING + BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION + HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF + MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." + +A. Sample test vectors + + Sample values for the string-to-key function are included below. + + + +Raeburn [Page 7] + +INTERNET DRAFT February 2003 + + + Iteration count = 1 + Pass phrase = "password" + Salt = "ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15 + 128-bit AES key: + 42 26 3c 6e 89 f4 fc 28 b8 df 68 ee 09 79 9f 15 + 256-bit PBKDF2 output: + cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15 + 0a d1 f7 a0 4b b9 f3 a3 33 ec c0 e2 e1 f7 08 37 + 256-bit AES key: + fe 69 7b 52 bc 0d 3c e1 44 32 ba 03 6a 92 e6 5b + bb 52 28 09 90 a2 fa 27 88 39 98 d7 2a f3 01 61 + + Iteration count = 2 + Pass phrase = "password" + Salt="ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + 01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d + 128-bit AES key: + c6 51 bf 29 e2 30 0a c2 7f a4 69 d6 93 bd da 13 + 256-bit PBKDF2 output: + 01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d + a0 53 78 b9 32 44 ec 8f 48 a9 9e 61 ad 79 9d 86 + 256-bit AES key: + a2 e1 6d 16 b3 60 69 c1 35 d5 e9 d2 e2 5f 89 61 + 02 68 56 18 b9 59 14 b4 67 c6 76 22 22 58 24 ff + + Iteration count = 1200 + Pass phrase = "password" + Salt = "ATHENA.MIT.EDUraeburn" + 128-bit PBKDF2 output: + 5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b + 128-bit AES key: + 4c 01 cd 46 d6 32 d0 1e 6d be 23 0a 01 ed 64 2a + 256-bit PBKDF2 output: + 5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b + a7 e5 2d db c5 e5 14 2f 70 8a 31 e2 e6 2b 1e 13 + 256-bit AES key: + 55 a6 ac 74 0a d1 7b 48 46 94 10 51 e1 e8 b0 a7 + 54 8d 93 b0 ab 30 a8 bc 3f f1 62 80 38 2b 8c 2a + + + + + + + + + + +Raeburn [Page 8] + +INTERNET DRAFT February 2003 + + + Iteration count = 5 + Pass phrase = "password" + Salt=0x1234567878563412 + 128-bit PBKDF2 output: + d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49 + 128-bit AES key: + e9 b2 3d 52 27 37 47 dd 5c 35 cb 55 be 61 9d 8e + 256-bit PBKDF2 output: + d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49 + 3f 98 d2 03 e6 be 49 a6 ad f4 fa 57 4b 6e 64 ee + 256-bit AES key: + 97 a4 e7 86 be 20 d8 1a 38 2d 5e bc 96 d5 90 9c + ab cd ad c8 7c a4 8f 57 45 04 15 9f 16 c3 6e 31 + (This test is based on values given in [PECMS].) + + Iteration count = 1200 + Pass phrase = (64 characters) + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + Salt="pass phrase equals block size" + 128-bit PBKDF2 output: + 13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9 + 128-bit AES key: + 59 d1 bb 78 9a 82 8b 1a a5 4e f9 c2 88 3f 69 ed + 256-bit PBKDF2 output: + 13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9 + c5 ec 59 f1 a4 52 f5 cc 9a d9 40 fe a0 59 8e d1 + 256-bit AES key: + 89 ad ee 36 08 db 8b c7 1f 1b fb fe 45 94 86 b0 + 56 18 b7 0c ba e2 20 92 53 4e 56 c5 53 ba 4b 34 + + Iteration count = 1200 + Pass phrase = (65 characters) + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + Salt = "pass phrase exceeds block size" + 128-bit PBKDF2 output: + 9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61 + 128-bit AES key: + cb 80 05 dc 5f 90 17 9a 7f 02 10 4c 00 18 75 1d + 256-bit PBKDF2 output: + 9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61 + 1a 8b 4d 28 26 01 db 3b 36 be 92 46 91 5e c8 2a + 256-bit AES key: + d7 8c 5c 9c b8 72 a8 c9 da d4 69 7f 0b b5 b2 d2 + 14 96 c8 2b eb 2c ae da 21 12 fc ee a0 57 40 1b + + + + + + + +Raeburn [Page 9] + +INTERNET DRAFT February 2003 + + + Iteration count = 50 + Pass phrase = g-clef (0xf09d849e) + Salt = "EXAMPLE.COMpianist" + 128-bit PBKDF2 output: + 6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39 + 128-bit AES key: + f1 49 c1 f2 e1 54 a7 34 52 d4 3e 7f e6 2a 56 e5 + 256-bit PBKDF2 output: + 6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39 + e7 fe 37 a0 c4 1e 02 c2 81 ff 30 69 e1 e9 4f 52 + 256-bit AES key: + 4b 6d 98 39 f8 44 06 df 1f 09 cc 16 6d b4 b8 3c + 57 18 48 b7 84 a3 d6 bd c3 46 58 9a 3e 39 3f 9e + + Some test vectors for CBC with cipher text stealing, using an initial + vector of all-zero. + + AES 128-bit key: + 63 68 69 63 6b 65 6e 20 74 65 72 69 79 61 6b 69 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 + Output: + c6 35 35 68 f2 bf 8c b4 d8 a5 80 36 2d a7 ff 7f + 97 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 + Output: + fc 00 78 3e 0e fd b2 c1 d4 45 d4 c8 ef f7 ed 22 + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + Output: + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + + + + + + + + + + + +Raeburn [Page 10] + +INTERNET DRAFT February 2003 + + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + b3 ff fd 94 0c 16 a1 8c 1b 55 49 d2 f8 38 02 9e + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20 + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + 9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8 + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + + Input: + 49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65 + 20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43 + 68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20 + 61 6e 64 20 77 6f 6e 74 6f 6e 20 73 6f 75 70 2e + Output: + 97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84 + 39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8 + 48 07 ef e8 36 ee 89 a5 26 73 0d bc 2f 7b c8 40 + 9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8 + +Document History (delete before RFC publication) + + Major changes from -02 to -03: + + Describe encryption of data of one block or less. + + Fix default string-to-key parameters in table to agree with text. + + Remove Recommendations section; the Kerberos RFC will cover + recommendations and requirements. + + Restore change history, added notes to RFC editor saying to remove + it, and update the [KCRYPTO] entry in Normative References. + + Delete confounder size, since it's gone from the simplified profile + in crypto-03. + + Change checksum numbers, since Assar Westerlund says 10 is in use. + + + + +Raeburn [Page 11] + +INTERNET DRAFT February 2003 + + + Add Security Consideration about denial of service caused by very + high spoofed iteration count. + + Major changes from -01 to -02: + + Add test vectors. + + Drop 192/384-bit variants. Prevailing opinion seems to be that + 128-bit keys are good for speed, and 256-bit for paranoia, and no one + cares about the intermediate sizes. + + Update for new string-to-key params per new Kerberos crypto draft and + discussions during the IETF conferences at Salt Lake City, December, + 2001, and Minneapolis, March, 2002. + + Drop Serpent and Twofish; Rijndael is the only one people care about. + Use "AES" in preference to "Rijndael". + + Use cipher text stealing mode intead of plain CBC, and add -cts to + the algorithm names. + + Drop SHA-2, stick with SHA-1. New test cases to exercise boundary + conditions in HMAC used in string-to-key. + + Split References into Normative/Informative. + + Major changes from -00: + + Define different types based on key/hash sizes, with hash size always + twice key size. Use simplified profile of revised section 6 of + RFC1510bis. Drop "-kd" from the names. + + Use PKCS#5 instead of simple hash. Changed string-to-key vector to + use some "Appendix Z" cases also submitted for kerberos-revisions. + +Notes to RFC Editor + + Assuming this document goes through Last Call along with the Kerberos + crypto framework draft, the reference entry for [KCRYPTO] will list + the draft name, not the RFC number. This should be replaced with the + RFC info. + + The "Document History" section should be deleted, as should this one. + + + + + + + + +Raeburn [Page 12] diff --git a/kerberosV/src/include/config.h.in b/kerberosV/src/include/config.h.in index 8f06ea385e9..0dde9922b56 100644 --- a/kerberosV/src/include/config.h.in +++ b/kerberosV/src/include/config.h.in @@ -1,24 +1,10 @@ -/* include/config.h.in. Generated automatically from configure.in by autoheader. */ +/* include/config.h.in. Generated from configure.in by autoheader. */ #ifndef RCSID #define RCSID(msg) \ -static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } +static /**/const char *const rcsid[] = { (const char *)rcsid, "@(#)" msg } #endif -#undef BINDIR -#undef LIBDIR -#undef LIBEXECDIR -#undef SBINDIR - -#undef HAVE_INT8_T -#undef HAVE_INT16_T -#undef HAVE_INT32_T -#undef HAVE_INT64_T -#undef HAVE_U_INT8_T -#undef HAVE_U_INT16_T -#undef HAVE_U_INT32_T -#undef HAVE_U_INT64_T - /* Maximum values on all known systems */ #define MaxHostNameLen (64+4) #define MaxPathLen (1024+4) @@ -28,6 +14,9 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define if you want authentication support in telnet. */ #undef AUTHENTICATION +/* path to bin */ +#undef BINDIR + /* Define if realloc(NULL) doesn't work. */ #undef BROKEN_REALLOC @@ -65,151 +54,166 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } struct sockaddr*, socklen_t*) */ #undef GETSOCKNAME_PROTO_COMPATIBLE -/* Define if you have the <arpa/ftp.h> header file. */ +/* Define if you have the `altzone' variable. */ +#undef HAVE_ALTZONE + +/* define if your system declares altzone */ +#undef HAVE_ALTZONE_DECLARATION + +/* Define to 1 if you have the <arpa/ftp.h> header file. */ #undef HAVE_ARPA_FTP_H -/* Define if you have the <arpa/inet.h> header file. */ +/* Define to 1 if you have the <arpa/inet.h> header file. */ #undef HAVE_ARPA_INET_H -/* Define if you have the <arpa/nameser.h> header file. */ +/* Define to 1 if you have the <arpa/nameser.h> header file. */ #undef HAVE_ARPA_NAMESER_H -/* Define if you have the <arpa/telnet.h> header file. */ +/* Define to 1 if you have the <arpa/telnet.h> header file. */ #undef HAVE_ARPA_TELNET_H -/* Define if you have the `asnprintf' function. */ +/* Define to 1 if you have the `asnprintf' function. */ #undef HAVE_ASNPRINTF -/* Define if you have the `asprintf' function. */ +/* Define to 1 if you have the `asprintf' function. */ #undef HAVE_ASPRINTF -/* Define if you have the <bind/bitypes.h> header file. */ +/* Define to 1 if you have the `atexit' function. */ +#undef HAVE_ATEXIT + +/* Define to 1 if you have the <bind/bitypes.h> header file. */ #undef HAVE_BIND_BITYPES_H -/* Define if you have the <bsdsetjmp.h> header file. */ +/* Define to 1 if you have the <bsdsetjmp.h> header file. */ #undef HAVE_BSDSETJMP_H -/* Define if you have the `bswap16' function. */ +/* Define to 1 if you have the `bswap16' function. */ #undef HAVE_BSWAP16 -/* Define if you have the `bswap32' function. */ +/* Define to 1 if you have the `bswap32' function. */ #undef HAVE_BSWAP32 -/* Define if you have the <capability.h> header file. */ +/* Define to 1 if you have the <capability.h> header file. */ #undef HAVE_CAPABILITY_H -/* Define if you have the `cap_set_proc' function. */ +/* Define to 1 if you have the `cap_set_proc' function. */ #undef HAVE_CAP_SET_PROC -/* Define if you have the `cgetent' function. */ +/* Define to 1 if you have the `cgetent' function. */ #undef HAVE_CGETENT -/* Define if you have the `chown' function. */ +/* Define if you have the function `chown'. */ #undef HAVE_CHOWN -/* Define if you have the <config.h> header file. */ +/* Define to 1 if you have the <config.h> header file. */ #undef HAVE_CONFIG_H -/* Define if you have the `copyhostent' function. */ +/* Define if you have the function `copyhostent'. */ #undef HAVE_COPYHOSTENT -/* Define if you have the `crypt' function. */ +/* Define to 1 if you have the `crypt' function. */ #undef HAVE_CRYPT -/* Define if you have the <crypt.h> header file. */ +/* Define to 1 if you have the <crypt.h> header file. */ #undef HAVE_CRYPT_H -/* Define if you have the <curses.h> header file. */ +/* Define to 1 if you have the <curses.h> header file. */ #undef HAVE_CURSES_H -/* Define if you have the `daemon' function. */ +/* Define if you have the function `daemon'. */ #undef HAVE_DAEMON /* define if you have a berkeley db1/2 library */ #undef HAVE_DB1 -/* define if you have a berkeley db3 library */ +/* define if you have a berkeley db3/4 library */ #undef HAVE_DB3 -/* Define if you have the `dbm_firstkey' function. */ +/* Define to 1 if you have the <db3/db.h> header file. */ +#undef HAVE_DB3_DB_H + +/* Define to 1 if you have the <db4/db.h> header file. */ +#undef HAVE_DB4_DB_H + +/* Define to 1 if you have the `dbm_firstkey' function. */ #undef HAVE_DBM_FIRSTKEY -/* Define if you have the <dbm.h> header file. */ +/* Define to 1 if you have the <dbm.h> header file. */ #undef HAVE_DBM_H -/* Define if you have the `dbopen' function. */ +/* Define to 1 if you have the `dbopen' function. */ #undef HAVE_DBOPEN -/* Define if you have the <db_185.h> header file. */ +/* Define to 1 if you have the <db_185.h> header file. */ #undef HAVE_DB_185_H -/* Define if you have the `db_create' function. */ +/* Define to 1 if you have the `db_create' function. */ #undef HAVE_DB_CREATE -/* Define if you have the <db.h> header file. */ +/* Define to 1 if you have the <db.h> header file. */ #undef HAVE_DB_H /* define if you have ndbm compat in db */ #undef HAVE_DB_NDBM -/* Define if you have the <dirent.h> header file. */ +/* Define to 1 if you have the <dirent.h> header file. */ #undef HAVE_DIRENT_H -/* Define if you have the <dlfcn.h> header file. */ +/* Define to 1 if you have the <dlfcn.h> header file. */ #undef HAVE_DLFCN_H -/* Define if you have the `dlopen' function. */ +/* Define to 1 if you have the `dlopen' function. */ #undef HAVE_DLOPEN -/* Define if you have the `dn_expand' function. */ +/* Define to 1 if you have the `dn_expand' function. */ #undef HAVE_DN_EXPAND -/* Define if you have the `ecalloc' function. */ +/* Define if you have the function `ecalloc'. */ #undef HAVE_ECALLOC -/* Define if you have the `el_init' function. */ +/* Define to 1 if you have the `el_init' function. */ #undef HAVE_EL_INIT -/* Define if you have the `emalloc' function. */ +/* Define if you have the function `emalloc'. */ #undef HAVE_EMALLOC /* define if your system declares environ */ #undef HAVE_ENVIRON_DECLARATION -/* Define if you have the `erealloc' function. */ +/* Define if you have the function `erealloc'. */ #undef HAVE_EREALLOC -/* Define if you have the `err' function. */ +/* Define if you have the function `err'. */ #undef HAVE_ERR -/* Define if you have the <errno.h> header file. */ +/* Define to 1 if you have the <errno.h> header file. */ #undef HAVE_ERRNO_H -/* Define if you have the `errx' function. */ +/* Define if you have the function `errx'. */ #undef HAVE_ERRX -/* Define if you have the <err.h> header file. */ +/* Define to 1 if you have the <err.h> header file. */ #undef HAVE_ERR_H -/* Define if you have the `estrdup' function. */ +/* Define if you have the function `estrdup'. */ #undef HAVE_ESTRDUP -/* Define if you have the `fchown' function. */ +/* Define if you have the function `fchown'. */ #undef HAVE_FCHOWN -/* Define if you have the `fcntl' function. */ +/* Define to 1 if you have the `fcntl' function. */ #undef HAVE_FCNTL -/* Define if you have the <fcntl.h> header file. */ +/* Define to 1 if you have the <fcntl.h> header file. */ #undef HAVE_FCNTL_H -/* Define if you have the `flock' function. */ +/* Define if you have the function `flock'. */ #undef HAVE_FLOCK -/* Define if you have the `fnmatch' function. */ +/* Define if you have the function `fnmatch'. */ #undef HAVE_FNMATCH -/* Define if you have the <fnmatch.h> header file. */ +/* Define to 1 if you have the <fnmatch.h> header file. */ #undef HAVE_FNMATCH_H /* Define if el_init takes four arguments. */ @@ -218,107 +222,110 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if krb_put_int takes four arguments. */ #undef HAVE_FOUR_VALUED_KRB_PUT_INT -/* Define if you have the `freeaddrinfo' function. */ +/* Define to 1 if you have the `freeaddrinfo' function. */ #undef HAVE_FREEADDRINFO -/* Define if you have the `freehostent' function. */ +/* Define if you have the function `freehostent'. */ #undef HAVE_FREEHOSTENT -/* Define if you have the `gai_strerror' function. */ +/* Define to 1 if you have the `gai_strerror' function. */ #undef HAVE_GAI_STRERROR -/* Define if you have the <gdbm/ndbm.h> header file. */ +/* Define to 1 if you have the <gdbm/ndbm.h> header file. */ #undef HAVE_GDBM_NDBM_H -/* Define if you have the `getaddrinfo' function. */ +/* Define to 1 if you have the `getaddrinfo' function. */ #undef HAVE_GETADDRINFO -/* Define if you have the `getconfattr' function. */ +/* Define to 1 if you have the `getconfattr' function. */ #undef HAVE_GETCONFATTR -/* Define if you have the `getcwd' function. */ +/* Define if you have the function `getcwd'. */ #undef HAVE_GETCWD -/* Define if you have the `getdtablesize' function. */ +/* Define if you have the function `getdtablesize'. */ #undef HAVE_GETDTABLESIZE -/* Define if you have the `getegid' function. */ +/* Define if you have the function `getegid'. */ #undef HAVE_GETEGID -/* Define if you have the `geteuid' function. */ +/* Define if you have the function `geteuid'. */ #undef HAVE_GETEUID -/* Define if you have the `getgid' function. */ +/* Define if you have the function `getgid'. */ #undef HAVE_GETGID -/* Define if you have the `gethostbyname' function. */ +/* Define to 1 if you have the `gethostbyname' function. */ #undef HAVE_GETHOSTBYNAME -/* Define if you have the `gethostbyname2' function. */ +/* Define to 1 if you have the `gethostbyname2' function. */ #undef HAVE_GETHOSTBYNAME2 -/* Define if you have the `gethostname' function. */ +/* Define if you have the function `gethostname'. */ #undef HAVE_GETHOSTNAME -/* Define if you have the `getifaddrs' function. */ +/* Define if you have the function `getifaddrs'. */ #undef HAVE_GETIFADDRS -/* Define if you have the `getipnodebyaddr' function. */ +/* Define if you have the function `getipnodebyaddr'. */ #undef HAVE_GETIPNODEBYADDR -/* Define if you have the `getipnodebyname' function. */ +/* Define if you have the function `getipnodebyname'. */ #undef HAVE_GETIPNODEBYNAME -/* Define if you have the `getlogin' function. */ +/* Define to 1 if you have the `getlogin' function. */ #undef HAVE_GETLOGIN /* Define if you have a working getmsg. */ #undef HAVE_GETMSG -/* Define if you have the `getnameinfo' function. */ +/* Define to 1 if you have the `getnameinfo' function. */ #undef HAVE_GETNAMEINFO -/* Define if you have the `getopt' function. */ +/* Define if you have the function `getopt'. */ #undef HAVE_GETOPT -/* Define if you have the `getprogname' function. */ +/* Define to 1 if you have the `getpagesize' function. */ +#undef HAVE_GETPAGESIZE + +/* Define to 1 if you have the `getprogname' function. */ #undef HAVE_GETPROGNAME -/* Define if you have the `getpwnam_r' function. */ +/* Define to 1 if you have the `getpwnam_r' function. */ #undef HAVE_GETPWNAM_R -/* Define if you have the `getrlimit' function. */ +/* Define to 1 if you have the `getrlimit' function. */ #undef HAVE_GETRLIMIT -/* Define if you have the `getsockopt' function. */ +/* Define to 1 if you have the `getsockopt' function. */ #undef HAVE_GETSOCKOPT -/* Define if you have the `getspnam' function. */ +/* Define to 1 if you have the `getspnam' function. */ #undef HAVE_GETSPNAM -/* Define if you have the `gettimeofday' function. */ +/* Define if you have the function `gettimeofday'. */ #undef HAVE_GETTIMEOFDAY -/* Define if you have the `getudbnam' function. */ +/* Define to 1 if you have the `getudbnam' function. */ #undef HAVE_GETUDBNAM -/* Define if you have the `getuid' function. */ +/* Define if you have the function `getuid'. */ #undef HAVE_GETUID -/* Define if you have the `getusershell' function. */ +/* Define if you have the function `getusershell'. */ #undef HAVE_GETUSERSHELL /* define if you have a glob() that groks GLOB_BRACE, GLOB_NOCHECK, GLOB_QUOTE, GLOB_TILDE, and GLOB_LIMIT */ #undef HAVE_GLOB -/* Define if you have the `grantpt' function. */ +/* Define to 1 if you have the `grantpt' function. */ #undef HAVE_GRANTPT -/* Define if you have the <grp.h> header file. */ +/* Define to 1 if you have the <grp.h> header file. */ #undef HAVE_GRP_H -/* Define if you have the `hstrerror' function. */ +/* Define to 1 if you have the `hstrerror' function. */ #undef HAVE_HSTRERROR /* Define if you have the `h_errlist' variable. */ @@ -339,133 +346,169 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if your system declares h_nerr */ #undef HAVE_H_NERR_DECLARATION -/* Define if you have the <ifaddrs.h> header file. */ +/* Define to 1 if you have the <ifaddrs.h> header file. */ #undef HAVE_IFADDRS_H /* Define if you have the in6addr_loopback variable */ #undef HAVE_IN6ADDR_LOOPBACK -/* Define if you have the `inet_aton' function. */ +/* define */ #undef HAVE_INET_ATON -/* Define if you have the `inet_ntop' function. */ +/* define */ #undef HAVE_INET_NTOP -/* Define if you have the `inet_pton' function. */ +/* define */ #undef HAVE_INET_PTON -/* Define if you have the `initgroups' function. */ +/* Define if you have the function `initgroups'. */ #undef HAVE_INITGROUPS -/* Define if you have the `initstate' function. */ +/* Define to 1 if you have the `initstate' function. */ #undef HAVE_INITSTATE -/* Define if you have the `innetgr' function. */ +/* Define if you have the function `innetgr'. */ #undef HAVE_INNETGR -/* Define if you have the <inttypes.h> header file. */ +/* Define to 1 if the system has the type `int16_t'. */ +#undef HAVE_INT16_T + +/* Define to 1 if the system has the type `int32_t'. */ +#undef HAVE_INT32_T + +/* Define to 1 if the system has the type `int64_t'. */ +#undef HAVE_INT64_T + +/* Define to 1 if the system has the type `int8_t'. */ +#undef HAVE_INT8_T + +/* Define to 1 if you have the <inttypes.h> header file. */ #undef HAVE_INTTYPES_H -/* Define if you have the <io.h> header file. */ +/* Define to 1 if you have the <io.h> header file. */ #undef HAVE_IO_H /* Define if you have IPv6. */ #undef HAVE_IPV6 -/* Define if you have the `iruserok' function. */ +/* Define if you have the function `iruserok'. */ #undef HAVE_IRUSEROK -/* Define if you have the `issetugid' function. */ +/* Define to 1 if you have the `issetugid' function. */ #undef HAVE_ISSETUGID -/* Define if you have the `krb_disable_debug' function. */ +/* Define to 1 if you have the `krb_disable_debug' function. */ #undef HAVE_KRB_DISABLE_DEBUG -/* Define if you have the `krb_enable_debug' function. */ +/* Define to 1 if you have the `krb_enable_debug' function. */ #undef HAVE_KRB_ENABLE_DEBUG -/* Define if you have the `krb_get_our_ip_for_realm' function. */ +/* Define to 1 if you have the `krb_get_kdc_time_diff' function. */ +#undef HAVE_KRB_GET_KDC_TIME_DIFF + +/* Define to 1 if you have the `krb_get_our_ip_for_realm' function. */ #undef HAVE_KRB_GET_OUR_IP_FOR_REALM -/* Define if you have the <libutil.h> header file. */ +/* Define to 1 if you have the `krb_kdctimeofday' function. */ +#undef HAVE_KRB_KDCTIMEOFDAY + +/* Define to 1 if you have the <libutil.h> header file. */ #undef HAVE_LIBUTIL_H -/* Define if you have the <limits.h> header file. */ +/* Define to 1 if you have the <limits.h> header file. */ #undef HAVE_LIMITS_H -/* Define if you have the `logout' function. */ +/* Define to 1 if you have the `loadquery' function. */ +#undef HAVE_LOADQUERY + +/* Define if you have the function `localtime_r'. */ +#undef HAVE_LOCALTIME_R + +/* Define to 1 if you have the `logout' function. */ #undef HAVE_LOGOUT -/* Define if you have the `logwtmp' function. */ +/* Define to 1 if you have the `logwtmp' function. */ #undef HAVE_LOGWTMP -/* Define if the system has the type `long long'. */ +/* Define to 1 if the system has the type `long long'. */ #undef HAVE_LONG_LONG -/* Define if you have the `lstat' function. */ +/* Define if you have the function `lstat'. */ #undef HAVE_LSTAT -/* Define if you have the <maillock.h> header file. */ +/* Define to 1 if you have the <maillock.h> header file. */ #undef HAVE_MAILLOCK_H -/* Define if you have the `memmove' function. */ +/* Define if you have the function `memmove'. */ #undef HAVE_MEMMOVE -/* Define if you have the <memory.h> header file. */ +/* Define to 1 if you have the <memory.h> header file. */ #undef HAVE_MEMORY_H -/* Define if you have the `mkstemp' function. */ +/* Define if you have the function `mkstemp'. */ #undef HAVE_MKSTEMP -/* Define if you have the `mktime' function. */ +/* Define to 1 if you have the `mktime' function. */ #undef HAVE_MKTIME +/* Define to 1 if you have a working `mmap' system call. */ +#undef HAVE_MMAP + /* define if you have a ndbm library */ #undef HAVE_NDBM -/* Define if you have the <ndbm.h> header file. */ +/* Define to 1 if you have the <ndbm.h> header file. */ #undef HAVE_NDBM_H -/* Define if you have the <netdb.h> header file. */ +/* Define to 1 if you have the <netdb.h> header file. */ #undef HAVE_NETDB_H -/* Define if you have the <netinet6/in6.h> header file. */ +/* Define to 1 if you have the <netgroup.h> header file. */ +#undef HAVE_NETGROUP_H + +/* Define to 1 if you have the <netinet6/in6.h> header file. */ #undef HAVE_NETINET6_IN6_H -/* Define if you have the <netinet6/in6_var.h> header file. */ +/* Define to 1 if you have the <netinet6/in6_var.h> header file. */ #undef HAVE_NETINET6_IN6_VAR_H -/* Define if you have the <netinet/in6.h> header file. */ +/* Define to 1 if you have the <netinet/in6.h> header file. */ #undef HAVE_NETINET_IN6_H -/* Define if you have the <netinet/in6_machtypes.h> header file. */ +/* Define to 1 if you have the <netinet/in6_machtypes.h> header file. */ #undef HAVE_NETINET_IN6_MACHTYPES_H -/* Define if you have the <netinet/in6_var.h> header file. */ -#undef HAVE_NETINET_IN6_VAR_H - -/* Define if you have the <netinet/in.h> header file. */ +/* Define to 1 if you have the <netinet/in.h> header file. */ #undef HAVE_NETINET_IN_H -/* Define if you have the <netinet/in_systm.h> header file. */ +/* Define to 1 if you have the <netinet/in_systm.h> header file. */ #undef HAVE_NETINET_IN_SYSTM_H -/* Define if you have the <netinet/ip.h> header file. */ +/* Define to 1 if you have the <netinet/ip.h> header file. */ #undef HAVE_NETINET_IP_H -/* Define if you have the <netinet/tcp.h> header file. */ +/* Define to 1 if you have the <netinet/tcp.h> header file. */ #undef HAVE_NETINET_TCP_H /* Define if you want to use Netinfo instead of krb5.conf. */ #undef HAVE_NETINFO -/* Define if you have the <netinfo/ni.h> header file. */ +/* Define to 1 if you have the <netinfo/ni.h> header file. */ #undef HAVE_NETINFO_NI_H -/* Define if you have the <net/if.h> header file. */ +/* Define to 1 if you have the <net/if.h> header file. */ #undef HAVE_NET_IF_H -/* Define if you have the `openpty' function. */ +/* Define if NDBM really is DB (creates files *.db) */ +#undef HAVE_NEW_DB + +/* define if you have hash functions like md4_finito() */ +#undef HAVE_OLD_HASH_NAMES + +/* Define to 1 if you have the `on_exit' function. */ +#undef HAVE_ON_EXIT + +/* Define to 1 if you have the `openpty' function. */ #undef HAVE_OPENPTY /* define to use openssl's libcrypto */ @@ -486,232 +529,244 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define to enable basic OSF C2 support. */ #undef HAVE_OSFC2 -/* Define if you have the <paths.h> header file. */ +/* Define to 1 if you have the <paths.h> header file. */ #undef HAVE_PATHS_H -/* Define if you have the `pidfile' function. */ +/* Define to 1 if you have the `pidfile' function. */ #undef HAVE_PIDFILE -/* Define if you have the <pthread.h> header file. */ +/* Define to 1 if you have the <pthread.h> header file. */ #undef HAVE_PTHREAD_H -/* Define if you have the `ptsname' function. */ +/* Define to 1 if you have the `ptsname' function. */ #undef HAVE_PTSNAME -/* Define if you have the <pty.h> header file. */ +/* Define to 1 if you have the <pty.h> header file. */ #undef HAVE_PTY_H -/* Define if you have the `putenv' function. */ +/* Define if you have the function `putenv'. */ #undef HAVE_PUTENV -/* Define if you have the <pwd.h> header file. */ +/* Define to 1 if you have the <pwd.h> header file. */ #undef HAVE_PWD_H -/* Define if you have the `rand' function. */ +/* Define to 1 if you have the `rand' function. */ #undef HAVE_RAND -/* Define if you have the `random' function. */ +/* Define to 1 if you have the `random' function. */ #undef HAVE_RANDOM -/* Define if you have the `rcmd' function. */ +/* Define if you have the function `rcmd'. */ #undef HAVE_RCMD /* Define if you have a readline compatible library. */ #undef HAVE_READLINE -/* Define if you have the `readv' function. */ +/* Define if you have the function `readv'. */ #undef HAVE_READV -/* Define if you have the `recvmsg' function. */ +/* Define if you have the function `recvmsg'. */ #undef HAVE_RECVMSG -/* Define if you have the <resolv.h> header file. */ +/* Define to 1 if you have the <resolv.h> header file. */ #undef HAVE_RESOLV_H -/* Define if you have the `res_search' function. */ +/* Define to 1 if you have the `res_nsearch' function. */ +#undef HAVE_RES_NSEARCH + +/* Define to 1 if you have the `res_search' function. */ #undef HAVE_RES_SEARCH -/* Define if you have the `revoke' function. */ +/* Define to 1 if you have the `revoke' function. */ #undef HAVE_REVOKE -/* Define if you have the <rpcsvc/ypclnt.h> header file. */ +/* Define to 1 if you have the <rpcsvc/ypclnt.h> header file. */ #undef HAVE_RPCSVC_YPCLNT_H -/* Define if you have the <sac.h> header file. */ +/* Define to 1 if you have the <sac.h> header file. */ #undef HAVE_SAC_H -/* Define if the system has the type `sa_family_t'. */ +/* Define to 1 if the system has the type `sa_family_t'. */ #undef HAVE_SA_FAMILY_T -/* Define if you have the <security/pam_modules.h> header file. */ +/* Define to 1 if you have the <security/pam_modules.h> header file. */ #undef HAVE_SECURITY_PAM_MODULES_H -/* Define if you have the `select' function. */ +/* Define to 1 if you have the `select' function. */ #undef HAVE_SELECT -/* Define if you have the `sendmsg' function. */ +/* Define if you have the function `sendmsg'. */ #undef HAVE_SENDMSG -/* Define if you have the `setegid' function. */ +/* Define if you have the function `setegid'. */ #undef HAVE_SETEGID -/* Define if you have the `setenv' function. */ +/* Define if you have the function `setenv'. */ #undef HAVE_SETENV -/* Define if you have the `seteuid' function. */ +/* Define if you have the function `seteuid'. */ #undef HAVE_SETEUID -/* Define if you have the `setitimer' function. */ +/* Define to 1 if you have the `setitimer' function. */ #undef HAVE_SETITIMER -/* Define if you have the `setlim' function. */ +/* Define to 1 if you have the `setlim' function. */ #undef HAVE_SETLIM -/* Define if you have the `setlogin' function. */ +/* Define to 1 if you have the `setlogin' function. */ #undef HAVE_SETLOGIN -/* Define if you have the `setpcred' function. */ +/* Define to 1 if you have the `setpcred' function. */ #undef HAVE_SETPCRED -/* Define if you have the `setpgid' function. */ +/* Define to 1 if you have the `setpgid' function. */ #undef HAVE_SETPGID -/* Define if you have the `setproctitle' function. */ +/* Define to 1 if you have the `setproctitle' function. */ #undef HAVE_SETPROCTITLE -/* Define if you have the `setprogname' function. */ +/* Define to 1 if you have the `setprogname' function. */ #undef HAVE_SETPROGNAME -/* Define if you have the `setregid' function. */ +/* Define to 1 if you have the `setregid' function. */ #undef HAVE_SETREGID -/* Define if you have the `setresgid' function. */ +/* Define to 1 if you have the `setresgid' function. */ #undef HAVE_SETRESGID -/* Define if you have the `setresuid' function. */ +/* Define to 1 if you have the `setresuid' function. */ #undef HAVE_SETRESUID -/* Define if you have the `setreuid' function. */ +/* Define to 1 if you have the `setreuid' function. */ #undef HAVE_SETREUID -/* Define if you have the `setsid' function. */ +/* Define to 1 if you have the `setsid' function. */ #undef HAVE_SETSID -/* Define if you have the `setsockopt' function. */ +/* Define to 1 if you have the `setsockopt' function. */ #undef HAVE_SETSOCKOPT -/* Define if you have the `setstate' function. */ +/* Define to 1 if you have the `setstate' function. */ #undef HAVE_SETSTATE -/* Define if you have the `setutent' function. */ +/* Define to 1 if you have the `setutent' function. */ #undef HAVE_SETUTENT -/* Define if you have the `sgi_getcapabilitybyname' function. */ +/* Define to 1 if you have the `sgi_getcapabilitybyname' function. */ #undef HAVE_SGI_GETCAPABILITYBYNAME -/* Define if you have the <sgtty.h> header file. */ +/* Define to 1 if you have the <sgtty.h> header file. */ #undef HAVE_SGTTY_H -/* Define if you have the <shadow.h> header file. */ +/* Define to 1 if you have the <shadow.h> header file. */ #undef HAVE_SHADOW_H -/* Define if you have the <siad.h> header file. */ +/* Define to 1 if you have the <siad.h> header file. */ #undef HAVE_SIAD_H -/* Define if you have the `sigaction' function. */ +/* Define to 1 if you have the `sigaction' function. */ #undef HAVE_SIGACTION -/* Define if you have the <signal.h> header file. */ +/* Define to 1 if you have the <signal.h> header file. */ #undef HAVE_SIGNAL_H /* define if you have a working snprintf */ #undef HAVE_SNPRINTF -/* Define if you have the `socket' function. */ +/* Define to 1 if you have the `socket' function. */ #undef HAVE_SOCKET -/* Define if the system has the type `socklen_t'. */ +/* Define to 1 if the system has the type `socklen_t'. */ #undef HAVE_SOCKLEN_T -/* Define if you have the <standards.h> header file. */ +/* Define to 1 if the system has the type `ssize_t'. */ +#undef HAVE_SSIZE_T + +/* Define to 1 if you have the <standards.h> header file. */ #undef HAVE_STANDARDS_H -/* Define if you have the <stdint.h> header file. */ +/* Define to 1 if you have the <stdint.h> header file. */ #undef HAVE_STDINT_H -/* Define if you have the <stdlib.h> header file. */ +/* Define to 1 if you have the <stdlib.h> header file. */ #undef HAVE_STDLIB_H -/* Define if you have the `strcasecmp' function. */ +/* Define if you have the function `strcasecmp'. */ #undef HAVE_STRCASECMP -/* Define if you have the `strdup' function. */ +/* Define if you have the function `strdup'. */ #undef HAVE_STRDUP -/* Define if you have the `strerror' function. */ +/* Define if you have the function `strerror'. */ #undef HAVE_STRERROR -/* Define if you have the `strftime' function. */ +/* Define if you have the function `strftime'. */ #undef HAVE_STRFTIME -/* Define if you have the <strings.h> header file. */ +/* Define to 1 if you have the <strings.h> header file. */ #undef HAVE_STRINGS_H -/* Define if you have the <string.h> header file. */ +/* Define to 1 if you have the <string.h> header file. */ #undef HAVE_STRING_H -/* Define if you have the `strlcat' function. */ +/* Define if you have the function `strlcat'. */ #undef HAVE_STRLCAT -/* Define if you have the `strlcpy' function. */ +/* Define if you have the function `strlcpy'. */ #undef HAVE_STRLCPY -/* Define if you have the `strlwr' function. */ +/* Define if you have the function `strlwr'. */ #undef HAVE_STRLWR -/* Define if you have the `strncasecmp' function. */ +/* Define if you have the function `strncasecmp'. */ #undef HAVE_STRNCASECMP -/* Define if you have the `strndup' function. */ +/* Define if you have the function `strndup'. */ #undef HAVE_STRNDUP -/* Define if you have the `strnlen' function. */ +/* Define if you have the function `strnlen'. */ #undef HAVE_STRNLEN -/* Define if you have the <stropts.h> header file. */ +/* Define to 1 if you have the <stropts.h> header file. */ #undef HAVE_STROPTS_H -/* Define if you have the `strptime' function. */ +/* Define if you have the function `strptime'. */ #undef HAVE_STRPTIME -/* Define if you have the `strsep' function. */ +/* Define if you have the function `strsep'. */ #undef HAVE_STRSEP -/* Define if you have the `strsep_copy' function. */ +/* Define if you have the function `strsep_copy'. */ #undef HAVE_STRSEP_COPY -/* Define if you have the `strstr' function. */ +/* Define to 1 if you have the `strstr' function. */ #undef HAVE_STRSTR -/* Define if you have the `strsvis' function. */ +/* Define to 1 if you have the `strsvis' function. */ #undef HAVE_STRSVIS -/* Define if you have the `strtok_r' function. */ +/* Define if you have the function `strtok_r'. */ #undef HAVE_STRTOK_R -/* Define if the system has the type `struct addrinfo'. */ +/* Define to 1 if the system has the type `struct addrinfo'. */ #undef HAVE_STRUCT_ADDRINFO -/* Define if the system has the type `struct ifaddrs'. */ +/* Define to 1 if the system has the type `struct ifaddrs'. */ #undef HAVE_STRUCT_IFADDRS -/* Define if the system has the type `struct sockaddr'. */ +/* Define to 1 if the system has the type `struct iovec'. */ +#undef HAVE_STRUCT_IOVEC + +/* Define to 1 if the system has the type `struct msghdr'. */ +#undef HAVE_STRUCT_MSGHDR + +/* Define to 1 if the system has the type `struct sockaddr'. */ #undef HAVE_STRUCT_SOCKADDR /* Define if struct sockaddr has field sa_len. */ #undef HAVE_STRUCT_SOCKADDR_SA_LEN -/* Define if the system has the type `struct sockaddr_storage'. */ +/* Define to 1 if the system has the type `struct sockaddr_storage'. */ #undef HAVE_STRUCT_SOCKADDR_STORAGE /* define if you have struct spwd */ @@ -750,151 +805,157 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if struct winsize is declared in sys/termios.h */ #undef HAVE_STRUCT_WINSIZE -/* Define if you have the `strunvis' function. */ +/* Define to 1 if you have the `strunvis' function. */ #undef HAVE_STRUNVIS -/* Define if you have the `strupr' function. */ +/* Define if you have the function `strupr'. */ #undef HAVE_STRUPR -/* Define if you have the `strvis' function. */ +/* Define to 1 if you have the `strvis' function. */ #undef HAVE_STRVIS -/* Define if you have the `strvisx' function. */ +/* Define to 1 if you have the `strvisx' function. */ #undef HAVE_STRVISX -/* Define if you have the `svis' function. */ +/* Define to 1 if you have the `svis' function. */ #undef HAVE_SVIS -/* Define if you have the `swab' function. */ +/* Define if you have the function `swab'. */ #undef HAVE_SWAB -/* Define if you have the `sysconf' function. */ +/* Define to 1 if you have the `sysconf' function. */ #undef HAVE_SYSCONF -/* Define if you have the `sysctl' function. */ +/* Define to 1 if you have the `sysctl' function. */ #undef HAVE_SYSCTL -/* Define if you have the `syslog' function. */ +/* Define to 1 if you have the `syslog' function. */ #undef HAVE_SYSLOG -/* Define if you have the <syslog.h> header file. */ +/* Define to 1 if you have the <syslog.h> header file. */ #undef HAVE_SYSLOG_H -/* Define if you have the <sys/bitypes.h> header file. */ +/* Define to 1 if you have the <sys/bitypes.h> header file. */ #undef HAVE_SYS_BITYPES_H -/* Define if you have the <sys/bswap.h> header file. */ +/* Define to 1 if you have the <sys/bswap.h> header file. */ #undef HAVE_SYS_BSWAP_H -/* Define if you have the <sys/capability.h> header file. */ +/* Define to 1 if you have the <sys/capability.h> header file. */ #undef HAVE_SYS_CAPABILITY_H -/* Define if you have the <sys/category.h> header file. */ +/* Define to 1 if you have the <sys/category.h> header file. */ #undef HAVE_SYS_CATEGORY_H -/* Define if you have the <sys/file.h> header file. */ +/* Define to 1 if you have the <sys/file.h> header file. */ #undef HAVE_SYS_FILE_H -/* Define if you have the <sys/filio.h> header file. */ +/* Define to 1 if you have the <sys/filio.h> header file. */ #undef HAVE_SYS_FILIO_H -/* Define if you have the <sys/ioccom.h> header file. */ +/* Define to 1 if you have the <sys/ioccom.h> header file. */ #undef HAVE_SYS_IOCCOM_H -/* Define if you have the <sys/ioctl.h> header file. */ +/* Define to 1 if you have the <sys/ioctl.h> header file. */ #undef HAVE_SYS_IOCTL_H -/* Define if you have the <sys/param.h> header file. */ +/* Define to 1 if you have the <sys/mman.h> header file. */ +#undef HAVE_SYS_MMAN_H + +/* Define to 1 if you have the <sys/param.h> header file. */ #undef HAVE_SYS_PARAM_H -/* Define if you have the <sys/proc.h> header file. */ +/* Define to 1 if you have the <sys/proc.h> header file. */ #undef HAVE_SYS_PROC_H -/* Define if you have the <sys/ptyio.h> header file. */ +/* Define to 1 if you have the <sys/ptyio.h> header file. */ #undef HAVE_SYS_PTYIO_H -/* Define if you have the <sys/ptyvar.h> header file. */ +/* Define to 1 if you have the <sys/ptyvar.h> header file. */ #undef HAVE_SYS_PTYVAR_H -/* Define if you have the <sys/pty.h> header file. */ +/* Define to 1 if you have the <sys/pty.h> header file. */ #undef HAVE_SYS_PTY_H -/* Define if you have the <sys/resource.h> header file. */ +/* Define to 1 if you have the <sys/resource.h> header file. */ #undef HAVE_SYS_RESOURCE_H -/* Define if you have the <sys/select.h> header file. */ +/* Define to 1 if you have the <sys/select.h> header file. */ #undef HAVE_SYS_SELECT_H -/* Define if you have the <sys/socket.h> header file. */ +/* Define to 1 if you have the <sys/socket.h> header file. */ #undef HAVE_SYS_SOCKET_H -/* Define if you have the <sys/sockio.h> header file. */ +/* Define to 1 if you have the <sys/sockio.h> header file. */ #undef HAVE_SYS_SOCKIO_H -/* Define if you have the <sys/stat.h> header file. */ +/* Define to 1 if you have the <sys/stat.h> header file. */ #undef HAVE_SYS_STAT_H -/* Define if you have the <sys/stream.h> header file. */ +/* Define to 1 if you have the <sys/stream.h> header file. */ #undef HAVE_SYS_STREAM_H -/* Define if you have the <sys/stropts.h> header file. */ +/* Define to 1 if you have the <sys/stropts.h> header file. */ #undef HAVE_SYS_STROPTS_H -/* Define if you have the <sys/strtty.h> header file. */ +/* Define to 1 if you have the <sys/strtty.h> header file. */ #undef HAVE_SYS_STRTTY_H -/* Define if you have the <sys/str_tty.h> header file. */ +/* Define to 1 if you have the <sys/str_tty.h> header file. */ #undef HAVE_SYS_STR_TTY_H -/* Define if you have the <sys/syscall.h> header file. */ +/* Define to 1 if you have the <sys/syscall.h> header file. */ #undef HAVE_SYS_SYSCALL_H -/* Define if you have the <sys/sysctl.h> header file. */ +/* Define to 1 if you have the <sys/sysctl.h> header file. */ #undef HAVE_SYS_SYSCTL_H -/* Define if you have the <sys/termio.h> header file. */ +/* Define to 1 if you have the <sys/termio.h> header file. */ #undef HAVE_SYS_TERMIO_H -/* Define if you have the <sys/timeb.h> header file. */ +/* Define to 1 if you have the <sys/timeb.h> header file. */ #undef HAVE_SYS_TIMEB_H -/* Define if you have the <sys/times.h> header file. */ +/* Define to 1 if you have the <sys/times.h> header file. */ #undef HAVE_SYS_TIMES_H -/* Define if you have the <sys/time.h> header file. */ +/* Define to 1 if you have the <sys/time.h> header file. */ #undef HAVE_SYS_TIME_H -/* Define if you have the <sys/tty.h> header file. */ +/* Define to 1 if you have the <sys/tty.h> header file. */ #undef HAVE_SYS_TTY_H -/* Define if you have the <sys/types.h> header file. */ +/* Define to 1 if you have the <sys/types.h> header file. */ #undef HAVE_SYS_TYPES_H -/* Define if you have the <sys/uio.h> header file. */ +/* Define to 1 if you have the <sys/uio.h> header file. */ #undef HAVE_SYS_UIO_H -/* Define if you have the <sys/un.h> header file. */ +/* Define to 1 if you have the <sys/un.h> header file. */ #undef HAVE_SYS_UN_H -/* Define if you have the <sys/utsname.h> header file. */ +/* Define to 1 if you have the <sys/utsname.h> header file. */ #undef HAVE_SYS_UTSNAME_H -/* Define if you have the <sys/wait.h> header file. */ +/* Define to 1 if you have the <sys/wait.h> header file. */ #undef HAVE_SYS_WAIT_H -/* Define if you have the <termios.h> header file. */ +/* Define to 1 if you have the <termcap.h> header file. */ +#undef HAVE_TERMCAP_H + +/* Define to 1 if you have the <termios.h> header file. */ #undef HAVE_TERMIOS_H -/* Define if you have the <termio.h> header file. */ +/* Define to 1 if you have the <termio.h> header file. */ #undef HAVE_TERMIO_H -/* Define if you have the <term.h> header file. */ +/* Define to 1 if you have the <term.h> header file. */ #undef HAVE_TERM_H -/* Define if you have the `tgetent' function. */ +/* Define to 1 if you have the `tgetent' function. */ #undef HAVE_TGETENT -/* Define if you have the `timegm' function. */ +/* Define to 1 if you have the `timegm' function. */ #undef HAVE_TIMEGM /* Define if you have the `timezone' variable. */ @@ -903,94 +964,118 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if your system declares timezone */ #undef HAVE_TIMEZONE_DECLARATION -/* Define if you have the <time.h> header file. */ +/* Define to 1 if you have the <time.h> header file. */ #undef HAVE_TIME_H -/* Define if you have the <tmpdir.h> header file. */ +/* Define to 1 if you have the <tmpdir.h> header file. */ #undef HAVE_TMPDIR_H -/* Define if you have the `ttyname' function. */ +/* Define to 1 if you have the `ttyname' function. */ #undef HAVE_TTYNAME -/* Define if you have the `ttyslot' function. */ +/* Define to 1 if you have the `ttyslot' function. */ #undef HAVE_TTYSLOT -/* Define if you have the <udb.h> header file. */ +/* Define to 1 if you have the <udb.h> header file. */ #undef HAVE_UDB_H -/* Define if you have the `umask' function. */ +/* Define to 1 if the system has the type `uint16_t'. */ +#undef HAVE_UINT16_T + +/* Define to 1 if the system has the type `uint32_t'. */ +#undef HAVE_UINT32_T + +/* Define to 1 if the system has the type `uint64_t'. */ +#undef HAVE_UINT64_T + +/* Define to 1 if the system has the type `uint8_t'. */ +#undef HAVE_UINT8_T + +/* Define to 1 if you have the `umask' function. */ #undef HAVE_UMASK -/* Define if you have the `uname' function. */ +/* Define to 1 if you have the `uname' function. */ #undef HAVE_UNAME -/* Define if you have the <unistd.h> header file. */ +/* Define to 1 if you have the <unistd.h> header file. */ #undef HAVE_UNISTD_H -/* Define if you have the `unlockpt' function. */ +/* Define to 1 if you have the `unlockpt' function. */ #undef HAVE_UNLOCKPT -/* Define if you have the `unsetenv' function. */ +/* Define if you have the function `unsetenv'. */ #undef HAVE_UNSETENV -/* Define if you have the `unvis' function. */ +/* Define to 1 if you have the `unvis' function. */ #undef HAVE_UNVIS -/* Define if you have the <userconf.h> header file. */ +/* Define to 1 if you have the <userconf.h> header file. */ #undef HAVE_USERCONF_H -/* Define if you have the <usersec.h> header file. */ +/* Define to 1 if you have the <usersec.h> header file. */ #undef HAVE_USERSEC_H -/* Define if you have the <util.h> header file. */ +/* Define to 1 if you have the <util.h> header file. */ #undef HAVE_UTIL_H -/* Define if you have the <utmpx.h> header file. */ +/* Define to 1 if you have the <utmpx.h> header file. */ #undef HAVE_UTMPX_H -/* Define if you have the <utmp.h> header file. */ +/* Define to 1 if you have the <utmp.h> header file. */ #undef HAVE_UTMP_H -/* Define if you have the `vasnprintf' function. */ +/* Define to 1 if the system has the type `u_int16_t'. */ +#undef HAVE_U_INT16_T + +/* Define to 1 if the system has the type `u_int32_t'. */ +#undef HAVE_U_INT32_T + +/* Define to 1 if the system has the type `u_int64_t'. */ +#undef HAVE_U_INT64_T + +/* Define to 1 if the system has the type `u_int8_t'. */ +#undef HAVE_U_INT8_T + +/* Define to 1 if you have the `vasnprintf' function. */ #undef HAVE_VASNPRINTF -/* Define if you have the `vasprintf' function. */ +/* Define to 1 if you have the `vasprintf' function. */ #undef HAVE_VASPRINTF -/* Define if you have the `verr' function. */ +/* Define if you have the function `verr'. */ #undef HAVE_VERR -/* Define if you have the `verrx' function. */ +/* Define if you have the function `verrx'. */ #undef HAVE_VERRX -/* Define if you have the `vhangup' function. */ +/* Define to 1 if you have the `vhangup' function. */ #undef HAVE_VHANGUP -/* Define if you have the `vis' function. */ +/* Define to 1 if you have the `vis' function. */ #undef HAVE_VIS -/* Define if you have the <vis.h> header file. */ +/* Define to 1 if you have the <vis.h> header file. */ #undef HAVE_VIS_H /* define if you have a working vsnprintf */ #undef HAVE_VSNPRINTF -/* Define if you have the `vsyslog' function. */ +/* Define if you have the function `vsyslog'. */ #undef HAVE_VSYSLOG -/* Define if you have the `vwarn' function. */ +/* Define if you have the function `vwarn'. */ #undef HAVE_VWARN -/* Define if you have the `vwarnx' function. */ +/* Define if you have the function `vwarnx'. */ #undef HAVE_VWARNX -/* Define if you have the `warn' function. */ +/* Define if you have the function `warn'. */ #undef HAVE_WARN -/* Define if you have the `warnx' function. */ +/* Define if you have the function `warnx'. */ #undef HAVE_WARNX -/* Define if you have the `writev' function. */ +/* Define if you have the function `writev'. */ #undef HAVE_WRITEV /* define if struct winsize has ws_xpixel */ @@ -999,22 +1084,28 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if struct winsize has ws_ypixel */ #undef HAVE_WS_YPIXEL -/* Define if you have the `XauFileName' function. */ +/* Define to 1 if you have the `XauFileName' function. */ #undef HAVE_XAUFILENAME -/* Define if you have the `XauReadAuth' function. */ +/* Define to 1 if you have the `XauReadAuth' function. */ #undef HAVE_XAUREADAUTH -/* Define if you have the `XauWriteAuth' function. */ +/* Define to 1 if you have the `XauWriteAuth' function. */ #undef HAVE_XAUWRITEAUTH -/* Define if you have the `yp_get_default_domain' function. */ +/* Define to 1 if you have the `yp_get_default_domain' function. */ #undef HAVE_YP_GET_DEFAULT_DOMAIN -/* Define if you have the `_getpty' function. */ +/* Define to 1 if you have the `_getpty' function. */ #undef HAVE__GETPTY -/* Define if you have the `_scrsize' function. */ +/* Define if you have the `_res' variable. */ +#undef HAVE__RES + +/* define if your system declares _res */ +#undef HAVE__RES_DECLARATION + +/* Define to 1 if you have the `_scrsize' function. */ #undef HAVE__SCRSIZE /* define if your compiler has __attribute__ */ @@ -1029,15 +1120,21 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define if you have the hesiod package. */ #undef HESIOD +/* Define if you are running IRIX 4. */ +#undef IRIX4 + /* Define if you have the krb4 package. */ #undef KRB4 /* Enable Kerberos 5 support in applications. */ #undef KRB5 -/* Define if krb_mk_req takes cons char * */ +/* Define if krb_mk_req takes const char * */ #undef KRB_MK_REQ_CONST +/* This is the krb4 sendauth version. */ +#undef KRB_SENDAUTH_VERS + /* Define to zero if your krb.h doesn't */ #undef KRB_VERIFY_NOT_SECURE @@ -1047,6 +1144,15 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define to two if your krb.h doesn't */ #undef KRB_VERIFY_SECURE_FAIL +/* path to lib */ +#undef LIBDIR + +/* path to libexec */ +#undef LIBEXECDIR + +/* path to localstate */ +#undef LOCALSTATEDIR + /* define if the system is missing a prototype for asnprintf() */ #undef NEED_ASNPRINTF_PROTO @@ -1080,24 +1186,51 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if the system is missing a prototype for snprintf() */ #undef NEED_SNPRINTF_PROTO +/* define if the system is missing a prototype for strndup() */ +#undef NEED_STRNDUP_PROTO + /* define if the system is missing a prototype for strsep() */ #undef NEED_STRSEP_PROTO +/* define if the system is missing a prototype for strsvis() */ +#undef NEED_STRSVIS_PROTO + /* define if the system is missing a prototype for strtok_r() */ #undef NEED_STRTOK_R_PROTO +/* define if the system is missing a prototype for strunvis() */ +#undef NEED_STRUNVIS_PROTO + +/* define if the system is missing a prototype for strvisx() */ +#undef NEED_STRVISX_PROTO + +/* define if the system is missing a prototype for strvis() */ +#undef NEED_STRVIS_PROTO + +/* define if the system is missing a prototype for svis() */ +#undef NEED_SVIS_PROTO + /* define if the system is missing a prototype for unsetenv() */ #undef NEED_UNSETENV_PROTO +/* define if the system is missing a prototype for unvis() */ +#undef NEED_UNVIS_PROTO + /* define if the system is missing a prototype for vasnprintf() */ #undef NEED_VASNPRINTF_PROTO /* define if the system is missing a prototype for vasprintf() */ #undef NEED_VASPRINTF_PROTO +/* define if the system is missing a prototype for vis() */ +#undef NEED_VIS_PROTO + /* define if the system is missing a prototype for vsnprintf() */ #undef NEED_VSNPRINTF_PROTO +/* Define if you don't want to use mmap. */ +#undef NO_MMAP + /* Define this to enable old environment option in telnet. */ #undef OLD_ENVIRON @@ -1114,6 +1247,21 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Name of package */ #undef PACKAGE +/* Define to the address where bug reports for this package should be sent. */ +#undef PACKAGE_BUGREPORT + +/* Define to the full name of this package. */ +#undef PACKAGE_NAME + +/* Define to the full name and version of this package. */ +#undef PACKAGE_STRING + +/* Define to the one symbol short name of this package. */ +#undef PACKAGE_TARNAME + +/* Define to the version of this package. */ +#undef PACKAGE_VERSION + /* Define if getlogin has POSIX flavour (and not BSD). */ #undef POSIX_GETLOGIN @@ -1126,19 +1274,25 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define as the return type of signal handlers (`int' or `void'). */ #undef RETSIGTYPE -/* Define if you have the ANSI C header files. */ +/* path to sbin */ +#undef SBINDIR + +/* Define to 1 if you have the ANSI C header files. */ #undef STDC_HEADERS /* Define if you have streams ptys. */ #undef STREAMSPTY +/* path to sysconf */ +#undef SYSCONFDIR + /* Define to what version of SunOS you are running. */ #undef SunOS -/* Define if you can safely include both <sys/time.h> and <time.h>. */ +/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */ #undef TIME_WITH_SYS_TIME -/* Define if your <sys/time.h> declares `struct tm'. */ +/* Define to 1 if your <sys/time.h> declares `struct tm'. */ #undef TM_IN_SYS_TIME /* Version number of package */ @@ -1150,13 +1304,22 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* define if target is big endian */ #undef WORDS_BIGENDIAN -/* Define if the X Window System is missing or not being used. */ +/* Define to 1 if the X Window System is missing or not being used. */ #undef X_DISPLAY_MISSING -/* Define if `lex' declares `yytext' as a `char *' by default, not a `char[]'. - */ +/* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a + `char[]'. */ #undef YYTEXT_POINTER +/* Number of bits in a file offset, on hosts where this is settable. */ +#undef _FILE_OFFSET_BITS + +/* Define to enable extensions on glibc-based systems such as Linux. */ +#undef _GNU_SOURCE + +/* Define for large files, on AIX-style hosts. */ +#undef _LARGE_FILES + /* Define to empty if `const' does not conform to ANSI C. */ #undef const @@ -1182,95 +1345,16 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } /* Define to `unsigned' if <sys/types.h> does not define. */ #undef size_t -/* Define this to what the type ssize_t should be. */ -#undef ssize_t - /* Define to `int' if <sys/types.h> doesn't define. */ #undef uid_t -#ifdef VOID_RETSIGTYPE -#define SIGRETURN(x) return -#else -#define SIGRETURN(x) return (RETSIGTYPE)(x) -#endif - -#ifdef BROKEN_REALLOC -#define realloc(X, Y) isoc_realloc((X), (Y)) -#define isoc_realloc(X, Y) ((X) ? realloc((X), (Y)) : malloc(Y)) -#endif - -#if defined(HAVE_FOUR_VALUED_KRB_PUT_INT) || !defined(KRB4) -#define KRB_PUT_INT(F, T, L, S) krb_put_int((F), (T), (L), (S)) -#else -#define KRB_PUT_INT(F, T, L, S) krb_put_int((F), (T), (S)) -#endif - - -#ifdef VOID_RETSIGTYPE -#define SIGRETURN(x) return -#else -#define SIGRETURN(x) return (RETSIGTYPE)(x) -#endif - -#ifdef BROKEN_REALLOC -#define realloc(X, Y) isoc_realloc((X), (Y)) -#define isoc_realloc(X, Y) ((X) ? realloc((X), (Y)) : malloc(Y)) -#endif - -#undef BINDIR -#undef LIBDIR -#undef LIBEXECDIR -#undef SBINDIR - -#undef BINDIR -#undef LIBDIR -#undef LIBEXECDIR -#undef SBINDIR - -#undef HAVE_INT8_T -#undef HAVE_INT16_T -#undef HAVE_INT32_T -#undef HAVE_INT64_T -#undef HAVE_U_INT8_T -#undef HAVE_U_INT16_T -#undef HAVE_U_INT32_T -#undef HAVE_U_INT64_T -#undef HAVE_UINT8_T -#undef HAVE_UINT16_T -#undef HAVE_UINT32_T -#undef HAVE_UINT64_T - #if defined(HAVE_FOUR_VALUED_KRB_PUT_INT) || !defined(KRB4) #define KRB_PUT_INT(F, T, L, S) krb_put_int((F), (T), (L), (S)) #else #define KRB_PUT_INT(F, T, L, S) krb_put_int((F), (T), (S)) #endif -#ifdef BROKEN_REALLOC -#define realloc(X, Y) isoc_realloc((X), (Y)) -#define isoc_realloc(X, Y) ((X) ? realloc((X), (Y)) : malloc(Y)) -#endif - -#ifdef VOID_RETSIGTYPE -#define SIGRETURN(x) return -#else -#define SIGRETURN(x) return (RETSIGTYPE)(x) -#endif -#define RCSID(msg) \ -static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } - -#undef PROTOTYPES - -/* Maximum values on all known systems */ -#define MaxHostNameLen (64+4) -#define MaxPathLen (1024+4) - -#if defined(HAVE_SGTTY_H) && defined(__NeXT__) -#define SGTTY -#endif - -/* telnet stuff ----------------------------------------------- */ #if defined(ENCRYPTION) && !defined(AUTHENTICATION) #define AUTHENTICATION 1 @@ -1290,20 +1374,30 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } #define LOGIN_PATH BINDIR "/login" #endif -/* random defines */ -/* - * Defining this enables lots of useful (and used) extensions on - * glibc-based systems such as Linux - */ +#ifdef ROKEN_RENAME +#include "roken_rename.h" +#endif -#define _GNU_SOURCE +#ifndef HAVE_KRB_KDCTIMEOFDAY +#define krb_kdctimeofday(X) gettimeofday((X), NULL) +#endif + +#ifndef HAVE_KRB_GET_KDC_TIME_DIFF +#define krb_get_kdc_time_diff() (0) +#endif + +#ifdef VOID_RETSIGTYPE +#define SIGRETURN(x) return +#else +#define SIGRETURN(x) return (RETSIGTYPE)(x) +#endif + +#ifdef BROKEN_REALLOC +#define realloc(X, Y) isoc_realloc((X), (Y)) +#define isoc_realloc(X, Y) ((X) ? realloc((X), (Y)) : malloc(Y)) +#endif -/* - * this assumes that KRB_C_BIGENDIAN is used. - * if we can find out endianess at compile-time, do so, - * otherwise WORDS_BIGENDIAN should already have been defined - */ #if ENDIANESS_IN_SYS_PARAM_H # include <sys/types.h> @@ -1313,6 +1407,19 @@ static /**/const char *const rcsid[] = { (const char *)rcsid, "\100(#)" msg } # endif #endif -#ifdef ROKEN_RENAME -#include "roken_rename.h" + +#if _AIX +#define _ALL_SOURCE +/* XXX this is gross, but kills about a gazillion warnings */ +struct ether_addr; +struct sockaddr; +struct sockaddr_dl; +struct sockaddr_in; #endif + + +/* IRIX 4 braindamage */ +#if IRIX == 4 && !defined(__STDC__) +#define __STDC__ 0 +#endif + diff --git a/kerberosV/src/include/make_crypto.c b/kerberosV/src/include/make_crypto.c new file mode 100644 index 00000000000..cd262e5d0ad --- /dev/null +++ b/kerberosV/src/include/make_crypto.c @@ -0,0 +1,96 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +RCSID("$KTH: make_crypto.c,v 1.4 2003/01/12 18:54:46 nectar Exp $"); +#endif +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <ctype.h> + +int +main(int argc, char **argv) +{ + char *p; + FILE *f; + if(argc != 2) { + fprintf(stderr, "Usage: make_crypto file\n"); + exit(1); + } + f = fopen(argv[1], "w"); + if(f == NULL) { + perror(argv[1]); + exit(1); + } + for(p = argv[1]; *p; p++) + if(!isalnum((int)*p)) + *p = '_'; + fprintf(f, "#ifndef __%s__\n", argv[1]); + fprintf(f, "#define __%s__\n", argv[1]); +#ifdef HAVE_OPENSSL + fputs("#define OPENSSL_DES_LIBDES_COMPATIBILITY\n", f); + fputs("#include <openssl/des.h>\n", f); + fputs("#include <openssl/rc4.h>\n", f); + fputs("#include <openssl/md4.h>\n", f); + fputs("#include <openssl/md5.h>\n", f); + fputs("#include <openssl/sha.h>\n", f); +#else + fputs("#include <des.h>\n", f); + fputs("#include <md4.h>\n", f); + fputs("#include <md5.h>\n", f); + fputs("#include <sha.h>\n", f); + fputs("#include <rc4.h>\n", f); +#ifdef HAVE_OLD_HASH_NAMES + fputs("\n", f); + fputs(" typedef struct md4 MD4_CTX;\n", f); + fputs("#define MD4_Init md4_init\n", f); + fputs("#define MD4_Update md4_update\n", f); + fputs("#define MD4_Final(D, C) md4_finito((C), (D))\n", f); + fputs("\n", f); + fputs(" typedef struct md5 MD5_CTX;\n", f); + fputs("#define MD5_Init md5_init\n", f); + fputs("#define MD5_Update md5_update\n", f); + fputs("#define MD5_Final(D, C) md5_finito((C), (D))\n", f); + fputs("\n", f); + fputs(" typedef struct sha SHA_CTX;\n", f); + fputs("#define SHA1_Init sha_init\n", f); + fputs("#define SHA1_Update sha_update\n", f); + fputs("#define SHA1_Final(D, C) sha_finito((C), (D))\n", f); +#endif +#endif + fprintf(f, "#endif /* __%s__ */\n", argv[1]); + fclose(f); + exit(0); +} diff --git a/kerberosV/src/kadmin/ChangeLog b/kerberosV/src/kadmin/ChangeLog index 60b539b3a69..093835e98be 100644 --- a/kerberosV/src/kadmin/ChangeLog +++ b/kerberosV/src/kadmin/ChangeLog @@ -1,3 +1,89 @@ +2003-04-14 Love Hörquist Åstrand <lha@it.su.se> + + * util.c: cast argument to tolower to unsigned char, from + Christian Biere <christianbiere@gmx.de> via NetBSD + +2003-04-06 Love Hörquist Åstrand <lha@it.su.se> + + * kadmind.8: s/kerberos/Kerberos/ + +2003-03-31 Love Hörquist Åstrand <lha@it.su.se> + + * kadmin.8: initialises -> initializes, from Perry E. Metzger" + <perry@piermont.com> + + * kadmin.c: principal, not pricipal. From Thomas Klausner + <wiz@netbsd.org> + +2003-02-04 Love Hörquist Åstrand <lha@it.su.se> + + * kadmind.8: spelling, from jmc <jmc@prioris.mini.pw.edu.pl> + + * kadmin.8: spelling, from jmc <jmc@prioris.mini.pw.edu.pl> + +2003-01-29 Love Hörquist Åstrand <lha@it.su.se> + + * server.c (kadmind_dispatch): kadm_chpass: require the password + to pass the password quality check in case the user changes the + user's own password kadm_chpass_with_key: disallow the user to + change it own password to a key, since that password might violate + the password quality check. + +2002-10-23 Assar Westerlund <assar@kth.se> + + * version4.c (decode_packet): check the length of the version + string and that rlen has a reasonable value + +2002-10-21 Johan Danielsson <joda@pdc.kth.se> + + * version4.c: check size of rlen + +2002-09-10 Johan Danielsson <joda@pdc.kth.se> + + * server.c: constify match_appl_version() + + * version4.c: change some lingering krb_err_base + +2002-09-09 Jacques Vidrine <nectar@kth.se> + + * server.c (kadmind_dispatch): while decoding arguments for + kadm_chpass_with_key, sanity check the number of keys given. + Potential problem pointed out by + Sebastian Krahmer <krahmer@suse.de>. + +2002-09-04 Johan Danielsson <joda@pdc.kth.se> + + * load.c (parse_generation): return if there is no generation + (spotted by Daniel Kouril) + +2002-06-07 Jacques Vidrine <n@nectar.com> + + * ank.c: do not attempt to free uninitialized pointer when + kadm5_randkey_principal fails. + +2002-06-07 Johan Danielsson <joda@pdc.kth.se> + + * util.c: remove unused variable; reported by Hans Insulander + +2002-03-05 Johan Danielsson <joda@pdc.kth.se> + + * kadmind.8: clarify some acl wording, and add an example file + +2002-02-11 Johan Danielsson <joda@pdc.kth.se> + + * ext.c: no need to use the "modify" keytab anymore + +2001-09-20 Assar Westerlund <assar@sics.se> + + * add-random-users.c: allocate several buffers for the list of + words, instead of one strdup per word (running under efence does + not work very well otherwise) + +2001-09-13 Assar Westerlund <assar@sics.se> + + * add-random-users.c: allow specifying the number of users to + create + 2001-08-24 Assar Westerlund <assar@sics.se> * Makefile.am: rename variable name to avoid error from current diff --git a/kerberosV/src/kadmin/ank.c b/kerberosV/src/kadmin/ank.c index 607f6906640..246fc1efd76 100644 --- a/kerberosV/src/kadmin/ank.c +++ b/kerberosV/src/kadmin/ank.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kadmin_locl.h" -RCSID("$KTH: ank.c,v 1.22 2001/08/10 08:08:22 joda Exp $"); +RCSID("$KTH: ank.c,v 1.25 2002/12/03 14:11:24 joda Exp $"); /* * fetch the default principal corresponding to `princ' @@ -112,7 +112,8 @@ add_one_principal (const char *name, if(use_defaults) set_defaults(&princ, &mask, default_ent, default_mask); else - edit_entry(&princ, &mask, default_ent, default_mask); + if(edit_entry(&princ, &mask, default_ent, default_mask)) + goto out; if(rand_key || key_data) { princ.attributes |= KRB5_KDB_DISALLOW_ALL_TIX; mask |= KADM5_ATTRIBUTES; @@ -136,8 +137,10 @@ add_one_principal (const char *name, } ret = kadm5_create_principal(kadm_handle, &princ, mask, password); - if(ret) + if(ret) { krb5_warn(context, ret, "kadm5_create_principal"); + goto out; + } if(rand_key) { krb5_keyblock *new_keys; int n_keys, i; @@ -149,7 +152,8 @@ add_one_principal (const char *name, } for(i = 0; i < n_keys; i++) krb5_free_keyblock_contents(context, &new_keys[i]); - free(new_keys); + if (n_keys > 0) + free(new_keys); kadm5_get_principal(kadm_handle, princ_ent, &princ, KADM5_PRINCIPAL | KADM5_KVNO | KADM5_ATTRIBUTES); princ.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); diff --git a/kerberosV/src/kadmin/ext.c b/kerberosV/src/kadmin/ext.c index c89774cf07e..9f955776435 100644 --- a/kerberosV/src/kadmin/ext.c +++ b/kerberosV/src/kadmin/ext.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kadmin_locl.h" -RCSID("$KTH: ext.c,v 1.7 2001/06/12 12:15:15 assar Exp $"); +RCSID("$KTH: ext.c,v 1.8 2002/02/11 14:29:52 joda Exp $"); struct ext_keytab_data { krb5_keytab keytab; @@ -87,7 +87,6 @@ ext_keytab(int argc, char **argv) int i; int optind = 0; char *keytab = NULL; - char keytab_buf[256]; struct ext_keytab_data data; args[0].value = &keytab; @@ -95,17 +94,11 @@ ext_keytab(int argc, char **argv) usage(); return 0; } - if (keytab == NULL) { - ret = krb5_kt_default_modify_name (context, keytab_buf, - sizeof(keytab_buf)); - if (ret) { - krb5_warn(context, ret, "krb5_kt_default_modify_name"); - return 0; - } - keytab = keytab_buf; - } + if (keytab == NULL) + ret = krb5_kt_default(context, &data.keytab); + else + ret = krb5_kt_resolve(context, keytab, &data.keytab); - ret = krb5_kt_resolve(context, keytab, &data.keytab); if(ret){ krb5_warn(context, ret, "krb5_kt_resolve"); return 0; diff --git a/kerberosV/src/kadmin/init.c b/kerberosV/src/kadmin/init.c index 58df29b98fa..f8242288941 100644 --- a/kerberosV/src/kadmin/init.c +++ b/kerberosV/src/kadmin/init.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -34,7 +34,7 @@ #include "kadmin_locl.h" #include <kadm5/private.h> -RCSID("$KTH: init.c,v 1.27 2000/09/10 19:20:16 joda Exp $"); +RCSID("$KTH: init.c,v 1.29 2002/12/03 14:08:17 joda Exp $"); static kadm5_ret_t create_random_entry(krb5_principal princ, @@ -90,6 +90,7 @@ static struct getargs args[] = { "realm max ticket lifetime" }, { "realm-max-renewable-life", 0, arg_string, NULL, "realm max renewable lifetime" }, + { "help", 'h', arg_flag, NULL }, }; static int num_args = sizeof(args) / sizeof(args[0]); @@ -107,14 +108,16 @@ init(int argc, char **argv) int i; char *realm_max_life = NULL; char *realm_max_rlife = NULL; + int help_flag = 0; HDB *db; int optind = 0; krb5_deltat max_life, max_rlife; args[0].value = &realm_max_life; args[1].value = &realm_max_rlife; + args[2].value = &help_flag; - if(getarg(args, num_args, argc, argv, &optind)) { + if(getarg(args, num_args, argc, argv, &optind) || help_flag) { usage(); return 0; } @@ -150,16 +153,24 @@ init(int argc, char **argv) const char *realm = argv[i]; /* Create `krbtgt/REALM' */ - krb5_make_principal(context, &princ, realm, - KRB5_TGS_NAME, realm, NULL); + ret = krb5_make_principal(context, &princ, realm, + KRB5_TGS_NAME, realm, NULL); + if(ret) + return 0; if (realm_max_life == NULL) { max_life = 0; - edit_deltat ("Realm max ticket life", &max_life, NULL, 0); + if(edit_deltat ("Realm max ticket life", &max_life, NULL, 0)) { + krb5_free_principal(context, princ); + return 0; + } } if (realm_max_rlife == NULL) { max_rlife = 0; - edit_deltat("Realm max renewable ticket life", &max_rlife, - NULL, 0); + if(edit_deltat("Realm max renewable ticket life", &max_rlife, + NULL, 0)) { + krb5_free_principal(context, princ); + return 0; + } } create_random_entry(princ, max_life, max_rlife, 0); krb5_free_principal(context, princ); diff --git a/kerberosV/src/kadmin/mod.c b/kerberosV/src/kadmin/mod.c index 5f993349e71..e699fba4a7f 100644 --- a/kerberosV/src/kadmin/mod.c +++ b/kerberosV/src/kadmin/mod.c @@ -33,7 +33,7 @@ #include "kadmin_locl.h" -RCSID("$KTH: mod.c,v 1.10 2000/07/11 14:34:56 joda Exp $"); +RCSID("$KTH: mod.c,v 1.11 2002/12/03 14:12:30 joda Exp $"); static int parse_args (krb5_context context, kadm5_principal_ent_t ent, int argc, char **argv, int *optind, char *name, @@ -136,7 +136,8 @@ mod_entry(int argc, char **argv) printf ("no such principal: %s\n", argv[0]); return 0; } - edit_entry(&princ, &mask, NULL, 0); + if(edit_entry(&princ, &mask, NULL, 0)) + goto out; } else { princ.principal = princ_ent; } @@ -144,6 +145,7 @@ mod_entry(int argc, char **argv) ret = kadm5_modify_principal(kadm_handle, &princ, mask); if(ret) krb5_warn(context, ret, "kadm5_modify_principal"); + out: kadm5_free_principal_ent(kadm_handle, &princ); return 0; } diff --git a/kerberosV/src/kadmin/server.c b/kerberosV/src/kadmin/server.c index 27211c29850..117674cfb18 100644 --- a/kerberosV/src/kadmin/server.c +++ b/kerberosV/src/kadmin/server.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -34,7 +34,7 @@ #include "kadmin_locl.h" #include <krb5-private.h> -RCSID("$KTH: server.c,v 1.33 2001/07/23 13:46:47 joda Exp $"); +RCSID("$KTH: server.c,v 1.38 2003/01/29 12:33:05 lha Exp $"); static kadm5_ret_t kadmind_dispatch(void *kadm_handle, krb5_boolean initial, @@ -217,19 +217,36 @@ kadmind_dispatch(void *kadm_handle, krb5_boolean initial, /* * The change is allowed if at least one of: - * a) it's for the principal him/herself and this was an initial ticket + + * a) it's for the principal him/herself and this was an + * initial ticket, but then, check with the password quality + * function. * b) the user is on the CPW ACL. */ if (initial && krb5_principal_compare (context->context, context->caller, princ)) - ret = 0; - else + { + krb5_data pwd_data; + const char *pwd_reason; + + pwd_data.data = password; + pwd_data.length = strlen(password); + + pwd_reason = kadm5_check_password_quality (context->context, + princ, &pwd_data); + if (pwd_reason != NULL) + ret = KADM5_PASS_Q_DICT; + else + ret = 0; + } else ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ); if(ret) { krb5_free_principal(context->context, princ); + memset(password, 0, strlen(password)); + free(password); goto fail; } ret = kadm5_chpass_principal(kadm_handle, princ, password); @@ -255,6 +272,13 @@ kadmind_dispatch(void *kadm_handle, krb5_boolean initial, krb5_free_principal(context->context, princ); goto fail; } + /* n_key_data will be squeezed into an int16_t below. */ + if (n_key_data < 0 || n_key_data >= 1 << 16 || + n_key_data > UINT_MAX/sizeof(*key_data)) { + ret = ERANGE; + krb5_free_principal(context->context, princ); + goto fail; + } key_data = malloc (n_key_data * sizeof(*key_data)); if (key_data == NULL) { @@ -279,18 +303,11 @@ kadmind_dispatch(void *kadm_handle, krb5_boolean initial, krb5_warnx(context->context, "%s: %s %s", client, op, name); /* - * The change is allowed if at least one of: - * a) it's for the principal him/herself and this was an initial ticket - * b) the user is on the CPW ACL. + * The change is only allowed if the user is on the CPW ACL, + * this it to force password quality check on the user. */ - if (initial - && krb5_principal_compare (context->context, context->caller, - princ)) - ret = 0; - else - ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ); - + ret = _kadm5_acl_check_permission(context, KADM5_PRIV_CPW, princ); if(ret) { int16_t dummy = n_key_data; @@ -404,7 +421,7 @@ kadmind_dispatch(void *kadm_handle, krb5_boolean initial, return 0; fail: krb5_warn(context->context, ret, "%s", op); - sp->seek(sp, 0, SEEK_SET); + krb5_storage_seek(sp, 0, SEEK_SET); krb5_store_int32(sp, ret); krb5_storage_to_data(sp, out); krb5_storage_free(sp); @@ -440,7 +457,7 @@ v5_loop (krb5_context context, } static krb5_boolean -match_appl_version(void *data, const char *appl_version) +match_appl_version(const void *data, const char *appl_version) { unsigned minor; if(sscanf(appl_version, "KADM0.%u", &minor) != 1) @@ -525,6 +542,8 @@ handle_v5(krb5_context context, v5_loop (context, ac, initial, kadm_handle, fd); } +extern int do_kerberos4; + krb5_error_code kadmind_loop(krb5_context context, krb5_auth_context ac, @@ -544,7 +563,10 @@ kadmind_loop(krb5_context context, if(len > 0xffff && (len & 0xffff) == ('K' << 8) + 'A') { len >>= 16; #ifdef KRB4 - handle_v4(context, keytab, len, fd); + if(do_kerberos4) + handle_v4(context, keytab, len, fd); + else + krb5_errx(context, 1, "version 4 kadmin is disabled"); #else krb5_errx(context, 1, "packet appears to be version 4"); #endif diff --git a/kerberosV/src/kdc/kstash.c b/kerberosV/src/kdc/kstash.c index f7cd6ee1fb7..1ee1098de31 100644 --- a/kerberosV/src/kdc/kstash.c +++ b/kerberosV/src/kdc/kstash.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,18 +33,18 @@ #include "headers.h" -RCSID("$KTH: kstash.c,v 1.14 2001/01/30 17:08:35 assar Exp $"); +RCSID("$KTH: kstash.c,v 1.15 2002/04/18 09:47:25 joda Exp $"); krb5_context context; -char *keyfile = HDB_DB_DIR "/m-key"; +const char *keyfile = HDB_DB_DIR "/m-key"; int convert_flag; int help_flag; int version_flag; int master_key_fd = -1; -char *enctype_str = "des3-cbc-sha1"; +const char *enctype_str = "des3-cbc-sha1"; struct getargs args[] = { { "enctype", 'e', arg_string, &enctype_str, "encryption type" }, diff --git a/kerberosV/src/kdc/log.c b/kerberosV/src/kdc/log.c index 4bcdc4839f6..36b1a7106bd 100644 --- a/kerberosV/src/kdc/log.c +++ b/kerberosV/src/kdc/log.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 1998, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,18 +32,16 @@ */ #include "kdc_locl.h" -RCSID("$KTH: log.c,v 1.13 2000/09/10 19:27:29 joda Exp $"); +RCSID("$KTH: log.c,v 1.14 2002/08/19 12:17:49 joda Exp $"); static krb5_log_facility *logf; void -kdc_openlog(krb5_config_section *cf) +kdc_openlog(void) { char **s = NULL, **p; krb5_initlog(context, "kdc", &logf); - if(cf) - s = krb5_config_get_strings(context, cf, "kdc", "logging", NULL); - + s = krb5_config_get_strings(context, NULL, "kdc", "logging", NULL); if(s == NULL) s = krb5_config_get_strings(context, NULL, "logging", "kdc", NULL); if(s){ diff --git a/kerberosV/src/kpasswd/kpasswd.1 b/kerberosV/src/kpasswd/kpasswd.1 index 93db7648479..b3881d1d582 100644 --- a/kerberosV/src/kpasswd/kpasswd.1 +++ b/kerberosV/src/kpasswd/kpasswd.1 @@ -1,6 +1,37 @@ -.\" $KTH: kpasswd.1,v 1.3 2001/05/02 08:59:22 assar Exp $ +.\" Copyright (c) 1997, 2000 - 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. .\" -.Dd Aug 27, 1997 +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: kpasswd.1,v 1.5 2003/02/16 21:10:22 lha Exp $ +.\" +.Dd August 27, 1997 .Dt KPASSWD 1 .Os HEIMDAL .Sh NAME diff --git a/kerberosV/src/kpasswd/kpasswd.c b/kerberosV/src/kpasswd/kpasswd.c index 4ef36c408d6..7aff2eb7d42 100644 --- a/kerberosV/src/kpasswd/kpasswd.c +++ b/kerberosV/src/kpasswd/kpasswd.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,7 +32,7 @@ */ #include "kpasswd_locl.h" -RCSID("$KTH: kpasswd.c,v 1.23 2000/12/31 07:48:34 assar Exp $"); +RCSID("$KTH: kpasswd.c,v 1.24 2001/09/27 01:29:40 assar Exp $"); static int version_flag; static int help_flag; @@ -131,7 +131,10 @@ main (int argc, char **argv) if (ret) krb5_err (context, 1, ret, "krb5_change_password"); - printf ("Reply from server: %.*s\n", (int)result_string.length, + printf ("%s%s%.*s\n", krb5_passwd_result_to_string(context, + result_code), + result_string.length > 0 ? " : " : "", + (int)result_string.length, (char *)result_string.data); krb5_data_free (&result_code_string); diff --git a/kerberosV/src/kuser/kgetcred.1 b/kerberosV/src/kuser/kgetcred.1 index ffe1a30ce65..80ca5f02768 100644 --- a/kerberosV/src/kuser/kgetcred.1 +++ b/kerberosV/src/kuser/kgetcred.1 @@ -1,4 +1,35 @@ -.\" $KTH: kgetcred.1,v 1.4 2001/06/08 21:40:40 joda Exp $ +.\" Copyright (c) 1999, 2001 - 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: kgetcred.1,v 1.6 2003/02/16 21:10:24 lha Exp $ .\" .Dd May 14, 1999 .Dt KGETCRED 1 @@ -25,7 +56,7 @@ ticket or of a special type. Supported options: .Bl -tag -width Ds .It Xo -.Fl e Ar enctype Ns , +.Fl e Ar enctype , .Fl -enctype= Ns Ar enctype .Xc encryption type to use diff --git a/kerberosV/src/lib/45/mk_req.c b/kerberosV/src/lib/45/mk_req.c index de357cccaf7..b656e770f1a 100644 --- a/kerberosV/src/lib/45/mk_req.c +++ b/kerberosV/src/lib/45/mk_req.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -35,7 +35,7 @@ #include "45_locl.h" -RCSID("$KTH: mk_req.c,v 1.6 2000/04/11 00:49:35 assar Exp $"); +RCSID("$KTH: mk_req.c,v 1.7 2002/05/24 15:21:00 joda Exp $"); static int lifetime = 255; @@ -108,8 +108,8 @@ krb_mk_req(KTEXT authent, krb5_store_int8(sp, req.length); - sp->store(sp, cr.ticket_st.dat, cr.ticket_st.length); - sp->store(sp, req.dat, req.length); + krb5_storage_write(sp, cr.ticket_st.dat, cr.ticket_st.length); + krb5_storage_write(sp, req.dat, req.length); krb5_storage_to_data(sp, &a); krb5_storage_free(sp); memcpy(authent->dat, a.data, a.length); diff --git a/kerberosV/src/lib/asn1/asn1-common.h b/kerberosV/src/lib/asn1/asn1-common.h index 4c20e933387..daa1332e0fa 100644 --- a/kerberosV/src/lib/asn1/asn1-common.h +++ b/kerberosV/src/lib/asn1/asn1-common.h @@ -1,4 +1,4 @@ -/* $KTH: asn1-common.h,v 1.1 2000/04/14 15:41:31 joda Exp $ */ +/* $KTH: asn1-common.h,v 1.2 2001/09/25 13:39:25 assar Exp $ */ #include <stddef.h> #include <time.h> @@ -13,4 +13,9 @@ typedef struct octet_string { typedef char *general_string; +typedef struct oid { + size_t length; + unsigned *components; +} oid; + #endif diff --git a/kerberosV/src/lib/asn1/check-common.c b/kerberosV/src/lib/asn1/check-common.c new file mode 100644 index 00000000000..676c22b9d0a --- /dev/null +++ b/kerberosV/src/lib/asn1/check-common.c @@ -0,0 +1,125 @@ +/* + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif +#include <stdio.h> +#include <string.h> +#include <err.h> +#include <roken.h> + +#include "check-common.h" + +RCSID("$KTH: check-common.c,v 1.1 2003/01/23 10:21:36 lha Exp $"); + +static void +print_bytes (unsigned const char *buf, size_t len) +{ + int i; + + for (i = 0; i < len; ++i) + printf ("%02x ", buf[i]); +} + +int +generic_test (const struct test_case *tests, + unsigned ntests, + size_t data_size, + int (*encode)(unsigned char *, size_t, void *, size_t *), + int (*length)(void *), + int (*decode)(unsigned char *, size_t, void *, size_t *), + int (*cmp)(void *a, void *b)) +{ + unsigned char buf[4711]; + int i; + int failures = 0; + void *val = malloc (data_size); + + if (data_size != 0 && val == NULL) + err (1, "malloc"); + + for (i = 0; i < ntests; ++i) { + int ret; + size_t sz, consumed_sz, length_sz; + unsigned char *beg; + + ret = (*encode) (buf + sizeof(buf) - 1, sizeof(buf), + tests[i].val, &sz); + beg = buf + sizeof(buf) - sz; + if (ret != 0) { + printf ("encoding of %s failed\n", tests[i].name); + ++failures; + } + if (sz != tests[i].byte_len) { + printf ("encoding of %s has wrong len (%lu != %lu)\n", + tests[i].name, + (unsigned long)sz, (unsigned long)tests[i].byte_len); + ++failures; + } + + length_sz = (*length) (tests[i].val); + if (sz != length_sz) { + printf ("length for %s is bad (%lu != %lu)\n", + tests[i].name, (unsigned long)length_sz, (unsigned long)sz); + ++failures; + } + + if (memcmp (beg, tests[i].bytes, tests[i].byte_len) != 0) { + printf ("encoding of %s has bad bytes:\n" + "correct: ", tests[i].name); + print_bytes (tests[i].bytes, tests[i].byte_len); + printf ("\nactual: "); + print_bytes (beg, sz); + printf ("\n"); + ++failures; + } + ret = (*decode) (beg, sz, val, &consumed_sz); + if (ret != 0) { + printf ("decoding of %s failed\n", tests[i].name); + ++failures; + } + if (sz != consumed_sz) { + printf ("different length decoding %s (%ld != %ld)\n", + tests[i].name, + (unsigned long)sz, (unsigned long)consumed_sz); + ++failures; + } + if ((*cmp)(val, tests[i].val) != 0) { + printf ("%s: comparison failed\n", tests[i].name); + ++failures; + } + } + free (val); + return failures; +} diff --git a/kerberosV/src/lib/asn1/check-common.h b/kerberosV/src/lib/asn1/check-common.h new file mode 100644 index 00000000000..52d59cb4f7a --- /dev/null +++ b/kerberosV/src/lib/asn1/check-common.h @@ -0,0 +1,53 @@ +/* + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +struct test_case { + void *val; + int byte_len; + const unsigned char *bytes; + char *name; +}; + +typedef int (*generic_encode)(unsigned char *, size_t, void *, size_t *); +typedef int (*generic_length)(void *); +typedef int (*generic_decode)(unsigned char *, size_t, void *, size_t *); + +int +generic_test (const struct test_case *tests, + unsigned ntests, + size_t data_size, + int (*encode)(unsigned char *, size_t, void *, size_t *), + int (*length)(void *), + int (*decode)(unsigned char *, size_t, void *, size_t *), + int (*cmp)(void *a, void *b)); + diff --git a/kerberosV/src/lib/asn1/check-der.c b/kerberosV/src/lib/asn1/check-der.c index 93253baf844..e71f9a48dbf 100644 --- a/kerberosV/src/lib/asn1/check-der.c +++ b/kerberosV/src/lib/asn1/check-der.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -39,97 +39,13 @@ #include <err.h> #include <roken.h> -#include <libasn1.h> +#include <asn1-common.h> +#include <asn1_err.h> +#include <der.h> -RCSID("$KTH: check-der.c,v 1.7 1999/12/02 17:05:01 joda Exp $"); +#include "check-common.h" -static void -print_bytes (unsigned const char *buf, size_t len) -{ - int i; - - for (i = 0; i < len; ++i) - printf ("%02x ", buf[i]); -} - -struct test_case { - void *val; - int byte_len; - const unsigned char *bytes; - char *name; -}; - -static int -generic_test (const struct test_case *tests, - unsigned ntests, - size_t data_size, - int (*encode)(unsigned char *, size_t, void *, size_t *), - int (*length)(void *), - int (*decode)(unsigned char *, size_t, void *, size_t *), - int (*cmp)(void *a, void *b)) -{ - unsigned char buf[4711]; - int i; - int failures = 0; - void *val = malloc (data_size); - - if (data_size != 0 && val == NULL) - err (1, "malloc"); - - for (i = 0; i < ntests; ++i) { - int ret; - size_t sz, consumed_sz, length_sz; - unsigned char *beg; - - ret = (*encode) (buf + sizeof(buf) - 1, sizeof(buf), - tests[i].val, &sz); - beg = buf + sizeof(buf) - sz; - if (ret != 0) { - printf ("encoding of %s failed\n", tests[i].name); - ++failures; - } - if (sz != tests[i].byte_len) { - printf ("encoding of %s has wrong len (%lu != %lu)\n", - tests[i].name, - (unsigned long)sz, (unsigned long)tests[i].byte_len); - ++failures; - } - - length_sz = (*length) (tests[i].val); - if (sz != length_sz) { - printf ("length for %s is bad (%lu != %lu)\n", - tests[i].name, (unsigned long)length_sz, (unsigned long)sz); - ++failures; - } - - if (memcmp (beg, tests[i].bytes, tests[i].byte_len) != 0) { - printf ("encoding of %s has bad bytes:\n" - "correct: ", tests[i].name); - print_bytes (tests[i].bytes, tests[i].byte_len); - printf ("\nactual: "); - print_bytes (beg, sz); - printf ("\n"); - ++failures; - } - ret = (*decode) (beg, sz, val, &consumed_sz); - if (ret != 0) { - printf ("decoding of %s failed\n", tests[i].name); - ++failures; - } - if (sz != consumed_sz) { - printf ("different length decoding %s (%ld != %ld)\n", - tests[i].name, - (unsigned long)sz, (unsigned long)consumed_sz); - ++failures; - } - if ((*cmp)(val, tests[i].val) != 0) { - printf ("%s: comparison failed\n", tests[i].name); - ++failures; - } - } - free (val); - return failures; -} +RCSID("$KTH: check-der.c,v 1.9 2003/01/23 10:19:49 lha Exp $"); static int cmp_integer (void *a, void *b) @@ -168,11 +84,9 @@ test_integer (void) } return generic_test (tests, ntests, sizeof(int), - (int (*)(unsigned char *, size_t, - void *, size_t *))encode_integer, - (int (*)(void *))length_integer, - (int (*)(unsigned char *, size_t, - void *, size_t *))decode_integer, + (generic_encode)encode_integer, + (generic_length) length_integer, + (generic_decode)decode_integer, cmp_integer); } @@ -202,11 +116,9 @@ test_octet_string (void) asprintf (&tests[0].name, "a octet string"); return generic_test (tests, ntests, sizeof(octet_string), - (int (*)(unsigned char *, size_t, - void *, size_t *))encode_octet_string, - (int (*)(void *))length_octet_string, - (int (*)(unsigned char *, size_t, - void *, size_t *))decode_octet_string, + (generic_encode)encode_octet_string, + (generic_length)length_octet_string, + (generic_decode)decode_octet_string, cmp_octet_string); } @@ -233,11 +145,9 @@ test_general_string (void) asprintf (&tests[0].name, "the string \"%s\"", s1); return generic_test (tests, ntests, sizeof(unsigned char *), - (int (*)(unsigned char *, size_t, - void *, size_t *))encode_general_string, - (int (*)(void *))length_general_string, - (int (*)(unsigned char *, size_t, - void *, size_t *))decode_general_string, + (generic_encode)encode_general_string, + (generic_length)length_general_string, + (generic_decode)decode_general_string, cmp_general_string); } @@ -267,11 +177,9 @@ test_generalized_time (void) } return generic_test (tests, ntests, sizeof(time_t), - (int (*)(unsigned char *, size_t, - void *, size_t *))encode_generalized_time, - (int (*)(void *))length_generalized_time, - (int (*)(unsigned char *, size_t, - void *, size_t *))decode_generalized_time, + (generic_encode)encode_generalized_time, + (generic_length)length_generalized_time, + (generic_decode)decode_generalized_time, cmp_generalized_time); } diff --git a/kerberosV/src/lib/asn1/check-gen.c b/kerberosV/src/lib/asn1/check-gen.c new file mode 100644 index 00000000000..40fa4e00549 --- /dev/null +++ b/kerberosV/src/lib/asn1/check-gen.c @@ -0,0 +1,189 @@ +/* + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif +#include <stdio.h> +#include <string.h> +#include <err.h> +#include <roken.h> + +#include <asn1-common.h> +#include <asn1_err.h> +#include <der.h> +#include <krb5_asn1.h> + +#include "check-common.h" + +RCSID("$KTH: check-gen.c,v 1.2 2003/01/26 10:55:07 lha Exp $"); + +static char *lha_princ[] = { "lha" }; +static char *lharoot_princ[] = { "lha", "root" }; +static char *datan_princ[] = { "host", "nutcracker.e.kth.se" }; + + +#define COMPARE_STRING(ac,bc,e) \ + do { if (strcmp((ac)->e, (bc)->e) != 0) return 1; } while(0) +#define COMPARE_INTEGER(ac,bc,e) \ + do { if ((ac)->e != (bc)->e) return 1; } while(0) +#define COMPARE_MEM(ac,bc,e,len) \ + do { if (memcmp((ac)->e, (bc)->e,len) != 0) return 1; } while(0) + +static int +cmp_principal (void *a, void *b) +{ + Principal *pa = a; + Principal *pb = b; + int i; + + COMPARE_STRING(pa,pb,realm); + COMPARE_INTEGER(pa,pb,name.name_type); + COMPARE_INTEGER(pa,pb,name.name_string.len); + + for (i = 0; i < pa->name.name_string.len; i++) + COMPARE_STRING(pa,pb,name.name_string.val[i]); + + return 0; +} + +static int +test_principal (void) +{ + struct test_case tests[] = { + { NULL, 29, + "0\e \0200\016 \003\002\001\001¡\a0\005\e\003" + "lha¡\a\e\005SU.SE" + }, + { NULL, 35, + "0! \0260\024 \003\002\001\001¡\r0\013\e\003" + "lha\e\004root¡\a\e\005SU.SE" + }, + { NULL, 54, + "04 &0$ \003\002\001\003¡\0350\e\e\004" + "host\e\023nutcracker.e.kth.se¡\n\e\bE.KTH.SE" + } + }; + + + Principal values[] = { + { { KRB5_NT_PRINCIPAL, { 1, lha_princ } }, "SU.SE" }, + { { KRB5_NT_PRINCIPAL, { 2, lharoot_princ } }, "SU.SE" }, + { { KRB5_NT_SRV_HST, { 2, datan_princ } }, "E.KTH.SE" } + }; + int i; + int ntests = sizeof(tests) / sizeof(*tests); + + for (i = 0; i < ntests; ++i) { + tests[i].val = &values[i]; + asprintf (&tests[i].name, "Principal %d", i); + } + + return generic_test (tests, ntests, sizeof(Principal), + (generic_encode)encode_Principal, + (generic_length)length_Principal, + (generic_decode)decode_Principal, + cmp_principal); +} + +static int +cmp_authenticator (void *a, void *b) +{ + Authenticator *aa = a; + Authenticator *ab = b; + int i; + + COMPARE_INTEGER(aa,ab,authenticator_vno); + COMPARE_STRING(aa,ab,crealm); + + COMPARE_INTEGER(aa,ab,cname.name_type); + COMPARE_INTEGER(aa,ab,cname.name_string.len); + + for (i = 0; i < aa->cname.name_string.len; i++) + COMPARE_STRING(aa,ab,cname.name_string.val[i]); + + return 0; +} + +static int +test_authenticator (void) +{ + struct test_case tests[] = { + { NULL, 63, + "\x62\x3d\x30\x3b\xa0\x03\x02\x01\x05\xa1\x0a\x1b\x08" + "\x45\x2e\x4b\x54\x48\x2e\x53\x45\xa2\x10\x30\x0e\xa0" + "\x03\x02\x01\x01\xa1\x07\x30\x05\x1b\x03\x6c\x68\x61" + "\xa4\x03\x02\x01\x0a\xa5\x11\x18\x0f\x31\x39\x37\x30" + "\x30\x31\x30\x31\x30\x30\x30\x31\x33\x39\x5a" + }, + { NULL, 67, + "\x62\x41\x30\x3f\xa0\x03\x02\x01\x05\xa1\x07\x1b\x05" + "\x53\x55\x2e\x53\x45\xa2\x16\x30\x14\xa0\x03\x02\x01" + "\x01\xa1\x0d\x30\x0b\x1b\x03\x6c\x68\x61\x1b\x04\x72" + "\x6f\x6f\x74\xa4\x04\x02\x02\x01\x24\xa5\x11\x18\x0f" + "\x31\x39\x37\x30\x30\x31\x30\x31\x30\x30\x31\x36\x33" + "\x39\x5a" + } + }; + + Authenticator values[] = { + { 5, "E.KTH.SE", { KRB5_NT_PRINCIPAL, { 1, lha_princ } }, + NULL, 10, 99, NULL, NULL, NULL }, + { 5, "SU.SE", { KRB5_NT_PRINCIPAL, { 2, lharoot_princ } }, + NULL, 292, 999, NULL, NULL, NULL } + }; + int i; + int ntests = sizeof(tests) / sizeof(*tests); + + for (i = 0; i < ntests; ++i) { + tests[i].val = &values[i]; + asprintf (&tests[i].name, "Authenticator %d", i); + } + + return generic_test (tests, ntests, sizeof(Authenticator), + (generic_encode)encode_Authenticator, + (generic_length)length_Authenticator, + (generic_decode)decode_Authenticator, + cmp_authenticator); +} + +int +main(int argc, char **argv) +{ + int ret = 0; + + ret += test_principal (); + ret += test_authenticator(); + + return ret; +} diff --git a/kerberosV/src/lib/asn1/der.h b/kerberosV/src/lib/asn1/der.h index 653e61a7228..b68ba652220 100644 --- a/kerberosV/src/lib/asn1/der.h +++ b/kerberosV/src/lib/asn1/der.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: der.h,v 1.20 2001/01/29 08:31:27 assar Exp $ */ +/* $KTH: der.h,v 1.22 2001/09/27 16:20:35 assar Exp $ */ #ifndef __DER_H__ #define __DER_H__ @@ -45,11 +45,13 @@ typedef enum {PRIM = 0, CONS = 1} Der_type; /* Universal tags */ enum { - UT_Integer = 2, + UT_Boolean = 1, + UT_Integer = 2, UT_BitString = 3, UT_OctetString = 4, UT_Null = 5, - UT_ObjID = 6, + UT_OID = 6, + UT_Enumerated = 10, UT_Sequence = 16, UT_Set = 17, UT_PrintableString = 19, @@ -75,6 +77,8 @@ int der_get_general_string (const unsigned char *p, size_t len, general_string *str, size_t *size); int der_get_octet_string (const unsigned char *p, size_t len, octet_string *data, size_t *size); +int der_get_oid (const unsigned char *p, size_t len, + oid *data, size_t *size); int der_get_tag (const unsigned char *p, size_t len, Der_class *class, Der_type *type, int *tag, size_t *size); @@ -88,8 +92,11 @@ int der_match_tag_and_length (const unsigned char *p, size_t len, int decode_integer (const unsigned char*, size_t, int*, size_t*); int decode_unsigned (const unsigned char*, size_t, unsigned*, size_t*); +int decode_enumerated (const unsigned char*, size_t, unsigned*, size_t*); int decode_general_string (const unsigned char*, size_t, general_string*, size_t*); +int decode_oid (const unsigned char *p, size_t len, + oid *k, size_t *size); int decode_octet_string (const unsigned char*, size_t, octet_string*, size_t*); int decode_generalized_time (const unsigned char*, size_t, time_t*, size_t*); @@ -99,6 +106,8 @@ int der_put_general_string (unsigned char *p, size_t len, const general_string *str, size_t*); int der_put_octet_string (unsigned char *p, size_t len, const octet_string *data, size_t*); +int der_put_oid (unsigned char *p, size_t len, + const oid *data, size_t *size); int der_put_tag (unsigned char *p, size_t len, Der_class class, Der_type type, int tag, size_t*); int der_put_length_and_tag (unsigned char*, size_t, size_t, @@ -108,29 +117,36 @@ int encode_integer (unsigned char *p, size_t len, const int *data, size_t*); int encode_unsigned (unsigned char *p, size_t len, const unsigned *data, size_t*); +int encode_enumerated (unsigned char *p, size_t len, + const unsigned *data, size_t*); int encode_general_string (unsigned char *p, size_t len, const general_string *data, size_t*); int encode_octet_string (unsigned char *p, size_t len, const octet_string *k, size_t*); +int encode_oid (unsigned char *p, size_t len, + const oid *k, size_t*); int encode_generalized_time (unsigned char *p, size_t len, const time_t *t, size_t*); void free_integer (int *num); void free_general_string (general_string *str); void free_octet_string (octet_string *k); +void free_oid (oid *k); void free_generalized_time (time_t *t); size_t length_len (size_t len); size_t length_integer (const int *data); size_t length_unsigned (const unsigned *data); +size_t length_enumerated (const unsigned *data); size_t length_general_string (const general_string *data); size_t length_octet_string (const octet_string *k); +size_t length_oid (const oid *k); size_t length_generalized_time (const time_t *t); int copy_general_string (const general_string *from, general_string *to); int copy_octet_string (const octet_string *from, octet_string *to); +int copy_oid (const oid *from, oid *to); int fix_dce(size_t reallen, size_t *len); #endif /* __DER_H__ */ - diff --git a/kerberosV/src/lib/asn1/der_free.c b/kerberosV/src/lib/asn1/der_free.c index f6e9016d710..c2102d0f510 100644 --- a/kerberosV/src/lib/asn1/der_free.c +++ b/kerberosV/src/lib/asn1/der_free.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "der_locl.h" -RCSID("$KTH: der_free.c,v 1.7 1999/12/02 17:05:01 joda Exp $"); +RCSID("$KTH: der_free.c,v 1.8 2001/09/25 13:39:26 assar Exp $"); void free_general_string (general_string *str) @@ -46,3 +46,9 @@ free_octet_string (octet_string *k) { free(k->data); } + +void +free_oid (oid *k) +{ + free(k->components); +} diff --git a/kerberosV/src/lib/asn1/der_get.c b/kerberosV/src/lib/asn1/der_get.c index 0a877b95a66..463e38f8982 100644 --- a/kerberosV/src/lib/asn1/der_get.c +++ b/kerberosV/src/lib/asn1/der_get.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "der_locl.h" -RCSID("$KTH: der_get.c,v 1.28 2000/04/06 17:19:53 assar Exp $"); +RCSID("$KTH: der_get.c,v 1.33 2002/09/03 16:21:49 nectar Exp $"); #include <version.h> @@ -66,10 +66,11 @@ der_get_int (const unsigned char *p, size_t len, int val = 0; size_t oldlen = len; - if (len--) + if (len > 0) { val = (signed char)*p++; - while (len--) - val = val * 256 + *p++; + while (--len) + val = val * 256 + *p++; + } *ret = val; if(size) *size = oldlen; return 0; @@ -139,6 +140,42 @@ der_get_octet_string (const unsigned char *p, size_t len, } int +der_get_oid (const unsigned char *p, size_t len, + oid *data, size_t *size) +{ + int n; + size_t oldlen = len; + + if (len < 1) + return ASN1_OVERRUN; + + data->components = malloc(len * sizeof(*data->components)); + if (data->components == NULL && len != 0) + return ENOMEM; + data->components[0] = (*p) / 40; + data->components[1] = (*p) % 40; + --len; + ++p; + for (n = 2; len > 0; ++n) { + unsigned u = 0; + + do { + --len; + u = u * 128 + (*p++ % 128); + } while (len > 0 && p[-1] & 0x80); + data->components[n] = u; + } + if (p[-1] & 0x80) { + free_oid (data); + return ASN1_OVERRUN; + } + data->length = n; + if (size) + *size = oldlen; + return 0; +} + +int der_get_tag (const unsigned char *p, size_t len, Der_class *class, Der_type *type, int *tag, size_t *size) @@ -215,6 +252,8 @@ decode_integer (const unsigned char *p, size_t len, p += l; len -= l; ret += l; + if (reallen > len) + return ASN1_OVERRUN; e = der_get_int (p, reallen, num, &l); if (e) return e; p += l; @@ -242,6 +281,8 @@ decode_unsigned (const unsigned char *p, size_t len, p += l; len -= l; ret += l; + if (reallen > len) + return ASN1_OVERRUN; e = der_get_unsigned (p, reallen, num, &l); if (e) return e; p += l; @@ -252,6 +293,33 @@ decode_unsigned (const unsigned char *p, size_t len, } int +decode_enumerated (const unsigned char *p, size_t len, + unsigned *num, size_t *size) +{ + size_t ret = 0; + size_t l, reallen; + int e; + + e = der_match_tag (p, len, UNIV, PRIM, UT_Enumerated, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + e = der_get_length (p, len, &reallen, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + e = der_get_int (p, reallen, num, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + if(size) *size = ret; + return 0; +} + +int decode_general_string (const unsigned char *p, size_t len, general_string *str, size_t *size) { @@ -315,6 +383,38 @@ decode_octet_string (const unsigned char *p, size_t len, return 0; } +int +decode_oid (const unsigned char *p, size_t len, + oid *k, size_t *size) +{ + size_t ret = 0; + size_t l; + int e; + size_t slen; + + e = der_match_tag (p, len, UNIV, PRIM, UT_OID, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + + e = der_get_length (p, len, &slen, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + if (len < slen) + return ASN1_OVERRUN; + + e = der_get_oid (p, slen, k, &l); + if (e) return e; + p += l; + len -= l; + ret += l; + if(size) *size = ret; + return 0; +} + static void generalizedtime2time (const char *s, time_t *t) { diff --git a/kerberosV/src/lib/asn1/der_length.c b/kerberosV/src/lib/asn1/der_length.c index 4afe7e534a6..84405f6dbd5 100644 --- a/kerberosV/src/lib/asn1/der_length.c +++ b/kerberosV/src/lib/asn1/der_length.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "der_locl.h" -RCSID("$KTH: der_length.c,v 1.11 2000/04/06 17:20:26 assar Exp $"); +RCSID("$KTH: der_length.c,v 1.12 2001/09/25 13:39:26 assar Exp $"); static size_t len_unsigned (unsigned val) @@ -67,6 +67,25 @@ len_int (int val) return ret; } +static size_t +len_oid (const oid *oid) +{ + size_t ret = 1; + int n; + + for (n = 2; n < oid->length; ++n) { + unsigned u = oid->components[n]; + + ++ret; + u /= 128; + while (u > 0) { + ++ret; + u /= 128; + } + } + return ret; +} + size_t length_len (size_t len) { @@ -93,6 +112,14 @@ length_unsigned (const unsigned *data) } size_t +length_enumerated (const unsigned *data) +{ + size_t len = len_int (*data); + + return 1 + length_len(len) + len; +} + +size_t length_general_string (const general_string *data) { char *str = *data; @@ -107,6 +134,14 @@ length_octet_string (const octet_string *k) } size_t +length_oid (const oid *k) +{ + size_t len = len_oid (k); + + return 1 + length_len(len) + len; +} + +size_t length_generalized_time (const time_t *t) { octet_string k; diff --git a/kerberosV/src/lib/asn1/der_locl.h b/kerberosV/src/lib/asn1/der_locl.h index 89c3f284510..ccfadf84ed2 100644 --- a/kerberosV/src/lib/asn1/der_locl.h +++ b/kerberosV/src/lib/asn1/der_locl.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: der_locl.h,v 1.3 1999/12/02 17:05:02 joda Exp $ */ +/* $KTH: der_locl.h,v 1.4 2001/09/27 16:21:47 assar Exp $ */ #ifndef __DER_LOCL_H__ #define __DER_LOCL_H__ @@ -49,6 +49,8 @@ #include <errno.h> #include <roken.h> -#include <libasn1.h> +#include <asn1-common.h> +#include <asn1_err.h> +#include <der.h> #endif /* __DER_LOCL_H__ */ diff --git a/kerberosV/src/lib/asn1/gen_copy.c b/kerberosV/src/lib/asn1/gen_copy.c index f4c9033d4f6..a85666dde45 100644 --- a/kerberosV/src/lib/asn1/gen_copy.c +++ b/kerberosV/src/lib/asn1/gen_copy.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: gen_copy.c,v 1.11 2000/04/06 17:22:05 assar Exp $"); +RCSID("$KTH: gen_copy.c,v 1.12 2001/09/25 13:39:26 assar Exp $"); static void copy_primitive (const char *typename, const char *from, const char *to) @@ -55,11 +55,15 @@ copy_type (const char *from, const char *to, const Type *t) break; case TInteger: case TUInteger: + case TEnumerated : fprintf(codefile, "*(%s) = *(%s);\n", to, from); break; case TOctetString: copy_primitive ("octet_string", from, to); break; + case TOID: + copy_primitive ("oid", from, to); + break; case TBitString: { fprintf(codefile, "*(%s) = *(%s);\n", to, from); break; diff --git a/kerberosV/src/lib/asn1/gen_decode.c b/kerberosV/src/lib/asn1/gen_decode.c index d1c82075f68..b3709550368 100644 --- a/kerberosV/src/lib/asn1/gen_decode.c +++ b/kerberosV/src/lib/asn1/gen_decode.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: gen_decode.c,v 1.16 2001/02/10 18:14:38 assar Exp $"); +RCSID("$KTH: gen_decode.c,v 1.18 2002/08/09 15:37:34 joda Exp $"); static void decode_primitive (const char *typename, const char *name) @@ -73,9 +73,15 @@ decode_type (const char *name, const Type *t) case TUInteger: decode_primitive ("unsigned", name); break; + case TEnumerated: + decode_primitive ("enumerated", name); + break; case TOctetString: decode_primitive ("octet_string", name); break; + case TOID : + decode_primitive ("oid", name); + break; case TBitString: { Member *m; int tag = -1; @@ -297,6 +303,7 @@ generate_type_decode (const Symbol *s) case TInteger: case TUInteger: case TOctetString: + case TOID: case TGeneralizedTime: case TGeneralString: case TBitString: @@ -307,9 +314,8 @@ generate_type_decode (const Symbol *s) fprintf (codefile, "size_t ret = 0, reallen;\n" "size_t l;\n" - "int i, e;\n\n"); + "int e;\n\n"); fprintf (codefile, "memset(data, 0, sizeof(*data));\n"); - fprintf (codefile, "i = 0;\n"); /* hack to avoid `unused variable' */ fprintf (codefile, "reallen = 0;\n"); /* hack to avoid `unused variable' */ decode_type ("data", s->type); diff --git a/kerberosV/src/lib/asn1/gen_encode.c b/kerberosV/src/lib/asn1/gen_encode.c index a3af892527b..b16e8bab117 100644 --- a/kerberosV/src/lib/asn1/gen_encode.c +++ b/kerberosV/src/lib/asn1/gen_encode.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: gen_encode.c,v 1.11 2000/06/19 15:19:08 joda Exp $"); +RCSID("$KTH: gen_encode.c,v 1.12 2001/09/25 13:39:26 assar Exp $"); static void encode_primitive (const char *typename, const char *name) @@ -76,6 +76,9 @@ encode_type (const char *name, const Type *t) case TOctetString: encode_primitive ("octet_string", name); break; + case TOID : + encode_primitive ("oid", name); + break; case TBitString: { Member *m; int pos; @@ -128,6 +131,10 @@ encode_type (const char *name, const Type *t) rest); break; } + case TEnumerated : { + encode_primitive ("enumerated", name); + break; + } case TSequence: { Member *m; int tag = -1; @@ -234,6 +241,8 @@ generate_type_encode (const Symbol *s) case TGeneralizedTime: case TGeneralString: case TBitString: + case TEnumerated: + case TOID: case TSequence: case TSequenceOf: case TApplication: diff --git a/kerberosV/src/lib/asn1/gen_free.c b/kerberosV/src/lib/asn1/gen_free.c index efbdb191290..c1921f501bb 100644 --- a/kerberosV/src/lib/asn1/gen_free.c +++ b/kerberosV/src/lib/asn1/gen_free.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: gen_free.c,v 1.8 2000/04/06 17:24:02 assar Exp $"); +RCSID("$KTH: gen_free.c,v 1.9 2001/09/25 13:39:26 assar Exp $"); static void free_primitive (const char *typename, const char *name) @@ -53,10 +53,14 @@ free_type (const char *name, const Type *t) break; case TInteger: case TUInteger: + case TEnumerated : break; case TOctetString: free_primitive ("octet_string", name); break; + case TOID : + free_primitive ("oid", name); + break; case TBitString: { break; } diff --git a/kerberosV/src/lib/asn1/gen_length.c b/kerberosV/src/lib/asn1/gen_length.c index 1e1d7942dfc..83d093586f7 100644 --- a/kerberosV/src/lib/asn1/gen_length.c +++ b/kerberosV/src/lib/asn1/gen_length.c @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: gen_length.c,v 1.10 2000/06/21 22:40:53 assar Exp $"); +RCSID("$KTH: gen_length.c,v 1.11 2001/09/25 13:39:26 assar Exp $"); static void length_primitive (const char *typename, @@ -69,9 +69,15 @@ length_type (const char *name, const Type *t, const char *variable) case TUInteger: length_primitive ("unsigned", name, variable); break; + case TEnumerated : + length_primitive ("enumerated", name, variable); + break; case TOctetString: length_primitive ("octet_string", name, variable); break; + case TOID : + length_primitive ("oid", name, variable); + break; case TBitString: { /* * XXX - Hope this is correct diff --git a/kerberosV/src/lib/asn1/gen_locl.h b/kerberosV/src/lib/asn1/gen_locl.h index e62ca1f3bb2..e39899fd0b7 100644 --- a/kerberosV/src/lib/asn1/gen_locl.h +++ b/kerberosV/src/lib/asn1/gen_locl.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: gen_locl.h,v 1.7 2000/04/09 09:21:56 assar Exp $ */ +/* $KTH: gen_locl.h,v 1.9 2001/09/27 16:21:47 assar Exp $ */ #ifndef __GEN_LOCL_H__ #define __GEN_LOCL_H__ @@ -66,6 +66,7 @@ void generate_glue (const Symbol *s); void init_generate (const char *filename, const char *basename); const char *filename (void); void close_generate(void); +void add_import(const char *module); int yyparse(void); extern FILE *headerfile, *codefile, *logfile; diff --git a/kerberosV/src/lib/asn1/k5.asn1 b/kerberosV/src/lib/asn1/k5.asn1 index 5d4ef3d530d..b015dea1cf4 100644 --- a/kerberosV/src/lib/asn1/k5.asn1 +++ b/kerberosV/src/lib/asn1/k5.asn1 @@ -1,4 +1,4 @@ --- $KTH: k5.asn1,v 1.25 2001/05/14 06:12:13 assar Exp $ +-- $KTH: k5.asn1,v 1.28 2003/01/15 03:13:47 lha Exp $ KERBEROS5 DEFINITIONS ::= BEGIN @@ -70,9 +70,11 @@ CKSUMTYPE ::= INTEGER { CKSUMTYPE_RSA_MD5(7), CKSUMTYPE_RSA_MD5_DES(8), CKSUMTYPE_RSA_MD5_DES3(9), - -- CKSUMTYPE_SHA1(10), + CKSUMTYPE_HMAC_SHA1_96_AES_128(10), + CKSUMTYPE_HMAC_SHA1_96_AES_256(11), CKSUMTYPE_HMAC_SHA1_DES3(12), CKSUMTYPE_SHA1(1000), -- correct value? 10 (9 also) + CKSUMTYPE_GSSAPI(0x8003), CKSUMTYPE_HMAC_MD5(-138), -- unofficial microsoft number CKSUMTYPE_HMAC_MD5_ENC(-1138) -- even more unofficial } @@ -89,6 +91,8 @@ ENCTYPE ::= INTEGER { ETYPE_ENCRYPT_RSA_PRIV(9), ETYPE_ENCRYPT_RSA_PUB(10), ETYPE_DES3_CBC_SHA1(16), -- with key derivation + ETYPE_AES128_CTS_HMAC_SHA1_96(17), + ETYPE_AES256_CTS_HMAC_SHA1_96(18), ETYPE_ARCFOUR_HMAC_MD5(23), ETYPE_ARCFOUR_HMAC_MD5_56(24), ETYPE_ENCTYPE_PK_CROSS(48), @@ -96,8 +100,7 @@ ENCTYPE ::= INTEGER { ETYPE_DES_CBC_NONE(-0x1000), ETYPE_DES3_CBC_NONE(-0x1001), ETYPE_DES_CFB64_NONE(-0x1002), - ETYPE_DES_PCBC_NONE(-0x1003), - ETYPE_DES3_CBC_NONE_IVEC(-0x1004) + ETYPE_DES_PCBC_NONE(-0x1003) } -- this is sugar to make something ASN1 does not have: unsigned diff --git a/kerberosV/src/lib/asn1/lex.l b/kerberosV/src/lib/asn1/lex.l index 546874f44e2..a21243ecf4a 100644 --- a/kerberosV/src/lib/asn1/lex.l +++ b/kerberosV/src/lib/asn1/lex.l @@ -32,7 +32,7 @@ * SUCH DAMAGE. */ -/* $KTH: lex.l,v 1.16 2001/04/18 13:08:47 joda Exp $ */ +/* $KTH: lex.l,v 1.19 2001/09/25 23:28:03 assar Exp $ */ #ifdef HAVE_CONFIG_H #include <config.h> @@ -44,6 +44,7 @@ #ifdef HAVE_UNISTD_H #include <unistd.h> #endif +#undef ECHO #include "symbol.h" #include "parse.h" #include "lex.h" @@ -74,17 +75,27 @@ OPTIONAL { return OPTIONAL; } BEGIN { return TBEGIN; } END { return END; } DEFINITIONS { return DEFINITIONS; } +ENUMERATED { return ENUMERATED; } EXTERNAL { return EXTERNAL; } +OBJECT { return OBJECT; } +IDENTIFIER { return IDENTIFIER; } [,;{}()|] { return *yytext; } "[" { return *yytext; } "]" { return *yytext; } ::= { return EEQUAL; } --[^\n]*\n { ++lineno; } --?(0x)?[0-9]+ { char *e; yylval.constant = strtol(yytext, &e, 0); - if(e == yytext) +-?(0x)?[0-9]+ { char *e, *y = yytext; + yylval.constant = strtol((const char *)yytext, + &e, 0); + if(e == y) error_message("malformed constant (%s)", yytext); - else return CONSTANT; } -[A-Za-z][-A-Za-z0-9_]* { yylval.name = strdup (yytext); return IDENTIFIER; } + else + return CONSTANT; + } +[A-Za-z][-A-Za-z0-9_]* { + yylval.name = strdup ((const char *)yytext); + return IDENT; + } [ \t] ; \n { ++lineno; } \.\. { return DOTDOT; } diff --git a/kerberosV/src/lib/asn1/parse.y b/kerberosV/src/lib/asn1/parse.y index ea58c52808e..819b5e901ee 100644 --- a/kerberosV/src/lib/asn1/parse.y +++ b/kerberosV/src/lib/asn1/parse.y @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: parse.y,v 1.17 2001/03/26 04:09:55 assar Exp $ */ +/* $KTH: parse.y,v 1.19 2001/09/27 16:21:47 assar Exp $ */ %{ #ifdef HAVE_CONFIG_H @@ -44,7 +44,7 @@ #include "lex.h" #include "gen_locl.h" -RCSID("$KTH: parse.y,v 1.17 2001/03/26 04:09:55 assar Exp $"); +RCSID("$KTH: parse.y,v 1.19 2001/09/27 16:21:47 assar Exp $"); static Type *new_type (Typetype t); void yyerror (char *); @@ -61,10 +61,12 @@ static void append (Member *l, Member *r); } %token INTEGER SEQUENCE OF OCTET STRING GeneralizedTime GeneralString -%token BIT APPLICATION OPTIONAL EEQUAL TBEGIN END DEFINITIONS EXTERNAL +%token BIT APPLICATION OPTIONAL EEQUAL TBEGIN END DEFINITIONS ENUMERATED +%token EXTERNAL %token DOTDOT %token IMPORTS FROM -%token <name> IDENTIFIER +%token OBJECT IDENTIFIER +%token <name> IDENT %token <constant> CONSTANT %type <constant> constant optional2 @@ -75,7 +77,7 @@ static void append (Member *l, Member *r); %% -envelope : IDENTIFIER DEFINITIONS EEQUAL TBEGIN specification END {} +envelope : IDENT DEFINITIONS EEQUAL TBEGIN specification END {} ; specification : @@ -87,22 +89,23 @@ declaration : imports_decl | constant_decl ; -referencenames : IDENTIFIER ',' referencenames +referencenames : IDENT ',' referencenames { Symbol *s = addsym($1); s->stype = Stype; } - | IDENTIFIER + | IDENT { Symbol *s = addsym($1); s->stype = Stype; } ; -imports_decl : IMPORTS referencenames FROM IDENTIFIER ';' +imports_decl : IMPORTS referencenames FROM IDENT ';' + { add_import($4); } ; -type_decl : IDENTIFIER EEQUAL type +type_decl : IDENT EEQUAL type { Symbol *s = addsym ($1); s->stype = Stype; @@ -111,7 +114,7 @@ type_decl : IDENTIFIER EEQUAL type } ; -constant_decl : IDENTIFIER type EEQUAL constant +constant_decl : IDENT type EEQUAL constant { Symbol *s = addsym ($1); s->stype = SConstant; @@ -134,6 +137,12 @@ type : INTEGER { $$ = new_type(TInteger); } $$ = new_type(TInteger); $$->members = $3; } + | OBJECT IDENTIFIER { $$ = new_type(TOID); } + | ENUMERATED '{' bitdecls '}' + { + $$ = new_type(TEnumerated); + $$->members = $3; + } | OCTET STRING { $$ = new_type(TOctetString); } | GeneralString { $$ = new_type(TGeneralString); } | GeneralizedTime { $$ = new_type(TGeneralizedTime); } @@ -152,7 +161,7 @@ type : INTEGER { $$ = new_type(TInteger); } $$ = new_type(TBitString); $$->members = $4; } - | IDENTIFIER + | IDENT { Symbol *s = addsym($1); $$ = new_type(TType); @@ -174,7 +183,7 @@ memberdecls : { $$ = NULL; } | memberdecls ',' memberdecl { $$ = $1; append($$, $3); } ; -memberdecl : IDENTIFIER '[' constant ']' type optional2 +memberdecl : IDENT '[' constant ']' type optional2 { $$ = malloc(sizeof(*$$)); $$->name = $1; @@ -196,7 +205,7 @@ bitdecls : { $$ = NULL; } | bitdecls ',' bitdecl { $$ = $1; append($$, $3); } ; -bitdecl : IDENTIFIER '(' constant ')' +bitdecl : IDENT '(' constant ')' { $$ = malloc(sizeof(*$$)); $$->name = $1; @@ -210,7 +219,7 @@ bitdecl : IDENTIFIER '(' constant ')' ; constant : CONSTANT { $$ = $1; } - | IDENTIFIER { + | IDENT { Symbol *s = addsym($1); if(s->stype != SConstant) error_message ("%s is not a constant\n", diff --git a/kerberosV/src/lib/asn1/symbol.c b/kerberosV/src/lib/asn1/symbol.c index ce92dcf8795..d0c8fab815c 100644 --- a/kerberosV/src/lib/asn1/symbol.c +++ b/kerberosV/src/lib/asn1/symbol.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gen_locl.h" -RCSID("$KTH: symbol.c,v 1.8 1999/12/02 17:05:02 joda Exp $"); +RCSID("$KTH: symbol.c,v 1.9 2001/09/25 13:39:27 assar Exp $"); static Hashtab *htab; @@ -55,7 +55,7 @@ hash (void *a) } void -initsym () +initsym (void) { htab = hashtabnew (101, cmp, hash); } diff --git a/kerberosV/src/lib/asn1/symbol.h b/kerberosV/src/lib/asn1/symbol.h index 2e805da8259..9bc7e48603c 100644 --- a/kerberosV/src/lib/asn1/symbol.h +++ b/kerberosV/src/lib/asn1/symbol.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,14 +31,14 @@ * SUCH DAMAGE. */ -/* $KTH: symbol.h,v 1.5 1999/12/02 17:05:02 joda Exp $ */ +/* $KTH: symbol.h,v 1.6 2001/09/25 13:39:27 assar Exp $ */ #ifndef _SYMBOL_H #define _SYMBOL_H enum typetype { TInteger, TOctetString, TBitString, TSequence, TSequenceOf, TGeneralizedTime, TGeneralString, TApplication, TType, - TUInteger }; + TUInteger, TEnumerated, TOID }; typedef enum typetype Typetype; diff --git a/kerberosV/src/lib/gssapi/8003.c b/kerberosV/src/lib/gssapi/8003.c index 7fd1edec3d9..d90df5ed227 100644 --- a/kerberosV/src/lib/gssapi/8003.c +++ b/kerberosV/src/lib/gssapi/8003.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: 8003.c,v 1.10 2001/08/29 02:21:09 assar Exp $"); +RCSID("$KTH: 8003.c,v 1.12 2002/10/31 14:38:49 joda Exp $"); static krb5_error_code encode_om_uint32(OM_uint32 n, u_char *p) @@ -100,56 +100,56 @@ gssapi_krb5_create_8003_checksum ( const krb5_data *fwd_data, Checksum *result) { - u_char *p; - - /* - * see rfc1964 (section 1.1.1 (Initial Token), and the checksum value - * field's format) */ - result->cksumtype = 0x8003; - if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) - result->checksum.length = 24 + 4 + fwd_data->length; - else - result->checksum.length = 24; - result->checksum.data = malloc (result->checksum.length); - if (result->checksum.data == NULL) { - *minor_status = ENOMEM; - return GSS_S_FAILURE; - } + u_char *p; + + /* + * see rfc1964 (section 1.1.1 (Initial Token), and the checksum value + * field's format) */ + result->cksumtype = 0x8003; + if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) + result->checksum.length = 24 + 4 + fwd_data->length; + else + result->checksum.length = 24; + result->checksum.data = malloc (result->checksum.length); + if (result->checksum.data == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } - p = result->checksum.data; - encode_om_uint32 (16, p); - p += 4; - if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) { - memset (p, 0, 16); - } else { - hash_input_chan_bindings (input_chan_bindings, p); - } - p += 16; - encode_om_uint32 (flags, p); - p += 4; - - if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) { + p = result->checksum.data; + encode_om_uint32 (16, p); + p += 4; + if (input_chan_bindings == GSS_C_NO_CHANNEL_BINDINGS) { + memset (p, 0, 16); + } else { + hash_input_chan_bindings (input_chan_bindings, p); + } + p += 16; + encode_om_uint32 (flags, p); + p += 4; + + if (fwd_data->length > 0 && (flags & GSS_C_DELEG_FLAG)) { #if 0 - u_char *tmp; + u_char *tmp; - result->checksum.length = 28 + fwd_data->length; - tmp = realloc(result->checksum.data, result->checksum.length); - if (tmp == NULL) - return ENOMEM; - result->checksum.data = tmp; + result->checksum.length = 28 + fwd_data->length; + tmp = realloc(result->checksum.data, result->checksum.length); + if (tmp == NULL) + return ENOMEM; + result->checksum.data = tmp; - p = (u_char*)result->checksum.data + 24; + p = (u_char*)result->checksum.data + 24; #endif - *p++ = (1 >> 0) & 0xFF; /* DlgOpt */ /* == 1 */ - *p++ = (1 >> 8) & 0xFF; /* DlgOpt */ /* == 0 */ - *p++ = (fwd_data->length >> 0) & 0xFF; /* Dlgth */ - *p++ = (fwd_data->length >> 8) & 0xFF; /* Dlgth */ - memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length); - - p += fwd_data->length; - } + *p++ = (1 >> 0) & 0xFF; /* DlgOpt */ /* == 1 */ + *p++ = (1 >> 8) & 0xFF; /* DlgOpt */ /* == 0 */ + *p++ = (fwd_data->length >> 0) & 0xFF; /* Dlgth */ + *p++ = (fwd_data->length >> 8) & 0xFF; /* Dlgth */ + memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length); + + p += fwd_data->length; + } - return GSS_S_COMPLETE; + return GSS_S_COMPLETE; } /* @@ -169,9 +169,10 @@ gssapi_krb5_verify_8003_checksum( unsigned char *p; OM_uint32 length; int DlgOpt; + static unsigned char zeros[16]; /* XXX should handle checksums > 24 bytes */ - if(cksum->cksumtype != 0x8003) { + if(cksum->cksumtype != 0x8003 || cksum->checksum.length < 24) { *minor_status = 0; return GSS_S_BAD_BINDINGS; } @@ -185,7 +186,8 @@ gssapi_krb5_verify_8003_checksum( p += 4; - if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS) { + if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS + && memcmp(p, zeros, sizeof(zeros)) != 0) { if(hash_input_chan_bindings(input_chan_bindings, hash) != 0) { *minor_status = 0; return GSS_S_BAD_BINDINGS; @@ -199,27 +201,33 @@ gssapi_krb5_verify_8003_checksum( p += sizeof(hash); decode_om_uint32(p, flags); + p += 4; if (cksum->checksum.length > 24 && (*flags & GSS_C_DELEG_FLAG)) { + if(cksum->checksum.length < 28) { + *minor_status = 0; + return GSS_S_BAD_BINDINGS; + } - p += 4; - - DlgOpt = (p[0] << 0) | (p[1] << 8 ); - if (DlgOpt != 1) { - *minor_status = 0; - return GSS_S_BAD_BINDINGS; - } - - p += 2; - fwd_data->length = (p[0] << 0) | (p[1] << 8); - fwd_data->data = malloc(fwd_data->length); - if (fwd_data->data == NULL) { - *minor_status = ENOMEM; - return GSS_S_FAILURE; - } - - p += 2; - memcpy(fwd_data->data, p, fwd_data->length); + DlgOpt = (p[0] << 0) | (p[1] << 8); + p += 2; + if (DlgOpt != 1) { + *minor_status = 0; + return GSS_S_BAD_BINDINGS; + } + + fwd_data->length = (p[0] << 0) | (p[1] << 8); + p += 2; + if(cksum->checksum.length < 28 + fwd_data->length) { + *minor_status = 0; + return GSS_S_BAD_BINDINGS; + } + fwd_data->data = malloc(fwd_data->length); + if (fwd_data->data == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + memcpy(fwd_data->data, p, fwd_data->length); } return GSS_S_COMPLETE; diff --git a/kerberosV/src/lib/gssapi/ChangeLog b/kerberosV/src/lib/gssapi/ChangeLog index c1735acb77e..c9fe5111046 100644 --- a/kerberosV/src/lib/gssapi/ChangeLog +++ b/kerberosV/src/lib/gssapi/ChangeLog @@ -1,3 +1,296 @@ +2003-04-29 Jacques Vidrine <nectar@kth.se> + + * verify_mic.c: 1.18->1.19: verify_mic_des3: If MIC verification + fails, retry using the `old' MIC computation (with zero IV). + +2003-04-28 Love <lha@stacken.kth.se> + + * compat.c (_gss_DES3_get_mic_compat): default to use compat + + * gssapi.3: 1.5->1.6: document [gssapi]correct_des3_mic and + [gssapi]broken_des3_mic + + * compat.c: 1.2->1.4: + (gss_krb5_compat_des3_mci): return a value + (gss_krb5_compat_des3_mic): enable turning on/off des3 mic compat + (_gss_DES3_get_mic_compat): handle [gssapi]correct_des3_mic too + + * gssapi.h: 1.26->1.27: + (gss_krb5_compat_des3_mic): new function, turn on/off des3 mic compat + (GSS_C_KRB5_COMPAT_DES3_MIC): cpp symbol that exists if + gss_krb5_compat_des3_mic exists + +2003-04-23 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: 1.44->1.45: test_acquire_cred_LDADD: use + libgssapi.la not ./libgssapi.la (makes make -jN work) + +2003-04-16 Love Hörnquist Åstrand <lha@it.su.se> + + * gssapi.3: spelling + + * gss_acquire_cred.3: Change .Fd #include <header.h> to .In + header.h, from Thomas Klausner <wiz@netbsd.org> + + +2003-04-06 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_acquire_cred.3: spelling + + * Makefile.am: remove stuff that sneaked in with last commit + + * acquire_cred.c (acquire_initiator_cred): if the requested name + isn't in the ccache, also check keytab. Extact the krbtgt for the + default realm to check how long the credentials will last. + + * add_cred.c (gss_add_cred): don't create a new ccache, just open + the old one; better check if output handle is compatible with new + (copied) handle + + * test_acquire_cred.c: test gss_add_cred too + +2003-04-03 Love Hörnquist Åstrand <lha@it.su.se> + + * Makefile.am: build test_acquire_cred + + * test_acquire_cred.c: simple gss_acquire_cred test + +2003-04-02 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_acquire_cred.3: s/gssapi/GSS-API/ + +2003-03-19 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_acquire_cred.3: document v1 interface (and that they are + obsolete) + +2003-03-18 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_acquire_cred.3: list supported mechanism and nametypes + +2003-03-16 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_acquire_cred.3: text about gss_display_name + + * Makefile.am (libgssapi_la_LDFLAGS): bump to 3:6:2 + (libgssapi_la_SOURCES): add all new functions + + * gssapi.3: now that we have a functions, uncomment the missing + ones + + * gss_acquire_cred.3: now that we have a functions, uncomment the + missing ones + + * process_context_token.c: implement gss_process_context_token + + * inquire_names_for_mech.c: implement gss_inquire_names_for_mech + + * inquire_mechs_for_name.c: implement gss_inquire_mechs_for_name + + * inquire_cred_by_mech.c: implement gss_inquire_cred_by_mech + + * add_cred.c: implement gss_add_cred + + * acquire_cred.c (gss_acquire_cred): more testing of input + argument, make sure output arguments are ok, since we don't know + the time_rec (for now), set it to time_req + + * export_sec_context.c: send lifetime, also set minor_status + + * get_mic.c: set minor_status + + * import_sec_context.c (gss_import_sec_context): add error + checking, pick up lifetime (if there is no lifetime, use + GSS_C_INDEFINITE) + + * init_sec_context.c: take care to set export value to something + sane before we start so caller will have harmless values in them + if then function fails + + * release_buffer.c (gss_release_buffer): set minor_status + + * wrap.c: make sure minor_status get set + + * verify_mic.c (gss_verify_mic_internal): rename verify_mic to + gss_verify_mic_internal and let it take the type as an argument, + (gss_verify_mic): call gss_verify_mic_internal + set minor_status + + * unwrap.c: set minor_status + + * test_oid_set_member.c (gss_test_oid_set_member): use + gss_oid_equal + + * release_oid_set.c (gss_release_oid_set): set minor_status + + * release_name.c (gss_release_name): set minor_status + + * release_cred.c (gss_release_cred): set minor_status + + * add_oid_set_member.c (gss_add_oid_set_member): set minor_status + + * compare_name.c (gss_compare_name): set minor_status + + * compat.c (check_compat): make sure ret have a defined value + + * context_time.c (gss_context_time): set minor_status + + * copy_ccache.c (gss_krb5_copy_ccache): set minor_status + + * create_emtpy_oid_set.c (gss_create_empty_oid_set): set + minor_status + + * delete_sec_context.c (gss_delete_sec_context): set minor_status + + * display_name.c (gss_display_name): set minor_status + + * display_status.c (gss_display_status): use gss_oid_equal, handle + supplementary errors + + * duplicate_name.c (gss_duplicate_name): set minor_status + + * inquire_context.c (gss_inquire_context): set lifetime_rec now + when we know it, set minor_status + + * inquire_cred.c (gss_inquire_cred): take care to set export value + to something sane before we start so caller will have harmless + values in them if the function fails + + * accept_sec_context.c (gss_accept_sec_context): take care to set + export value to something sane before we start so caller will have + harmless values in them if then function fails, set lifetime from + ticket expiration date + + * indicate_mechs.c (gss_indicate_mechs): use + gss_create_empty_oid_set and gss_add_oid_set_member + + * gssapi.h (gss_ctx_id_t_desc): store the lifetime in the cred, + since there is no ticket transfered in the exported context + + * export_name.c (gss_export_name): export name with + GSS_C_NT_EXPORT_NAME wrapping, not just the principal + + * import_name.c (import_export_name): new function, parses a + GSS_C_NT_EXPORT_NAME + (import_krb5_name): factor out common code of parsing krb5 name + (gss_oid_equal): rename from oid_equal + + * gssapi_locl.h: add prototypes for gss_oid_equal and + gss_verify_mic_internal + + * gssapi.h: comment out the argument names + +2003-03-15 Love Hörnquist Åstrand <lha@it.su.se> + + * gssapi.3: add LIST OF FUNCTIONS and copyright/license + + * Makefile.am: s/gss_aquire_cred.3/gss_acquire_cred.3/ + + * Makefile.am: man_MANS += gss_aquire_cred.3 + +2003-03-14 Love Hörnquist Åstrand <lha@it.su.se> + + * gss_aquire_cred.3: the gssapi api manpage + +2003-03-03 Love Hörnquist Åstrand <lha@it.su.se> + + * inquire_context.c: (gss_inquire_context): rename argument open + to open_context + + * gssapi.h (gss_inquire_context): rename argument open to open_context + +2003-02-27 Love Hörnquist Åstrand <lha@it.su.se> + + * init_sec_context.c (do_delegation): remove unused variable + subkey + + * gssapi.3: all 0.5.x version had broken token delegation + +2003-02-21 Love Hörnquist Åstrand <lha@it.su.se> + + * (init_auth): only generate one subkey + +2003-01-27 Love Hörnquist Åstrand <lha@it.su.se> + + * verify_mic.c (verify_mic_des3): fix 3des verify_mic to conform + to rfc (and mit kerberos), provide backward compat hook + + * get_mic.c (mic_des3): fix 3des get_mic to conform to rfc (and + mit kerberos), provide backward compat hook + + * init_sec_context.c (init_auth): check if we need compat for + older get_mic/verify_mic + + * gssapi_locl.h: add prototype for _gss_DES3_get_mic_compat + + * gssapi.h (more_flags): add COMPAT_OLD_DES3 + + * Makefile.am: add gssapi.3 and compat.c + + * gssapi.3: add gssapi COMPATIBILITY documentation + + * accept_sec_context.c (gss_accept_sec_context): check if we need + compat for older get_mic/verify_mic + + * compat.c: check for compatiblity with other heimdal's 3des + get_mic/verify_mic + +2002-10-31 Johan Danielsson <joda@pdc.kth.se> + + * check return value from gssapi_krb5_init + + * 8003.c (gssapi_krb5_verify_8003_checksum): check size of input + +2002-09-03 Johan Danielsson <joda@pdc.kth.se> + + * wrap.c (wrap_des3): use ETYPE_DES3_CBC_NONE + + * unwrap.c (unwrap_des3): use ETYPE_DES3_CBC_NONE + +2002-09-02 Johan Danielsson <joda@pdc.kth.se> + + * init_sec_context.c: we need to generate a local subkey here + +2002-08-20 Jacques Vidrine <n@nectar.com> + + * acquire_cred.c, inquire_cred.c, release_cred.c: Use default + credential resolution if gss_acquire_cred is called with + GSS_C_NO_NAME. + +2002-06-20 Jacques Vidrine <n@nectar.com> + + * import_name.c: Compare name types by value if pointers do + not match. Reported by: "Douglas E. Engert" <deengert@anl.gov> + +2002-05-20 Jacques Vidrine <n@nectar.com> + + * verify_mic.c (gss_verify_mic), unwrap.c (gss_unwrap): initialize + the qop_state parameter. from Doug Rabson <dfr@nlsystems.com> + +2002-05-09 Jacques Vidrine <n@nectar.com> + + * acquire_cred.c: handle GSS_C_INITIATE/GSS_C_ACCEPT/GSS_C_BOTH + +2002-05-08 Jacques Vidrine <n@nectar.com> + + * acquire_cred.c: initialize gssapi; handle null desired_name + +2002-03-22 Johan Danielsson <joda@pdc.kth.se> + + * Makefile.am: remove non-functional stuff accidentally committed + +2002-03-11 Assar Westerlund <assar@sics.se> + + * Makefile.am (libgssapi_la_LDFLAGS): bump version to 3:5:2 + * 8003.c (gssapi_krb5_verify_8003_checksum): handle zero channel + bindings + +2001-10-31 Jacques Vidrine <n@nectar.com> + + * get_mic.c (mic_des3): MIC computation using DES3/SHA1 + was bogusly appending the message buffer to the result, + overwriting a heap buffer in the process. + 2001-08-29 Assar Westerlund <assar@sics.se> * 8003.c (gssapi_krb5_verify_8003_checksum, diff --git a/kerberosV/src/lib/gssapi/accept_sec_context.c b/kerberosV/src/lib/gssapi/accept_sec_context.c index 0114eabf555..3b04cd2c2e6 100644 --- a/kerberosV/src/lib/gssapi/accept_sec_context.c +++ b/kerberosV/src/lib/gssapi/accept_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,12 +33,12 @@ #include "gssapi_locl.h" -RCSID("$KTH: accept_sec_context.c,v 1.30 2001/08/29 02:21:09 assar Exp $"); +RCSID("$KTH: accept_sec_context.c,v 1.33 2003/03/16 17:41:12 lha Exp $"); krb5_keytab gssapi_krb5_keytab; OM_uint32 -gsskrb5_register_acceptor_identity (char *identity) +gsskrb5_register_acceptor_identity (const char *identity) { krb5_error_code ret; char *p; @@ -76,347 +76,356 @@ gss_accept_sec_context gss_cred_id_t * delegated_cred_handle ) { - krb5_error_code kret; - OM_uint32 ret; - krb5_data indata; - krb5_flags ap_options; - OM_uint32 flags; - krb5_ticket *ticket = NULL; - krb5_keytab keytab = NULL; - krb5_data fwd_data; - OM_uint32 minor; - - ret = 0; - gssapi_krb5_init (); - - krb5_data_zero (&fwd_data); - output_token->length = 0; - output_token->value = NULL; - - if (*context_handle == GSS_C_NO_CONTEXT) { - *context_handle = malloc(sizeof(**context_handle)); + krb5_error_code kret; + OM_uint32 ret = GSS_S_COMPLETE; + krb5_data indata; + krb5_flags ap_options; + OM_uint32 flags; + krb5_ticket *ticket = NULL; + krb5_keytab keytab = NULL; + krb5_data fwd_data; + OM_uint32 minor; + + GSSAPI_KRB5_INIT(); + + krb5_data_zero (&fwd_data); + output_token->length = 0; + output_token->value = NULL; + + if (src_name != NULL) + *src_name = NULL; + if (mech_type) + *mech_type = GSS_KRB5_MECHANISM; + if (*context_handle == GSS_C_NO_CONTEXT) { - *minor_status = ENOMEM; - return GSS_S_FAILURE; + *context_handle = malloc(sizeof(**context_handle)); + if (*context_handle == GSS_C_NO_CONTEXT) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + } + + (*context_handle)->auth_context = NULL; + (*context_handle)->source = NULL; + (*context_handle)->target = NULL; + (*context_handle)->flags = 0; + (*context_handle)->more_flags = 0; + (*context_handle)->ticket = NULL; + (*context_handle)->lifetime = GSS_C_INDEFINITE; + + kret = krb5_auth_con_init (gssapi_krb5_context, + &(*context_handle)->auth_context); + if (kret) { + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); + goto failure; } - } - - (*context_handle)->auth_context = NULL; - (*context_handle)->source = NULL; - (*context_handle)->target = NULL; - (*context_handle)->flags = 0; - (*context_handle)->more_flags = 0; - (*context_handle)->ticket = NULL; - - if (src_name != NULL) - *src_name = NULL; - - kret = krb5_auth_con_init (gssapi_krb5_context, - &(*context_handle)->auth_context); - if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; - } - - if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS - && input_chan_bindings->application_data.length == - 2 * sizeof((*context_handle)->auth_context->local_port) - ) { + + if (input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS + && input_chan_bindings->application_data.length == + 2 * sizeof((*context_handle)->auth_context->local_port) + ) { - /* Port numbers are expected to be in application_data.value, - * initator's port first */ + /* Port numbers are expected to be in application_data.value, + * initator's port first */ - krb5_address initiator_addr, acceptor_addr; + krb5_address initiator_addr, acceptor_addr; - memset(&initiator_addr, 0, sizeof(initiator_addr)); - memset(&acceptor_addr, 0, sizeof(acceptor_addr)); + memset(&initiator_addr, 0, sizeof(initiator_addr)); + memset(&acceptor_addr, 0, sizeof(acceptor_addr)); - (*context_handle)->auth_context->remote_port = - *(int16_t *) input_chan_bindings->application_data.value; + (*context_handle)->auth_context->remote_port = + *(int16_t *) input_chan_bindings->application_data.value; - (*context_handle)->auth_context->local_port = - *((int16_t *) input_chan_bindings->application_data.value + 1); + (*context_handle)->auth_context->local_port = + *((int16_t *) input_chan_bindings->application_data.value + 1); - kret = gss_address_to_krb5addr(input_chan_bindings->acceptor_addrtype, - &input_chan_bindings->acceptor_address, - (*context_handle)->auth_context->local_port, - &acceptor_addr); - if (kret) { - gssapi_krb5_set_error_string (); - ret = GSS_S_BAD_BINDINGS; - *minor_status = kret; - goto failure; - } + kret = gss_address_to_krb5addr(input_chan_bindings->acceptor_addrtype, + &input_chan_bindings->acceptor_address, + (*context_handle)->auth_context->local_port, + &acceptor_addr); + if (kret) { + gssapi_krb5_set_error_string (); + ret = GSS_S_BAD_BINDINGS; + *minor_status = kret; + goto failure; + } - kret = gss_address_to_krb5addr(input_chan_bindings->initiator_addrtype, - &input_chan_bindings->initiator_address, - (*context_handle)->auth_context->remote_port, - &initiator_addr); - if (kret) { - krb5_free_address (gssapi_krb5_context, &acceptor_addr); - gssapi_krb5_set_error_string (); - ret = GSS_S_BAD_BINDINGS; - *minor_status = kret; - goto failure; - } + kret = gss_address_to_krb5addr(input_chan_bindings->initiator_addrtype, + &input_chan_bindings->initiator_address, + (*context_handle)->auth_context->remote_port, + &initiator_addr); + if (kret) { + krb5_free_address (gssapi_krb5_context, &acceptor_addr); + gssapi_krb5_set_error_string (); + ret = GSS_S_BAD_BINDINGS; + *minor_status = kret; + goto failure; + } - kret = krb5_auth_con_setaddrs(gssapi_krb5_context, - (*context_handle)->auth_context, - &acceptor_addr, /* local address */ - &initiator_addr); /* remote address */ + kret = krb5_auth_con_setaddrs(gssapi_krb5_context, + (*context_handle)->auth_context, + &acceptor_addr, /* local address */ + &initiator_addr); /* remote address */ - krb5_free_address (gssapi_krb5_context, &initiator_addr); - krb5_free_address (gssapi_krb5_context, &acceptor_addr); + krb5_free_address (gssapi_krb5_context, &initiator_addr); + krb5_free_address (gssapi_krb5_context, &acceptor_addr); #if 0 - free(input_chan_bindings->application_data.value); - input_chan_bindings->application_data.value = NULL; - input_chan_bindings->application_data.length = 0; + free(input_chan_bindings->application_data.value); + input_chan_bindings->application_data.value = NULL; + input_chan_bindings->application_data.length = 0; #endif - if (kret) { - gssapi_krb5_set_error_string (); - ret = GSS_S_BAD_BINDINGS; - *minor_status = kret; - goto failure; - } - } + if (kret) { + gssapi_krb5_set_error_string (); + ret = GSS_S_BAD_BINDINGS; + *minor_status = kret; + goto failure; + } + } - { - int32_t tmp; - - krb5_auth_con_getflags(gssapi_krb5_context, - (*context_handle)->auth_context, - &tmp); - tmp |= KRB5_AUTH_CONTEXT_DO_SEQUENCE; - krb5_auth_con_setflags(gssapi_krb5_context, - (*context_handle)->auth_context, - tmp); - } - - ret = gssapi_krb5_decapsulate (minor_status, - input_token_buffer, - &indata, - "\x01\x00"); - if (ret) - goto failure; - - if (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) { - if (gssapi_krb5_keytab != NULL) { - keytab = gssapi_krb5_keytab; - } - } else if (acceptor_cred_handle->keytab != NULL) { - keytab = acceptor_cred_handle->keytab; - } - - kret = krb5_rd_req (gssapi_krb5_context, - &(*context_handle)->auth_context, - &indata, - (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) ? NULL + { + int32_t tmp; + + krb5_auth_con_getflags(gssapi_krb5_context, + (*context_handle)->auth_context, + &tmp); + tmp |= KRB5_AUTH_CONTEXT_DO_SEQUENCE; + krb5_auth_con_setflags(gssapi_krb5_context, + (*context_handle)->auth_context, + tmp); + } + + ret = gssapi_krb5_decapsulate (minor_status, + input_token_buffer, + &indata, + "\x01\x00"); + if (ret) + goto failure; + + if (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) { + if (gssapi_krb5_keytab != NULL) { + keytab = gssapi_krb5_keytab; + } + } else if (acceptor_cred_handle->keytab != NULL) { + keytab = acceptor_cred_handle->keytab; + } + + kret = krb5_rd_req (gssapi_krb5_context, + &(*context_handle)->auth_context, + &indata, + (acceptor_cred_handle == GSS_C_NO_CREDENTIAL) ? NULL : acceptor_cred_handle->principal, - keytab, - &ap_options, - &ticket); - if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; - } - - kret = krb5_copy_principal (gssapi_krb5_context, - ticket->client, - &(*context_handle)->source); - if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; - } - - kret = krb5_copy_principal (gssapi_krb5_context, - ticket->server, - &(*context_handle)->target); - if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; - } - - if (src_name != NULL) { + keytab, + &ap_options, + &ticket); + if (kret) { + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); + goto failure; + } + kret = krb5_copy_principal (gssapi_krb5_context, ticket->client, - src_name); + &(*context_handle)->source); if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); + goto failure; } - } - { - krb5_authenticator authenticator; - - kret = krb5_auth_con_getauthenticator(gssapi_krb5_context, - (*context_handle)->auth_context, - &authenticator); - if(kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; - } - - ret = gssapi_krb5_verify_8003_checksum(minor_status, - input_chan_bindings, - authenticator->cksum, - &flags, - &fwd_data); - krb5_free_authenticator(gssapi_krb5_context, &authenticator); - if (ret) + kret = krb5_copy_principal (gssapi_krb5_context, + ticket->server, + &(*context_handle)->target); + if (kret) { + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); goto failure; - } + } - if (fwd_data.length > 0 && (flags & GSS_C_DELEG_FLAG)) { - - krb5_ccache ccache; + ret = _gss_DES3_get_mic_compat(minor_status, *context_handle); + if (ret) + goto failure; + + if (src_name != NULL) { + kret = krb5_copy_principal (gssapi_krb5_context, + ticket->client, + src_name); + if (kret) { + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); + goto failure; + } + } + + { + krb5_authenticator authenticator; - if (delegated_cred_handle == NULL) - /* XXX Create a new delegated_cred_handle? */ - kret = krb5_cc_default (gssapi_krb5_context, &ccache); - else if (*delegated_cred_handle == NULL) { - if ((*delegated_cred_handle = - calloc(1, sizeof(**delegated_cred_handle))) == NULL) { + kret = krb5_auth_con_getauthenticator(gssapi_krb5_context, + (*context_handle)->auth_context, + &authenticator); + if(kret) { ret = GSS_S_FAILURE; - *minor_status = ENOMEM; - krb5_set_error_string(gssapi_krb5_context, "out of memory"); - gssapi_krb5_set_error_string(); + *minor_status = kret; + gssapi_krb5_set_error_string (); goto failure; - } - if ((ret = gss_duplicate_name(minor_status, ticket->client, - &(*delegated_cred_handle)->principal)) != 0) { - flags &= ~GSS_C_DELEG_FLAG; - free(*delegated_cred_handle); - *delegated_cred_handle = NULL; - goto end_fwd; - } - } - if (delegated_cred_handle != NULL && - (*delegated_cred_handle)->ccache == NULL) { + } + + ret = gssapi_krb5_verify_8003_checksum(minor_status, + input_chan_bindings, + authenticator->cksum, + &flags, + &fwd_data); + krb5_free_authenticator(gssapi_krb5_context, &authenticator); + if (ret) + goto failure; + } + + if (fwd_data.length > 0 && (flags & GSS_C_DELEG_FLAG)) { + + krb5_ccache ccache; + + if (delegated_cred_handle == NULL) + /* XXX Create a new delegated_cred_handle? */ + kret = krb5_cc_default (gssapi_krb5_context, &ccache); + else if (*delegated_cred_handle == NULL) { + if ((*delegated_cred_handle = + calloc(1, sizeof(**delegated_cred_handle))) == NULL) { + ret = GSS_S_FAILURE; + *minor_status = ENOMEM; + krb5_set_error_string(gssapi_krb5_context, "out of memory"); + gssapi_krb5_set_error_string(); + goto failure; + } + if ((ret = gss_duplicate_name(minor_status, ticket->client, + &(*delegated_cred_handle)->principal)) != 0) { + flags &= ~GSS_C_DELEG_FLAG; + free(*delegated_cred_handle); + *delegated_cred_handle = NULL; + goto end_fwd; + } + } + if (delegated_cred_handle != NULL && + (*delegated_cred_handle)->ccache == NULL) { kret = krb5_cc_gen_new (gssapi_krb5_context, &krb5_mcc_ops, &(*delegated_cred_handle)->ccache); - ccache = (*delegated_cred_handle)->ccache; - } - if (delegated_cred_handle != NULL && - (*delegated_cred_handle)->mechanisms == NULL) { + ccache = (*delegated_cred_handle)->ccache; + } + if (delegated_cred_handle != NULL && + (*delegated_cred_handle)->mechanisms == NULL) { ret = gss_create_empty_oid_set(minor_status, - &(*delegated_cred_handle)->mechanisms); + &(*delegated_cred_handle)->mechanisms); if (ret) - goto failure; + goto failure; ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, - &(*delegated_cred_handle)->mechanisms); + &(*delegated_cred_handle)->mechanisms); if (ret) - goto failure; - } + goto failure; + } - if (kret) { - flags &= ~GSS_C_DELEG_FLAG; - goto end_fwd; - } + if (kret) { + flags &= ~GSS_C_DELEG_FLAG; + goto end_fwd; + } - kret = krb5_cc_initialize(gssapi_krb5_context, - ccache, - *src_name); - if (kret) { - flags &= ~GSS_C_DELEG_FLAG; - goto end_fwd; - } + kret = krb5_cc_initialize(gssapi_krb5_context, + ccache, + *src_name); + if (kret) { + flags &= ~GSS_C_DELEG_FLAG; + goto end_fwd; + } - kret = krb5_rd_cred2(gssapi_krb5_context, - (*context_handle)->auth_context, - ccache, - &fwd_data); - if (kret) { - flags &= ~GSS_C_DELEG_FLAG; - goto end_fwd; - } - -end_fwd: - free(fwd_data.data); - } + kret = krb5_rd_cred2(gssapi_krb5_context, + (*context_handle)->auth_context, + ccache, + &fwd_data); + if (kret) { + flags &= ~GSS_C_DELEG_FLAG; + goto end_fwd; + } + + end_fwd: + free(fwd_data.data); + } - flags |= GSS_C_TRANS_FLAG; + flags |= GSS_C_TRANS_FLAG; - if (ret_flags) - *ret_flags = flags; - (*context_handle)->flags = flags; - (*context_handle)->more_flags |= OPEN; + if (ret_flags) + *ret_flags = flags; + (*context_handle)->lifetime = ticket->ticket.endtime; + (*context_handle)->flags = flags; + (*context_handle)->more_flags |= OPEN; - if (mech_type) - *mech_type = GSS_KRB5_MECHANISM; + if (mech_type) + *mech_type = GSS_KRB5_MECHANISM; - if (time_rec) - *time_rec = GSS_C_INDEFINITE; + if (time_rec) + *time_rec = (*context_handle)->lifetime; - if(flags & GSS_C_MUTUAL_FLAG) { - krb5_data outbuf; + if(flags & GSS_C_MUTUAL_FLAG) { + krb5_data outbuf; - kret = krb5_mk_rep (gssapi_krb5_context, - (*context_handle)->auth_context, - &outbuf); - if (kret) { - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - goto failure; + kret = krb5_mk_rep (gssapi_krb5_context, + (*context_handle)->auth_context, + &outbuf); + if (kret) { + ret = GSS_S_FAILURE; + *minor_status = kret; + gssapi_krb5_set_error_string (); + goto failure; + } + ret = gssapi_krb5_encapsulate (minor_status, + &outbuf, + output_token, + "\x02\x00"); + krb5_data_free (&outbuf); + if (ret) + goto failure; + } else { + output_token->length = 0; + output_token->value = NULL; } - ret = gssapi_krb5_encapsulate (minor_status, - &outbuf, - output_token, - "\x02\x00"); - krb5_data_free (&outbuf); - if (ret) - goto failure; - } else { - output_token->length = 0; - } - (*context_handle)->ticket = ticket; - ticket = NULL; + (*context_handle)->ticket = ticket; + ticket = NULL; #if 0 - krb5_free_ticket (context, ticket); + krb5_free_ticket (context, ticket); #endif - return GSS_S_COMPLETE; - -failure: - if (fwd_data.length > 0) - free(fwd_data.data); - if (ticket != NULL) - krb5_free_ticket (gssapi_krb5_context, ticket); - krb5_auth_con_free (gssapi_krb5_context, - (*context_handle)->auth_context); - if((*context_handle)->source) - krb5_free_principal (gssapi_krb5_context, - (*context_handle)->source); - if((*context_handle)->target) - krb5_free_principal (gssapi_krb5_context, - (*context_handle)->target); - free (*context_handle); - if (src_name != NULL) { - gss_release_name (&minor, src_name); - *src_name = NULL; - } - *context_handle = GSS_C_NO_CONTEXT; - return ret; + *minor_status = 0; + return GSS_S_COMPLETE; + + failure: + if (fwd_data.length > 0) + free(fwd_data.data); + if (ticket != NULL) + krb5_free_ticket (gssapi_krb5_context, ticket); + krb5_auth_con_free (gssapi_krb5_context, + (*context_handle)->auth_context); + if((*context_handle)->source) + krb5_free_principal (gssapi_krb5_context, + (*context_handle)->source); + if((*context_handle)->target) + krb5_free_principal (gssapi_krb5_context, + (*context_handle)->target); + free (*context_handle); + if (src_name != NULL) { + gss_release_name (&minor, src_name); + *src_name = NULL; + } + *context_handle = GSS_C_NO_CONTEXT; + return ret; } diff --git a/kerberosV/src/lib/gssapi/acquire_cred.c b/kerberosV/src/lib/gssapi/acquire_cred.c index fc998c59752..f45e8bcb782 100644 --- a/kerberosV/src/lib/gssapi/acquire_cred.c +++ b/kerberosV/src/lib/gssapi/acquire_cred.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,183 @@ #include "gssapi_locl.h" -RCSID("$KTH: acquire_cred.c,v 1.7 2001/07/06 15:33:28 assar Exp $"); +RCSID("$KTH: acquire_cred.c,v 1.13 2003/04/06 00:31:55 lha Exp $"); + +static krb5_error_code +get_keytab(krb5_keytab *keytab) +{ + char kt_name[256]; + krb5_error_code kret; + + if (gssapi_krb5_keytab != NULL) { + kret = krb5_kt_get_name(gssapi_krb5_context, + gssapi_krb5_keytab, + kt_name, sizeof(kt_name)); + if (kret == 0) + kret = krb5_kt_resolve(gssapi_krb5_context, kt_name, keytab); + } else + kret = krb5_kt_default(gssapi_krb5_context, keytab); + return (kret); +} + +static OM_uint32 acquire_initiator_cred + (OM_uint32 * minor_status, + const gss_name_t desired_name, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t handle, + gss_OID_set * actual_mechs, + OM_uint32 * time_rec + ) +{ + OM_uint32 ret; + krb5_creds cred; + krb5_principal def_princ; + krb5_get_init_creds_opt opt; + krb5_ccache ccache; + krb5_keytab keytab; + krb5_error_code kret; + + keytab = NULL; + ccache = NULL; + def_princ = NULL; + ret = GSS_S_FAILURE; + memset(&cred, 0, sizeof(cred)); + + kret = krb5_cc_default(gssapi_krb5_context, &ccache); + if (kret) + goto end; + kret = krb5_cc_get_principal(gssapi_krb5_context, ccache, + &def_princ); + if (kret != 0) { + /* we'll try to use a keytab below */ + krb5_cc_destroy(gssapi_krb5_context, ccache); + ccache = NULL; + kret = 0; + } else if (handle->principal == NULL) { + kret = krb5_copy_principal(gssapi_krb5_context, def_princ, + &handle->principal); + if (kret) + goto end; + } else if (handle->principal != NULL && + krb5_principal_compare(gssapi_krb5_context, handle->principal, + def_princ) == FALSE) { + /* Before failing, lets check the keytab */ + krb5_free_principal(gssapi_krb5_context, def_princ); + def_princ = NULL; + } + if (def_princ == NULL) { + /* We have no existing credentials cache, + * so attempt to get a TGT using a keytab. + */ + if (handle->principal == NULL) { + kret = krb5_get_default_principal(gssapi_krb5_context, + &handle->principal); + if (kret) + goto end; + } + kret = get_keytab(&keytab); + if (kret) + goto end; + krb5_get_init_creds_opt_init(&opt); + kret = krb5_get_init_creds_keytab(gssapi_krb5_context, &cred, + handle->principal, keytab, 0, NULL, &opt); + if (kret) + goto end; + kret = krb5_cc_gen_new(gssapi_krb5_context, &krb5_mcc_ops, + &ccache); + if (kret) + goto end; + kret = krb5_cc_initialize(gssapi_krb5_context, ccache, cred.client); + if (kret) + goto end; + kret = krb5_cc_store_cred(gssapi_krb5_context, ccache, &cred); + if (kret) + goto end; + handle->lifetime = cred.times.endtime; + } else { + krb5_creds in_cred, *out_cred; + krb5_const_realm realm; + + memset(&in_cred, 0, sizeof(in_cred)); + in_cred.client = handle->principal; + + realm = krb5_principal_get_realm(gssapi_krb5_context, + handle->principal); + if (realm == NULL) { + kret = KRB5_PRINC_NOMATCH; /* XXX */ + goto end; + } + + kret = krb5_make_principal(gssapi_krb5_context, &in_cred.server, + realm, KRB5_TGS_NAME, realm, NULL); + if (kret) + goto end; + + kret = krb5_get_credentials(gssapi_krb5_context, 0, + ccache, &in_cred, &out_cred); + krb5_free_principal(gssapi_krb5_context, in_cred.server); + if (kret) + goto end; + + handle->lifetime = out_cred->times.endtime; + krb5_free_creds(gssapi_krb5_context, out_cred); + } + + handle->ccache = ccache; + ret = GSS_S_COMPLETE; + +end: + if (cred.client != NULL) + krb5_free_creds_contents(gssapi_krb5_context, &cred); + if (def_princ != NULL) + krb5_free_principal(gssapi_krb5_context, def_princ); + if (keytab != NULL) + krb5_kt_close(gssapi_krb5_context, keytab); + if (ret != GSS_S_COMPLETE) { + if (ccache != NULL) + krb5_cc_close(gssapi_krb5_context, ccache); + if (kret != 0) { + *minor_status = kret; + gssapi_krb5_set_error_string (); + } + } + return (ret); +} + +static OM_uint32 acquire_acceptor_cred + (OM_uint32 * minor_status, + const gss_name_t desired_name, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t handle, + gss_OID_set * actual_mechs, + OM_uint32 * time_rec + ) +{ + OM_uint32 ret; + krb5_error_code kret; + + kret = 0; + ret = GSS_S_FAILURE; + kret = get_keytab(&handle->keytab); + if (kret) + goto end; + ret = GSS_S_COMPLETE; + +end: + if (ret != GSS_S_COMPLETE) { + if (handle->keytab != NULL) + krb5_kt_close(gssapi_krb5_context, handle->keytab); + if (kret != 0) { + *minor_status = kret; + gssapi_krb5_set_error_string (); + } + } + return (ret); +} OM_uint32 gss_acquire_cred (OM_uint32 * minor_status, @@ -48,129 +224,80 @@ OM_uint32 gss_acquire_cred { gss_cred_id_t handle; OM_uint32 ret; - krb5_error_code kret = 0; - krb5_ccache ccache; - handle = (gss_cred_id_t)malloc(sizeof(*handle)); - if (handle == GSS_C_NO_CREDENTIAL) - return GSS_S_FAILURE; - - memset(handle, 0, sizeof (*handle)); + GSSAPI_KRB5_INIT (); - ret = gss_duplicate_name(minor_status, desired_name, &handle->principal); - if (ret) { - free(handle); - return ret; - } + *output_cred_handle = NULL; + if (time_rec) + *time_rec = 0; + if (actual_mechs) + *actual_mechs = GSS_C_NO_OID_SET; - if (krb5_cc_default(gssapi_krb5_context, &ccache) == 0) { - krb5_principal def_princ; + if (desired_mechs) { + OM_uint32 present = 0; - if (krb5_cc_get_principal(gssapi_krb5_context, ccache, - &def_princ) != 0) { - krb5_cc_close(gssapi_krb5_context, ccache); - goto try_keytab; - } - if (krb5_principal_compare(gssapi_krb5_context, handle->principal, - def_princ) == FALSE) { - krb5_free_principal(gssapi_krb5_context, def_princ); - krb5_cc_close(gssapi_krb5_context, ccache); - goto try_keytab; - } - handle->ccache = ccache; - handle->keytab = NULL; - krb5_free_principal(gssapi_krb5_context, def_princ); - } else { - krb5_creds cred; - krb5_get_init_creds_opt opt; - - try_keytab: - if (gssapi_krb5_keytab != NULL) { - char kt_name[256]; - - kret = krb5_kt_get_name(gssapi_krb5_context, - gssapi_krb5_keytab, - kt_name, sizeof(kt_name)); - if (kret) - goto krb5_bad; - kret = krb5_kt_resolve(gssapi_krb5_context, kt_name, - &handle->keytab); - if (kret) - goto krb5_bad; - } else { - kret = krb5_kt_default(gssapi_krb5_context, &handle->keytab); - if (kret != 0) - goto krb5_bad; + ret = gss_test_oid_set_member(minor_status, GSS_KRB5_MECHANISM, + desired_mechs, &present); + if (ret) + return ret; + if (!present) { + *minor_status = 0; + return GSS_S_BAD_MECH; } + } - krb5_get_init_creds_opt_init(&opt); - memset(&cred, 0, sizeof(cred)); + handle = (gss_cred_id_t)malloc(sizeof(*handle)); + if (handle == GSS_C_NO_CREDENTIAL) { + *minor_status = ENOMEM; + return (GSS_S_FAILURE); + } - kret = krb5_get_init_creds_keytab(gssapi_krb5_context, &cred, - handle->principal, handle->keytab, - 0, NULL, &opt); - if (kret != 0) - goto krb5_bad; + memset(handle, 0, sizeof (*handle)); - kret = krb5_cc_gen_new(gssapi_krb5_context, &krb5_mcc_ops, - &handle->ccache); - if (kret != 0) { - krb5_free_creds_contents(gssapi_krb5_context, &cred); - goto krb5_bad; + if (desired_name != GSS_C_NO_NAME) { + ret = gss_duplicate_name(minor_status, desired_name, + &handle->principal); + if (ret != GSS_S_COMPLETE) { + free(handle); + return (ret); } - - kret = krb5_cc_initialize(gssapi_krb5_context, handle->ccache, - cred.client); - if (kret != 0) { - krb5_free_creds_contents(gssapi_krb5_context, &cred); - goto krb5_bad; + } + if (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH) { + ret = acquire_initiator_cred(minor_status, desired_name, time_req, + desired_mechs, cred_usage, handle, actual_mechs, time_rec); + if (ret != GSS_S_COMPLETE) { + free(handle); + return (ret); } - - kret = krb5_cc_store_cred(gssapi_krb5_context, handle->ccache, &cred); - if (kret != 0) { - krb5_free_creds_contents(gssapi_krb5_context, &cred); - goto krb5_bad; + } else if (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH) { + ret = acquire_acceptor_cred(minor_status, desired_name, time_req, + desired_mechs, cred_usage, handle, actual_mechs, time_rec); + if (ret != GSS_S_COMPLETE) { + free(handle); + return (ret); } - - krb5_free_creds_contents(gssapi_krb5_context, &cred); + } else { + free(handle); + *minor_status = GSS_KRB5_S_G_BAD_USAGE; + return GSS_S_FAILURE; } - - /* XXX */ - handle->lifetime = time_req; - handle->usage = cred_usage; - ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms); - if (ret) - goto gssapi_bad; - - ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, + if (ret == GSS_S_COMPLETE) + ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, &handle->mechanisms); - if (ret) - goto gssapi_bad; - - ret = gss_inquire_cred(minor_status, handle, NULL, time_rec, NULL, + if (ret == GSS_S_COMPLETE) + ret = gss_inquire_cred(minor_status, handle, NULL, time_rec, NULL, actual_mechs); - if (ret) - goto gssapi_bad; - + if (ret != GSS_S_COMPLETE) { + if (handle->mechanisms != NULL) + gss_release_oid_set(NULL, &handle->mechanisms); + free(handle); + return (ret); + } + *minor_status = 0; + if (time_rec) + *time_rec = handle->lifetime; + handle->usage = cred_usage; *output_cred_handle = handle; return (GSS_S_COMPLETE); - - krb5_bad: - ret = GSS_S_FAILURE; - *minor_status = kret; - gssapi_krb5_set_error_string (); - - gssapi_bad: - krb5_free_principal(gssapi_krb5_context, handle->principal); - if (handle->ccache != NULL) - krb5_cc_close(gssapi_krb5_context, handle->ccache); - if (handle->keytab != NULL) - krb5_kt_close(gssapi_krb5_context, handle->keytab); - if (handle->mechanisms != NULL) - gss_release_oid_set(NULL, &handle->mechanisms); - - free(handle); - - return (ret); } diff --git a/kerberosV/src/lib/gssapi/add_cred.c b/kerberosV/src/lib/gssapi/add_cred.c new file mode 100644 index 00000000000..930aa72f405 --- /dev/null +++ b/kerberosV/src/lib/gssapi/add_cred.c @@ -0,0 +1,216 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$KTH: add_cred.c,v 1.2 2003/04/06 00:29:17 lha Exp $"); + +OM_uint32 gss_add_cred ( + OM_uint32 *minor_status, + const gss_cred_id_t input_cred_handle, + const gss_name_t desired_name, + const gss_OID desired_mech, + gss_cred_usage_t cred_usage, + OM_uint32 initiator_time_req, + OM_uint32 acceptor_time_req, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *initiator_time_rec, + OM_uint32 *acceptor_time_rec) +{ + OM_uint32 ret, lifetime; + gss_cred_id_t cred, handle; + + handle = NULL; + cred = input_cred_handle; + + if (gss_oid_equal(desired_mech, GSS_KRB5_MECHANISM) == 0) { + *minor_status = 0; + return GSS_S_BAD_MECH; + } + + if (cred == GSS_C_NO_CREDENTIAL && output_cred_handle == NULL) { + *minor_status = 0; + return GSS_S_NO_CRED; + } + + /* check if requested output usage is compatible with output usage */ + if (output_cred_handle != NULL && + (cred->usage != cred_usage && cred->usage != GSS_C_BOTH)) { + *minor_status = GSS_KRB5_S_G_BAD_USAGE; + return(GSS_S_FAILURE); + } + + /* check that we have the same name */ + if (desired_name != GSS_C_NO_NAME && + krb5_principal_compare(gssapi_krb5_context, desired_name, + cred->principal) != FALSE) { + *minor_status = 0; + return GSS_S_BAD_NAME; + } + + /* make a copy */ + if (output_cred_handle) { + + handle = (gss_cred_id_t)malloc(sizeof(*handle)); + if (handle == GSS_C_NO_CREDENTIAL) { + *minor_status = ENOMEM; + return (GSS_S_FAILURE); + } + + memset(handle, 0, sizeof (*handle)); + + handle->usage = cred_usage; + handle->lifetime = cred->lifetime; + handle->principal = NULL; + handle->keytab = NULL; + handle->ccache = NULL; + handle->mechanisms = NULL; + + ret = GSS_S_FAILURE; + + ret = gss_duplicate_name(minor_status, cred->principal, + &handle->principal); + if (ret) { + free(handle); + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + + if (cred->keytab) { + krb5_error_code kret; + char name[KRB5_KT_PREFIX_MAX_LEN + MAXPATHLEN]; + int len; + + ret = GSS_S_FAILURE; + + kret = krb5_kt_get_type(gssapi_krb5_context, cred->keytab, + name, KRB5_KT_PREFIX_MAX_LEN); + if (kret) { + *minor_status = kret; + goto failure; + } + len = strlen(name); + name[len++] = ':'; + + kret = krb5_kt_get_name(gssapi_krb5_context, cred->keytab, + name + len, + sizeof(name) - len); + if (kret) { + *minor_status = kret; + goto failure; + } + + kret = krb5_kt_resolve(gssapi_krb5_context, name, + &handle->keytab); + if (kret){ + *minor_status = kret; + goto failure; + } + } + + if (cred->ccache) { + krb5_error_code kret; + const char *type, *name; + char *type_name; + + ret = GSS_S_FAILURE; + + type = krb5_cc_get_type(gssapi_krb5_context, cred->ccache); + if (type == NULL){ + *minor_status = ENOMEM; + goto failure; + } + + name = krb5_cc_get_name(gssapi_krb5_context, cred->ccache); + if (name == NULL) { + *minor_status = ENOMEM; + goto failure; + } + + asprintf(&type_name, "%s:%s", type, name); + if (type_name == NULL) { + *minor_status = ENOMEM; + goto failure; + } + + kret = krb5_cc_resolve(gssapi_krb5_context, type_name, + &handle->ccache); + free(type_name); + if (kret) { + *minor_status = kret; + goto failure; + } + } + + ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms); + if (ret) + goto failure; + + ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, + &handle->mechanisms); + if (ret) + goto failure; + } + + ret = gss_inquire_cred(minor_status, cred, NULL, &lifetime, + NULL, actual_mechs); + if (ret) + goto failure; + + if (initiator_time_rec) + *initiator_time_rec = lifetime; + if (acceptor_time_rec) + *acceptor_time_rec = lifetime; + + if (output_cred_handle) + *output_cred_handle = handle; + + *minor_status = 0; + return ret; + + failure: + + if (handle) { + if (handle->principal) + gss_release_name(NULL, &handle->principal); + if (handle->keytab) + krb5_kt_close(gssapi_krb5_context, handle->keytab); + if (handle->ccache) + krb5_cc_destroy(gssapi_krb5_context, handle->ccache); + if (handle->mechanisms) + gss_release_oid_set(NULL, &handle->mechanisms); + free(handle); + } + return ret; +} diff --git a/kerberosV/src/lib/gssapi/add_oid_set_member.c b/kerberosV/src/lib/gssapi/add_oid_set_member.c index de4210a9190..a9e88e016f0 100644 --- a/kerberosV/src/lib/gssapi/add_oid_set_member.c +++ b/kerberosV/src/lib/gssapi/add_oid_set_member.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: add_oid_set_member.c,v 1.7 2001/02/18 03:39:08 assar Exp $"); +RCSID("$KTH: add_oid_set_member.c,v 1.8 2003/03/16 17:50:49 lha Exp $"); OM_uint32 gss_add_oid_set_member ( OM_uint32 * minor_status, @@ -50,8 +50,10 @@ OM_uint32 gss_add_oid_set_member ( if (res != GSS_S_COMPLETE) return res; - if (present) + if (present) { + *minor_status = 0; return GSS_S_COMPLETE; + } n = (*oid_set)->count + 1; tmp = realloc ((*oid_set)->elements, n * sizeof(gss_OID_desc)); @@ -62,5 +64,6 @@ OM_uint32 gss_add_oid_set_member ( (*oid_set)->elements = tmp; (*oid_set)->count = n; (*oid_set)->elements[n-1] = *member_oid; + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/compare_name.c b/kerberosV/src/lib/gssapi/compare_name.c index 256770db4ab..98d875d6c5a 100644 --- a/kerberosV/src/lib/gssapi/compare_name.c +++ b/kerberosV/src/lib/gssapi/compare_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: compare_name.c,v 1.2 1999/12/02 17:05:03 joda Exp $"); +RCSID("$KTH: compare_name.c,v 1.4 2003/03/16 17:50:07 lha Exp $"); OM_uint32 gss_compare_name (OM_uint32 * minor_status, @@ -42,8 +42,10 @@ OM_uint32 gss_compare_name int * name_equal ) { - gssapi_krb5_init (); + GSSAPI_KRB5_INIT(); + *name_equal = krb5_principal_compare (gssapi_krb5_context, name1, name2); + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/compat.c b/kerberosV/src/lib/gssapi/compat.c new file mode 100644 index 00000000000..1d4b6e4add6 --- /dev/null +++ b/kerberosV/src/lib/gssapi/compat.c @@ -0,0 +1,113 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$Id: compat.c,v 1.1.1.1 2003/05/11 02:15:38 hin Exp $"); + + +static krb5_error_code +check_compat(OM_uint32 *minor_status, gss_name_t name, + const char *option, krb5_boolean *compat, + krb5_boolean match_val) +{ + krb5_error_code ret = 0; + char **p, **q; + krb5_principal match; + + + p = krb5_config_get_strings(gssapi_krb5_context, NULL, "gssapi", + option, NULL); + if(p == NULL) + return 0; + + for(q = p; *q; q++) { + + ret = krb5_parse_name(gssapi_krb5_context, *q, &match); + if (ret) + break; + + if (krb5_principal_match(gssapi_krb5_context, name, match)) { + *compat = match_val; + break; + } + + krb5_free_principal(gssapi_krb5_context, match); + } + krb5_config_free_strings(p); + + if (ret) { + *minor_status = ret; + return GSS_S_FAILURE; + } + + return 0; +} + +OM_uint32 +_gss_DES3_get_mic_compat(OM_uint32 *minor_status, gss_ctx_id_t ctx) +{ + krb5_boolean use_compat = TRUE; + OM_uint32 ret; + + if ((ctx->more_flags & COMPAT_OLD_DES3_SELECTED) == 0) { + ret = check_compat(minor_status, ctx->target, + "broken_des3_mic", &use_compat, TRUE); + if (ret) + return ret; + ret = check_compat(minor_status, ctx->target, + "correct_des3_mic", &use_compat, FALSE); + if (ret) + return ret; + + if (use_compat) + ctx->more_flags |= COMPAT_OLD_DES3; + ctx->more_flags |= COMPAT_OLD_DES3_SELECTED; + } + return 0; +} + +OM_uint32 +gss_krb5_compat_des3_mic(OM_uint32 *minor_status, gss_ctx_id_t ctx, int on) +{ + *minor_status = 0; + + if (on) { + ctx->more_flags |= COMPAT_OLD_DES3; + } else { + ctx->more_flags &= ~COMPAT_OLD_DES3; + } + ctx->more_flags |= COMPAT_OLD_DES3_SELECTED; + + return 0; +} diff --git a/kerberosV/src/lib/gssapi/context_time.c b/kerberosV/src/lib/gssapi/context_time.c index 58ef68eca6d..6c1abd6de02 100644 --- a/kerberosV/src/lib/gssapi/context_time.c +++ b/kerberosV/src/lib/gssapi/context_time.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: context_time.c,v 1.5 2001/05/11 09:16:45 assar Exp $"); +RCSID("$KTH: context_time.c,v 1.7 2003/03/16 17:48:33 lha Exp $"); OM_uint32 gss_context_time (OM_uint32 * minor_status, @@ -46,7 +46,7 @@ OM_uint32 gss_context_time krb5_error_code kret; krb5_timestamp timeret; - gssapi_krb5_init(); + GSSAPI_KRB5_INIT (); ret = gss_inquire_context(minor_status, context_handle, NULL, NULL, &lifetime, NULL, NULL, NULL, NULL); @@ -62,5 +62,6 @@ OM_uint32 gss_context_time } *time_rec = lifetime - timeret; + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/copy_ccache.c b/kerberosV/src/lib/gssapi/copy_ccache.c index 4318f93180c..f4bff055140 100644 --- a/kerberosV/src/lib/gssapi/copy_ccache.c +++ b/kerberosV/src/lib/gssapi/copy_ccache.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 2000 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,25 +33,26 @@ #include "gssapi_locl.h" -RCSID("$KTH: copy_ccache.c,v 1.2 2001/05/11 09:16:45 assar Exp $"); +RCSID("$KTH: copy_ccache.c,v 1.3 2003/03/16 17:47:44 lha Exp $"); OM_uint32 -gss_krb5_copy_ccache(OM_uint32 *minor, +gss_krb5_copy_ccache(OM_uint32 *minor_status, gss_cred_id_t cred, krb5_ccache out) { krb5_error_code kret; if (cred->ccache == NULL) { - *minor = EINVAL; + *minor_status = EINVAL; return GSS_S_FAILURE; } kret = krb5_cc_copy_cache(gssapi_krb5_context, cred->ccache, out); if (kret) { - *minor = kret; + *minor_status = kret; gssapi_krb5_set_error_string (); return GSS_S_FAILURE; } + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/create_emtpy_oid_set.c b/kerberosV/src/lib/gssapi/create_emtpy_oid_set.c index 77c30cd1da4..2641f4bcddc 100644 --- a/kerberosV/src/lib/gssapi/create_emtpy_oid_set.c +++ b/kerberosV/src/lib/gssapi/create_emtpy_oid_set.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: create_emtpy_oid_set.c,v 1.4 2001/02/18 03:39:08 assar Exp $"); +RCSID("$KTH: create_emtpy_oid_set.c,v 1.5 2003/03/16 17:47:07 lha Exp $"); OM_uint32 gss_create_empty_oid_set ( OM_uint32 * minor_status, @@ -47,5 +47,6 @@ OM_uint32 gss_create_empty_oid_set ( } (*oid_set)->count = 0; (*oid_set)->elements = NULL; + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/delete_sec_context.c b/kerberosV/src/lib/gssapi/delete_sec_context.c index c28cb36e535..70c1ade3f9b 100644 --- a/kerberosV/src/lib/gssapi/delete_sec_context.c +++ b/kerberosV/src/lib/gssapi/delete_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: delete_sec_context.c,v 1.9 2001/05/10 15:23:04 assar Exp $"); +RCSID("$KTH: delete_sec_context.c,v 1.11 2003/03/16 17:46:40 lha Exp $"); OM_uint32 gss_delete_sec_context (OM_uint32 * minor_status, @@ -41,28 +41,29 @@ OM_uint32 gss_delete_sec_context gss_buffer_t output_token ) { - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); - if (output_token) { - output_token->length = 0; - output_token->value = NULL; - } + if (output_token) { + output_token->length = 0; + output_token->value = NULL; + } - krb5_auth_con_free (gssapi_krb5_context, - (*context_handle)->auth_context); - if((*context_handle)->source) - krb5_free_principal (gssapi_krb5_context, - (*context_handle)->source); - if((*context_handle)->target) - krb5_free_principal (gssapi_krb5_context, - (*context_handle)->target); - if ((*context_handle)->ticket) { - krb5_free_ticket (gssapi_krb5_context, - (*context_handle)->ticket); - free((*context_handle)->ticket); - } + krb5_auth_con_free (gssapi_krb5_context, + (*context_handle)->auth_context); + if((*context_handle)->source) + krb5_free_principal (gssapi_krb5_context, + (*context_handle)->source); + if((*context_handle)->target) + krb5_free_principal (gssapi_krb5_context, + (*context_handle)->target); + if ((*context_handle)->ticket) { + krb5_free_ticket (gssapi_krb5_context, + (*context_handle)->ticket); + free((*context_handle)->ticket); + } - free (*context_handle); - *context_handle = GSS_C_NO_CONTEXT; - return GSS_S_COMPLETE; + free (*context_handle); + *context_handle = GSS_C_NO_CONTEXT; + *minor_status = 0; + return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/display_name.c b/kerberosV/src/lib/gssapi/display_name.c index c499e2244ab..15f6ad24631 100644 --- a/kerberosV/src/lib/gssapi/display_name.c +++ b/kerberosV/src/lib/gssapi/display_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: display_name.c,v 1.7 2001/05/11 09:16:46 assar Exp $"); +RCSID("$KTH: display_name.c,v 1.9 2003/03/16 17:46:11 lha Exp $"); OM_uint32 gss_display_name (OM_uint32 * minor_status, @@ -42,31 +42,32 @@ OM_uint32 gss_display_name gss_OID * output_name_type ) { - krb5_error_code kret; - char *buf; - size_t len; + krb5_error_code kret; + char *buf; + size_t len; - gssapi_krb5_init (); - kret = krb5_unparse_name (gssapi_krb5_context, - input_name, - &buf); - if (kret) { - *minor_status = kret; - gssapi_krb5_set_error_string (); - return GSS_S_FAILURE; - } - len = strlen (buf); - output_name_buffer->length = len; - output_name_buffer->value = malloc(len + 1); - if (output_name_buffer->value == NULL) { + GSSAPI_KRB5_INIT (); + kret = krb5_unparse_name (gssapi_krb5_context, + input_name, + &buf); + if (kret) { + *minor_status = kret; + gssapi_krb5_set_error_string (); + return GSS_S_FAILURE; + } + len = strlen (buf); + output_name_buffer->length = len; + output_name_buffer->value = malloc(len + 1); + if (output_name_buffer->value == NULL) { + free (buf); + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + memcpy (output_name_buffer->value, buf, len); + ((char *)output_name_buffer->value)[len] = '\0'; free (buf); - *minor_status = ENOMEM; - return GSS_S_FAILURE; - } - memcpy (output_name_buffer->value, buf, len); - ((char *)output_name_buffer->value)[len] = '\0'; - free (buf); - if (output_name_type) - *output_name_type = GSS_KRB5_NT_PRINCIPAL_NAME; - return GSS_S_COMPLETE; + if (output_name_type) + *output_name_type = GSS_KRB5_NT_PRINCIPAL_NAME; + *minor_status = 0; + return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/display_status.c b/kerberosV/src/lib/gssapi/display_status.c index b529afecab9..7f1bcb8fcfd 100644 --- a/kerberosV/src/lib/gssapi/display_status.c +++ b/kerberosV/src/lib/gssapi/display_status.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1998 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: display_status.c,v 1.7 2001/08/23 04:34:41 assar Exp $"); +RCSID("$KTH: display_status.c,v 1.9 2003/03/16 17:45:36 lha Exp $"); static char *krb5_error_string; @@ -93,6 +93,26 @@ routine_error(OM_uint32 v) return msgs[v]; } +static char * +supplementary_error(OM_uint32 v) +{ + static char *msgs[] = { + "normal completion", + "continuation call to routine required", + "duplicate per-message token detected", + "timed-out per-message token detected", + "reordered (early) per-message token detected", + "skipped predecessor token(s) detected" + }; + + v >>= GSS_C_SUPPLEMENTARY_OFFSET; + + if (v >= sizeof(msgs)/sizeof(*msgs)) + return "unknown routine error"; + else + return msgs[v]; +} + void gssapi_krb5_set_error_string (void) { @@ -117,18 +137,25 @@ OM_uint32 gss_display_status { char *buf; - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); - *minor_status = 0; + status_string->length = 0; + status_string->value = NULL; - if (mech_type != GSS_C_NO_OID && - mech_type != GSS_KRB5_MECHANISM) - return GSS_S_BAD_MECH; + if (gss_oid_equal(mech_type, GSS_C_NO_OID) == 0 && + gss_oid_equal(mech_type, GSS_KRB5_MECHANISM) == 0) { + *minor_status = 0; + return GSS_C_GSS_CODE; + } if (status_type == GSS_C_GSS_CODE) { - asprintf (&buf, "%s %s", - calling_error(GSS_CALLING_ERROR(status_value)), - routine_error(GSS_ROUTINE_ERROR(status_value))); + if (GSS_SUPPLEMENTARY_INFO(status_value)) + asprintf(&buf, "%s", + supplementary_error(GSS_SUPPLEMENTARY_INFO(status_value))); + else + asprintf (&buf, "%s %s", + calling_error(GSS_CALLING_ERROR(status_value)), + routine_error(GSS_ROUTINE_ERROR(status_value))); } else if (status_type == GSS_C_MECH_CODE) { buf = gssapi_krb5_get_error_string (); if (buf == NULL) { @@ -140,8 +167,10 @@ OM_uint32 gss_display_status else buf = strdup(tmp); } - } else + } else { + *minor_status = EINVAL; return GSS_S_BAD_STATUS; + } if (buf == NULL) { *minor_status = ENOMEM; @@ -149,6 +178,7 @@ OM_uint32 gss_display_status } *message_context = 0; + *minor_status = 0; status_string->length = strlen(buf); status_string->value = buf; diff --git a/kerberosV/src/lib/gssapi/duplicate_name.c b/kerberosV/src/lib/gssapi/duplicate_name.c index cd16bf95720..09f7ffaf10a 100644 --- a/kerberosV/src/lib/gssapi/duplicate_name.c +++ b/kerberosV/src/lib/gssapi/duplicate_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: duplicate_name.c,v 1.5 2001/05/11 09:16:46 assar Exp $"); +RCSID("$KTH: duplicate_name.c,v 1.7 2003/03/16 17:44:26 lha Exp $"); OM_uint32 gss_duplicate_name ( OM_uint32 * minor_status, @@ -41,18 +41,19 @@ OM_uint32 gss_duplicate_name ( gss_name_t * dest_name ) { - krb5_error_code kret; + krb5_error_code kret; - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); - kret = krb5_copy_principal (gssapi_krb5_context, - src_name, - dest_name); - if (kret) { - *minor_status = kret; - gssapi_krb5_set_error_string (); - return GSS_S_FAILURE; - } else { - return GSS_S_COMPLETE; - } + kret = krb5_copy_principal (gssapi_krb5_context, + src_name, + dest_name); + if (kret) { + *minor_status = kret; + gssapi_krb5_set_error_string (); + return GSS_S_FAILURE; + } else { + *minor_status = 0; + return GSS_S_COMPLETE; + } } diff --git a/kerberosV/src/lib/gssapi/export_name.c b/kerberosV/src/lib/gssapi/export_name.c index 5f5e116c55a..d5eecddfb62 100644 --- a/kerberosV/src/lib/gssapi/export_name.c +++ b/kerberosV/src/lib/gssapi/export_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 1999, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: export_name.c,v 1.4 1999/12/02 17:05:03 joda Exp $"); +RCSID("$KTH: export_name.c,v 1.5 2003/03/16 17:34:46 lha Exp $"); OM_uint32 gss_export_name (OM_uint32 * minor_status, @@ -41,8 +41,54 @@ OM_uint32 gss_export_name gss_buffer_t exported_name ) { - return gss_display_name(minor_status, - input_name, - exported_name, - NULL); + krb5_error_code kret; + char *buf, *name; + size_t len; + + GSSAPI_KRB5_INIT (); + kret = krb5_unparse_name (gssapi_krb5_context, + input_name, + &name); + if (kret) { + *minor_status = kret; + gssapi_krb5_set_error_string (); + return GSS_S_FAILURE; + } + len = strlen (name); + + exported_name->length = 10 + len + GSS_KRB5_MECHANISM->length; + exported_name->value = malloc(exported_name->length); + if (exported_name->value == NULL) { + free (name); + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + + /* TOK, MECH_OID_LEN, DER(MECH_OID), NAME_LEN, NAME */ + + buf = exported_name->value; + memcpy(buf, "\x04\x01", 2); + buf += 2; + buf[0] = ((GSS_KRB5_MECHANISM->length + 2) >> 8) & 0xff; + buf[1] = (GSS_KRB5_MECHANISM->length + 2) & 0xff; + buf+= 2; + buf[0] = 0x06; + buf[1] = (GSS_KRB5_MECHANISM->length) & 0xFF; + buf+= 2; + + memcpy(buf, GSS_KRB5_MECHANISM->elements, GSS_KRB5_MECHANISM->length); + buf += GSS_KRB5_MECHANISM->length; + + buf[0] = (len >> 24) & 0xff; + buf[1] = (len >> 16) & 0xff; + buf[2] = (len >> 8) & 0xff; + buf[3] = (len) & 0xff; + buf += 4; + + memcpy (buf, name, len); + + free (name); + + *minor_status = 0; + return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/export_sec_context.c b/kerberosV/src/lib/gssapi/export_sec_context.c index de7dede3357..87e6dc94df8 100644 --- a/kerberosV/src/lib/gssapi/export_sec_context.c +++ b/kerberosV/src/lib/gssapi/export_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: export_sec_context.c,v 1.4 2001/02/18 03:39:09 assar Exp $"); +RCSID("$KTH: export_sec_context.c,v 1.6 2003/03/16 18:02:52 lha Exp $"); OM_uint32 gss_export_sec_context ( @@ -51,9 +51,11 @@ gss_export_sec_context ( OM_uint32 minor; krb5_error_code kret; - gssapi_krb5_init (); - if (!((*context_handle)->flags & GSS_C_TRANS_FLAG)) + GSSAPI_KRB5_INIT (); + if (!((*context_handle)->flags & GSS_C_TRANS_FLAG)) { + *minor_status = 0; return GSS_S_UNAVAILABLE; + } sp = krb5_storage_emem (); if (sp == NULL) { @@ -145,27 +147,6 @@ gss_export_sec_context ( goto failure; } -#if 0 - { - size_t sz; - unsigned char auth_buf[1024]; - - ret = encode_Authenticator (auth_buf, sizeof(auth_buf), - ac->authenticator, &sz); - if (ret) { - krb5_storage_free (sp); - *minor_status = ret; - return GSS_S_FAILURE; - } - data.data = auth_buf; - data.length = sz; - kret = krb5_store_data (sp, data); - if (kret) { - *minor_status = kret; - goto failure; - } - } -#endif kret = krb5_store_int32 (sp, ac->keytype); if (kret) { *minor_status = kret; @@ -196,6 +177,9 @@ gss_export_sec_context ( goto failure; data.data = buffer.value; data.length = buffer.length; + + ret = GSS_S_FAILURE; + kret = krb5_store_data (sp, data); gss_release_buffer (&minor, &buffer); if (kret) { @@ -213,6 +197,11 @@ gss_export_sec_context ( *minor_status = kret; goto failure; } + kret = krb5_store_int32 (sp, (*context_handle)->lifetime); + if (kret) { + *minor_status = kret; + goto failure; + } kret = krb5_storage_to_data (sp, &data); krb5_storage_free (sp); @@ -226,6 +215,7 @@ gss_export_sec_context ( GSS_C_NO_BUFFER); if (ret != GSS_S_COMPLETE) gss_release_buffer (NULL, interprocess_token); + *minor_status = 0; return ret; failure: krb5_storage_free (sp); diff --git a/kerberosV/src/lib/gssapi/get_mic.c b/kerberosV/src/lib/gssapi/get_mic.c index 360367a036d..6638448467d 100644 --- a/kerberosV/src/lib/gssapi/get_mic.c +++ b/kerberosV/src/lib/gssapi/get_mic.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: get_mic.c,v 1.18 2001/06/18 02:50:15 assar Exp $"); +RCSID("$KTH: get_mic.c,v 1.21 2003/03/16 18:02:04 lha Exp $"); static OM_uint32 mic_des @@ -115,6 +115,7 @@ mic_des memset (deskey, 0, sizeof(deskey)); memset (schedule, 0, sizeof(schedule)); + *minor_status = 0; return GSS_S_COMPLETE; } @@ -139,6 +140,7 @@ mic_des3 krb5_error_code kret; krb5_data encdata; char *tmp; + char ivec[8]; gssapi_krb5_encap_length (36, &len, &total_len); @@ -219,10 +221,15 @@ mic_des3 return GSS_S_FAILURE; } - kret = krb5_encrypt (gssapi_krb5_context, - crypto, - KRB5_KU_USAGE_SEQ, - seq, 8, &encdata); + if (context_handle->more_flags & COMPAT_OLD_DES3) + memset(ivec, 0, 8); + else + memcpy(ivec, p + 8, 8); + + kret = krb5_encrypt_ivec (gssapi_krb5_context, + crypto, + KRB5_KU_USAGE_SEQ, + seq, 8, &encdata, ivec); krb5_crypto_destroy (gssapi_krb5_context, crypto); if (kret) { free (message_token->value); @@ -236,15 +243,12 @@ mic_des3 memcpy (p, encdata.data, encdata.length); krb5_data_free (&encdata); - p += 8 + cksum.checksum.length; - - memcpy (p, message_buffer->value, message_buffer->length); - krb5_auth_con_setlocalseqnumber (gssapi_krb5_context, context_handle->auth_context, ++seq_number); free_Checksum (&cksum); + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/gss_acquire_cred.3 b/kerberosV/src/lib/gssapi/gss_acquire_cred.3 new file mode 100644 index 00000000000..b96ddf6c808 --- /dev/null +++ b/kerberosV/src/lib/gssapi/gss_acquire_cred.3 @@ -0,0 +1,465 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $Id: gss_acquire_cred.3,v 1.1 2003/05/11 02:15:39 hin Exp $ +.\" +.Dd April 2, 2003 +.Dt GSS_ACQUIRE_CRED 3 +.Os HEIMDAL +.Sh NAME +.Nm gss_accept_sec_context , +.Nm gss_acquire_cred , +.Nm gss_add_cred , +.Nm gss_add_oid_set_member , +.Nm gss_canonicalize_name , +.Nm gss_compare_name , +.Nm gss_context_time , +.Nm gss_create_empty_oid_set , +.Nm gss_delete_sec_context , +.Nm gss_display_name , +.Nm gss_display_status , +.Nm gss_duplicate_name , +.Nm gss_export_name , +.Nm gss_export_sec_context , +.Nm gss_get_mic , +.Nm gss_import_name , +.Nm gss_import_sec_context , +.Nm gss_indicate_mechs , +.Nm gss_init_sec_context , +.Nm gss_inquire_context , +.Nm gss_inquire_cred , +.Nm gss_inquire_cred_by_mech , +.Nm gss_inquire_mechs_for_name , +.Nm gss_inquire_names_for_mech , +.Nm gss_krb5_copy_ccache , +.Nm gss_krb5_compat_des3_mic , +.Nm gss_process_context_token , +.Nm gss_release_buffer , +.Nm gss_release_cred , +.Nm gss_release_name , +.Nm gss_release_oid_set , +.Nm gss_seal , +.Nm gss_sign , +.Nm gss_test_oid_set_member , +.Nm gss_unseal , +.Nm gss_unwrap , +.Nm gss_verify , +.Nm gss_verify_mic , +.Nm gss_wrap , +.Nm gss_wrap_size_limit +.Nd Generic Security Service Application Program Interface library +.Sh LIBRARY +GSS-API library (libgssapi, -lgssapi) +.Sh SYNOPSIS +.In gssapi.h +.Pp +.Ft OM_uint32 +.Fo gss_accept_sec_context +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t * context_handle" +.Fa "const gss_cred_id_t acceptor_cred_handle" +.Fa "const gss_buffer_t input_token_buffer" +.Fa "const gss_channel_bindings_t input_chan_bindings" +.Fa "gss_name_t * src_name" +.Fa "gss_OID * mech_type" +.Fa "gss_buffer_t output_token" +.Fa "OM_uint32 * ret_flags" +.Fa "OM_uint32 * time_rec" +.Fa "gss_cred_id_t * delegated_cred_handle" +.Fc +.Pp +.Ft OM_uint32 +.Fo gss_acquire_cred +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t desired_name" +.Fa "OM_uint32 time_req" +.Fa "const gss_OID_set desired_mechs" +.Fa "gss_cred_usage_t cred_usage" +.Fa "gss_cred_id_t * output_cred_handle" +.Fa "gss_OID_set * actual_mechs" +.Fa "OM_uint32 * time_rec" +.Fc +.\" .Fn gss_add_cred +.Ft OM_uint32 +.Fo gss_add_oid_set_member +.Fa "OM_uint32 * minor_status" +.Fa "const gss_OID member_oid" +.Fa "gss_OID_set * oid_set" +.Fc +.Ft OM_uint32 +.Fo gss_canonicalize_name +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t input_name" +.Fa "const gss_OID mech_type" +.Fa "gss_name_t * output_name" +.Fc +.Ft OM_uint32 +.Fo gss_compare_name +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t name1" +.Fa "const gss_name_t name2" +.Fa "int * name_equal" +.Fc +.Ft OM_uint32 +.Fo gss_context_time +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "OM_uint32 * time_rec" +.Fc +.Ft OM_uint32 +.Fo gss_create_empty_oid_set +.Fa "OM_uint32 * minor_status" +.Fa "gss_OID_set * oid_set" +.Fc +.Ft OM_uint32 +.Fo gss_delete_sec_context +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t * context_handle" +.Fa "gss_buffer_t output_token" +.Fc +.Ft OM_uint32 +.Fo gss_display_name +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t input_name" +.Fa "gss_buffer_t output_name_buffer" +.Fa "gss_OID * output_name_type" +.Fc +.Ft OM_uint32 +.Fo gss_display_status +.Fa "OM_uint32 *minor_status" +.Fa "OM_uint32 status_value" +.Fa "int status_type" +.Fa "const gss_OID mech_type" +.Fa "OM_uint32 *message_context" +.Fa "gss_buffer_t status_string" +.Fc +.Ft OM_uint32 +.Fo gss_duplicate_name +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t src_name" +.Fa "gss_name_t * dest_name" +.Fc +.Ft OM_uint32 +.Fo gss_export_name +.Fa "OM_uint32 * minor_status" +.Fa "const gss_name_t input_name" +.Fa "gss_buffer_t exported_name" +.Fc +.Ft OM_uint32 +.Fo gss_export_sec_context +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t * context_handle" +.Fa "gss_buffer_t interprocess_token" +.Fc +.Ft OM_uint32 +.Fo gss_get_mic +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "gss_qop_t qop_req" +.Fa "const gss_buffer_t message_buffer" +.Fa "gss_buffer_t message_token" +.Fc +.Ft OM_uint32 +.Fo gss_import_name +.Fa "OM_uint32 * minor_status, +.Fa "const gss_buffer_t input_name_buffer" +.Fa "const gss_OID input_name_type" +.Fa "gss_name_t * output_name" +.Fc +.Ft OM_uint32 +.Fo gss_import_sec_context +.Fa "OM_uint32 * minor_status" +.Fa "const gss_buffer_t interprocess_token" +.Fa "gss_ctx_id_t * context_handle" +.Fc +.Ft OM_uint32 +.Fo gss_indicate_mechs +.Fa "OM_uint32 * minor_status" +.Fa "gss_OID_set * mech_set" +.Fc +.Ft OM_uint32 +.Fo gss_init_sec_context +.Fa "OM_uint32 * minor_status" +.Fa "const gss_cred_id_t initiator_cred_handle" +.Fa "gss_ctx_id_t * context_handle" +.Fa "const gss_name_t target_name" +.Fa "const gss_OID mech_type" +.Fa "OM_uint32 req_flags" +.Fa "OM_uint32 time_req" +.Fa "const gss_channel_bindings_t input_chan_bindings" +.Fa "const gss_buffer_t input_token" +.Fa "gss_OID * actual_mech_type" +.Fa "gss_buffer_t output_token" +.Fa "OM_uint32 * ret_flags" +.Fa "OM_uint32 * time_rec" +.Fc +.Ft OM_uint32 +.Fo gss_inquire_context +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "gss_name_t * src_name" +.Fa "gss_name_t * targ_name" +.Fa "OM_uint32 * lifetime_rec" +.Fa "gss_OID * mech_type" +.Fa "OM_uint32 * ctx_flags" +.Fa "int * locally_initiated" +.Fa "int * open_context" +.Fc +.Ft OM_uint32 +.Fo gss_inquire_cred +.Fa "OM_uint32 * minor_status" +.Fa "const gss_cred_id_t cred_handle" +.Fa "gss_name_t * name" +.Fa "OM_uint32 * lifetime" +.Fa "gss_cred_usage_t * cred_usage" +.Fa "gss_OID_set * mechanisms" +.Fc +.Ft OM_uint32 +.Fo gss_inquire_cred_by_mech +.Fc +.Ft OM_uint32 +.Fo gss_inquire_mechs_for_name +.Fc +.Ft OM_uint32 +.Fo gss_inquire_names_for_mech +.Fc +.Ft OM_uint32 +.Fo gss_krb5_copy_ccache +.Fa "OM_uint32 *minor" +.Fa "gss_cred_id_t cred" +.Fa "krb5_ccache out" +.Fc +.Ft OM_uint32 +.Fo gss_krb5_compat_des3_mic +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t context_handle" +.Fa "int onoff" +.Fc +.Ft OM_uint32 +.Fo gss_process_context_token +.Fc +.Ft OM_uint32 +.Fo gss_release_buffer +.Fa "OM_uint32 * minor_status" +.Fa "gss_buffer_t buffer" +.Fc +.Ft OM_uint32 +.Fo gss_release_cred +.Fa "OM_uint32 * minor_status" +.Fa "gss_cred_id_t * cred_handle" +.Fc +.Ft OM_uint32 +.Fo gss_release_name +.Fa "OM_uint32 * minor_status" +.Fa "gss_name_t * input_name" +.Fc +.Ft +.Fo gss_release_oid_set +.Fa "OM_uint32 * minor_status" +.Fa "gss_OID_set * set" +.Fc +.Ft OM_uint32 +.Fo gss_seal +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t context_handle" +.Fa "int conf_req_flag" +.Fa "int qop_req" +.Fa "gss_buffer_t input_message_buffer" +.Fa "int * conf_state" +.Fa "gss_buffer_t output_message_buffer" +.Fc +.Ft OM_uint32 +.Fo gss_sign +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t context_handle" +.Fa "int qop_req" +.Fa "gss_buffer_t message_buffer" +.Fa "gss_buffer_t message_token" +.Fc +.Ft OM_uint32 +.Fo gss_test_oid_set_member +.Fa "OM_uint32 * minor_status" +.Fa "const gss_OID member" +.Fa "const gss_OID_set set" +.Fa "int * present" +.Fc +.Ft OM_uint32 +.Fo gss_unseal +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t context_handle" +.Fa "gss_buffer_t input_message_buffer" +.Fa "gss_buffer_t output_message_buffer" +.Fa "int * conf_state" +.Fa "int * qop_state" +.Fc +.Ft OM_uint32 +.Fo gss_unwrap +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "const gss_buffer_t input_message_buffer" +.Fa "gss_buffer_t output_message_buffer" +.Fa "int * conf_state" +.Fa "gss_qop_t * qop_state" +.Fc +.Ft OM_uint32 +.Fo gss_verify +.Fa "OM_uint32 * minor_status" +.Fa "gss_ctx_id_t context_handle" +.Fa "gss_buffer_t message_buffer" +.Fa "gss_buffer_t token_buffer" +.Fa "int * qop_state" +.Fc +.Ft OM_uint32 +.Fo gss_verify_mic +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "const gss_buffer_t message_buffer" +.Fa "const gss_buffer_t token_buffer" +.Fa "gss_qop_t * qop_state" +.Fc +.Ft +.Fo gss_wrap +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "int conf_req_flag" +.Fa "gss_qop_t qop_req" +.Fa "const gss_buffer_t input_message_buffer" +.Fa "int * conf_state" +.Fa "gss_buffer_t output_message_buffer" +.Fc +.Ft OM_uint32 +.Fo gss_wrap_size_limit +.Fa "OM_uint32 * minor_status" +.Fa "const gss_ctx_id_t context_handle" +.Fa "int conf_req_flag" +.Fa "gss_qop_t qop_req" +.Fa "OM_uint32 req_output_size" +.Fa "OM_uint32 * max_input_size" +.Fc +.Sh DESCRIPTION +Generic Security Service API (GSS-API) version 2, and its C binding, +is described in +.Li RFC2743 +and +.Li RFC2744 . +Version 1 (deprecated) of the C binding is described in +.Li RFC1509 . +.Pp +Heimdals GSS-API implementation supports the following mechanisms +.Bl -bullet +.It +.Li GSS_KRB5_MECHANISM +.El +.Pp +GSS-API have generic name types that all mechanism are supposed to +implement (if possible) +.Bl -bullet +.It +.Li GSS_C_NT_USER_NAME +.It +.Li GSS_C_NT_MACHINE_UID_NAME +.It +.Li GSS_C_NT_STRING_UID_NAME +.It +.Li GSS_C_NT_HOSTBASED_SERVICE +.It +.Li GSS_C_NT_ANONYMOUS +.It +.Li GSS_C_NT_EXPORT_NAME +.El +.Pp +GSS-API implementations that supports Kerberos 5 have some additional +name types +.Bl -bullet +.It +.Li GSS_KRB5_NT_PRINCIPAL_NAME +.It +.Li GSS_KRB5_NT_USER_NAME +.It +.Li GSS_KRB5_NT_MACHINE_UID_NAME +.It +.Li GSS_KRB5_NT_STRING_UID_NAME +.El +.Pp +.Fn gss_display_name +takes the gss name in +.Fa input_name +and put a printable form in +.Fa output_name_buffer . +.Fa output_name_buffer +should be freed when done using +.Fn gss_release_buffer . +.Fa output_name_type +can either be +.Dv NULL +or a pointer to a +.Li gss_OID +and will in the later case contain the OID type of the name. +The name should only be used for printing. +Access control should be done with the result of +.Fn gss_export_name . +.Pp +.Fn gss_sign , +.Fn gss_verify , +.Fn gss_seal , +and +.Fn gss_unseal +are part of the GSS-API V1 interface and are obsolete. The functions +should not be used for new applications. +They are provided so that version 1 applications can link against the +library. +.Pp +.Fn gss_krb5_copy_ccache +is an extension to the GSS-API API. +The function will extract the krb5 credential that are transfered from +the initiator to the acceptor when using token delegation in the +Kerberos mechanism. +The acceptor receives the delegated token in the last argument to +.Fn gss_accept_sec_context . +.Pp +.Nm gss_krb5_compat_des3_mic +turns on or off the compatibly with older version of Heimdal using +des3 get and verify mic, this is way to programmatically set the +[gssapi]broken_des3_mic and [gssapi]correct_des3_mic flags (see +COMPATIBILITY section in +.Xr gssapi 3 ) . +If the CPP symbol +.Dv GSS_C_KRB5_COMPAT_DES3_MIC +is present, +.Nm gss_krb5_compat_des3_mic +exists. +.Nm gss_krb5_compat_des3_mic +will be removed in a later version of the GSS-API library. +.Sh SEE ALSO +.Xr krb5 3 , +.Xr krb5_ccache 3 , +.Xr gssapi 3 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/gssapi/gssapi.3 b/kerberosV/src/lib/gssapi/gssapi.3 new file mode 100644 index 00000000000..4ceca68470c --- /dev/null +++ b/kerberosV/src/lib/gssapi/gssapi.3 @@ -0,0 +1,149 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $Id: gssapi.3,v 1.1 2003/05/11 02:15:40 hin Exp $ +.\" +.Dd January 23, 2003 +.Dt GSSAPI 3 +.Os +.Sh NAME +.Nm gssapi +.Nd Generic Security Service Application Program Interface library +.Sh LIBRARY +GSS-API Library (libgssapi, -lgssapi) +.Sh DESCRIPTION +The Generic Security Service Application Program Interface (GSS-API) +provides security services to callers in a generic fashion, +supportable with a range of underlying mechanisms and technologies and +hence allowing source-level portability of applications to different +environments. +.Sh LIST OF FUNCTIONS +These functions constitute the gssapi library, +.Em libgssapi . +Declarations for these functions may be obtained from the include file +.Pa gssapi.h . +.sp 2 +.nf +.ta \w'gss_inquire_names_for_mech'u+2n +\w'Description goes here'u +\fIName/Page\fP \fIDescription\fP +.ta \w'gss_inquire_names_for_mech'u+2n +\w'Description goes here'u+6nC +.sp 5p +gss_accept_sec_context.3 +gss_acquire_cred.3 +gss_add_cred.3 +gss_add_oid_set_member.3 +gss_canonicalize_name.3 +gss_compare_name.3 +gss_context_time.3 +gss_create_empty_oid_set.3 +gss_delete_sec_context.3 +gss_display_name.3 +gss_display_status.3 +gss_duplicate_name.3 +gss_export_name.3 +gss_export_sec_context.3 +gss_get_mic.3 +gss_import_name.3 +gss_import_sec_context.3 +gss_indicate_mechs.3 +gss_init_sec_context.3 +gss_inquire_context.3 +gss_inquire_cred.3 +gss_inquire_cred_by_mech.3 +gss_inquire_mechs_for_name.3 +gss_inquire_names_for_mech.3 +gss_krb5_copy_ccache.3 +gss_process_context_token.3 +gss_release_buffer.3 +gss_release_cred.3 +gss_release_name.3 +gss_release_oid_set.3 +gss_seal.3 +gss_sign.3 +gss_test_oid_set_member.3 +gss_unseal.3 +gss_unwrap.3 +gss_verify.3 +gss_verify_mic.3 +gss_wrap.3 +gss_wrap_size_limit.3 +.ta +.Fi +.Sh COMPATIBILITY +The +.Nm Heimdal +GSS-API implementation had a bug in releases before 0.6 that made it +fail to inter-operate when using DES3 with other GSS-API +implementations when using +.Fn gss_get_mic +/ +.Fn gss_verify_mic . +.Pp +Default is to use the broken GSS-API DES3 mic in Heimdal 0.6, this +will change in 0.7 to use correct des3 mic. +.Pp +To turn on compatibility with older clients and servers, change the +.Nm [gssapi] +.Ar broken_des3_mic +in +.Pa krb5.conf +that contains a list of globbing expressions that will be matched +against the server name. +To turn off compatibility with older clients and servers use +.Nm [gssapi] +.Ar correct_des3_mic . +.Pp +If a match for a entry is in both +.Nm [gssapi] +.Ar correct_des3_mic +and +.Nm [gssapi] +.Ar correct_des3_mic , +the later will override. +.Pp +This config option modifies behaviour for both clients and servers. +.Pp +Example: +.Bd -literal -offset indent +[gssapi] + broken_des3_mic = cvs/*@SU.SE + broken_des3_mic = host/*@E.KTH.SE + correct_des3_mic = host/*@SU.SE +.Ed +.Sh BUGS +All of 0.5.x versions of +.Nm heimdal +had broken token delegations in the client side, the server side was +correct. +.Sh SEE ALSO +.Xr krb5 3 , +.Xr krb5.conf 5 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/gssapi/gssapi.h b/kerberosV/src/lib/gssapi/gssapi.h index ca3988b3b32..93ce37415e3 100644 --- a/kerberosV/src/lib/gssapi/gssapi.h +++ b/kerberosV/src/lib/gssapi/gssapi.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: gssapi.h,v 1.21 2001/05/04 13:52:02 assar Exp $ */ +/* $Id: gssapi.h,v 1.1.1.3 2003/05/11 02:15:40 hin Exp $ */ #ifndef GSSAPI_H_ #define GSSAPI_H_ @@ -67,8 +67,10 @@ typedef struct gss_ctx_id_t_desc_struct { struct krb5_auth_context_data *auth_context; gss_name_t source, target; OM_uint32 flags; - enum { LOCAL = 1, OPEN = 2} more_flags; + enum { LOCAL = 1, OPEN = 2, + COMPAT_OLD_DES3 = 4, COMPAT_OLD_DES3_SELECTED = 8 } more_flags; struct krb5_ticket *ticket; + time_t lifetime; } gss_ctx_id_t_desc; typedef gss_ctx_id_t_desc *gss_ctx_id_t; @@ -449,267 +451,267 @@ extern gss_OID GSS_KRB5_MECHANISM; */ OM_uint32 gss_acquire_cred - (OM_uint32 * minor_status, - const gss_name_t desired_name, - OM_uint32 time_req, - const gss_OID_set desired_mechs, - gss_cred_usage_t cred_usage, - gss_cred_id_t * output_cred_handle, - gss_OID_set * actual_mechs, - OM_uint32 * time_rec + (OM_uint32 * /*minor_status*/, + const gss_name_t /*desired_name*/, + OM_uint32 /*time_req*/, + const gss_OID_set /*desired_mechs*/, + gss_cred_usage_t /*cred_usage*/, + gss_cred_id_t * /*output_cred_handle*/, + gss_OID_set * /*actual_mechs*/, + OM_uint32 * /*time_rec*/ ); OM_uint32 gss_release_cred - (OM_uint32 * minor_status, - gss_cred_id_t * cred_handle + (OM_uint32 * /*minor_status*/, + gss_cred_id_t * /*cred_handle*/ ); OM_uint32 gss_init_sec_context - (OM_uint32 * minor_status, - const gss_cred_id_t initiator_cred_handle, - gss_ctx_id_t * context_handle, - const gss_name_t target_name, - const gss_OID mech_type, - OM_uint32 req_flags, - OM_uint32 time_req, - const gss_channel_bindings_t input_chan_bindings, - const gss_buffer_t input_token, - gss_OID * actual_mech_type, - gss_buffer_t output_token, - OM_uint32 * ret_flags, - OM_uint32 * time_rec + (OM_uint32 * /*minor_status*/, + const gss_cred_id_t /*initiator_cred_handle*/, + gss_ctx_id_t * /*context_handle*/, + const gss_name_t /*target_name*/, + const gss_OID /*mech_type*/, + OM_uint32 /*req_flags*/, + OM_uint32 /*time_req*/, + const gss_channel_bindings_t /*input_chan_bindings*/, + const gss_buffer_t /*input_token*/, + gss_OID * /*actual_mech_type*/, + gss_buffer_t /*output_token*/, + OM_uint32 * /*ret_flags*/, + OM_uint32 * /*time_rec*/ ); OM_uint32 gss_accept_sec_context - (OM_uint32 * minor_status, - gss_ctx_id_t * context_handle, - const gss_cred_id_t acceptor_cred_handle, - const gss_buffer_t input_token_buffer, - const gss_channel_bindings_t input_chan_bindings, - gss_name_t * src_name, - gss_OID * mech_type, - gss_buffer_t output_token, - OM_uint32 * ret_flags, - OM_uint32 * time_rec, - gss_cred_id_t * delegated_cred_handle + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t * /*context_handle*/, + const gss_cred_id_t /*acceptor_cred_handle*/, + const gss_buffer_t /*input_token_buffer*/, + const gss_channel_bindings_t /*input_chan_bindings*/, + gss_name_t * /*src_name*/, + gss_OID * /*mech_type*/, + gss_buffer_t /*output_token*/, + OM_uint32 * /*ret_flags*/, + OM_uint32 * /*time_rec*/, + gss_cred_id_t * /*delegated_cred_handle*/ ); OM_uint32 gss_process_context_token - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - const gss_buffer_t token_buffer + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + const gss_buffer_t /*token_buffer*/ ); OM_uint32 gss_delete_sec_context - (OM_uint32 * minor_status, - gss_ctx_id_t * context_handle, - gss_buffer_t output_token + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t * /*context_handle*/, + gss_buffer_t /*output_token*/ ); OM_uint32 gss_context_time - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - OM_uint32 * time_rec + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + OM_uint32 * /*time_rec*/ ); OM_uint32 gss_get_mic - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - gss_qop_t qop_req, - const gss_buffer_t message_buffer, - gss_buffer_t message_token + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + gss_qop_t /*qop_req*/, + const gss_buffer_t /*message_buffer*/, + gss_buffer_t /*message_token*/ ); OM_uint32 gss_verify_mic - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - const gss_buffer_t message_buffer, - const gss_buffer_t token_buffer, - gss_qop_t * qop_state + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + const gss_buffer_t /*message_buffer*/, + const gss_buffer_t /*token_buffer*/, + gss_qop_t * /*qop_state*/ ); OM_uint32 gss_wrap - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - int conf_req_flag, - gss_qop_t qop_req, - const gss_buffer_t input_message_buffer, - int * conf_state, - gss_buffer_t output_message_buffer + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + int /*conf_req_flag*/, + gss_qop_t /*qop_req*/, + const gss_buffer_t /*input_message_buffer*/, + int * /*conf_state*/, + gss_buffer_t /*output_message_buffer*/ ); OM_uint32 gss_unwrap - (OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - const gss_buffer_t input_message_buffer, - gss_buffer_t output_message_buffer, - int * conf_state, - gss_qop_t * qop_state + (OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + const gss_buffer_t /*input_message_buffer*/, + gss_buffer_t /*output_message_buffer*/, + int * /*conf_state*/, + gss_qop_t * /*qop_state*/ ); OM_uint32 gss_display_status - (OM_uint32 * minor_status, - OM_uint32 status_value, - int status_type, - const gss_OID mech_type, - OM_uint32 * message_context, - gss_buffer_t status_string + (OM_uint32 * /*minor_status*/, + OM_uint32 /*status_value*/, + int /*status_type*/, + const gss_OID /*mech_type*/, + OM_uint32 * /*message_context*/, + gss_buffer_t /*status_string*/ ); OM_uint32 gss_indicate_mechs - (OM_uint32 * minor_status, - gss_OID_set * mech_set + (OM_uint32 * /*minor_status*/, + gss_OID_set * /*mech_set*/ ); OM_uint32 gss_compare_name - (OM_uint32 * minor_status, - const gss_name_t name1, - const gss_name_t name2, - int * name_equal + (OM_uint32 * /*minor_status*/, + const gss_name_t /*name1*/, + const gss_name_t /*name2*/, + int * /*name_equal*/ ); OM_uint32 gss_display_name - (OM_uint32 * minor_status, - const gss_name_t input_name, - gss_buffer_t output_name_buffer, - gss_OID * output_name_type + (OM_uint32 * /*minor_status*/, + const gss_name_t /*input_name*/, + gss_buffer_t /*output_name_buffer*/, + gss_OID * /*output_name_type*/ ); OM_uint32 gss_import_name - (OM_uint32 * minor_status, - const gss_buffer_t input_name_buffer, - const gss_OID input_name_type, - gss_name_t * output_name + (OM_uint32 * /*minor_status*/, + const gss_buffer_t /*input_name_buffer*/, + const gss_OID /*input_name_type*/, + gss_name_t * /*output_name*/ ); OM_uint32 gss_export_name - (OM_uint32 * minor_status, - const gss_name_t input_name, - gss_buffer_t exported_name + (OM_uint32 * /*minor_status*/, + const gss_name_t /*input_name*/, + gss_buffer_t /*exported_name*/ ); OM_uint32 gss_release_name - (OM_uint32 * minor_status, - gss_name_t * input_name + (OM_uint32 * /*minor_status*/, + gss_name_t * /*input_name*/ ); OM_uint32 gss_release_buffer - (OM_uint32 * minor_status, - gss_buffer_t buffer + (OM_uint32 * /*minor_status*/, + gss_buffer_t /*buffer*/ ); OM_uint32 gss_release_oid_set - (OM_uint32 * minor_status, - gss_OID_set * set + (OM_uint32 * /*minor_status*/, + gss_OID_set * /*set*/ ); OM_uint32 gss_inquire_cred - (OM_uint32 * minor_status, - const gss_cred_id_t cred_handle, - gss_name_t * name, - OM_uint32 * lifetime, - gss_cred_usage_t * cred_usage, - gss_OID_set * mechanisms + (OM_uint32 * /*minor_status*/, + const gss_cred_id_t /*cred_handle*/, + gss_name_t * /*name*/, + OM_uint32 * /*lifetime*/, + gss_cred_usage_t * /*cred_usage*/, + gss_OID_set * /*mechanisms*/ ); OM_uint32 gss_inquire_context ( - OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - gss_name_t * src_name, - gss_name_t * targ_name, - OM_uint32 * lifetime_rec, - gss_OID * mech_type, - OM_uint32 * ctx_flags, - int * locally_initiated, - int * open + OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + gss_name_t * /*src_name*/, + gss_name_t * /*targ_name*/, + OM_uint32 * /*lifetime_rec*/, + gss_OID * /*mech_type*/, + OM_uint32 * /*ctx_flags*/, + int * /*locally_initiated*/, + int * /*open_context*/ ); OM_uint32 gss_wrap_size_limit ( - OM_uint32 * minor_status, - const gss_ctx_id_t context_handle, - int conf_req_flag, - gss_qop_t qop_req, - OM_uint32 req_output_size, - OM_uint32 * max_input_size + OM_uint32 * /*minor_status*/, + const gss_ctx_id_t /*context_handle*/, + int /*conf_req_flag*/, + gss_qop_t /*qop_req*/, + OM_uint32 /*req_output_size*/, + OM_uint32 * /*max_input_size*/ ); OM_uint32 gss_add_cred ( - OM_uint32 * minor_status, - const gss_cred_id_t input_cred_handle, - const gss_name_t desired_name, - const gss_OID desired_mech, - gss_cred_usage_t cred_usage, - OM_uint32 initiator_time_req, - OM_uint32 acceptor_time_req, - gss_cred_id_t * output_cred_handle, - gss_OID_set * actual_mechs, - OM_uint32 * initiator_time_rec, - OM_uint32 * acceptor_time_rec + OM_uint32 * /*minor_status*/, + const gss_cred_id_t /*input_cred_handle*/, + const gss_name_t /*desired_name*/, + const gss_OID /*desired_mech*/, + gss_cred_usage_t /*cred_usage*/, + OM_uint32 /*initiator_time_req*/, + OM_uint32 /*acceptor_time_req*/, + gss_cred_id_t * /*output_cred_handle*/, + gss_OID_set * /*actual_mechs*/, + OM_uint32 * /*initiator_time_rec*/, + OM_uint32 * /*acceptor_time_rec*/ ); OM_uint32 gss_inquire_cred_by_mech ( - OM_uint32 * minor_status, - const gss_cred_id_t cred_handle, - const gss_OID mech_type, - gss_name_t * name, - OM_uint32 * initiator_lifetime, - OM_uint32 * acceptor_lifetime, - gss_cred_usage_t * cred_usage + OM_uint32 * /*minor_status*/, + const gss_cred_id_t /*cred_handle*/, + const gss_OID /*mech_type*/, + gss_name_t * /*name*/, + OM_uint32 * /*initiator_lifetime*/, + OM_uint32 * /*acceptor_lifetime*/, + gss_cred_usage_t * /*cred_usage*/ ); OM_uint32 gss_export_sec_context ( - OM_uint32 * minor_status, - gss_ctx_id_t * context_handle, - gss_buffer_t interprocess_token + OM_uint32 * /*minor_status*/, + gss_ctx_id_t * /*context_handle*/, + gss_buffer_t /*interprocess_token*/ ); OM_uint32 gss_import_sec_context ( - OM_uint32 * minor_status, - const gss_buffer_t interprocess_token, - gss_ctx_id_t * context_handle + OM_uint32 * /*minor_status*/, + const gss_buffer_t /*interprocess_token*/, + gss_ctx_id_t * /*context_handle*/ ); OM_uint32 gss_create_empty_oid_set ( - OM_uint32 * minor_status, - gss_OID_set * oid_set + OM_uint32 * /*minor_status*/, + gss_OID_set * /*oid_set*/ ); OM_uint32 gss_add_oid_set_member ( - OM_uint32 * minor_status, - const gss_OID member_oid, - gss_OID_set * oid_set + OM_uint32 * /*minor_status*/, + const gss_OID /*member_oid*/, + gss_OID_set * /*oid_set*/ ); OM_uint32 gss_test_oid_set_member ( - OM_uint32 * minor_status, - const gss_OID member, - const gss_OID_set set, - int * present + OM_uint32 * /*minor_status*/, + const gss_OID /*member*/, + const gss_OID_set /*set*/, + int * /*present*/ ); OM_uint32 gss_inquire_names_for_mech ( - OM_uint32 * minor_status, - const gss_OID mechanism, - gss_OID_set * name_types + OM_uint32 * /*minor_status*/, + const gss_OID /*mechanism*/, + gss_OID_set * /*name_types*/ ); OM_uint32 gss_inquire_mechs_for_name ( - OM_uint32 * minor_status, - const gss_name_t input_name, - gss_OID_set * mech_types + OM_uint32 * /*minor_status*/, + const gss_name_t /*input_name*/, + gss_OID_set * /*mech_types*/ ); OM_uint32 gss_canonicalize_name ( - OM_uint32 * minor_status, - const gss_name_t input_name, - const gss_OID mech_type, - gss_name_t * output_name + OM_uint32 * /*minor_status*/, + const gss_name_t /*input_name*/, + const gss_OID /*mech_type*/, + gss_name_t * /*output_name*/ ); OM_uint32 gss_duplicate_name ( - OM_uint32 * minor_status, - const gss_name_t src_name, - gss_name_t * dest_name + OM_uint32 * /*minor_status*/, + const gss_name_t /*src_name*/, + gss_name_t * /*dest_name*/ ); /* @@ -724,38 +726,38 @@ OM_uint32 gss_duplicate_name ( */ OM_uint32 gss_sign - (OM_uint32 * minor_status, - gss_ctx_id_t context_handle, - int qop_req, - gss_buffer_t message_buffer, - gss_buffer_t message_token + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t /*context_handle*/, + int /*qop_req*/, + gss_buffer_t /*message_buffer*/, + gss_buffer_t /*message_token*/ ); OM_uint32 gss_verify - (OM_uint32 * minor_status, - gss_ctx_id_t context_handle, - gss_buffer_t message_buffer, - gss_buffer_t token_buffer, - int * qop_state + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t /*context_handle*/, + gss_buffer_t /*message_buffer*/, + gss_buffer_t /*token_buffer*/, + int * /*qop_state*/ ); OM_uint32 gss_seal - (OM_uint32 * minor_status, - gss_ctx_id_t context_handle, - int conf_req_flag, - int qop_req, - gss_buffer_t input_message_buffer, - int * conf_state, - gss_buffer_t output_message_buffer + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t /*context_handle*/, + int /*conf_req_flag*/, + int /*qop_req*/, + gss_buffer_t /*input_message_buffer*/, + int * /*conf_state*/, + gss_buffer_t /*output_message_buffer*/ ); OM_uint32 gss_unseal - (OM_uint32 * minor_status, - gss_ctx_id_t context_handle, - gss_buffer_t input_message_buffer, - gss_buffer_t output_message_buffer, - int * conf_state, - int * qop_state + (OM_uint32 * /*minor_status*/, + gss_ctx_id_t /*context_handle*/, + gss_buffer_t /*input_message_buffer*/, + gss_buffer_t /*output_message_buffer*/, + int * /*conf_state*/, + int * /*qop_state*/ ); /* @@ -763,11 +765,16 @@ OM_uint32 gss_unseal */ OM_uint32 gsskrb5_register_acceptor_identity - (char *identity); + (const char */*identity*/); OM_uint32 gss_krb5_copy_ccache - (OM_uint32 *minor, - gss_cred_id_t cred, - struct krb5_ccache_data *out); + (OM_uint32 */*minor*/, + gss_cred_id_t /*cred*/, + struct krb5_ccache_data */*out*/); + +#define GSS_C_KRB5_COMPAT_DES3_MIC 1 + +OM_uint32 +gss_krb5_compat_des3_mic(OM_uint32 *, gss_ctx_id_t, int); #endif /* GSSAPI_H_ */ diff --git a/kerberosV/src/lib/gssapi/gssapi_locl.h b/kerberosV/src/lib/gssapi/gssapi_locl.h index be19b0be76a..57e6c12e913 100644 --- a/kerberosV/src/lib/gssapi/gssapi_locl.h +++ b/kerberosV/src/lib/gssapi/gssapi_locl.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: gssapi_locl.h,v 1.21 2001/08/29 02:21:09 assar Exp $ */ +/* $KTH: gssapi_locl.h,v 1.24 2003/03/16 17:30:15 lha Exp $ */ #ifndef GSSAPI_LOCL_H #define GSSAPI_LOCL_H @@ -50,6 +50,14 @@ extern krb5_keytab gssapi_krb5_keytab; krb5_error_code gssapi_krb5_init (void); +#define GSSAPI_KRB5_INIT() do { \ + krb5_error_code kret; \ + if((kret = gssapi_krb5_init ()) != 0) { \ + *minor_status = kret; \ + return GSS_S_FAILURE; \ + } \ +} while (0) + OM_uint32 gssapi_krb5_create_8003_checksum ( OM_uint32 *minor_status, @@ -96,6 +104,14 @@ gssapi_krb5_verify_header(u_char **str, char *type); OM_uint32 +gss_verify_mic_internal(OM_uint32 * minor_status, + const gss_ctx_id_t context_handle, + const gss_buffer_t message_buffer, + const gss_buffer_t token_buffer, + gss_qop_t * qop_state, + char * type); + +OM_uint32 gss_krb5_get_remotekey(const gss_ctx_id_t context_handle, krb5_keyblock **key); @@ -117,10 +133,16 @@ gss_address_to_krb5addr(OM_uint32 gss_addr_type, #define SC_LOCAL_SUBKEY 0x08 #define SC_REMOTE_SUBKEY 0x10 +int +gss_oid_equal(const gss_OID a, const gss_OID b); + void gssapi_krb5_set_error_string (void); char * gssapi_krb5_get_error_string (void); +OM_uint32 +_gss_DES3_get_mic_compat(OM_uint32 *minor_status, gss_ctx_id_t ctx); + #endif diff --git a/kerberosV/src/lib/gssapi/import_name.c b/kerberosV/src/lib/gssapi/import_name.c index 12744e98a74..43d6d6cf9f1 100644 --- a/kerberosV/src/lib/gssapi/import_name.c +++ b/kerberosV/src/lib/gssapi/import_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,14 +33,36 @@ #include "gssapi_locl.h" -RCSID("$KTH: import_name.c,v 1.10 2001/05/11 09:16:46 assar Exp $"); +RCSID("$KTH: import_name.c,v 1.13 2003/03/16 17:33:31 lha Exp $"); + +static OM_uint32 +parse_krb5_name (OM_uint32 *minor_status, + const char *name, + gss_name_t *output_name) +{ + krb5_error_code kerr; + + kerr = krb5_parse_name (gssapi_krb5_context, name, output_name); + + if (kerr == 0) + return GSS_S_COMPLETE; + else if (kerr == KRB5_PARSE_ILLCHAR || kerr == KRB5_PARSE_MALFORMED) { + gssapi_krb5_set_error_string (); + *minor_status = kerr; + return GSS_S_BAD_NAME; + } else { + gssapi_krb5_set_error_string (); + *minor_status = kerr; + return GSS_S_FAILURE; + } +} static OM_uint32 import_krb5_name (OM_uint32 *minor_status, const gss_buffer_t input_name_buffer, gss_name_t *output_name) { - krb5_error_code kerr; + OM_uint32 ret; char *tmp; tmp = malloc (input_name_buffer->length + 1); @@ -53,21 +75,10 @@ import_krb5_name (OM_uint32 *minor_status, input_name_buffer->length); tmp[input_name_buffer->length] = '\0'; - kerr = krb5_parse_name (gssapi_krb5_context, - tmp, - output_name); - free (tmp); - if (kerr == 0) - return GSS_S_COMPLETE; - else if (kerr == KRB5_PARSE_ILLCHAR || kerr == KRB5_PARSE_MALFORMED) { - gssapi_krb5_set_error_string (); - *minor_status = kerr; - return GSS_S_BAD_NAME; - } else { - gssapi_krb5_set_error_string (); - *minor_status = kerr; - return GSS_S_FAILURE; - } + ret = parse_krb5_name(minor_status, tmp, output_name); + free(tmp); + + return ret; } static OM_uint32 @@ -81,6 +92,8 @@ import_hostbased_name (OM_uint32 *minor_status, char *host; char local_hostname[MAXHOSTNAMELEN]; + *output_name = NULL; + tmp = malloc (input_name_buffer->length + 1); if (tmp == NULL) { *minor_status = ENOMEM; @@ -124,6 +137,64 @@ import_hostbased_name (OM_uint32 *minor_status, } } +static OM_uint32 +import_export_name (OM_uint32 *minor_status, + const gss_buffer_t input_name_buffer, + gss_name_t *output_name) +{ + unsigned char *p; + uint32_t length; + OM_uint32 ret; + char *name; + + if (input_name_buffer->length < 10 + GSS_KRB5_MECHANISM->length) + return GSS_S_BAD_NAME; + + /* TOK, MECH_OID_LEN, DER(MECH_OID), NAME_LEN, NAME */ + + p = input_name_buffer->value; + + if (memcmp(&p[0], "\x04\x01\x00", 3) != 0 || + p[3] != GSS_KRB5_MECHANISM->length + 2 || + p[4] != 0x06 || + p[5] != GSS_KRB5_MECHANISM->length || + memcmp(&p[6], GSS_KRB5_MECHANISM->elements, + GSS_KRB5_MECHANISM->length) != 0) + return GSS_S_BAD_NAME; + + p += 6 + GSS_KRB5_MECHANISM->length; + + length = p[0] << 24 | p[1] << 16 | p[2] << 8 | p[3]; + p += 4; + + if (length > input_name_buffer->length - 10 - GSS_KRB5_MECHANISM->length) + return GSS_S_BAD_NAME; + + name = malloc(length + 1); + if (name == NULL) { + *minor_status = ENOMEM; + return GSS_S_FAILURE; + } + memcpy(name, p, length); + name[length] = '\0'; + + ret = parse_krb5_name(minor_status, name, output_name); + free(name); + + return ret; +} + +int +gss_oid_equal(const gss_OID a, const gss_OID b) +{ + if (a == b) + return 1; + else if (a == GSS_C_NO_OID || b == GSS_C_NO_OID || a->length != b->length) + return 0; + else + return memcmp(a->elements, b->elements, a->length) == 0; +} + OM_uint32 gss_import_name (OM_uint32 * minor_status, const gss_buffer_t input_name_buffer, @@ -131,20 +202,27 @@ OM_uint32 gss_import_name gss_name_t * output_name ) { - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); - if (input_name_type == GSS_C_NT_HOSTBASED_SERVICE) + *minor_status = 0; + *output_name = GSS_C_NO_NAME; + + if (gss_oid_equal(input_name_type, GSS_C_NT_HOSTBASED_SERVICE)) return import_hostbased_name (minor_status, input_name_buffer, output_name); - else if (input_name_type == GSS_C_NO_OID - || input_name_type == GSS_C_NT_USER_NAME - || input_name_type == GSS_KRB5_NT_PRINCIPAL_NAME) + else if (gss_oid_equal(input_name_type, GSS_C_NO_OID) + || gss_oid_equal(input_name_type, GSS_C_NT_USER_NAME) + || gss_oid_equal(input_name_type, GSS_KRB5_NT_PRINCIPAL_NAME)) /* default printable syntax */ return import_krb5_name (minor_status, input_name_buffer, output_name); - else { + else if (gss_oid_equal(input_name_type, GSS_C_NT_EXPORT_NAME)) { + return import_export_name(minor_status, + input_name_buffer, + output_name); + } else { *minor_status = 0; return GSS_S_BAD_NAMETYPE; } diff --git a/kerberosV/src/lib/gssapi/import_sec_context.c b/kerberosV/src/lib/gssapi/import_sec_context.c index db13a92379a..cf01aeef584 100644 --- a/kerberosV/src/lib/gssapi/import_sec_context.c +++ b/kerberosV/src/lib/gssapi/import_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: import_sec_context.c,v 1.5 2001/05/11 09:16:46 assar Exp $"); +RCSID("$KTH: import_sec_context.c,v 1.7 2003/03/16 18:01:32 lha Exp $"); OM_uint32 gss_import_sec_context ( @@ -55,7 +55,9 @@ gss_import_sec_context ( int32_t flags; OM_uint32 minor; - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); + + localp = remotep = NULL; sp = krb5_storage_from_mem (interprocess_token->value, interprocess_token->length); @@ -83,99 +85,113 @@ gss_import_sec_context ( /* flags */ - krb5_ret_int32 (sp, &flags); + *minor_status = 0; + + if (krb5_ret_int32 (sp, &flags) != 0) + goto failure; /* retrieve the auth context */ ac = (*context_handle)->auth_context; krb5_ret_int32 (sp, &ac->flags); - if (flags & SC_LOCAL_ADDRESS) - krb5_ret_address (sp, localp = &local); - else - localp = NULL; - if (flags & SC_REMOTE_ADDRESS) - krb5_ret_address (sp, remotep = &remote); - else - remotep = NULL; + if (flags & SC_LOCAL_ADDRESS) { + if (krb5_ret_address (sp, localp = &local) != 0) + goto failure; + } + + if (flags & SC_REMOTE_ADDRESS) { + if (krb5_ret_address (sp, remotep = &remote) != 0) + goto failure; + } + krb5_auth_con_setaddrs (gssapi_krb5_context, ac, localp, remotep); if (localp) krb5_free_address (gssapi_krb5_context, localp); if (remotep) krb5_free_address (gssapi_krb5_context, remotep); - krb5_ret_int16 (sp, &ac->local_port); - krb5_ret_int16 (sp, &ac->remote_port); + localp = remotep = NULL; + + if (krb5_ret_int16 (sp, &ac->local_port) != 0) + goto failure; + + if (krb5_ret_int16 (sp, &ac->remote_port) != 0) + goto failure; if (flags & SC_KEYBLOCK) { - krb5_ret_keyblock (sp, &keyblock); + if (krb5_ret_keyblock (sp, &keyblock) != 0) + goto failure; krb5_auth_con_setkey (gssapi_krb5_context, ac, &keyblock); krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); } if (flags & SC_LOCAL_SUBKEY) { - krb5_ret_keyblock (sp, &keyblock); + if (krb5_ret_keyblock (sp, &keyblock) != 0) + goto failure; krb5_auth_con_setlocalsubkey (gssapi_krb5_context, ac, &keyblock); krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); } if (flags & SC_REMOTE_SUBKEY) { - krb5_ret_keyblock (sp, &keyblock); + if (krb5_ret_keyblock (sp, &keyblock) != 0) + goto failure; krb5_auth_con_setremotesubkey (gssapi_krb5_context, ac, &keyblock); krb5_free_keyblock_contents (gssapi_krb5_context, &keyblock); } - krb5_ret_int32 (sp, &ac->local_seqnumber); - krb5_ret_int32 (sp, &ac->remote_seqnumber); - -#if 0 - { - size_t sz; - - krb5_ret_data (sp, &data); - ac->authenticator = malloc (sizeof (*ac->authenticator)); - if (ac->authenticator == NULL) { - *minor_status = ENOMEM; - ret = GSS_S_FAILURE; - goto failure; - } - - kret = decode_Authenticator (data.data, data.length, - ac->authenticator, &sz); - krb5_data_free (&data); - if (kret) { - *minor_status = kret; - ret = GSS_S_FAILURE; - goto failure; - } - } -#endif + if (krb5_ret_int32 (sp, &ac->local_seqnumber)) + goto failure; + if (krb5_ret_int32 (sp, &ac->remote_seqnumber)) + goto failure; - krb5_ret_int32 (sp, &tmp); + if (krb5_ret_int32 (sp, &tmp) != 0) + goto failure; ac->keytype = tmp; - krb5_ret_int32 (sp, &tmp); + if (krb5_ret_int32 (sp, &tmp) != 0) + goto failure; ac->cksumtype = tmp; /* names */ - krb5_ret_data (sp, &data); + if (krb5_ret_data (sp, &data)) + goto failure; buffer.value = data.data; buffer.length = data.length; - ret = gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + ret = gss_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME, &(*context_handle)->source); + if (ret) { + ret = gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + &(*context_handle)->source); + if (ret) { + krb5_data_free (&data); + goto failure; + } + } krb5_data_free (&data); - if (ret) - goto failure; - krb5_ret_data (sp, &data); + if (krb5_ret_data (sp, &data) != 0) + goto failure; buffer.value = data.data; buffer.length = data.length; - ret = gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + ret = gss_import_name (minor_status, &buffer, GSS_C_NT_EXPORT_NAME, &(*context_handle)->target); + if (ret) { + ret = gss_import_name (minor_status, &buffer, GSS_C_NO_OID, + &(*context_handle)->target); + if (ret) { + krb5_data_free (&data); + goto failure; + } + } krb5_data_free (&data); - if (ret) - goto failure; - krb5_ret_int32 (sp, &tmp); + if (krb5_ret_int32 (sp, &tmp)) + goto failure; (*context_handle)->flags = tmp; - krb5_ret_int32 (sp, &tmp); + if (krb5_ret_int32 (sp, &tmp)) + goto failure; (*context_handle)->more_flags = tmp; + if (krb5_ret_int32 (sp, &tmp) == 0) + (*context_handle)->lifetime = tmp; + else + (*context_handle)->lifetime = GSS_C_INDEFINITE; return GSS_S_COMPLETE; @@ -186,6 +202,10 @@ failure: gss_release_name(&minor, &(*context_handle)->source); if ((*context_handle)->target != NULL) gss_release_name(&minor, &(*context_handle)->target); + if (localp) + krb5_free_address (gssapi_krb5_context, localp); + if (remotep) + krb5_free_address (gssapi_krb5_context, remotep); free (*context_handle); *context_handle = GSS_C_NO_CONTEXT; return ret; diff --git a/kerberosV/src/lib/gssapi/indicate_mechs.c b/kerberosV/src/lib/gssapi/indicate_mechs.c index cff9f92daba..7171db390fb 100644 --- a/kerberosV/src/lib/gssapi/indicate_mechs.c +++ b/kerberosV/src/lib/gssapi/indicate_mechs.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,25 +33,23 @@ #include "gssapi_locl.h" -RCSID("$KTH: indicate_mechs.c,v 1.4 2001/02/18 03:39:09 assar Exp $"); +RCSID("$KTH: indicate_mechs.c,v 1.5 2003/03/16 17:38:20 lha Exp $"); OM_uint32 gss_indicate_mechs (OM_uint32 * minor_status, gss_OID_set * mech_set ) { - *mech_set = malloc(sizeof(**mech_set)); - if (*mech_set == NULL) { - *minor_status = ENOMEM; - return GSS_S_FAILURE; - } - (*mech_set)->count = 1; - (*mech_set)->elements = malloc((*mech_set)->count * sizeof(gss_OID_desc)); - if ((*mech_set)->elements == NULL) { - free (*mech_set); - *minor_status = ENOMEM; - return GSS_S_FAILURE; - } - (*mech_set)->elements[0] = *GSS_KRB5_MECHANISM; + OM_uint32 ret; + + ret = gss_create_empty_oid_set(minor_status, mech_set); + if (ret) + return ret; + + ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, mech_set); + if (ret) + return ret; + + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/init_sec_context.c b/kerberosV/src/lib/gssapi/init_sec_context.c index f0fa467c583..3ea41b5cdd0 100644 --- a/kerberosV/src/lib/gssapi/init_sec_context.c +++ b/kerberosV/src/lib/gssapi/init_sec_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: init_sec_context.c,v 1.29 2001/08/29 02:21:09 assar Exp $"); +RCSID("$KTH: init_sec_context.c,v 1.36 2003/03/16 18:00:00 lha Exp $"); /* * copy the addresses from `input_chan_bindings' (if any) to @@ -111,21 +111,11 @@ do_delegation (krb5_auth_context ac, { krb5_creds creds; krb5_kdc_flags fwd_flags; - krb5_keyblock *subkey; krb5_error_code kret; memset (&creds, 0, sizeof(creds)); krb5_data_zero (fwd_data); - kret = krb5_generate_subkey (gssapi_krb5_context, &cred->session, &subkey); - if (kret) - goto out; - - kret = krb5_auth_con_setlocalsubkey(gssapi_krb5_context, ac, subkey); - krb5_free_keyblock (gssapi_krb5_context, subkey); - if (kret) - goto out; - kret = krb5_cc_get_principal(gssapi_krb5_context, ccache, &creds.client); if (kret) goto out; @@ -204,9 +194,6 @@ init_auth krb5_enctype enctype; krb5_data fwd_data; - output_token->length = 0; - output_token->value = NULL; - krb5_data_zero(&outbuf); krb5_data_zero(&fwd_data); @@ -224,6 +211,7 @@ init_auth (*context_handle)->flags = 0; (*context_handle)->more_flags = 0; (*context_handle)->ticket = NULL; + (*context_handle)->lifetime = GSS_C_INDEFINITE; kret = krb5_auth_con_init (gssapi_krb5_context, &(*context_handle)->auth_context); @@ -288,10 +276,15 @@ init_auth goto failure; } + ret = _gss_DES3_get_mic_compat(minor_status, *context_handle); + if (ret) + goto failure; + + memset(&this_cred, 0, sizeof(this_cred)); this_cred.client = (*context_handle)->source; this_cred.server = (*context_handle)->target; - if (time_req) { + if (time_req && time_req != GSS_C_INDEFINITE) { krb5_timestamp ts; krb5_timeofday (gssapi_krb5_context, &ts); @@ -313,10 +306,22 @@ init_auth goto failure; } + (*context_handle)->lifetime = cred->times.endtime; + krb5_auth_con_setkey(gssapi_krb5_context, (*context_handle)->auth_context, &cred->session); + kret = krb5_auth_con_generatelocalsubkey(gssapi_krb5_context, + (*context_handle)->auth_context, + &cred->session); + if(kret) { + gssapi_krb5_set_error_string (); + *minor_status = kret; + ret = GSS_S_FAILURE; + goto failure; + } + flags = 0; ap_options = 0; if (req_flags & GSS_C_DELEG_FLAG) @@ -342,7 +347,7 @@ init_auth if (ret_flags) *ret_flags = flags; (*context_handle)->flags = flags; - (*context_handle)->more_flags = LOCAL; + (*context_handle)->more_flags |= LOCAL; ret = gssapi_krb5_create_8003_checksum (minor_status, input_chan_bindings, @@ -407,6 +412,9 @@ init_auth if (flags & GSS_C_MUTUAL_FLAG) { return GSS_S_CONTINUE_NEEDED; } else { + if (time_rec) + *time_rec = (*context_handle)->lifetime; + (*context_handle)->more_flags |= OPEN; return GSS_S_COMPLETE; } @@ -448,6 +456,12 @@ repl_mutual krb5_data indata; krb5_ap_rep_enc_part *repl; + output_token->length = 0; + output_token->value = NULL; + + if (actual_mech_type) + *actual_mech_type = GSS_KRB5_MECHANISM; + ret = gssapi_krb5_decapsulate (minor_status, input_token, &indata, "\x02\x00"); if (ret) @@ -466,10 +480,14 @@ repl_mutual krb5_free_ap_rep_enc_part (gssapi_krb5_context, repl); - output_token->length = 0; - (*context_handle)->more_flags |= OPEN; + + if (time_rec) + *time_rec = (*context_handle)->lifetime; + if (ret_flags) + *ret_flags = (*context_handle)->flags; + *minor_status = 0; return GSS_S_COMPLETE; } @@ -493,7 +511,22 @@ OM_uint32 gss_init_sec_context OM_uint32 * time_rec ) { - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); + + output_token->length = 0; + output_token->value = NULL; + + if (ret_flags) + *ret_flags = 0; + if (time_rec) + *time_rec = 0; + + if (target_name == GSS_C_NO_NAME) { + if (actual_mech_type) + *actual_mech_type = GSS_C_NO_OID; + *minor_status = 0; + return GSS_S_BAD_NAME; + } if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) return init_auth (minor_status, diff --git a/kerberosV/src/lib/gssapi/inquire_context.c b/kerberosV/src/lib/gssapi/inquire_context.c index f5da7039f07..7259ed41d8d 100644 --- a/kerberosV/src/lib/gssapi/inquire_context.c +++ b/kerberosV/src/lib/gssapi/inquire_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: inquire_context.c,v 1.3 1999/12/02 17:05:04 joda Exp $"); +RCSID("$KTH: inquire_context.c,v 1.5 2003/03/16 17:43:30 lha Exp $"); OM_uint32 gss_inquire_context ( OM_uint32 * minor_status, @@ -44,7 +44,7 @@ OM_uint32 gss_inquire_context ( gss_OID * mech_type, OM_uint32 * ctx_flags, int * locally_initiated, - int * open + int * open_context ) { OM_uint32 ret; @@ -66,7 +66,7 @@ OM_uint32 gss_inquire_context ( } if (lifetime_rec) - *lifetime_rec = GSS_C_INDEFINITE; + *lifetime_rec = context_handle->lifetime; if (mech_type) *mech_type = GSS_KRB5_MECHANISM; @@ -77,8 +77,9 @@ OM_uint32 gss_inquire_context ( if (locally_initiated) *locally_initiated = context_handle->more_flags & LOCAL; - if (open) - *open = context_handle->more_flags & OPEN; + if (open_context) + *open_context = context_handle->more_flags & OPEN; + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/inquire_cred.c b/kerberosV/src/lib/gssapi/inquire_cred.c index 7b0b8d5aa48..0d10c628cb7 100644 --- a/kerberosV/src/lib/gssapi/inquire_cred.c +++ b/kerberosV/src/lib/gssapi/inquire_cred.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: inquire_cred.c,v 1.2 1999/12/02 17:05:04 joda Exp $"); +RCSID("$KTH: inquire_cred.c,v 1.4 2003/03/16 17:42:14 lha Exp $"); OM_uint32 gss_inquire_cred (OM_uint32 * minor_status, @@ -46,15 +46,34 @@ OM_uint32 gss_inquire_cred { OM_uint32 ret; + *minor_status = 0; + + if (name) + *name = NULL; + if (mechanisms) + *mechanisms = GSS_C_NO_OID_SET; + if (cred_handle == GSS_C_NO_CREDENTIAL) { return GSS_S_FAILURE; } if (name != NULL) { - ret = gss_duplicate_name(minor_status, cred_handle->principal, name); - if (ret) { + if (cred_handle->principal != NULL) { + ret = gss_duplicate_name(minor_status, cred_handle->principal, + name); + if (ret) return ret; - } + } else if (cred_handle->usage == GSS_C_ACCEPT) { + *minor_status = krb5_sname_to_principal(gssapi_krb5_context, NULL, + NULL, KRB5_NT_SRV_HST, name); + if (*minor_status) + return GSS_S_FAILURE; + } else { + *minor_status = krb5_get_default_principal(gssapi_krb5_context, + name); + if (*minor_status) + return GSS_S_FAILURE; + } } if (lifetime != NULL) { *lifetime = cred_handle->lifetime; diff --git a/kerberosV/src/lib/gssapi/inquire_cred_by_mech.c b/kerberosV/src/lib/gssapi/inquire_cred_by_mech.c new file mode 100644 index 00000000000..e6964941c6f --- /dev/null +++ b/kerberosV/src/lib/gssapi/inquire_cred_by_mech.c @@ -0,0 +1,80 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$KTH: inquire_cred_by_mech.c,v 1.1 2003/03/16 18:11:16 lha Exp $"); + +OM_uint32 gss_inquire_cred_by_mech ( + OM_uint32 * minor_status, + const gss_cred_id_t cred_handle, + const gss_OID mech_type, + gss_name_t * name, + OM_uint32 * initiator_lifetime, + OM_uint32 * acceptor_lifetime, + gss_cred_usage_t * cred_usage + ) +{ + OM_uint32 ret; + OM_uint32 lifetime; + + if (gss_oid_equal(mech_type, GSS_C_NO_OID) == 0 && + gss_oid_equal(mech_type, GSS_KRB5_MECHANISM) == 0) { + *minor_status = EINVAL; + return GSS_S_BAD_MECH; + } + + ret = gss_inquire_cred (minor_status, + cred_handle, + name, + &lifetime, + cred_usage, + NULL); + + if (ret == 0 && cred_handle != GSS_C_NO_CREDENTIAL) { + gss_cred_usage_t usage; + + usage = cred_handle->usage; + + if (initiator_lifetime) { + if (usage == GSS_C_INITIATE || usage == GSS_C_BOTH) + *initiator_lifetime = lifetime; + } + if (acceptor_lifetime) { + if (usage == GSS_C_ACCEPT || usage == GSS_C_BOTH) + *acceptor_lifetime = lifetime; + } + } + + return ret; +} diff --git a/kerberosV/src/lib/gssapi/inquire_mechs_for_name.c b/kerberosV/src/lib/gssapi/inquire_mechs_for_name.c new file mode 100644 index 00000000000..9a63b649432 --- /dev/null +++ b/kerberosV/src/lib/gssapi/inquire_mechs_for_name.c @@ -0,0 +1,57 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$KTH: inquire_mechs_for_name.c,v 1.1 2003/03/16 18:12:33 lha Exp $"); + +OM_uint32 gss_inquire_mechs_for_name ( + OM_uint32 * minor_status, + const gss_name_t input_name, + gss_OID_set * mech_types + ) +{ + OM_uint32 ret; + + ret = gss_create_empty_oid_set(minor_status, mech_types); + if (ret) + return ret; + + ret = gss_add_oid_set_member(minor_status, + GSS_KRB5_MECHANISM, + mech_types); + if (ret) + gss_release_oid_set(NULL, mech_types); + + return ret; +} diff --git a/kerberosV/src/lib/gssapi/inquire_names_for_mech.c b/kerberosV/src/lib/gssapi/inquire_names_for_mech.c new file mode 100644 index 00000000000..fe7abd8addc --- /dev/null +++ b/kerberosV/src/lib/gssapi/inquire_names_for_mech.c @@ -0,0 +1,80 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$KTH: inquire_names_for_mech.c,v 1.1 2003/03/16 18:15:29 lha Exp $"); + + +static gss_OID *name_list[] = { + &GSS_C_NT_HOSTBASED_SERVICE, + &GSS_C_NT_USER_NAME, + &GSS_KRB5_NT_PRINCIPAL_NAME, + &GSS_C_NT_EXPORT_NAME, + NULL +}; + +OM_uint32 gss_inquire_names_for_mech ( + OM_uint32 * minor_status, + const gss_OID mechanism, + gss_OID_set * name_types + ) +{ + OM_uint32 ret; + int i; + + *minor_status = 0; + + if (gss_oid_equal(mechanism, GSS_KRB5_MECHANISM) == 0 && + gss_oid_equal(mechanism, GSS_C_NULL_OID) == 0) { + *name_types = GSS_C_NO_OID_SET; + return GSS_S_BAD_MECH; + } + + ret = gss_create_empty_oid_set(minor_status, name_types); + if (ret != GSS_S_COMPLETE) + return ret; + + for (i = 0; name_list[i] != NULL; i++) { + ret = gss_add_oid_set_member(minor_status, + *(name_list[i]), + name_types); + if (ret != GSS_S_COMPLETE) + break; + } + + if (ret != GSS_S_COMPLETE) + gss_release_oid_set(NULL, name_types); + + return GSS_S_COMPLETE; +} diff --git a/kerberosV/src/lib/gssapi/process_context_token.c b/kerberosV/src/lib/gssapi/process_context_token.c new file mode 100644 index 00000000000..8e7dce4f88e --- /dev/null +++ b/kerberosV/src/lib/gssapi/process_context_token.c @@ -0,0 +1,65 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "gssapi_locl.h" + +RCSID("$KTH: process_context_token.c,v 1.1 2003/03/16 18:19:05 lha Exp $"); + +OM_uint32 gss_process_context_token ( + OM_uint32 *minor_status, + const gss_ctx_id_t context_handle, + const gss_buffer_t token_buffer + ) +{ + OM_uint32 ret = GSS_S_FAILURE; + gss_buffer_desc empty_buffer; + gss_qop_t qop_state; + + empty_buffer.length = 0; + empty_buffer.value = NULL; + + qop_state = GSS_C_QOP_DEFAULT; + + ret = gss_verify_mic_internal(minor_status, context_handle, + token_buffer, &empty_buffer, + GSS_C_QOP_DEFAULT, "\x01\x02"); + + if (ret == GSS_S_COMPLETE) + ret = gss_delete_sec_context(minor_status, + (gss_ctx_id_t *)&context_handle, + GSS_C_NO_BUFFER); + if (ret == GSS_S_COMPLETE) + *minor_status = 0; + + return ret; +} diff --git a/kerberosV/src/lib/gssapi/release_buffer.c b/kerberosV/src/lib/gssapi/release_buffer.c index 8eff1854ad1..a10430f023b 100644 --- a/kerberosV/src/lib/gssapi/release_buffer.c +++ b/kerberosV/src/lib/gssapi/release_buffer.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,13 +33,14 @@ #include "gssapi_locl.h" -RCSID("$KTH: release_buffer.c,v 1.4 2000/04/12 09:47:23 assar Exp $"); +RCSID("$KTH: release_buffer.c,v 1.5 2003/03/16 17:58:20 lha Exp $"); OM_uint32 gss_release_buffer (OM_uint32 * minor_status, gss_buffer_t buffer ) { + *minor_status = 0; free (buffer->value); buffer->value = NULL; buffer->length = 0; diff --git a/kerberosV/src/lib/gssapi/release_cred.c b/kerberosV/src/lib/gssapi/release_cred.c index bf655baa144..f4082b740f9 100644 --- a/kerberosV/src/lib/gssapi/release_cred.c +++ b/kerberosV/src/lib/gssapi/release_cred.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,20 +33,23 @@ #include "gssapi_locl.h" -RCSID("$KTH: release_cred.c,v 1.5 2001/01/30 00:49:05 assar Exp $"); +RCSID("$KTH: release_cred.c,v 1.8 2003/03/16 17:52:19 lha Exp $"); OM_uint32 gss_release_cred (OM_uint32 * minor_status, gss_cred_id_t * cred_handle ) { + *minor_status = 0; + if (*cred_handle == GSS_C_NO_CREDENTIAL) { return GSS_S_COMPLETE; } - gssapi_krb5_init (); + GSSAPI_KRB5_INIT (); - krb5_free_principal(gssapi_krb5_context, (*cred_handle)->principal); + if ((*cred_handle)->principal != NULL) + krb5_free_principal(gssapi_krb5_context, (*cred_handle)->principal); if ((*cred_handle)->keytab != NULL) krb5_kt_close(gssapi_krb5_context, (*cred_handle)->keytab); if ((*cred_handle)->ccache != NULL) diff --git a/kerberosV/src/lib/gssapi/release_name.c b/kerberosV/src/lib/gssapi/release_name.c index 3353d0de5d7..b364e6a7428 100644 --- a/kerberosV/src/lib/gssapi/release_name.c +++ b/kerberosV/src/lib/gssapi/release_name.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,16 +33,18 @@ #include "gssapi_locl.h" -RCSID("$KTH: release_name.c,v 1.5 2000/04/12 09:48:27 assar Exp $"); +RCSID("$KTH: release_name.c,v 1.7 2003/03/16 17:52:48 lha Exp $"); OM_uint32 gss_release_name (OM_uint32 * minor_status, gss_name_t * input_name ) { - gssapi_krb5_init (); - krb5_free_principal(gssapi_krb5_context, - *input_name); - *input_name = GSS_C_NO_NAME; - return GSS_S_COMPLETE; + GSSAPI_KRB5_INIT (); + if (minor_status) + *minor_status = 0; + krb5_free_principal(gssapi_krb5_context, + *input_name); + *input_name = GSS_C_NO_NAME; + return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/release_oid_set.c b/kerberosV/src/lib/gssapi/release_oid_set.c index 699f15c2fc1..aa7c87b979f 100644 --- a/kerberosV/src/lib/gssapi/release_oid_set.c +++ b/kerberosV/src/lib/gssapi/release_oid_set.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,13 +33,15 @@ #include "gssapi_locl.h" -RCSID("$KTH: release_oid_set.c,v 1.4 2000/04/19 13:06:13 assar Exp $"); +RCSID("$KTH: release_oid_set.c,v 1.5 2003/03/16 17:53:25 lha Exp $"); OM_uint32 gss_release_oid_set (OM_uint32 * minor_status, gss_OID_set * set ) { + if (minor_status) + *minor_status = 0; free ((*set)->elements); free (*set); *set = GSS_C_NO_OID_SET; diff --git a/kerberosV/src/lib/gssapi/test_acquire_cred.c b/kerberosV/src/lib/gssapi/test_acquire_cred.c new file mode 100644 index 00000000000..4da2542d6cb --- /dev/null +++ b/kerberosV/src/lib/gssapi/test_acquire_cred.c @@ -0,0 +1,98 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "gssapi_locl.h" +#include <err.h> + +RCSID("$KTH: test_acquire_cred.c,v 1.2 2003/04/06 00:20:37 lha Exp $"); + +static void +print_time(OM_uint32 time_rec) +{ + if (time_rec == GSS_C_INDEFINITE) { + printf("cred never expire\n"); + } else { + time_t t = time_rec; + printf("expiration time: %s", ctime(&t)); + } +} + +int +main(int argc, char **argv) +{ + OM_uint32 major_status, minor_status; + gss_cred_id_t cred_handle, copy_cred; + OM_uint32 time_rec; + + major_status = gss_acquire_cred(&minor_status, + GSS_C_NO_NAME, + 0, + NULL, + GSS_C_INITIATE, + &cred_handle, + NULL, + &time_rec); + if (GSS_ERROR(major_status)) + errx(1, "acquire_cred failed"); + + + print_time(time_rec); + + major_status = gss_add_cred (&minor_status, + cred_handle, + GSS_C_NO_NAME, + GSS_KRB5_MECHANISM, + GSS_C_INITIATE, + 0, + 0, + ©_cred, + NULL, + &time_rec, + NULL); + + if (GSS_ERROR(major_status)) + errx(1, "add_cred failed"); + + print_time(time_rec); + + major_status = gss_release_cred(&minor_status, + &cred_handle); + if (GSS_ERROR(major_status)) + errx(1, "release_cred failed"); + + major_status = gss_release_cred(&minor_status, + ©_cred); + if (GSS_ERROR(major_status)) + errx(1, "release_cred failed"); + + return 0; +} diff --git a/kerberosV/src/lib/gssapi/test_oid_set_member.c b/kerberosV/src/lib/gssapi/test_oid_set_member.c index 2c22f450be7..3ab6293377e 100644 --- a/kerberosV/src/lib/gssapi/test_oid_set_member.c +++ b/kerberosV/src/lib/gssapi/test_oid_set_member.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: test_oid_set_member.c,v 1.4 1999/12/02 17:05:04 joda Exp $"); +RCSID("$KTH: test_oid_set_member.c,v 1.5 2003/03/16 17:54:06 lha Exp $"); OM_uint32 gss_test_oid_set_member ( OM_uint32 * minor_status, @@ -44,14 +44,12 @@ OM_uint32 gss_test_oid_set_member ( { size_t i; + *minor_status = 0; *present = 0; for (i = 0; i < set->count; ++i) - if (member->length == set->elements[i].length - && memcmp (member->elements, - set->elements[i].elements, - member->length) == 0) { - *present = 1; - break; - } + if (gss_oid_equal(member, &set->elements[i]) != 0) { + *present = 1; + break; + } return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/gssapi/unwrap.c b/kerberosV/src/lib/gssapi/unwrap.c index a0019cba8e0..b4789bc9c7e 100644 --- a/kerberosV/src/lib/gssapi/unwrap.c +++ b/kerberosV/src/lib/gssapi/unwrap.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: unwrap.c,v 1.19 2001/08/23 04:35:55 assar Exp $"); +RCSID("$KTH: unwrap.c,v 1.22 2003/03/16 17:54:43 lha Exp $"); OM_uint32 gss_krb5_get_remotekey(const gss_ctx_id_t context_handle, @@ -53,7 +53,7 @@ gss_krb5_get_remotekey(const gss_ctx_id_t context_handle, context_handle->auth_context, &skey); if(skey == NULL) - return GSS_S_FAILURE; + return GSS_KRB5_S_KG_NO_SUBKEY; /* XXX */ *key = skey; return 0; } @@ -86,10 +86,8 @@ unwrap_des ret = gssapi_krb5_verify_header (&p, input_message_buffer->length, "\x02\x01"); - if (ret) { - *minor_status = 0; + if (ret) return ret; - } if (memcmp (p, "\x00\x00", 2) != 0) return GSS_S_BAD_SIG; @@ -222,10 +220,8 @@ unwrap_des3 ret = gssapi_krb5_verify_header (&p, input_message_buffer->length, "\x02\x01"); - if (ret) { - *minor_status = 0; + if (ret) return ret; - } if (memcmp (p, "\x04\x00", 2) != 0) /* HMAC SHA1 DES3_KD */ return GSS_S_BAD_SIG; @@ -296,7 +292,7 @@ unwrap_des3 p -= 28; ret = krb5_crypto_init(gssapi_krb5_context, key, - ETYPE_DES3_CBC_NONE_IVEC, &crypto); + ETYPE_DES3_CBC_NONE, &crypto); if (ret) { gssapi_krb5_set_error_string (); *minor_status = ret; @@ -388,6 +384,8 @@ OM_uint32 gss_unwrap OM_uint32 ret; krb5_keytype keytype; + if (qop_state != NULL) + *qop_state = GSS_C_QOP_DEFAULT; ret = gss_krb5_get_remotekey(context_handle, &key); if (ret) { gssapi_krb5_set_error_string (); @@ -396,6 +394,8 @@ OM_uint32 gss_unwrap } krb5_enctype_to_keytype (gssapi_krb5_context, key->keytype, &keytype); + *minor_status = 0; + switch (keytype) { case KEYTYPE_DES : ret = unwrap_des (minor_status, context_handle, diff --git a/kerberosV/src/lib/gssapi/verify_mic.c b/kerberosV/src/lib/gssapi/verify_mic.c index df123739c9f..97dbbc10ecc 100644 --- a/kerberosV/src/lib/gssapi/verify_mic.c +++ b/kerberosV/src/lib/gssapi/verify_mic.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: verify_mic.c,v 1.15 2001/08/23 04:35:55 assar Exp $"); +RCSID("$Id: verify_mic.c,v 1.1.1.4 2003/05/11 02:15:41 hin Exp $"); static OM_uint32 verify_mic_des @@ -42,7 +42,8 @@ verify_mic_des const gss_buffer_t message_buffer, const gss_buffer_t token_buffer, gss_qop_t * qop_state, - krb5_keyblock *key + krb5_keyblock *key, + char *type ) { u_char *p; @@ -57,7 +58,7 @@ verify_mic_des p = token_buffer->value; ret = gssapi_krb5_verify_header (&p, token_buffer->length, - "\x01\x01"); + type); if (ret) { *minor_status = 0; return ret; @@ -87,6 +88,7 @@ verify_mic_des if (memcmp (p - 8, hash, 8) != 0) { memset (deskey, 0, sizeof(deskey)); memset (schedule, 0, sizeof(schedule)); + *minor_status = 0; return GSS_S_BAD_MIC; } @@ -112,6 +114,7 @@ verify_mic_des memset (schedule, 0, sizeof(schedule)); if (memcmp (p, seq_data, 8) != 0) { + *minor_status = 0; return GSS_S_BAD_MIC; } @@ -119,6 +122,7 @@ verify_mic_des context_handle->auth_context, ++seq_number); + *minor_status = 0; return GSS_S_COMPLETE; } @@ -129,7 +133,8 @@ verify_mic_des3 const gss_buffer_t message_buffer, const gss_buffer_t token_buffer, gss_qop_t * qop_state, - krb5_keyblock *key + krb5_keyblock *key, + char *type ) { u_char *p; @@ -138,14 +143,15 @@ verify_mic_des3 OM_uint32 ret; krb5_crypto crypto; krb5_data seq_data; - int cmp; + int cmp, docompat; Checksum csum; char *tmp; + char ivec[8]; p = token_buffer->value; ret = gssapi_krb5_verify_header (&p, token_buffer->length, - "\x01\x01"); + type); if (ret) { *minor_status = 0; return ret; @@ -167,22 +173,34 @@ verify_mic_des3 } /* verify sequence number */ + docompat = (context_handle->more_flags & COMPAT_OLD_DES3); +retry: + if (docompat) + memset(ivec, 0, 8); + else + memcpy(ivec, p + 8, 8); - ret = krb5_decrypt (gssapi_krb5_context, - crypto, - KRB5_KU_USAGE_SEQ, - p, 8, &seq_data); + ret = krb5_decrypt_ivec (gssapi_krb5_context, + crypto, + KRB5_KU_USAGE_SEQ, + p, 8, &seq_data, ivec); if (ret) { - gssapi_krb5_set_error_string (); - krb5_crypto_destroy (gssapi_krb5_context, crypto); - *minor_status = ret; - return GSS_S_FAILURE; + if (docompat++) { + gssapi_krb5_set_error_string (); + krb5_crypto_destroy (gssapi_krb5_context, crypto); + *minor_status = ret; + return GSS_S_FAILURE; + } else + goto retry; } if (seq_data.length != 8) { - krb5_crypto_destroy (gssapi_krb5_context, crypto); krb5_data_free (&seq_data); - return GSS_S_BAD_MIC; + if (docompat++) { + krb5_crypto_destroy (gssapi_krb5_context, crypto); + return GSS_S_BAD_MIC; + } else + goto retry; } krb5_auth_getremoteseqnumber (gssapi_krb5_context, @@ -198,8 +216,11 @@ verify_mic_des3 cmp = memcmp (seq, seq_data.data, seq_data.length); krb5_data_free (&seq_data); if (cmp != 0) { - krb5_crypto_destroy (gssapi_krb5_context, crypto); - return GSS_S_BAD_MIC; + if (docompat++) { + krb5_crypto_destroy (gssapi_krb5_context, crypto); + return GSS_S_BAD_MIC; + } else + goto retry; } /* verify checksum */ @@ -235,16 +256,18 @@ verify_mic_des3 ++seq_number); krb5_crypto_destroy (gssapi_krb5_context, crypto); + *minor_status = 0; return GSS_S_COMPLETE; } OM_uint32 -gss_verify_mic +gss_verify_mic_internal (OM_uint32 * minor_status, const gss_ctx_id_t context_handle, const gss_buffer_t message_buffer, const gss_buffer_t token_buffer, - gss_qop_t * qop_state + gss_qop_t * qop_state, + char * type ) { krb5_keyblock *key; @@ -261,11 +284,13 @@ gss_verify_mic switch (keytype) { case KEYTYPE_DES : ret = verify_mic_des (minor_status, context_handle, - message_buffer, token_buffer, qop_state, key); + message_buffer, token_buffer, qop_state, key, + type); break; case KEYTYPE_DES3 : ret = verify_mic_des3 (minor_status, context_handle, - message_buffer, token_buffer, qop_state, key); + message_buffer, token_buffer, qop_state, key, + type); break; default : *minor_status = KRB5_PROG_ETYPE_NOSUPP; @@ -273,5 +298,27 @@ gss_verify_mic break; } krb5_free_keyblock (gssapi_krb5_context, key); + + return ret; +} + +OM_uint32 +gss_verify_mic + (OM_uint32 * minor_status, + const gss_ctx_id_t context_handle, + const gss_buffer_t message_buffer, + const gss_buffer_t token_buffer, + gss_qop_t * qop_state + ) +{ + OM_uint32 ret; + + if (qop_state != NULL) + *qop_state = GSS_C_QOP_DEFAULT; + + ret = gss_verify_mic_internal(minor_status, context_handle, + message_buffer, token_buffer, + qop_state, "\x01\x01"); + return ret; } diff --git a/kerberosV/src/lib/gssapi/wrap.c b/kerberosV/src/lib/gssapi/wrap.c index dd2ce5d7549..1d6259b10e6 100644 --- a/kerberosV/src/lib/gssapi/wrap.c +++ b/kerberosV/src/lib/gssapi/wrap.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "gssapi_locl.h" -RCSID("$KTH: wrap.c,v 1.19 2001/06/18 02:53:52 assar Exp $"); +RCSID("$KTH: wrap.c,v 1.21 2003/03/16 17:57:48 lha Exp $"); OM_uint32 gss_krb5_get_localkey(const gss_ctx_id_t context_handle, @@ -109,6 +109,7 @@ gss_wrap_size_limit ( break; } krb5_free_keyblock (gssapi_krb5_context, key); + *minor_status = 0; return ret; } @@ -141,8 +142,10 @@ wrap_des output_message_buffer->length = total_len; output_message_buffer->value = malloc (total_len); - if (output_message_buffer->value == NULL) + if (output_message_buffer->value == NULL) { + *minor_status = ENOMEM; return GSS_S_FAILURE; + } p = gssapi_krb5_make_header(output_message_buffer->value, len, @@ -228,6 +231,7 @@ wrap_des } if(conf_state != NULL) *conf_state = conf_req_flag; + *minor_status = 0; return GSS_S_COMPLETE; } @@ -259,8 +263,10 @@ wrap_des3 output_message_buffer->length = total_len; output_message_buffer->value = malloc (total_len); - if (output_message_buffer->value == NULL) + if (output_message_buffer->value == NULL) { + *minor_status = ENOMEM; return GSS_S_FAILURE; + } p = gssapi_krb5_make_header(output_message_buffer->value, len, @@ -330,7 +336,7 @@ wrap_des3 4); - ret = krb5_crypto_init(gssapi_krb5_context, key, ETYPE_DES3_CBC_NONE_IVEC, + ret = krb5_crypto_init(gssapi_krb5_context, key, ETYPE_DES3_CBC_NONE, &crypto); if (ret) { free (output_message_buffer->value); @@ -395,6 +401,7 @@ wrap_des3 } if(conf_state != NULL) *conf_state = conf_req_flag; + *minor_status = 0; return GSS_S_COMPLETE; } diff --git a/kerberosV/src/lib/hdb/common.c b/kerberosV/src/lib/hdb/common.c index 4c6fcf35619..2a44b8c3542 100644 --- a/kerberosV/src/lib/hdb/common.c +++ b/kerberosV/src/lib/hdb/common.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,35 +33,21 @@ #include "hdb_locl.h" -RCSID("$KTH: common.c,v 1.10 2001/07/13 06:30:41 assar Exp $"); +RCSID("$KTH: common.c,v 1.12 2003/01/14 06:54:32 lha Exp $"); int hdb_principal2key(krb5_context context, krb5_principal p, krb5_data *key) { Principal new; size_t len; - unsigned char *buf; int ret; ret = copy_Principal(p, &new); - if(ret) - goto out; + if(ret) + return ret; new.name.name_type = 0; - len = length_Principal(&new); - buf = malloc(len); - if(buf == NULL){ - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - ret = encode_Principal(buf + len - 1, len, &new, &len); - if(ret){ - free(buf); - goto out; - } - key->data = buf; - key->length = len; -out: + + ASN1_MALLOC_ENCODE(Principal, key->data, key->length, &new, &len, ret); free_Principal(&new); return ret; } @@ -75,24 +61,11 @@ hdb_key2principal(krb5_context context, krb5_data *key, krb5_principal p) int hdb_entry2value(krb5_context context, hdb_entry *ent, krb5_data *value) { - unsigned char *buf; size_t len; int ret; - - len = length_hdb_entry(ent); - buf = malloc(len); - if(buf == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - return ENOMEM; - } - ret = encode_hdb_entry(buf + len - 1, len, ent, &len); - if(ret){ - free(buf); - return ret; - } - value->data = buf; - value->length = len; - return 0; + + ASN1_MALLOC_ENCODE(hdb_entry, value->data, value->length, ent, &len, ret); + return ret; } int @@ -105,20 +78,22 @@ krb5_error_code _hdb_fetch(krb5_context context, HDB *db, unsigned flags, hdb_entry *entry) { krb5_data key, value; - int code = 0; + int code; hdb_principal2key(context, entry->principal, &key); code = db->_get(context, db, key, &value); krb5_data_free(&key); if(code) return code; - hdb_value2entry(context, &value, entry); + code = hdb_value2entry(context, &value, entry); + krb5_data_free(&value); + if (code) + return code; if (db->master_key_set && (flags & HDB_F_DECRYPT)) { code = hdb_unseal_keys (context, db, entry); if (code) hdb_free_entry(context, entry); } - krb5_data_free(&value); return code; } diff --git a/kerberosV/src/lib/hdb/hdb-private.h b/kerberosV/src/lib/hdb/hdb-private.h index 7563d36a3fe..a47de702106 100644 --- a/kerberosV/src/lib/hdb/hdb-private.h +++ b/kerberosV/src/lib/hdb/hdb-private.h @@ -2,35 +2,26 @@ #ifndef __hdb_private_h__ #define __hdb_private_h__ -#ifdef __STDC__ #include <stdarg.h> -#ifndef __P -#define __P(x) x -#endif -#else -#ifndef __P -#define __P(x) () -#endif -#endif krb5_error_code -_hdb_fetch __P(( - krb5_context context, - HDB *db, - unsigned flags, - hdb_entry *entry)); +_hdb_fetch ( + krb5_context /*context*/, + HDB */*db*/, + unsigned /*flags*/, + hdb_entry */*entry*/); krb5_error_code -_hdb_remove __P(( - krb5_context context, - HDB *db, - hdb_entry *entry)); +_hdb_remove ( + krb5_context /*context*/, + HDB */*db*/, + hdb_entry */*entry*/); krb5_error_code -_hdb_store __P(( - krb5_context context, - HDB *db, - unsigned flags, - hdb_entry *entry)); +_hdb_store ( + krb5_context /*context*/, + HDB */*db*/, + unsigned /*flags*/, + hdb_entry */*entry*/); #endif /* __hdb_private_h__ */ diff --git a/kerberosV/src/lib/hdb/hdb-protos.h b/kerberosV/src/lib/hdb/hdb-protos.h index 93f4d79d8cb..ce85fcb0564 100644 --- a/kerberosV/src/lib/hdb/hdb-protos.h +++ b/kerberosV/src/lib/hdb/hdb-protos.h @@ -2,196 +2,187 @@ #ifndef __hdb_protos_h__ #define __hdb_protos_h__ -#ifdef __STDC__ #include <stdarg.h> -#ifndef __P -#define __P(x) x -#endif -#else -#ifndef __P -#define __P(x) () -#endif -#endif krb5_error_code -hdb_add_master_key __P(( - krb5_context context, - krb5_keyblock *key, - hdb_master_key *inout)); +hdb_add_master_key ( + krb5_context /*context*/, + krb5_keyblock */*key*/, + hdb_master_key */*inout*/); krb5_error_code -hdb_check_db_format __P(( - krb5_context context, - HDB *db)); +hdb_check_db_format ( + krb5_context /*context*/, + HDB */*db*/); krb5_error_code -hdb_clear_master_key __P(( - krb5_context context, - HDB *db)); +hdb_clear_master_key ( + krb5_context /*context*/, + HDB */*db*/); krb5_error_code -hdb_create __P(( - krb5_context context, - HDB **db, - const char *filename)); +hdb_create ( + krb5_context /*context*/, + HDB **/*db*/, + const char */*filename*/); krb5_error_code -hdb_db_create __P(( - krb5_context context, - HDB **db, - const char *filename)); +hdb_db_create ( + krb5_context /*context*/, + HDB **/*db*/, + const char */*filename*/); krb5_error_code -hdb_enctype2key __P(( - krb5_context context, - hdb_entry *e, - krb5_enctype enctype, - Key **key)); +hdb_enctype2key ( + krb5_context /*context*/, + hdb_entry */*e*/, + krb5_enctype /*enctype*/, + Key **/*key*/); krb5_error_code -hdb_entry2string __P(( - krb5_context context, - hdb_entry *ent, - char **str)); +hdb_entry2string ( + krb5_context /*context*/, + hdb_entry */*ent*/, + char **/*str*/); int -hdb_entry2value __P(( - krb5_context context, - hdb_entry *ent, - krb5_data *value)); +hdb_entry2value ( + krb5_context /*context*/, + hdb_entry */*ent*/, + krb5_data */*value*/); krb5_error_code -hdb_foreach __P(( - krb5_context context, - HDB *db, - unsigned flags, - hdb_foreach_func_t func, - void *data)); +hdb_foreach ( + krb5_context /*context*/, + HDB */*db*/, + unsigned /*flags*/, + hdb_foreach_func_t /*func*/, + void */*data*/); void -hdb_free_entry __P(( - krb5_context context, - hdb_entry *ent)); +hdb_free_entry ( + krb5_context /*context*/, + hdb_entry */*ent*/); void -hdb_free_key __P((Key *key)); +hdb_free_key (Key */*key*/); void -hdb_free_master_key __P(( - krb5_context context, - hdb_master_key mkey)); +hdb_free_master_key ( + krb5_context /*context*/, + hdb_master_key /*mkey*/); krb5_error_code -hdb_init_db __P(( - krb5_context context, - HDB *db)); +hdb_init_db ( + krb5_context /*context*/, + HDB */*db*/); int -hdb_key2principal __P(( - krb5_context context, - krb5_data *key, - krb5_principal p)); +hdb_key2principal ( + krb5_context /*context*/, + krb5_data */*key*/, + krb5_principal /*p*/); krb5_error_code -hdb_ldap_create __P(( - krb5_context context, - HDB ** db, - const char *arg)); +hdb_ldap_create ( + krb5_context /*context*/, + HDB ** /*db*/, + const char */*arg*/); krb5_error_code -hdb_lock __P(( - int fd, - int operation)); +hdb_lock ( + int /*fd*/, + int /*operation*/); krb5_error_code -hdb_ndbm_create __P(( - krb5_context context, - HDB **db, - const char *filename)); +hdb_ndbm_create ( + krb5_context /*context*/, + HDB **/*db*/, + const char */*filename*/); krb5_error_code -hdb_next_enctype2key __P(( - krb5_context context, - const hdb_entry *e, - krb5_enctype enctype, - Key **key)); +hdb_next_enctype2key ( + krb5_context /*context*/, + const hdb_entry */*e*/, + krb5_enctype /*enctype*/, + Key **/*key*/); int -hdb_principal2key __P(( - krb5_context context, - krb5_principal p, - krb5_data *key)); +hdb_principal2key ( + krb5_context /*context*/, + krb5_principal /*p*/, + krb5_data */*key*/); krb5_error_code -hdb_print_entry __P(( - krb5_context context, - HDB *db, - hdb_entry *entry, - void *data)); +hdb_print_entry ( + krb5_context /*context*/, + HDB */*db*/, + hdb_entry */*entry*/, + void */*data*/); krb5_error_code -hdb_process_master_key __P(( - krb5_context context, - int kvno, - krb5_keyblock *key, - krb5_enctype etype, - hdb_master_key *mkey)); +hdb_process_master_key ( + krb5_context /*context*/, + int /*kvno*/, + krb5_keyblock */*key*/, + krb5_enctype /*etype*/, + hdb_master_key */*mkey*/); krb5_error_code -hdb_read_master_key __P(( - krb5_context context, - const char *filename, - hdb_master_key *mkey)); +hdb_read_master_key ( + krb5_context /*context*/, + const char */*filename*/, + hdb_master_key */*mkey*/); krb5_error_code -hdb_seal_keys __P(( - krb5_context context, - HDB *db, - hdb_entry *ent)); +hdb_seal_keys ( + krb5_context /*context*/, + HDB */*db*/, + hdb_entry */*ent*/); krb5_error_code -hdb_seal_keys_mkey __P(( - krb5_context context, - hdb_entry *ent, - hdb_master_key mkey)); +hdb_seal_keys_mkey ( + krb5_context /*context*/, + hdb_entry */*ent*/, + hdb_master_key /*mkey*/); krb5_error_code -hdb_set_master_key __P(( - krb5_context context, - HDB *db, - krb5_keyblock *key)); +hdb_set_master_key ( + krb5_context /*context*/, + HDB */*db*/, + krb5_keyblock */*key*/); krb5_error_code -hdb_set_master_keyfile __P(( - krb5_context context, - HDB *db, - const char *keyfile)); +hdb_set_master_keyfile ( + krb5_context /*context*/, + HDB */*db*/, + const char */*keyfile*/); krb5_error_code -hdb_unlock __P((int fd)); +hdb_unlock (int /*fd*/); krb5_error_code -hdb_unseal_keys __P(( - krb5_context context, - HDB *db, - hdb_entry *ent)); +hdb_unseal_keys ( + krb5_context /*context*/, + HDB */*db*/, + hdb_entry */*ent*/); krb5_error_code -hdb_unseal_keys_mkey __P(( - krb5_context context, - hdb_entry *ent, - hdb_master_key mkey)); +hdb_unseal_keys_mkey ( + krb5_context /*context*/, + hdb_entry */*ent*/, + hdb_master_key /*mkey*/); int -hdb_value2entry __P(( - krb5_context context, - krb5_data *value, - hdb_entry *ent)); +hdb_value2entry ( + krb5_context /*context*/, + krb5_data */*value*/, + hdb_entry */*ent*/); krb5_error_code -hdb_write_master_key __P(( - krb5_context context, - const char *filename, - hdb_master_key mkey)); +hdb_write_master_key ( + krb5_context /*context*/, + const char */*filename*/, + hdb_master_key /*mkey*/); #endif /* __hdb_protos_h__ */ diff --git a/kerberosV/src/lib/hdb/keytab.c b/kerberosV/src/lib/hdb/keytab.c index 8cb4b1f6d49..ed3245afb19 100644 --- a/kerberosV/src/lib/hdb/keytab.c +++ b/kerberosV/src/lib/hdb/keytab.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -35,7 +35,7 @@ /* keytab backend for HDB databases */ -RCSID("$KTH: keytab.c,v 1.4 2001/07/13 06:30:41 assar Exp $"); +RCSID("$KTH: keytab.c,v 1.5 2002/08/26 13:28:11 assar Exp $"); struct hdb_data { char *dbname; @@ -144,7 +144,7 @@ find_db (krb5_context context, const char **mkey, krb5_const_principal principal) { - krb5_config_binding *top_bind = NULL; + const krb5_config_binding *top_bind = NULL; krb5_config_binding *default_binding = NULL; krb5_config_binding *db; krb5_realm *prealm = krb5_princ_realm(context, (krb5_principal)principal); diff --git a/kerberosV/src/lib/hdb/print.c b/kerberosV/src/lib/hdb/print.c index f0f46b788a6..93a7c467214 100644 --- a/kerberosV/src/lib/hdb/print.c +++ b/kerberosV/src/lib/hdb/print.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1999-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "hdb_locl.h" #include <ctype.h> -RCSID("$KTH: print.c,v 1.7 2001/07/13 06:30:42 assar Exp $"); +RCSID("$KTH: print.c,v 1.8 2002/05/24 15:18:02 joda Exp $"); /* This is the present contents of a dump line. This might change at @@ -71,7 +71,7 @@ append_string(krb5_context context, krb5_storage *sp, const char *fmt, ...) krb5_set_error_string(context, "malloc: out of memory"); return ENOMEM; } - ret = sp->store(sp, s, strlen(s)); + ret = krb5_storage_write(sp, s, strlen(s)); free(s); return ret; } @@ -226,7 +226,7 @@ hdb_entry2string (krb5_context context, hdb_entry *ent, char **str) return ret; } - sp->store(sp, "\0", 1); + krb5_storage_write(sp, "\0", 1); krb5_storage_to_data(sp, &data); krb5_storage_free(sp); *str = data.data; @@ -256,7 +256,7 @@ hdb_print_entry(krb5_context context, HDB *db, hdb_entry *entry, void *data) return ret; } - sp->store(sp, "\n", 1); + krb5_storage_write(sp, "\n", 1); krb5_storage_free(sp); return 0; } diff --git a/kerberosV/src/lib/kadm5/ChangeLog b/kerberosV/src/lib/kadm5/ChangeLog index 49e95b7a343..1879c19960e 100644 --- a/kerberosV/src/lib/kadm5/ChangeLog +++ b/kerberosV/src/lib/kadm5/ChangeLog @@ -1,3 +1,86 @@ +2003-04-16 Love Hörnquist Åstrand <lha@it.su.se> + + * send_recv.c: check return values from krb5_data_alloc + * log.c: check return values from krb5_data_alloc + +2003-04-16 Love Hörnquist Åstrand <lha@it.su.se> + + * dump_log.c (print_entry): check return values from + krb5_data_alloc + +2003-04-01 Love Hörnquist Åstrand <lha@it.su.se> + + * init_c.c (kadm_connect): if a context realm was passed in, use + that to form the kadmin/admin principal + +2003-03-19 Love Hörnquist Åstrand <lha@it.su.se> + + * ipropd_master.c (main): make sure we don't consider dead slave + for select processing + (write_stats): use slave_stats_file variable, + check return value of strftime + (args): allow specifying slave stats file + (slave_dead): close the fd when the slave dies + +2002-10-21 Johan Danielsson <joda@pdc.kth.se> + + * ipropd_slave.c (from Derrick Brashear): Propagating a large + database without this means the slave kdcs can get erroneous + HDB_NOENTRY and return the resulting errors. This creates a new db + handle, populates it, and moves it into place. + +2002-08-26 Assar Westerlund <assar@kth.se> + + * ipropd_slave.c (receive_everything): type-correctness calling + _krb5_get_int + + * context_s.c (find_db_spec): const-correctness in parameters to + krb5_config_get_next + +2002-08-16 Johan Danielsson <joda@pdc.kth.se> + + * private.h: rename header file flag macro + + * Makefile.am: generate kadm5-{protos,private}.h + +2002-08-15 Johan Danielsson <joda@pdc.kth.se> + + * ipropd_master.c: check return value of krb5_sockaddr2address + +2002-07-04 Johan Danielsson <joda@pdc.kth.se> + + * ipropd_master.c: handle slaves that come and go; add status + reporting (both from Love) + + * iprop.h: KADM5_SLAVE_STATS + +2002-03-25 Jacques Vidrine <n@nectar.com> + + * init_c.c (get_cred_cache): bug fix: the default credentials + cache was not being used if a client name was specified. + +2002-03-25 Johan Danielsson <joda@pdc.kth.se> + + * init_c.c (get_cred_cache): when getting the default_client from + the cred cache, make sure the instance part is "admin"; this + should require fewer uses of -p + +2002-03-11 Assar Westerlund <assar@sics.se> + + * Makefile.am (libkadm5srv_la_LDFLAGS): set version to 7:5:0 + (libkadm5clnt_la_LDFLAGS): set version to 6:3:2 + +2002-02-08 Johan Danielsson <joda@pdc.kth.se> + + * init_c.c: we have to create our own param struct before + marshaling + +2001-09-05 Johan Danielsson <joda@pdc.kth.se> + + * Makefile.am: link with LIB_pidfile + + * iprop.h: include util.h for pidfile + 2001-08-31 Assar Westerlund <assar@sics.se> * ipropd_slave.c (main): syslog with the correct name diff --git a/kerberosV/src/lib/kadm5/context_s.c b/kerberosV/src/lib/kadm5/context_s.c index 499bb845788..1b0c64d8d09 100644 --- a/kerberosV/src/lib/kadm5/context_s.c +++ b/kerberosV/src/lib/kadm5/context_s.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kadm5_locl.h" -RCSID("$KTH: context_s.c,v 1.16 2001/08/13 14:42:13 joda Exp $"); +RCSID("$KTH: context_s.c,v 1.17 2002/08/26 13:28:36 assar Exp $"); static void set_funcs(kadm5_server_context *c) @@ -124,14 +124,15 @@ set_config(kadm5_server_context *ctx, static kadm5_ret_t find_db_spec(kadm5_server_context *ctx) { - krb5_config_binding *top_binding = NULL; + const krb5_config_binding *top_binding = NULL; krb5_config_binding *db_binding; krb5_config_binding *default_binding = NULL; krb5_context context = ctx->context; while((db_binding = (krb5_config_binding *) krb5_config_get_next(context, - NULL, &top_binding, + NULL, + &top_binding, krb5_config_list, "kdc", "database", diff --git a/kerberosV/src/lib/kadm5/kadm5-private.h b/kerberosV/src/lib/kadm5/kadm5-private.h index 6ae21cbe95c..63e579f99c9 100644 --- a/kerberosV/src/lib/kadm5/kadm5-private.h +++ b/kerberosV/src/lib/kadm5/kadm5-private.h @@ -1,245 +1,522 @@ -/* - * Copyright (c) 2000 Kungliga Tekniska Högskolan - * (Royal Institute of Technology, Stockholm, Sweden). - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * 3. Neither the name of the Institute nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - */ +/* This is a generated file */ +#ifndef __kadm5_private_h__ +#define __kadm5_private_h__ -/* $KTH: kadm5-private.h,v 1.3 2000/07/24 04:31:17 assar Exp $ */ +#include <stdarg.h> -#ifndef __kadm5_privatex_h__ -#define __kadm5_privatex_h__ +kadm5_ret_t +_kadm5_acl_check_permission ( + kadm5_server_context */*context*/, + unsigned /*op*/, + krb5_const_principal /*princ*/); + +kadm5_ret_t +_kadm5_acl_init (kadm5_server_context */*context*/); -kadm5_ret_t _kadm5_privs_to_string (u_int32_t, char*, size_t); +kadm5_ret_t +_kadm5_bump_pw_expire ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/); -kadm5_ret_t _kadm5_string_to_privs (const char*, u_int32_t*); +kadm5_ret_t +_kadm5_c_init_context ( + kadm5_client_context **/*ctx*/, + kadm5_config_params */*params*/, + krb5_context /*context*/); -HDB *_kadm5_s_get_db (void *); +kadm5_ret_t +_kadm5_client_recv ( + kadm5_client_context */*context*/, + krb5_data */*reply*/); kadm5_ret_t -_kadm5_acl_check_permission __P(( - kadm5_server_context *context, - unsigned op, - krb5_const_principal princ)); +_kadm5_client_send ( + kadm5_client_context */*context*/, + krb5_storage */*sp*/); + +int +_kadm5_cmp_keys ( + Key */*keys1*/, + int /*len1*/, + Key */*keys2*/, + int /*len2*/); + +kadm5_ret_t +_kadm5_connect (void */*handle*/); + +kadm5_ret_t +_kadm5_error_code (kadm5_ret_t /*code*/); + +void +_kadm5_free_keys ( + kadm5_server_context */*context*/, + int /*len*/, + Key */*keys*/); + +void +_kadm5_init_keys ( + Key */*keys*/, + int /*len*/); + +kadm5_ret_t +_kadm5_marshal_params ( + krb5_context /*context*/, + kadm5_config_params */*params*/, + krb5_data */*out*/); + +kadm5_ret_t +_kadm5_privs_to_string ( + u_int32_t /*privs*/, + char */*string*/, + size_t /*len*/); + +HDB * +_kadm5_s_get_db (void */*server_handle*/); kadm5_ret_t -_kadm5_acl_init __P((kadm5_server_context *context)); +_kadm5_s_init_context ( + kadm5_server_context **/*ctx*/, + kadm5_config_params */*params*/, + krb5_context /*context*/); kadm5_ret_t -_kadm5_c_init_context __P(( - kadm5_client_context **ctx, - kadm5_config_params *params, - krb5_context context)); +_kadm5_set_keys ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + const char */*password*/); kadm5_ret_t -_kadm5_client_recv __P(( - kadm5_client_context *context, - krb5_data *reply)); +_kadm5_set_keys2 ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + int16_t /*n_key_data*/, + krb5_key_data */*key_data*/); kadm5_ret_t -_kadm5_client_send __P(( - kadm5_client_context *context, - krb5_storage *sp)); +_kadm5_set_keys3 ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + int /*n_keys*/, + krb5_keyblock */*keyblocks*/); kadm5_ret_t -_kadm5_connect __P((void*)); +_kadm5_set_keys_randomly ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + krb5_keyblock **/*new_keys*/, + int */*n_keys*/); kadm5_ret_t -_kadm5_error_code __P((kadm5_ret_t code)); +_kadm5_set_modifier ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/); kadm5_ret_t -_kadm5_s_init_context __P(( - kadm5_server_context **ctx, - kadm5_config_params *params, - krb5_context context)); +_kadm5_setup_entry ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + u_int32_t /*mask*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*princ_mask*/, + kadm5_principal_ent_t /*def*/, + u_int32_t /*def_mask*/); kadm5_ret_t -_kadm5_set_keys __P(( - kadm5_server_context *context, - hdb_entry *ent, - const char *password)); +_kadm5_string_to_privs ( + const char */*s*/, + u_int32_t* /*privs*/); kadm5_ret_t -_kadm5_set_keys2 __P(( - kadm5_server_context *context, - hdb_entry *ent, - int16_t n_key_data, - krb5_key_data *key_data)); +_kadm5_unmarshal_params ( + krb5_context /*context*/, + krb5_data */*in*/, + kadm5_config_params */*params*/); kadm5_ret_t -_kadm5_set_keys3 __P(( - kadm5_server_context *context, - hdb_entry *ent, - int n_keys, - krb5_keyblock *keyblocks)); +kadm5_c_chpass_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + char */*password*/); kadm5_ret_t -_kadm5_set_keys_randomly __P((kadm5_server_context *context, - hdb_entry *ent, - krb5_keyblock **new_keys, - int *n_keys)); +kadm5_c_chpass_principal_with_key ( + void */*server_handle*/, + krb5_principal /*princ*/, + int /*n_key_data*/, + krb5_key_data */*key_data*/); kadm5_ret_t -_kadm5_set_modifier __P(( - kadm5_server_context *context, - hdb_entry *ent)); +kadm5_c_create_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/, + char */*password*/); kadm5_ret_t -_kadm5_bump_pw_expire __P((kadm5_server_context *context, - hdb_entry *ent)); +kadm5_c_delete_principal ( + void */*server_handle*/, + krb5_principal /*princ*/); kadm5_ret_t -_kadm5_setup_entry __P(( - kadm5_server_context *context, - hdb_entry *ent, - u_int32_t mask, - kadm5_principal_ent_t princ, - u_int32_t princ_mask, - kadm5_principal_ent_t def, - u_int32_t def_mask)); +kadm5_c_destroy (void */*server_handle*/); kadm5_ret_t -kadm5_log_get_version_fd (int fd, u_int32_t *ver); +kadm5_c_flush (void */*server_handle*/); kadm5_ret_t -kadm5_log_get_version (kadm5_server_context *context, u_int32_t *ver); +kadm5_c_get_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + kadm5_principal_ent_t /*out*/, + u_int32_t /*mask*/); kadm5_ret_t -kadm5_log_set_version (kadm5_server_context *context, u_int32_t vno); +kadm5_c_get_principals ( + void */*server_handle*/, + const char */*exp*/, + char ***/*princs*/, + int */*count*/); kadm5_ret_t -kadm5_log_init (kadm5_server_context *context); +kadm5_c_get_privs ( + void */*server_handle*/, + u_int32_t */*privs*/); kadm5_ret_t -kadm5_log_reinit (kadm5_server_context *context); +kadm5_c_init_with_creds ( + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_create (kadm5_server_context *context, - hdb_entry *ent); +kadm5_c_init_with_creds_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_delete (kadm5_server_context *context, - krb5_principal princ); +kadm5_c_init_with_password ( + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_rename (kadm5_server_context *context, - krb5_principal source, - hdb_entry *ent); +kadm5_c_init_with_password_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_modify (kadm5_server_context *context, - hdb_entry *ent, - u_int32_t mask); +kadm5_c_init_with_skey ( + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_nop (kadm5_server_context *context); +kadm5_c_init_with_skey_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_log_end (kadm5_server_context *context); +kadm5_c_modify_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/); kadm5_ret_t -kadm5_log_foreach (kadm5_server_context *context, - void (*func)(kadm5_server_context *server_context, - u_int32_t ver, - time_t timestamp, - enum kadm_ops op, - u_int32_t len, - krb5_storage *sp)); +kadm5_c_randkey_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + krb5_keyblock **/*new_keys*/, + int */*n_keys*/); kadm5_ret_t -kadm5_log_replay_create (kadm5_server_context *context, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_c_rename_principal ( + void */*server_handle*/, + krb5_principal /*source*/, + krb5_principal /*target*/); kadm5_ret_t -kadm5_log_replay_delete (kadm5_server_context *context, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_log_create ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/); kadm5_ret_t -kadm5_log_replay_rename (kadm5_server_context *context, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_log_delete ( + kadm5_server_context */*context*/, + krb5_principal /*princ*/); kadm5_ret_t -kadm5_log_replay_modify (kadm5_server_context *context, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_log_end (kadm5_server_context */*context*/); kadm5_ret_t -kadm5_log_replay_nop (kadm5_server_context *context, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_log_foreach ( + kadm5_server_context */*context*/, + void (*/*func*/)(kadm5_server_context *server_context, u_int32_t ver, time_t timestamp, enum kadm_ops op, u_int32_t len, krb5_storage *sp)); kadm5_ret_t -kadm5_log_replay (kadm5_server_context *context, - enum kadm_ops op, - u_int32_t ver, - u_int32_t len, - krb5_storage *sp); +kadm5_log_get_version ( + kadm5_server_context */*context*/, + u_int32_t */*ver*/); + +kadm5_ret_t +kadm5_log_get_version_fd ( + int /*fd*/, + u_int32_t */*ver*/); krb5_storage * -kadm5_log_goto_end (int fd); +kadm5_log_goto_end (int /*fd*/); kadm5_ret_t -kadm5_log_previous (krb5_storage *sp, - u_int32_t *ver, - time_t *timestamp, - enum kadm_ops *op, - u_int32_t *len); +kadm5_log_init (kadm5_server_context */*context*/); kadm5_ret_t -kadm5_log_truncate (kadm5_server_context *server_context); +kadm5_log_modify ( + kadm5_server_context */*context*/, + hdb_entry */*ent*/, + u_int32_t /*mask*/); kadm5_ret_t -_kadm5_marshal_params __P((krb5_context context, - kadm5_config_params *params, - krb5_data *out)); +kadm5_log_nop (kadm5_server_context */*context*/); kadm5_ret_t -_kadm5_unmarshal_params __P((krb5_context context, - krb5_data *in, - kadm5_config_params *params)); +kadm5_log_previous ( + krb5_storage */*sp*/, + u_int32_t */*ver*/, + time_t */*timestamp*/, + enum kadm_ops */*op*/, + u_int32_t */*len*/); -void -_kadm5_free_keys (kadm5_server_context *context, - int len, Key *keys); +kadm5_ret_t +kadm5_log_reinit (kadm5_server_context */*context*/); -void -_kadm5_init_keys (Key *keys, int len); +kadm5_ret_t +kadm5_log_rename ( + kadm5_server_context */*context*/, + krb5_principal /*source*/, + hdb_entry */*ent*/); -int -_kadm5_cmp_keys(Key *keys1, int len1, Key *keys2, int len2); +kadm5_ret_t +kadm5_log_replay ( + kadm5_server_context */*context*/, + enum kadm_ops /*op*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_replay_create ( + kadm5_server_context */*context*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_replay_delete ( + kadm5_server_context */*context*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_replay_modify ( + kadm5_server_context */*context*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_replay_nop ( + kadm5_server_context */*context*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_replay_rename ( + kadm5_server_context */*context*/, + u_int32_t /*ver*/, + u_int32_t /*len*/, + krb5_storage */*sp*/); + +kadm5_ret_t +kadm5_log_set_version ( + kadm5_server_context */*context*/, + u_int32_t /*vno*/); -#endif /* __kadm5_privatex_h__ */ +kadm5_ret_t +kadm5_log_truncate (kadm5_server_context */*server_context*/); + +kadm5_ret_t +kadm5_s_chpass_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + char */*password*/); + +kadm5_ret_t +kadm5_s_chpass_principal_cond ( + void */*server_handle*/, + krb5_principal /*princ*/, + char */*password*/); + +kadm5_ret_t +kadm5_s_chpass_principal_with_key ( + void */*server_handle*/, + krb5_principal /*princ*/, + int /*n_key_data*/, + krb5_key_data */*key_data*/); + +kadm5_ret_t +kadm5_s_create_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/, + char */*password*/); + +kadm5_ret_t +kadm5_s_create_principal_with_key ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/); + +kadm5_ret_t +kadm5_s_delete_principal ( + void */*server_handle*/, + krb5_principal /*princ*/); + +kadm5_ret_t +kadm5_s_destroy (void */*server_handle*/); + +kadm5_ret_t +kadm5_s_flush (void */*server_handle*/); + +kadm5_ret_t +kadm5_s_get_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + kadm5_principal_ent_t /*out*/, + u_int32_t /*mask*/); + +kadm5_ret_t +kadm5_s_get_principals ( + void */*server_handle*/, + const char */*exp*/, + char ***/*princs*/, + int */*count*/); + +kadm5_ret_t +kadm5_s_get_privs ( + void */*server_handle*/, + u_int32_t */*privs*/); + +kadm5_ret_t +kadm5_s_init_with_creds ( + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_init_with_creds_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_init_with_password ( + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_init_with_password_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_init_with_skey ( + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_init_with_skey_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); + +kadm5_ret_t +kadm5_s_modify_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/); + +kadm5_ret_t +kadm5_s_randkey_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + krb5_keyblock **/*new_keys*/, + int */*n_keys*/); + +kadm5_ret_t +kadm5_s_rename_principal ( + void */*server_handle*/, + krb5_principal /*source*/, + krb5_principal /*target*/); + +#endif /* __kadm5_private_h__ */ diff --git a/kerberosV/src/lib/kadm5/kadm5-protos.h b/kerberosV/src/lib/kadm5/kadm5-protos.h index 5501535d4d1..c0a0cce7a0c 100644 --- a/kerberosV/src/lib/kadm5/kadm5-protos.h +++ b/kerberosV/src/lib/kadm5/kadm5-protos.h @@ -1,516 +1,210 @@ -/* - * Copyright (c) 2000 Kungliga Tekniska Högskolan - * (Royal Institute of Technology, Stockholm, Sweden). - * All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * 3. Neither the name of the Institute nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. - * - * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - */ - -/* $KTH: kadm5-protos.h,v 1.2 2000/07/22 05:52:01 assar Exp $ */ - +/* This is a generated file */ #ifndef __kadm5_protos_h__ #define __kadm5_protos_h__ -kadm5_ret_t -kadm5_c_chpass_principal __P(( - void *server_handle, - krb5_principal princ, - char *password)); - -kadm5_ret_t -kadm5_c_chpass_principal_with_key __P(( - void *server_handle, - krb5_principal princ, - int n_key_data, - krb5_key_data *key_data)); - -kadm5_ret_t -kadm5_c_create_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask, - char *password)); +#include <stdarg.h> -kadm5_ret_t -kadm5_c_delete_principal __P(( - void *server_handle, - krb5_principal princ)); - -kadm5_ret_t -kadm5_c_destroy __P((void *server_handle)); - -kadm5_ret_t -kadm5_c_flush __P((void *server_handle)); - -kadm5_ret_t -kadm5_c_get_principal __P(( - void *server_handle, - krb5_principal princ, - kadm5_principal_ent_t out, - u_int32_t mask)); - -kadm5_ret_t -kadm5_c_get_principals __P(( - void *server_handle, - const char *exp, - char ***princs, - int *count)); - -kadm5_ret_t -kadm5_c_get_privs __P(( - void *server_handle, - u_int32_t *privs)); - -kadm5_ret_t -kadm5_c_init_with_creds __P(( - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_init_with_creds_ctx __P(( - krb5_context context, - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_init_with_password __P(( - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_init_with_password_ctx __P(( - krb5_context context, - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_init_with_skey __P(( - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_init_with_skey_ctx __P(( - krb5_context context, - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_c_modify_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask)); - -kadm5_ret_t -kadm5_c_randkey_principal __P(( - void *server_handle, - krb5_principal princ, - krb5_keyblock **new_keys, - int *n_keys)); - -kadm5_ret_t -kadm5_c_rename_principal __P(( - void *server_handle, - krb5_principal source, - krb5_principal target)); +const char * +kadm5_check_password_quality ( + krb5_context /*context*/, + krb5_principal /*principal*/, + krb5_data */*pwd_data*/); kadm5_ret_t -kadm5_chpass_principal __P(( - void *server_handle, - krb5_principal princ, - char *password)); +kadm5_chpass_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + char */*password*/); kadm5_ret_t -kadm5_chpass_principal_with_key __P(( - void *server_handle, - krb5_principal princ, - int n_key_data, - krb5_key_data *key_data)); +kadm5_chpass_principal_with_key ( + void */*server_handle*/, + krb5_principal /*princ*/, + int /*n_key_data*/, + krb5_key_data */*key_data*/); kadm5_ret_t -kadm5_create_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask, - char *password)); +kadm5_create_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/, + char */*password*/); kadm5_ret_t -kadm5_delete_principal __P(( - void *server_handle, - krb5_principal princ)); +kadm5_delete_principal ( + void */*server_handle*/, + krb5_principal /*princ*/); kadm5_ret_t -kadm5_destroy __P((void *server_handle)); +kadm5_destroy (void */*server_handle*/); kadm5_ret_t -kadm5_flush __P((void *server_handle)); +kadm5_flush (void */*server_handle*/); void -kadm5_free_key_data __P(( - void *server_handle, - int16_t *n_key_data, - krb5_key_data *key_data)); +kadm5_free_key_data ( + void */*server_handle*/, + int16_t */*n_key_data*/, + krb5_key_data */*key_data*/); void -kadm5_free_name_list __P(( - void *server_handle, - char **names, - int *count)); +kadm5_free_name_list ( + void */*server_handle*/, + char **/*names*/, + int */*count*/); void -kadm5_free_principal_ent __P(( - void *server_handle, - kadm5_principal_ent_t princ)); - -kadm5_ret_t -kadm5_get_principal __P(( - void *server_handle, - krb5_principal princ, - kadm5_principal_ent_t out, - u_int32_t mask)); - -kadm5_ret_t -kadm5_get_principals __P(( - void *server_handle, - const char *exp, - char ***princs, - int *count)); - -kadm5_ret_t -kadm5_get_privs __P(( - void *server_handle, - u_int32_t *privs)); - -kadm5_ret_t -kadm5_init_with_creds __P(( - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_init_with_creds_ctx __P(( - krb5_context context, - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_init_with_password __P(( - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_init_with_password_ctx __P(( - krb5_context context, - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_init_with_skey __P(( - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_init_with_skey_ctx __P(( - krb5_context context, - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_modify_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask)); - -kadm5_ret_t -kadm5_randkey_principal __P(( - void *server_handle, - krb5_principal princ, - krb5_keyblock **new_keys, - int *n_keys)); - -kadm5_ret_t -kadm5_rename_principal __P(( - void *server_handle, - krb5_principal source, - krb5_principal target)); - -kadm5_ret_t -kadm5_ret_key_data __P(( - krb5_storage *sp, - krb5_key_data *key)); +kadm5_free_principal_ent ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/); + +kadm5_ret_t +kadm5_get_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + kadm5_principal_ent_t /*out*/, + u_int32_t /*mask*/); kadm5_ret_t -kadm5_ret_principal_ent __P(( - krb5_storage *sp, - kadm5_principal_ent_t princ)); +kadm5_get_principals ( + void */*server_handle*/, + const char */*exp*/, + char ***/*princs*/, + int */*count*/); kadm5_ret_t -kadm5_ret_principal_ent_mask __P(( - krb5_storage *sp, - kadm5_principal_ent_t princ, - u_int32_t *mask)); +kadm5_get_privs ( + void */*server_handle*/, + u_int32_t */*privs*/); kadm5_ret_t -kadm5_ret_tl_data __P(( - krb5_storage *sp, - krb5_tl_data *tl)); +kadm5_init_with_creds ( + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_chpass_principal __P(( - void *server_handle, - krb5_principal princ, - char *password)); +kadm5_init_with_creds_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + krb5_ccache /*ccache*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_chpass_principal_cond __P(( - void *server_handle, - krb5_principal princ, - char *password)); +kadm5_init_with_password ( + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_chpass_principal_with_key __P(( - void *server_handle, - krb5_principal princ, - int n_key_data, - krb5_key_data *key_data)); +kadm5_init_with_password_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*password*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_create_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask, - char *password)); +kadm5_init_with_skey ( + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_create_principal_with_key __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask)); +kadm5_init_with_skey_ctx ( + krb5_context /*context*/, + const char */*client_name*/, + const char */*keytab*/, + const char */*service_name*/, + kadm5_config_params */*realm_params*/, + unsigned long /*struct_version*/, + unsigned long /*api_version*/, + void **/*server_handle*/); kadm5_ret_t -kadm5_s_delete_principal __P(( - void *server_handle, - krb5_principal princ)); +kadm5_modify_principal ( + void */*server_handle*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/); kadm5_ret_t -kadm5_s_destroy __P((void *server_handle)); +kadm5_randkey_principal ( + void */*server_handle*/, + krb5_principal /*princ*/, + krb5_keyblock **/*new_keys*/, + int */*n_keys*/); kadm5_ret_t -kadm5_s_flush __P((void *server_handle)); +kadm5_rename_principal ( + void */*server_handle*/, + krb5_principal /*source*/, + krb5_principal /*target*/); kadm5_ret_t -kadm5_s_get_principal __P(( - void *server_handle, - krb5_principal princ, - kadm5_principal_ent_t out, - u_int32_t mask)); +kadm5_ret_key_data ( + krb5_storage */*sp*/, + krb5_key_data */*key*/); kadm5_ret_t -kadm5_s_get_principals __P(( - void *server_handle, - const char *exp, - char ***princs, - int *count)); +kadm5_ret_principal_ent ( + krb5_storage */*sp*/, + kadm5_principal_ent_t /*princ*/); kadm5_ret_t -kadm5_s_get_privs __P(( - void *server_handle, - u_int32_t *privs)); +kadm5_ret_principal_ent_mask ( + krb5_storage */*sp*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t */*mask*/); kadm5_ret_t -kadm5_s_init_with_creds __P(( - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); +kadm5_ret_tl_data ( + krb5_storage */*sp*/, + krb5_tl_data */*tl*/); -kadm5_ret_t -kadm5_s_init_with_creds_ctx __P(( - krb5_context context, - const char *client_name, - krb5_ccache ccache, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_s_init_with_password __P(( - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_s_init_with_password_ctx __P(( - krb5_context context, - const char *client_name, - const char *password, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_s_init_with_skey __P(( - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_s_init_with_skey_ctx __P(( - krb5_context context, - const char *client_name, - const char *keytab, - const char *service_name, - kadm5_config_params *realm_params, - unsigned long struct_version, - unsigned long api_version, - void **server_handle)); - -kadm5_ret_t -kadm5_s_modify_principal __P(( - void *server_handle, - kadm5_principal_ent_t princ, - u_int32_t mask)); - -kadm5_ret_t -kadm5_s_randkey_principal __P(( - void *server_handle, - krb5_principal princ, - krb5_keyblock **new_keys, - int *n_keys)); - -kadm5_ret_t -kadm5_s_rename_principal __P(( - void *server_handle, - krb5_principal source, - krb5_principal target)); +void +kadm5_setup_passwd_quality_check ( + krb5_context /*context*/, + const char */*check_library*/, + const char */*check_function*/); kadm5_ret_t -kadm5_store_key_data __P(( - krb5_storage *sp, - krb5_key_data *key)); +kadm5_store_key_data ( + krb5_storage */*sp*/, + krb5_key_data */*key*/); kadm5_ret_t -kadm5_store_principal_ent __P(( - krb5_storage *sp, - kadm5_principal_ent_t princ)); +kadm5_store_principal_ent ( + krb5_storage */*sp*/, + kadm5_principal_ent_t /*princ*/); kadm5_ret_t -kadm5_store_principal_ent_mask __P(( - krb5_storage *sp, - kadm5_principal_ent_t princ, - u_int32_t mask)); +kadm5_store_principal_ent_mask ( + krb5_storage */*sp*/, + kadm5_principal_ent_t /*princ*/, + u_int32_t /*mask*/); kadm5_ret_t -kadm5_store_tl_data __P(( - krb5_storage *sp, - krb5_tl_data *tl)); - -void -kadm5_setup_passwd_quality_check(krb5_context context, - const char *check_library, - const char *check_function); - -const char * -kadm5_check_password_quality (krb5_context context, - krb5_principal principal, - krb5_data *pwd_data); +kadm5_store_tl_data ( + krb5_storage */*sp*/, + krb5_tl_data */*tl*/); #endif /* __kadm5_protos_h__ */ diff --git a/kerberosV/src/lib/kadm5/kadm5_err.et b/kerberosV/src/lib/kadm5/kadm5_err.et index b07edbbe2e5..1afb24919b8 100644 --- a/kerberosV/src/lib/kadm5/kadm5_err.et +++ b/kerberosV/src/lib/kadm5/kadm5_err.et @@ -3,7 +3,7 @@ # # This might look like a com_err file, but is not # -id "$KTH: kadm5_err.et,v 1.4 1998/02/16 16:37:17 joda Exp $" +id "$KTH: kadm5_err.et,v 1.5 2001/12/06 17:02:55 assar Exp $" error_table ovk kadm5 @@ -29,7 +29,7 @@ error_code BAD_POLICY, "Invalid policy name" error_code BAD_PRINCIPAL, "Invalid principal name." error_code BAD_AUX_ATTR, "Invalid auxillary attributes" error_code BAD_HISTORY, "Invalid password history count" -error_code BAD_MIN_PASS_LIFE, "Password minimum life is greater then password maximum life" +error_code BAD_MIN_PASS_LIFE, "Password minimum life is greater than password maximum life" error_code PASS_Q_TOOSHORT, "Password is too short" error_code PASS_Q_CLASS, "Password does not contain enough character classes" error_code PASS_Q_DICT, "Password is in the password dictionary" diff --git a/kerberosV/src/lib/kadm5/private.h b/kerberosV/src/lib/kadm5/private.h index 6de904b9a8d..bd6cc8ed69b 100644 --- a/kerberosV/src/lib/kadm5/private.h +++ b/kerberosV/src/lib/kadm5/private.h @@ -31,10 +31,10 @@ * SUCH DAMAGE. */ -/* $KTH: private.h,v 1.14 2000/07/11 15:58:57 joda Exp $ */ +/* $KTH: private.h,v 1.15 2002/08/16 20:57:44 joda Exp $ */ -#ifndef __kadm5_private_h__ -#define __kadm5_private_h__ +#ifndef __kadm5_privatex_h__ +#define __kadm5_privatex_h__ struct kadm_func { kadm5_ret_t (*chpass_principal) (void *, krb5_principal, char*); @@ -129,4 +129,4 @@ enum kadm_ops { #include "kadm5-private.h" -#endif /* __kadm5_private_h__ */ +#endif /* __kadm5_privatex_h__ */ diff --git a/kerberosV/src/lib/kadm5/replay_log.c b/kerberosV/src/lib/kadm5/replay_log.c index 9dc1dab1bf3..6bd9bc27dae 100644 --- a/kerberosV/src/lib/kadm5/replay_log.c +++ b/kerberosV/src/lib/kadm5/replay_log.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998, 1999, 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "iprop.h" -RCSID("$KTH: replay_log.c,v 1.8 2001/02/19 18:10:43 joda Exp $"); +RCSID("$KTH: replay_log.c,v 1.9 2002/05/24 15:19:22 joda Exp $"); int start_version = -1; int end_version = -1; @@ -51,7 +51,7 @@ apply_entry(kadm5_server_context *server_context, if((start_version != -1 && ver < start_version) || (end_version != -1 && ver > end_version)) { /* XXX skip this entry */ - (*sp->seek)(sp, len, SEEK_CUR); + krb5_storage_seek(sp, len, SEEK_CUR); return; } printf ("ver %u... ", ver); diff --git a/kerberosV/src/lib/kadm5/send_recv.c b/kerberosV/src/lib/kadm5/send_recv.c index d4188c2b746..b4fb4fb7110 100644 --- a/kerberosV/src/lib/kadm5/send_recv.c +++ b/kerberosV/src/lib/kadm5/send_recv.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kadm5_locl.h" -RCSID("$KTH: send_recv.c,v 1.8 2000/07/11 16:00:58 joda Exp $"); +RCSID("$KTH: send_recv.c,v 1.10 2003/04/16 17:58:59 lha Exp $"); kadm5_ret_t _kadm5_client_send(kadm5_client_context *context, krb5_storage *sp) @@ -45,10 +45,12 @@ _kadm5_client_send(kadm5_client_context *context, krb5_storage *sp) assert(context->sock != -1); - len = sp->seek(sp, 0, SEEK_CUR); + len = krb5_storage_seek(sp, 0, SEEK_CUR); ret = krb5_data_alloc(&msg, len); - sp->seek(sp, 0, SEEK_SET); - sp->fetch(sp, msg.data, msg.length); + if (ret) + return ret; + krb5_storage_seek(sp, 0, SEEK_SET); + krb5_storage_read(sp, msg.data, msg.length); ret = krb5_mk_priv(context->context, context->ac, &msg, &out, NULL); krb5_data_free(&msg); diff --git a/kerberosV/src/lib/kafs/ChangeLog b/kerberosV/src/lib/kafs/ChangeLog index e6dccd6efe3..4c125e1e0f7 100644 --- a/kerberosV/src/lib/kafs/ChangeLog +++ b/kerberosV/src/lib/kafs/ChangeLog @@ -1,3 +1,165 @@ +2003-04-23 Love Hörquist Åstrand <lha@it.su.se> + + * common.c, kafs.h: drop the int argument (the error code) from + the logging function + +2003-04-22 Johan Danielsson <joda@pdc.kth.se> + + * afskrb5.c (v5_convert): better match what other functions do + with values from krb5.conf, like case insensitivity + +2003-04-16 Love Hörquist Åstrand <lha@it.su.se> + + * kafs.3: Change .Fd #include <header.h> to .In header.h + from Thomas Klausner <wiz@netbsd.org> + +2003-04-14 Love Hörquist Åstrand <lha@it.su.se> + + * Makefile.am: (libkafs_la_LDFLAGS): update version + + * Makefile.am (ROKEN_SRCS): drop strupr.c + + * kafs.3: document kafs_set_verbose + + * common.c (kafs_set_verbose): add function that (re)sets the + logging function + (_kafs_try_get_cred): add function that does (krb_data->get_cred) to + make logging easier (that is now done in this function) + (*): use _kafs_try_get_cred + + * afskrb5.c (get_cred): handle that inst can be the empty string too + (v5_convert): use _kafs_foldup + (krb5_afslog_uid_home): set name + (krb5_afslog_uid_home): ditto + + * afskrb.c (krb_afslog_uid_home): set name + (krb_afslog_uid_home): ditto + + * kafs_locl.h (kafs_data): add name + (_kafs_foldup): internally export + +2003-04-11 Love Hörquist Åstrand <lha@it.su.se> + + * kafs.3: tell that cell-name is uppercased + + * Makefile.am: add INCLUDE_krb4 when using krb4, add INCLUDE_des + when using krb5, add strupr.c + + * afskrb5.c: Check the cell part of the name, not the realm part + when checking if 2b should be used. The reson is afs@REALM might + have updated their servers but not afs/cell@REALM. Add constant + KAFS_RXKAD_2B_KVNO. + +2003-04-06 Love Hörquist Åstrand <lha@it.su.se> + + * kafs.3: s/kerberos/Kerberos/ + +2003-03-19 Love Hörquist Åstrand <lha@it.su.se> + + * kafs.3: spelling, from <jmc@prioris.mini.pw.edu.pl> + + * kafs.3: document the kafs_settoken functions write about the + krb5_appdefault option for kerberos 5 afs tokens fix prototypes + +2003-03-18 Love Hörquist Åstrand <lha@it.su.se> + + * afskrb5.c (kafs_settoken5): change signature to include a + krb5_context, use v5_convert + (v5_convert): new function, converts a krb5_ccreds to a kafs_token in + three diffrent ways, not at all, local 524/2b, and using 524 + (v5_to_kt): add code to do local 524/2b + (get_cred): use v5_convert + + + * kafs.h (kafs_settoken5): change signature to include a + krb5_context + + * Makefile.am: always build the libkafs library now that the + kerberos 5 can stand on their own + + * kafs.3: expose the krb5 functions + + * common.c (kafs_settoken_rxkad): move all content kerberos + version from kafs_settoken to kafs_settoken_rxkad + (_kafs_fixup_viceid): move the fixup the timestamp to make client + happy code here. + (_kafs_v4_to_kt): move all the kerberos 4 dependant parts from + kafs_settoken here. + (*): adapt to kafs_token + + * afskrb5.c (kafs_settoken5): new function, inserts a krb5_creds + into kernel + (v5_to_kt): new function, stores a krb5_creds in struct kafs_token + (get_cred): add a appdefault boolean ("libkafs", realm, "afs-use-524") + that can used to toggle if there should v5 token should be used + directly or converted via 524 first. + + * afskrb.c: move kafs_settoken here, use struct kafs_token + + * kafs_locl.h: include krb5-v4compat.h if needed, define an + internal structure struct kafs_token that carries around for rxkad + data that is independant of kerberos version + +2003-02-18 Love Hörquist Åstrand <lha@it.su.se> + + * dlfcn.h: s/intialize/initialize, from + <jmc@prioris.mini.pw.edu.pl> + +2003-02-08 Assar Westerlund <assar@kth.se> + + * afssysdefs.h: fix FreeBSD section + +2003-02-06 Love Hörquist Åstrand <lha@it.su.se> + + * afssysdefs.h: use syscall 208 on openbsd (all version) use + syscall 339 on freebsd 5.0 and later, use 210 on 4.x and earlier + +2002-08-28 Johan Danielsson <joda@pdc.kth.se> + + * kafs.3: move around sections (from NetBSD) + +2002-05-31 Assar Westerlund <assar@pdc.kth.se> + + * common.c: remove the trial of afs@REALM for cell != realm, it + tries to use the wrong key for foreign cells + +2002-05-20 Johan Danielsson <joda@pdc.kth.se> + + * Makefile.am: version number + +2002-04-18 Johan Danielsson <joda@pdc.kth.se> + + * common.c (find_cells): make file parameter const + +2001-11-01 Assar Westerlund <assar@sics.se> + + * add strsep, and bump version to 3:3:3 + +2001-10-27 Assar Westerlund <assar@sics.se> + + * Makefile.am (libkafs_la_LDFLAGS): set version to 3:2:3 + +2001-10-24 Assar Westerlund <assar@sics.se> + + * afskrb.c (afslog_uid_int): handle krb_get_tf_fullname that + cannot take NULLs + (such as the MIT one) + +2001-10-22 Assar Westerlund <assar@sics.se> + + * Makefile.am (ROKEN_SRCS): add strlcpy.c + +2001-10-09 Assar Westerlund <assar@sics.se> + + * Makefile.am (ROKEN_SRCS): add strtok_r.c + * roken_rename.h (dns_srv_order): rename correctly + (strtok_r): add renaming + +2001-09-10 Assar Westerlund <assar@sics.se> + + * kafs.h, common.c: look for configuration files in /etc/arla (the + location in debian's arla package) + 2001-08-26 Assar Westerlund <assar@sics.se> * Makefile.am: handle both krb5 and krb4 cases diff --git a/kerberosV/src/lib/kafs/afskrb.c b/kerberosV/src/lib/kafs/afskrb.c index 6e26a438392..c4cde6c6afe 100644 --- a/kerberosV/src/lib/kafs/afskrb.c +++ b/kerberosV/src/lib/kafs/afskrb.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2001, 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,9 @@ #include "kafs_locl.h" -RCSID("$KTH: afskrb.c,v 1.14 2000/03/16 05:35:56 assar Exp $"); +RCSID("$KTH: afskrb.c,v 1.17 2003/04/14 08:32:11 lha Exp $"); + +#ifdef KRB4 struct krb_kafs_data { const char *realm; @@ -41,16 +43,19 @@ struct krb_kafs_data { static int get_cred(kafs_data *data, const char *name, const char *inst, - const char *realm, CREDENTIALS *c) + const char *realm, uid_t uid, struct kafs_token *kt) { + CREDENTIALS c; KTEXT_ST tkt; - int ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, c); + int ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, &c); if (ret) { ret = krb_mk_req(&tkt, (char*)name, (char*)inst, (char*)realm, 0); if (ret == KSUCCESS) - ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, c); + ret = krb_get_cred((char*)name, (char*)inst, (char*)realm, &c); } + if (ret == 0) + ret = _kafs_v4_to_kt(&c, uid, kt); return ret; } @@ -62,21 +67,28 @@ afslog_uid_int(kafs_data *data, const char *homedir) { int ret; - CREDENTIALS c; + struct kafs_token kt; + char name[ANAME_SZ]; + char inst[INST_SZ]; char realm[REALM_SZ]; + kt.ticket = NULL; + if (cell == 0 || cell[0] == 0) return _kafs_afslog_all_local_cells (data, uid, homedir); /* Extract realm from ticket file. */ - ret = krb_get_tf_fullname(tkt_string(), NULL, NULL, realm); + ret = krb_get_tf_fullname(tkt_string(), name, inst, realm); if (ret != KSUCCESS) return ret; - ret = _kafs_get_cred(data, cell, realm_hint, realm, &c); + kt.ticket = NULL; + ret = _kafs_get_cred(data, cell, realm_hint, realm, uid, &kt); - if (ret == 0) - ret = kafs_settoken(cell, uid, &c); + if (ret == 0) { + ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len); + free(kt.ticket); + } return ret; } @@ -96,6 +108,7 @@ krb_afslog_uid_home(const char *cell, const char *realm_hint, uid_t uid, { kafs_data kd; + kd.name = "krb4"; kd.afslog_uid = afslog_uid_int; kd.get_cred = get_cred; kd.get_realm = get_realm; @@ -130,6 +143,31 @@ krb_realm_of_cell(const char *cell, char **realm) { kafs_data kd; + kd.name = "krb4"; kd.get_realm = get_realm; return _kafs_realm_of_cell(&kd, cell, realm); } + +int +kafs_settoken(const char *cell, uid_t uid, CREDENTIALS *c) +{ + struct kafs_token kt; + int ret; + + kt.ticket = NULL; + + ret = _kafs_v4_to_kt(c, uid, &kt); + if (ret) + return ret; + + if (kt.ct.EndTimestamp < time(NULL)) { + free(kt.ticket); + return 0; + } + + ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len); + free(kt.ticket); + return ret; +} + +#endif /* KRB4 */ diff --git a/kerberosV/src/lib/kafs/afskrb5.c b/kerberosV/src/lib/kafs/afskrb5.c index 502fa821515..4dbf3115423 100644 --- a/kerberosV/src/lib/kafs/afskrb5.c +++ b/kerberosV/src/lib/kafs/afskrb5.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1995-2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "kafs_locl.h" -RCSID("$KTH: afskrb5.c,v 1.14 2001/06/18 13:11:32 assar Exp $"); +RCSID("$KTH: afskrb5.c,v 1.18.2.1 2003/04/22 14:25:43 joda Exp $"); struct krb5_kafs_data { krb5_context context; @@ -41,9 +41,126 @@ struct krb5_kafs_data { krb5_const_realm realm; }; +enum { + KAFS_RXKAD_2B_KVNO = 213, + KAFS_RXKAD_K5_KVNO = 256 +}; + +static int +v5_to_kt(krb5_creds *cred, uid_t uid, struct kafs_token *kt, int local524) +{ + int kvno, ret; + + kt->ticket = NULL; + + /* check if des key */ + if (cred->session.keyvalue.length != 8) + return EINVAL; + + if (local524) { + Ticket t; + unsigned char *buf; + size_t buf_len; + size_t len; + + kvno = KAFS_RXKAD_2B_KVNO; + + ret = decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len); + if (ret) + return ret; + if (t.tkt_vno != 5) + return -1; + + ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_len, &t.enc_part, + &len, ret); + free_Ticket(&t); + if (ret) + return ret; + if(buf_len != len) { + free(buf); + return KRB5KRB_ERR_GENERIC; + } + + kt->ticket = buf; + kt->ticket_len = buf_len; + + } else { + kvno = KAFS_RXKAD_K5_KVNO; + kt->ticket = malloc(cred->ticket.length); + if (kt->ticket == NULL) + return ENOMEM; + kt->ticket_len = cred->ticket.length; + memcpy(kt->ticket, cred->ticket.data, kt->ticket_len); + + ret = 0; + } + + + /* + * Build a struct ClearToken + */ + + kt->ct.AuthHandle = kvno; + memcpy(kt->ct.HandShakeKey, cred->session.keyvalue.data, 8); + kt->ct.ViceId = uid; + kt->ct.BeginTimestamp = cred->times.starttime; + kt->ct.EndTimestamp = cred->times.endtime; + + _kafs_fixup_viceid(&kt->ct, uid); + + return 0; +} + +static krb5_error_code +v5_convert(krb5_context context, krb5_ccache id, + krb5_creds *cred, uid_t uid, + const char *cell, + struct kafs_token *kt) +{ + krb5_error_code ret; + char *c, *val; + + c = strdup(cell); + if (c == NULL) + return ENOMEM; + _kafs_foldup(c, c); + krb5_appdefault_string (context, "libkafs", + c, + "afs-use-524", "yes", &val); + free(c); + + if (strcasecmp(val, "local") == 0 || + strcasecmp(val, "2b") == 0) + ret = v5_to_kt(cred, uid, kt, 1); + else if(strcasecmp(val, "yes") == 0 || + strcasecmp(val, "true") == 0 || + atoi(val)) { + struct credentials c; + + if (id == NULL) + ret = krb524_convert_creds_kdc(context, cred, &c); + else + ret = krb524_convert_creds_kdc_ccache(context, id, cred, &c); + if (ret) + goto out; + + ret = _kafs_v4_to_kt(&c, uid, kt); + } else + ret = v5_to_kt(cred, uid, kt, 0); + + out: + free(val); + return ret; +} + + +/* + * + */ + static int get_cred(kafs_data *data, const char *name, const char *inst, - const char *realm, CREDENTIALS *c) + const char *realm, uid_t uid, struct kafs_token *kt) { krb5_error_code ret; krb5_creds in_creds, *out_creds; @@ -65,8 +182,11 @@ get_cred(kafs_data *data, const char *name, const char *inst, krb5_free_principal(d->context, in_creds.client); if(ret) return ret; - ret = krb524_convert_creds_kdc_ccache(d->context, d->id, out_creds, c); + + ret = v5_convert(d->context, d->id, out_creds, uid, + (inst != NULL && inst[0] != '\0') ? inst : realm, kt); krb5_free_creds(d->context, out_creds); + return ret; } @@ -75,7 +195,7 @@ afslog_uid_int(kafs_data *data, const char *cell, const char *rh, uid_t uid, const char *homedir) { krb5_error_code ret; - CREDENTIALS c; + struct kafs_token kt; krb5_principal princ; krb5_realm *trealm; /* ticket realm */ struct krb5_kafs_data *d = data->data; @@ -94,12 +214,15 @@ afslog_uid_int(kafs_data *data, const char *cell, const char *rh, uid_t uid, krb5_free_principal (d->context, princ); } - ret = _kafs_get_cred(data, cell, d->realm, *trealm, &c); + kt.ticket = NULL; + ret = _kafs_get_cred(data, cell, d->realm, *trealm, uid, &kt); if(trealm) krb5_free_principal (d->context, princ); - if(ret == 0) - ret = kafs_settoken(cell, uid, &c); + if(ret == 0) { + ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len); + free(kt.ticket); + } return ret; } @@ -126,6 +249,7 @@ krb5_afslog_uid_home(krb5_context context, { kafs_data kd; struct krb5_kafs_data d; + kd.name = "krb5"; kd.afslog_uid = afslog_uid_int; kd.get_cred = get_cred; kd.get_realm = get_realm; @@ -174,6 +298,29 @@ krb5_realm_of_cell(const char *cell, char **realm) { kafs_data kd; + kd.name = "krb5"; kd.get_realm = get_realm; return _kafs_realm_of_cell(&kd, cell, realm); } + +/* + * + */ + +int +kafs_settoken5(krb5_context context, const char *cell, uid_t uid, + krb5_creds *cred) +{ + struct kafs_token kt; + int ret; + + ret = v5_convert(context, NULL, cred, uid, cell, &kt); + if (ret) + return ret; + + ret = kafs_settoken_rxkad(cell, &kt.ct, kt.ticket, kt.ticket_len); + + free(kt.ticket); + + return ret; +} diff --git a/kerberosV/src/lib/kafs/afssysdefs.h b/kerberosV/src/lib/kafs/afssysdefs.h index 1645a57d9da..dbc1b3e3835 100644 --- a/kerberosV/src/lib/kafs/afssysdefs.h +++ b/kerberosV/src/lib/kafs/afssysdefs.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: afssysdefs.h,v 1.24 2000/11/17 01:07:47 assar Exp $ */ +/* $KTH: afssysdefs.h,v 1.26 2003/02/08 22:55:55 assar Exp $ */ /* * This section is for machines using single entry point AFS syscalls! @@ -82,7 +82,19 @@ #define AFS_SYSCALL 31 #endif -#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) +#if defined(__FreeBSD__) +#if __FreeBSD_version >= 500000 +#define AFS_SYSCALL 339 +#else +#define AFS_SYSCALL 210 +#endif +#endif /* __FreeBSD__ */ + +#ifdef __OpenBSD__ +#define AFS_SYSCALL 208 +#endif + +#if defined(__NetBSD__) #define AFS_SYSCALL 210 #endif diff --git a/kerberosV/src/lib/kafs/dlfcn.h b/kerberosV/src/lib/kafs/dlfcn.h index 5671e9caa3a..b8dfd985a53 100644 --- a/kerberosV/src/lib/kafs/dlfcn.h +++ b/kerberosV/src/lib/kafs/dlfcn.h @@ -19,7 +19,7 @@ extern "C" { #define RTLD_GLOBAL 0x100 /* allow symbols to be global */ /* - * To be able to intialize, a library may provide a dl_info structure + * To be able to initialize, a library may provide a dl_info structure * that contains functions to be called to initialize and terminate. */ struct dl_info { diff --git a/kerberosV/src/lib/kafs/kafs_locl.h b/kerberosV/src/lib/kafs/kafs_locl.h index 37ce5970747..cdfd1f8f77d 100644 --- a/kerberosV/src/lib/kafs/kafs_locl.h +++ b/kerberosV/src/lib/kafs/kafs_locl.h @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: kafs_locl.h,v 1.15 1999/12/02 16:58:40 joda Exp $ */ +/* $KTH: kafs_locl.h,v 1.17 2003/04/14 08:28:37 lha Exp $ */ #ifndef __KAFS_LOCL_H__ #define __KAFS_LOCL_H__ @@ -93,7 +93,13 @@ #endif #ifdef KRB4 #include <krb.h> -#endif +#else +#ifdef KRB5 +#include "crypto-headers.h" +#include <krb5-v4compat.h> +typedef struct credentials CREDENTIALS; +#endif /* KRB5 */ +#endif /* KRB4 */ #include <kafs.h> #include <resolve.h> @@ -101,31 +107,47 @@ #include "afssysdefs.h" struct kafs_data; +struct kafs_token; typedef int (*afslog_uid_func_t)(struct kafs_data *, - const char *cell, - const char *realm_hint, + const char *, + const char *, uid_t, - const char *homedir); + const char *); typedef int (*get_cred_func_t)(struct kafs_data*, const char*, const char*, - const char*, CREDENTIALS*); + const char*, uid_t, struct kafs_token *); typedef char* (*get_realm_func_t)(struct kafs_data*, const char*); typedef struct kafs_data { + const char *name; afslog_uid_func_t afslog_uid; get_cred_func_t get_cred; get_realm_func_t get_realm; void *data; } kafs_data; +struct kafs_token { + struct ClearToken ct; + void *ticket; + size_t ticket_len; +}; + +void _kafs_foldup(char *, const char *); + int _kafs_afslog_all_local_cells(kafs_data*, uid_t, const char*); int _kafs_get_cred(kafs_data*, const char*, const char*, const char *, - CREDENTIALS*); + uid_t, struct kafs_token *); int -_kafs_realm_of_cell(kafs_data *data, const char *cell, char **realm); +_kafs_realm_of_cell(kafs_data *, const char *, char **); + +int +_kafs_v4_to_kt(CREDENTIALS *, uid_t, struct kafs_token *); + +void +_kafs_fixup_viceid(struct ClearToken *, uid_t); #ifdef _AIX int aix_pioctl(char*, int, struct ViceIoctl*, int); diff --git a/kerberosV/src/lib/kafs/roken_rename.h b/kerberosV/src/lib/kafs/roken_rename.h index 2c202e0d16b..e2e64f98736 100644 --- a/kerberosV/src/lib/kafs/roken_rename.h +++ b/kerberosV/src/lib/kafs/roken_rename.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2001 Kungliga Tekniska Högskolan + * Copyright (c) 2001-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: roken_rename.h,v 1.2 2001/08/26 00:48:57 assar Exp $ */ +/* $KTH: roken_rename.h,v 1.6 2002/08/19 15:08:24 joda Exp $ */ #ifndef __roken_rename_h__ #define __roken_rename_h__ @@ -40,12 +40,22 @@ * Libroken routines that are added libkafs */ -#define _resolve_debug _roken_resolve_debug +#define _resolve_debug _kafs_resolve_debug -#define dns_free_data _kafs_dns_free_data -#define dns_lookup _kafs_dns_lookup -#define dns_string_to_type _kafs_dns_string_to_type -#define dns_type_to_string _kafs_dns_type_to_string -#define dns_srv_order _krb_dns_srv_order +#define rk_dns_free_data _kafs_dns_free_data +#define rk_dns_lookup _kafs_dns_lookup +#define rk_dns_string_to_type _kafs_dns_string_to_type +#define rk_dns_type_to_string _kafs_dns_type_to_string +#define rk_dns_srv_order _kafs_dns_srv_order + +#ifndef HAVE_STRTOK_R +#define strtok_r _kafs_strtok_r +#endif +#ifndef HAVE_STRLCPY +#define strlcpy _kafs_strlcpy +#endif +#ifndef HAVE_STRSEP +#define strsep _kafs_strsep +#endif #endif /* __roken_rename_h__ */ diff --git a/kerberosV/src/lib/krb5/aes-test.c b/kerberosV/src/lib/krb5/aes-test.c new file mode 100644 index 00000000000..84e1efc6c97 --- /dev/null +++ b/kerberosV/src/lib/krb5/aes-test.c @@ -0,0 +1,472 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "krb5_locl.h" + +#ifdef HAVE_OPENSSL +#include <openssl/evp.h> +#endif + +RCSID("$KTH: aes-test.c,v 1.3 2003/03/25 11:30:41 lha Exp $"); + +static int verbose = 0; + +static void +hex_dump_data(krb5_data *data) +{ + unsigned char *p = data->data; + int i, j; + + for (i = j = 0; i < data->length; i++, j++) { + printf("%02x ", p[i]); + if (j > 15) { + printf("\n"); + j = 0; + } + } + if (j != 0) + printf("\n"); +} + +struct { + char *password; + char *salt; + int saltlen; + int iterations; + krb5_enctype enctype; + int keylen; + char *pbkdf2; + char *key; +} keys[] = { +#ifdef ENABLE_AES + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 1, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\xcd\xed\xb5\x28\x1b\xb2\xf8\x01\x56\x5a\x11\x22\xb2\x56\x35\x15", + "\x42\x26\x3c\x6e\x89\xf4\xfc\x28\xb8\xdf\x68\xee\x09\x79\x9f\x15" + }, + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 1, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\xcd\xed\xb5\x28\x1b\xb2\xf8\x01\x56\x5a\x11\x22\xb2\x56\x35\x15" + "\x0a\xd1\xf7\xa0\x4b\xb9\xf3\xa3\x33\xec\xc0\xe2\xe1\xf7\x08\x37", + "\xfe\x69\x7b\x52\xbc\x0d\x3c\xe1\x44\x32\xba\x03\x6a\x92\xe6\x5b" + "\xbb\x52\x28\x09\x90\xa2\xfa\x27\x88\x39\x98\xd7\x2a\xf3\x01\x61" + }, + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 2, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\x01\xdb\xee\x7f\x4a\x9e\x24\x3e\x98\x8b\x62\xc7\x3c\xda\x93\x5d", + "\xc6\x51\xbf\x29\xe2\x30\x0a\xc2\x7f\xa4\x69\xd6\x93\xbd\xda\x13" + }, + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 2, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\x01\xdb\xee\x7f\x4a\x9e\x24\x3e\x98\x8b\x62\xc7\x3c\xda\x93\x5d" + "\xa0\x53\x78\xb9\x32\x44\xec\x8f\x48\xa9\x9e\x61\xad\x79\x9d\x86", + "\xa2\xe1\x6d\x16\xb3\x60\x69\xc1\x35\xd5\xe9\xd2\xe2\x5f\x89\x61" + "\x02\x68\x56\x18\xb9\x59\x14\xb4\x67\xc6\x76\x22\x22\x58\x24\xff" + }, + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 1200, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\x5c\x08\xeb\x61\xfd\xf7\x1e\x4e\x4e\xc3\xcf\x6b\xa1\xf5\x51\x2b", + "\x4c\x01\xcd\x46\xd6\x32\xd0\x1e\x6d\xbe\x23\x0a\x01\xed\x64\x2a" + }, + { + "password", "ATHENA.MIT.EDUraeburn", -1, + 1200, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\x5c\x08\xeb\x61\xfd\xf7\x1e\x4e\x4e\xc3\xcf\x6b\xa1\xf5\x51\x2b" + "\xa7\xe5\x2d\xdb\xc5\xe5\x14\x2f\x70\x8a\x31\xe2\xe6\x2b\x1e\x13", + "\x55\xa6\xac\x74\x0a\xd1\x7b\x48\x46\x94\x10\x51\xe1\xe8\xb0\xa7" + "\x54\x8d\x93\xb0\xab\x30\xa8\xbc\x3f\xf1\x62\x80\x38\x2b\x8c\x2a" + }, + { + "password", "\x12\x34\x56\x78\x78\x56\x34\x12", 8, + 5, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\xd1\xda\xa7\x86\x15\xf2\x87\xe6\xa1\xc8\xb1\x20\xd7\x06\x2a\x49", + "\xe9\xb2\x3d\x52\x27\x37\x47\xdd\x5c\x35\xcb\x55\xbe\x61\x9d\x8e" + }, + { + "password", "\x12\x34\x56\x78\x78\x56\x34\x12", 8, + 5, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\xd1\xda\xa7\x86\x15\xf2\x87\xe6\xa1\xc8\xb1\x20\xd7\x06\x2a\x49" + "\x3f\x98\xd2\x03\xe6\xbe\x49\xa6\xad\xf4\xfa\x57\x4b\x6e\x64\xee", + "\x97\xa4\xe7\x86\xbe\x20\xd8\x1a\x38\x2d\x5e\xbc\x96\xd5\x90\x9c" + "\xab\xcd\xad\xc8\x7c\xa4\x8f\x57\x45\x04\x15\x9f\x16\xc3\x6e\x31" + }, + { + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "pass phrase equals block size", -1, + 1200, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\x13\x9c\x30\xc0\x96\x6b\xc3\x2b\xa5\x5f\xdb\xf2\x12\x53\x0a\xc9", + "\x59\xd1\xbb\x78\x9a\x82\x8b\x1a\xa5\x4e\xf9\xc2\x88\x3f\x69\xed" + }, + { + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "pass phrase equals block size", -1, + 1200, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\x13\x9c\x30\xc0\x96\x6b\xc3\x2b\xa5\x5f\xdb\xf2\x12\x53\x0a\xc9" + "\xc5\xec\x59\xf1\xa4\x52\xf5\xcc\x9a\xd9\x40\xfe\xa0\x59\x8e\xd1", + "\x89\xad\xee\x36\x08\xdb\x8b\xc7\x1f\x1b\xfb\xfe\x45\x94\x86\xb0" + "\x56\x18\xb7\x0c\xba\xe2\x20\x92\x53\x4e\x56\xc5\x53\xba\x4b\x34" + }, + { + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "pass phrase exceeds block size", -1, + 1200, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\x9c\xca\xd6\xd4\x68\x77\x0c\xd5\x1b\x10\xe6\xa6\x87\x21\xbe\x61", + "\xcb\x80\x05\xdc\x5f\x90\x17\x9a\x7f\x02\x10\x4c\x00\x18\x75\x1d" + }, + { + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "pass phrase exceeds block size", -1, + 1200, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\x9c\xca\xd6\xd4\x68\x77\x0c\xd5\x1b\x10\xe6\xa6\x87\x21\xbe\x61" + "\x1a\x8b\x4d\x28\x26\x01\xdb\x3b\x36\xbe\x92\x46\x91\x5e\xc8\x2a", + "\xd7\x8c\x5c\x9c\xb8\x72\xa8\xc9\xda\xd4\x69\x7f\x0b\xb5\xb2\xd2" + "\x14\x96\xc8\x2b\xeb\x2c\xae\xda\x21\x12\xfc\xee\xa0\x57\x40\x1b" + + }, + { + "\xf0\x9d\x84\x9e" /* g-clef */, "EXAMPLE.COMpianist", -1, + 50, + ETYPE_AES128_CTS_HMAC_SHA1_96, 16, + "\x6b\x9c\xf2\x6d\x45\x45\x5a\x43\xa5\xb8\xbb\x27\x6a\x40\x3b\x39", + "\xf1\x49\xc1\xf2\xe1\x54\xa7\x34\x52\xd4\x3e\x7f\xe6\x2a\x56\xe5" + }, + { + "\xf0\x9d\x84\x9e" /* g-clef */, "EXAMPLE.COMpianist", -1, + 50, + ETYPE_AES256_CTS_HMAC_SHA1_96, 32, + "\x6b\x9c\xf2\x6d\x45\x45\x5a\x43\xa5\xb8\xbb\x27\x6a\x40\x3b\x39" + "\xe7\xfe\x37\xa0\xc4\x1e\x02\xc2\x81\xff\x30\x69\xe1\xe9\x4f\x52", + "\x4b\x6d\x98\x39\xf8\x44\x06\xdf\x1f\x09\xcc\x16\x6d\xb4\xb8\x3c" + "\x57\x18\x48\xb7\x84\xa3\xd6\xbd\xc3\x46\x58\x9a\x3e\x39\x3f\x9e" + }, +#endif + { + "foo", "", -1, + 0, + ETYPE_ARCFOUR_HMAC_MD5, 16, + NULL, + "\xac\x8e\x65\x7f\x83\xdf\x82\xbe\xea\x5d\x43\xbd\xaf\x78\x00\xcc" + }, + { + "test", "", -1, + 0, + ETYPE_ARCFOUR_HMAC_MD5, 16, + NULL, + "\x0c\xb6\x94\x88\x05\xf7\x97\xbf\x2a\x82\x80\x79\x73\xb8\x95\x37" + } +}; + +static int +string_to_key_test(krb5_context context) +{ + krb5_data password, opaque; + krb5_error_code ret; + krb5_keyblock key; + krb5_salt salt; + int i, val = 0; + char iter[4]; + char keyout[32]; + + for (i = 0; i < sizeof(keys)/sizeof(keys[0]); i++) { + + password.data = keys[i].password; + password.length = strlen(password.data); + + salt.salttype = KRB5_PW_SALT; + salt.saltvalue.data = keys[i].salt; + if (keys[i].saltlen == -1) + salt.saltvalue.length = strlen(salt.saltvalue.data); + else + salt.saltvalue.length = keys[i].saltlen; + + opaque.data = iter; + opaque.length = sizeof(iter); + _krb5_put_int(iter, keys[i].iterations, 4); + + if (verbose) + printf("%d: password: %s salt: %s\n", + i, keys[i].password, keys[i].salt); + + if (keys[i].keylen > sizeof(keyout)) + abort(); + +#ifdef ENABLE_AES + if (keys[i].pbkdf2) { + +#ifdef HAVE_OPENSSL + PKCS5_PBKDF2_HMAC_SHA1(password.data, password.length, + salt.saltvalue.data, salt.saltvalue.length, + keys[i].iterations, + keys[i].keylen, keyout); + + if (memcmp(keyout, keys[i].pbkdf2, keys[i].keylen) != 0) { + krb5_warnx(context, "%d: openssl key pbkdf2", i); + val = 1; + continue; + } +#endif + + ret = krb5_PKCS5_PBKDF2(context, CKSUMTYPE_SHA1, password, salt, + keys[i].iterations - 1, + keys[i].enctype, + &key); + if (ret) { + krb5_warn(context, ret, "%d: krb5_PKCS5_PBKDF2", i); + val = 1; + continue; + } + + if (key.keyvalue.length != keys[i].keylen) { + krb5_warnx(context, "%d: size key pbkdf2", i); + val = 1; + continue; + } + + if (memcmp(key.keyvalue.data, keys[i].pbkdf2, keys[i].keylen) != 0) { + krb5_warnx(context, "%d: key pbkdf2 pl %d", + i, password.length); + val = 1; + continue; + } + + if (verbose) { + printf("PBKDF2:\n"); + hex_dump_data(&key.keyvalue); + } + + krb5_free_keyblock_contents(context, &key); + } +#endif + + ret = krb5_string_to_key_data_salt_opaque (context, keys[i].enctype, + password, salt, opaque, + &key); + if (ret) { + krb5_warn(context, ret, "%d: string_to_key_data_salt_opaque", i); + val = 1; + continue; + } + + if (key.keyvalue.length != keys[i].keylen) { + krb5_warnx(context, "%d: key wrong length (%d/%d)", + i, key.keyvalue.length, keys[i].keylen); + val = 1; + continue; + } + + if (memcmp(key.keyvalue.data, keys[i].key, keys[i].keylen) != 0) { + krb5_warnx(context, "%d: key wrong", i); + val = 1; + continue; + } + + if (verbose) { + printf("key:\n"); + hex_dump_data(&key.keyvalue); + } + krb5_free_keyblock_contents(context, &key); + } + return val; +} + +#ifdef ENABLE_AES + +struct { + size_t len; + char *input; + char *output; +} encs[] = { + { + 17, + "\x49\x20\x77\x6f\x75\x6c\x64\x20\x6c\x69\x6b\x65\x20\x74\x68\x65" + "\x20", + "\xc6\x35\x35\x68\xf2\xbf\x8c\xb4\xd8\xa5\x80\x36\x2d\xa7\xff\x7f" + "\x97" + }, + { + 31, + "\x49\x20\x77\x6f\x75\x6c\x64\x20\x6c\x69\x6b\x65\x20\x74\x68\x65" + "\x20\x47\x65\x6e\x65\x72\x61\x6c\x20\x47\x61\x75\x27\x73\x20", + "\xfc\x00\x78\x3e\x0e\xfd\xb2\xc1\xd4\x45\xd4\xc8\xef\xf7\xed\x22" + "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5" + }, + { + 32, + "\x49\x20\x77\x6f\x75\x6c\x64\x20\x6c\x69\x6b\x65\x20\x74\x68\x65" + "\x20\x47\x65\x6e\x65\x72\x61\x6c\x20\x47\x61\x75\x27\x73\x20\x43", + "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5\xa8" + "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" + }, + { + 47, + "\x49\x20\x77\x6f\x75\x6c\x64\x20\x6c\x69\x6b\x65\x20\x74\x68\x65" + "\x20\x47\x65\x6e\x65\x72\x61\x6c\x20\x47\x61\x75\x27\x73\x20\x43" + "\x68\x69\x63\x6b\x65\x6e\x2c\x20\x70\x6c\x65\x61\x73\x65\x2c", + "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" + "\xb3\xff\xfd\x94\x0c\x16\xa1\x8c\x1b\x55\x49\xd2\xf8\x38\x02\x9e" + "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5" + }, + { + 64, + "\x49\x20\x77\x6f\x75\x6c\x64\x20\x6c\x69\x6b\x65\x20\x74\x68\x65" + "\x20\x47\x65\x6e\x65\x72\x61\x6c\x20\x47\x61\x75\x27\x73\x20\x43" + "\x68\x69\x63\x6b\x65\x6e\x2c\x20\x70\x6c\x65\x61\x73\x65\x2c\x20" + "\x61\x6e\x64\x20\x77\x6f\x6e\x74\x6f\x6e\x20\x73\x6f\x75\x70\x2e", + "\x97\x68\x72\x68\xd6\xec\xcc\xc0\xc0\x7b\x25\xe2\x5e\xcf\xe5\x84" + "\x39\x31\x25\x23\xa7\x86\x62\xd5\xbe\x7f\xcb\xcc\x98\xeb\xf5\xa8" + "\x48\x07\xef\xe8\x36\xee\x89\xa5\x26\x73\x0d\xbc\x2f\x7b\xc8\x40" + "\x9d\xad\x8b\xbb\x96\xc4\xcd\xc0\x3b\xc1\x03\xe1\xa1\x94\xbb\xd8" + } +}; + +char *enc_key = + "\x63\x68\x69\x63\x6b\x65\x6e\x20\x74\x65\x72\x69\x79\x61\x6b\x69"; + +static int +samep(int testn, char *type, const char *p1, const char *p2, size_t len) +{ + size_t i; + int val = 1; + + for (i = 0; i < len; i++) { + if (p1[i] != p2[i]) { + if (verbose) + printf("M"); + val = 0; + } else { + if (verbose) + printf("."); + } + } + if (verbose) + printf("\n"); + return val; +} + +static int +encryption_test(krb5_context context) +{ + char iv[AES_BLOCK_SIZE]; + int i, val = 0; + AES_KEY ekey, dkey; + char *p; + + AES_set_encrypt_key(enc_key, 128, &ekey); + AES_set_decrypt_key(enc_key, 128, &dkey); + + for (i = 0; i < sizeof(encs)/sizeof(encs[0]); i++) { + if (verbose) + printf("test: %d\n", i); + memset(iv, 0, sizeof(iv)); + + p = malloc(encs[i].len + 1); + if (p == NULL) + krb5_errx(context, 1, "malloc"); + + p[encs[i].len] = '\0'; + + memcpy(p, encs[i].input, encs[i].len); + + _krb5_aes_cts_encrypt(p, p, encs[i].len, + &ekey, iv, AES_ENCRYPT); + + if (p[encs[i].len] != '\0') { + krb5_warnx(context, "%d: encrypt modified off end", i); + val = 1; + } + + if (!samep(i, "cipher", p, encs[i].output, encs[i].len)) + val = 1; + + memset(iv, 0, sizeof(iv)); + + _krb5_aes_cts_encrypt(p, p, encs[i].len, + &dkey, iv, AES_DECRYPT); + + if (p[encs[i].len] != '\0') { + krb5_warnx(context, "%d: decrypt modified off end", i); + val = 1; + } + + if (!samep(i, "clear", p, encs[i].input, encs[i].len)) + val = 1; + + free(p); + } + return val; +} + +#endif /* ENABLE_AES */ + +int +main(int argc, char **argv) +{ + krb5_error_code ret; + krb5_context context; + int val = 0; + + ret = krb5_init_context (&context); + if (ret) + errx (1, "krb5_init_context failed: %d", ret); + + val |= string_to_key_test(context); + +#ifdef ENABLE_AES + val |= encryption_test(context); +#endif + + if (verbose && val == 0) + printf("all ok\n"); + if (val) + printf("tests failed\n"); + + krb5_free_context(context); + + return val; +} diff --git a/kerberosV/src/lib/krb5/auth_context.c b/kerberosV/src/lib/krb5/auth_context.c index bff8737b374..f0fb0aa979d 100644 --- a/kerberosV/src/lib/krb5/auth_context.c +++ b/kerberosV/src/lib/krb5/auth_context.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: auth_context.c,v 1.57 2001/06/17 23:12:34 assar Exp $"); +RCSID("$KTH: auth_context.c,v 1.59 2002/09/02 17:11:02 joda Exp $"); krb5_error_code krb5_auth_con_init(krb5_context context, @@ -153,7 +153,8 @@ krb5_auth_con_genaddrs(krb5_context context, strerror(ret)); goto out; } - krb5_sockaddr2address (context, local, &local_k_address); + ret = krb5_sockaddr2address (context, local, &local_k_address); + if(ret) goto out; if(flags & KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR) { krb5_sockaddr2port (context, local, &auth_context->local_port); } else @@ -168,7 +169,8 @@ krb5_auth_con_genaddrs(krb5_context context, krb5_set_error_string (context, "getpeername: %s", strerror(ret)); goto out; } - krb5_sockaddr2address (context, remote, &remote_k_address); + ret = krb5_sockaddr2address (context, remote, &remote_k_address); + if(ret) goto out; if(flags & KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR) { krb5_sockaddr2port (context, remote, &auth_context->remote_port); } else @@ -290,6 +292,24 @@ krb5_auth_con_setlocalsubkey(krb5_context context, } krb5_error_code +krb5_auth_con_generatelocalsubkey(krb5_context context, + krb5_auth_context auth_context, + krb5_keyblock *key) +{ + krb5_error_code ret; + krb5_keyblock *subkey; + + ret = krb5_generate_subkey (context, key, &subkey); + if(ret) + return ret; + if(auth_context->local_subkey) + krb5_free_keyblock(context, auth_context->local_subkey); + auth_context->local_subkey = subkey; + return 0; +} + + +krb5_error_code krb5_auth_con_setremotesubkey(krb5_context context, krb5_auth_context auth_context, krb5_keyblock *keyblock) diff --git a/kerberosV/src/lib/krb5/build_ap_req.c b/kerberosV/src/lib/krb5/build_ap_req.c index bfdb106cced..7551f606d8d 100644 --- a/kerberosV/src/lib/krb5/build_ap_req.c +++ b/kerberosV/src/lib/krb5/build_ap_req.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: build_ap_req.c,v 1.17 2001/05/14 06:14:44 assar Exp $"); +RCSID("$KTH: build_ap_req.c,v 1.18 2002/09/04 16:26:04 joda Exp $"); krb5_error_code krb5_build_ap_req (krb5_context context, @@ -66,15 +66,10 @@ krb5_build_ap_req (krb5_context context, ap.authenticator.kvno = NULL; ap.authenticator.cipher = authenticator; - retdata->length = length_AP_REQ(&ap); - retdata->data = malloc(retdata->length); - if(retdata->data == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; - } else - encode_AP_REQ((unsigned char *)retdata->data + retdata->length - 1, - retdata->length, &ap, &len); + ASN1_MALLOC_ENCODE(AP_REQ, retdata->data, retdata->length, + &ap, &len, ret); + free_AP_REQ(&ap); - return ret; + } diff --git a/kerberosV/src/lib/krb5/cache.c b/kerberosV/src/lib/krb5/cache.c index b6877604213..0b1c02d607a 100644 --- a/kerberosV/src/lib/krb5/cache.c +++ b/kerberosV/src/lib/krb5/cache.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: cache.c,v 1.47 2001/05/14 06:14:45 assar Exp $"); +RCSID("$KTH: cache.c,v 1.52 2003/03/16 18:23:59 lha Exp $"); /* * Add a new ccache type with operations `ops', overwriting any @@ -46,33 +46,25 @@ krb5_cc_register(krb5_context context, const krb5_cc_ops *ops, krb5_boolean override) { - char *prefix_copy; int i; for(i = 0; i < context->num_cc_ops && context->cc_ops[i].prefix; i++) { if(strcmp(context->cc_ops[i].prefix, ops->prefix) == 0) { - if(override) - free(context->cc_ops[i].prefix); - else { + if(!override) { krb5_set_error_string(context, "ccache type %s already exists", ops->prefix); return KRB5_CC_TYPE_EXISTS; } + break; } } - prefix_copy = strdup(ops->prefix); - if (prefix_copy == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - return KRB5_CC_NOMEM; - } if(i == context->num_cc_ops) { krb5_cc_ops *o = realloc(context->cc_ops, (context->num_cc_ops + 1) * sizeof(*context->cc_ops)); if(o == NULL) { krb5_set_error_string(context, "malloc: out of memory"); - free(prefix_copy); return KRB5_CC_NOMEM; } context->num_cc_ops++; @@ -81,7 +73,6 @@ krb5_cc_register(krb5_context context, (context->num_cc_ops - i) * sizeof(*context->cc_ops)); } memcpy(&context->cc_ops[i], ops, sizeof(context->cc_ops[i])); - context->cc_ops[i].prefix = prefix_copy; return 0; } @@ -189,24 +180,57 @@ krb5_cc_get_type(krb5_context context, } /* - * Return a pointer to a static string containing the default ccache name. + * Return krb5_cc_ops of a the ccache `id'. + */ + +const krb5_cc_ops * +krb5_cc_get_ops(krb5_context context, krb5_ccache id) +{ + return id->ops; +} + +/* + * Set the default cc name for `context' to `name'. + */ + +krb5_error_code +krb5_cc_set_default_name(krb5_context context, const char *name) +{ + krb5_error_code ret = 0; + char *p; + + if (name == NULL) { + char *e; + e = getenv("KRB5CCNAME"); + if (e) + p = strdup(e); + else + asprintf(&p,"FILE:/tmp/krb5cc_%u", (unsigned)getuid()); + } else + p = strdup(name); + + if (p == NULL) + return ENOMEM; + + if (context->default_cc_name) + free(context->default_cc_name); + + context->default_cc_name = p; + + return ret; +} + +/* + * Return a pointer to a context static string containing the default ccache name. */ const char* krb5_cc_default_name(krb5_context context) { - static char name[1024]; - char *p; + if (context->default_cc_name == NULL) + krb5_cc_set_default_name(context, NULL); - p = getenv("KRB5CCNAME"); - if(p) - strlcpy (name, p, sizeof(name)); - else - snprintf(name, - sizeof(name), - "FILE:/tmp/krb5cc_%u", - (unsigned)getuid()); - return name; + return context->default_cc_name; } /* @@ -218,9 +242,11 @@ krb5_error_code krb5_cc_default(krb5_context context, krb5_ccache *id) { - return krb5_cc_resolve(context, - krb5_cc_default_name(context), - id); + const char *p = krb5_cc_default_name(context); + + if (p == NULL) + return ENOMEM; + return krb5_cc_resolve(context, p, id); } /* diff --git a/kerberosV/src/lib/krb5/changepw.c b/kerberosV/src/lib/krb5/changepw.c index 31d713900a3..dd0578918a8 100644 --- a/kerberosV/src/lib/krb5/changepw.c +++ b/kerberosV/src/lib/krb5/changepw.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,15 +33,13 @@ #include <krb5_locl.h> -RCSID("$KTH: changepw.c,v 1.33 2001/06/17 23:11:06 assar Exp $"); +RCSID("$KTH: changepw.c,v 1.38 2002/09/29 11:48:34 joda Exp $"); static krb5_error_code send_request (krb5_context context, krb5_auth_context *auth_context, krb5_creds *creds, int sock, - struct sockaddr *sa, - int sa_size, char *passwd, const char *host) { @@ -59,7 +57,7 @@ send_request (krb5_context context, ret = krb5_mk_req_extended (context, auth_context, - AP_OPTS_MUTUAL_REQUIRED, + AP_OPTS_MUTUAL_REQUIRED | AP_OPTS_USE_SUBKEY, NULL, /* in_data */ creds, &ap_req_data); @@ -89,8 +87,8 @@ send_request (krb5_context context, *p++ = (ap_req_data.length >> 0) & 0xFF; memset(&msghdr, 0, sizeof(msghdr)); - msghdr.msg_name = (void *)sa; - msghdr.msg_namelen = sa_size; + msghdr.msg_name = NULL; + msghdr.msg_namelen = 0; msghdr.msg_iov = iov; msghdr.msg_iovlen = sizeof(iov)/sizeof(*iov); #if 0 @@ -146,7 +144,7 @@ process_reply (krb5_context context, u_char reply[BUFSIZ]; size_t len; u_int16_t pkt_len, pkt_ver; - krb5_data ap_rep_data; + krb5_data ap_rep_data, priv_data; int save_errno; ret = recvfrom (sock, reply, sizeof(reply), 0, NULL, NULL); @@ -175,10 +173,13 @@ process_reply (krb5_context context, ap_rep_data.data = reply + 6; ap_rep_data.length = (reply[4] << 8) | (reply[5]); + priv_data.data = (u_char*)ap_rep_data.data + ap_rep_data.length; + priv_data.length = len - ap_rep_data.length - 6; + if ((u_char *)priv_data.data + priv_data.length > reply + len) + return KRB5_KPASSWD_MALFORMED; if (ap_rep_data.length) { krb5_ap_rep_enc_part *ap_rep; - krb5_data priv_data; u_char *p; ret = krb5_rd_rep (context, @@ -190,9 +191,6 @@ process_reply (krb5_context context, krb5_free_ap_rep_enc_part (context, ap_rep); - priv_data.data = (u_char*)ap_rep_data.data + ap_rep_data.length; - priv_data.length = len - ap_rep_data.length - 6; - ret = krb5_rd_priv (context, auth_context, &priv_data, @@ -266,11 +264,14 @@ krb5_change_password (krb5_context context, if (ret) return ret; + krb5_auth_con_setflags (context, auth_context, + KRB5_AUTH_CONTEXT_DO_SEQUENCE); + ret = krb5_krbhst_init (context, realm, KRB5_KRBHST_CHANGEPW, &handle); if (ret) goto out; - while (krb5_krbhst_next(context, handle, &hi) == 0) { + while (!done && (ret = krb5_krbhst_next(context, handle, &hi)) == 0) { struct addrinfo *ai, *a; ret = krb5_krbhst_get_addrinfo(context, hi, &ai); @@ -284,6 +285,19 @@ krb5_change_password (krb5_context context, if (sock < 0) continue; + ret = connect(sock, a->ai_addr, a->ai_addrlen); + if (ret < 0) { + close (sock); + goto out; + } + + ret = krb5_auth_con_genaddrs (context, auth_context, sock, + KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR); + if (ret) { + close (sock); + goto out; + } + for (i = 0; !done && i < 5; ++i) { fd_set fdset; struct timeval tv; @@ -294,8 +308,6 @@ krb5_change_password (krb5_context context, &auth_context, creds, sock, - a->ai_addr, - a->ai_addrlen, newpw, hi->hostname); if (ret) { @@ -354,3 +366,21 @@ krb5_change_password (krb5_context context, return ret; } } + +const char * +krb5_passwd_result_to_string (krb5_context context, + int result) +{ + static const char *strings[] = { + "Success", + "Malformed", + "Hard error", + "Auth error", + "Soft error" + }; + + if (result < 0 || result > KRB5_KPASSWD_SOFTERROR) + return "unknown result code"; + else + return strings[result]; +} diff --git a/kerberosV/src/lib/krb5/convert_creds.c b/kerberosV/src/lib/krb5/convert_creds.c index 16256439879..0f039f0e16f 100644 --- a/kerberosV/src/lib/krb5/convert_creds.c +++ b/kerberosV/src/lib/krb5/convert_creds.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,7 +32,9 @@ */ #include "krb5_locl.h" -RCSID("$KTH: convert_creds.c,v 1.24 2001/06/20 02:49:21 joda Exp $"); +RCSID("$KTH: convert_creds.c,v 1.26 2003/03/18 03:11:16 lha Exp $"); + +#include "krb5-v4compat.h" static krb5_error_code check_ticket_flags(TicketFlags f) @@ -42,42 +44,6 @@ check_ticket_flags(TicketFlags f) /* include this here, to avoid dependencies on libkrb */ -#define MAX_KTXT_LEN 1250 - -#define ANAME_SZ 40 -#define REALM_SZ 40 -#define SNAME_SZ 40 -#define INST_SZ 40 - -struct ktext { - unsigned int length; /* Length of the text */ - unsigned char dat[MAX_KTXT_LEN]; /* The data itself */ - u_int32_t mbz; /* zero to catch runaway strings */ -}; - -struct credentials { - char service[ANAME_SZ]; /* Service name */ - char instance[INST_SZ]; /* Instance */ - char realm[REALM_SZ]; /* Auth domain */ - des_cblock session; /* Session key */ - int lifetime; /* Lifetime */ - int kvno; /* Key version number */ - struct ktext ticket_st; /* The ticket itself */ - int32_t issue_date; /* The issue time */ - char pname[ANAME_SZ]; /* Principal's name */ - char pinst[INST_SZ]; /* Principal's instance */ -}; - - -#define TKTLIFENUMFIXED 64 -#define TKTLIFEMINFIXED 0x80 -#define TKTLIFEMAXFIXED 0xBF -#define TKTLIFENOEXPIRE 0xFF -#define MAXTKTLIFETIME (30*24*3600) /* 30 days */ -#ifndef NEVERDATE -#define NEVERDATE ((time_t)0x7fffffffL) -#endif - static const int _tkt_lifetimes[TKTLIFENUMFIXED] = { 38400, 41055, 43894, 46929, 50174, 53643, 57352, 61318, 65558, 70091, 74937, 80119, 85658, 91581, 97914, 104684, @@ -89,8 +55,8 @@ static const int _tkt_lifetimes[TKTLIFENUMFIXED] = { 1623226, 1735464, 1855462, 1983758, 2120925, 2267576, 2424367, 2592000 }; -static int -_krb_time_to_life(time_t start, time_t end) +int +_krb5_krb_time_to_life(time_t start, time_t end) { int i; time_t life = end - start; @@ -113,6 +79,26 @@ _krb_time_to_life(time_t start, time_t end) } +time_t +_krb5_krb_life_to_time(int start, int life_) +{ + unsigned char life = (unsigned char) life_; + +#if 0 + if (krb_no_long_lifetimes) + return start + life*5*60; +#endif + + if (life == TKTLIFENOEXPIRE) + return NEVERDATE; + if (life < TKTLIFEMINFIXED) + return start + life*5*60; + if (life > TKTLIFEMAXFIXED) + return start + MAXTKTLIFETIME; + return start + _tkt_lifetimes[life - TKTLIFEMINFIXED]; +} + + /* Convert the v5 credentials in `in_cred' to v4-dito in `v4creds'. * This is done by sending them to the 524 function in the KDC. If * `in_cred' doesn't contain a DES session key, then a new one is @@ -183,8 +169,8 @@ krb524_convert_creds_kdc(krb5_context context, if(ret) goto out; v4creds->issue_date = v5_creds->times.starttime; - v4creds->lifetime = _krb_time_to_life(v4creds->issue_date, - v5_creds->times.endtime); + v4creds->lifetime = _krb5_krb_time_to_life(v4creds->issue_date, + v5_creds->times.endtime); ret = krb5_524_conv_principal(context, v5_creds->client, v4creds->pname, v4creds->pinst, diff --git a/kerberosV/src/lib/krb5/data.c b/kerberosV/src/lib/krb5/data.c index 7785361d018..494f96e8628 100644 --- a/kerberosV/src/lib/krb5/data.c +++ b/kerberosV/src/lib/krb5/data.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: data.c,v 1.16 2001/05/14 06:14:46 assar Exp $"); +RCSID("$KTH: data.c,v 1.17 2003/03/25 22:07:17 lha Exp $"); void krb5_data_zero(krb5_data *p) @@ -50,6 +50,12 @@ krb5_data_free(krb5_data *p) p->length = 0; } +void +krb5_free_data_contents(krb5_context context, krb5_data *data) +{ + krb5_data_free(data); +} + void krb5_free_data(krb5_context context, krb5_data *p) diff --git a/kerberosV/src/lib/krb5/expand_hostname.c b/kerberosV/src/lib/krb5/expand_hostname.c index 0455d6e9122..eec5bae63f1 100644 --- a/kerberosV/src/lib/krb5/expand_hostname.c +++ b/kerberosV/src/lib/krb5/expand_hostname.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: expand_hostname.c,v 1.10 2001/05/14 06:14:46 assar Exp $"); +RCSID("$KTH: expand_hostname.c,v 1.11 2001/09/18 09:35:47 joda Exp $"); static krb5_error_code copy_hostname(krb5_context context, @@ -148,5 +148,6 @@ krb5_expand_hostname_realms (krb5_context context, free (*new_hostname); } } + freeaddrinfo(ai); return vanilla_hostname (context, orig_hostname, new_hostname, realms); } diff --git a/kerberosV/src/lib/krb5/get_addrs.c b/kerberosV/src/lib/krb5/get_addrs.c index cd1ebaa8378..a298f1443b1 100644 --- a/kerberosV/src/lib/krb5/get_addrs.c +++ b/kerberosV/src/lib/krb5/get_addrs.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: get_addrs.c,v 1.43 2001/07/03 18:43:57 assar Exp $"); +RCSID("$KTH: get_addrs.c,v 1.45 2003/01/25 15:19:49 lha Exp $"); #ifdef __osf__ /* hate */ @@ -144,6 +144,8 @@ find_all_addresses (krb5_context context, krb5_addresses *res, int flags) for (ifa = ifa0, idx = 0; ifa != NULL; ifa = ifa->ifa_next) { if ((ifa->ifa_flags & IFF_UP) == 0) continue; + if (ifa->ifa_addr == NULL) + continue; if (memcmp(ifa->ifa_addr, &sa_zero, sizeof(sa_zero)) == 0) continue; if (krb5_sockaddr_uninteresting(ifa->ifa_addr)) @@ -185,6 +187,8 @@ find_all_addresses (krb5_context context, krb5_addresses *res, int flags) for (ifa = ifa0; ifa != NULL; ifa = ifa->ifa_next) { if ((ifa->ifa_flags & IFF_UP) == 0) continue; + if (ifa->ifa_addr == NULL) + continue; if (memcmp(ifa->ifa_addr, &sa_zero, sizeof(sa_zero)) == 0) continue; if (krb5_sockaddr_uninteresting(ifa->ifa_addr)) @@ -229,8 +233,11 @@ get_addrs_int (krb5_context context, krb5_addresses *res, int flags) ret = find_all_addresses (context, res, flags); if(ret || res->len == 0) ret = gethostname_fallback (context, res); - } else + } else { + res->len = 0; + res->val = NULL; ret = 0; + } if(ret == 0 && (flags & EXTRA_ADDRESSES)) { krb5_addresses a; diff --git a/kerberosV/src/lib/krb5/get_cred.c b/kerberosV/src/lib/krb5/get_cred.c index 69a1d3eb9a9..bbc81a3d922 100644 --- a/kerberosV/src/lib/krb5/get_cred.c +++ b/kerberosV/src/lib/krb5/get_cred.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: get_cred.c,v 1.87 2001/07/03 18:45:03 assar Exp $"); +RCSID("$KTH: get_cred.c,v 1.91 2002/09/04 21:12:46 joda Exp $"); /* * Take the `body' and encode it into `padata' using the credentials @@ -54,36 +54,14 @@ make_pa_tgs_req(krb5_context context, krb5_data in_data; krb5_error_code ret; - buf_size = 1024; - buf = malloc (buf_size); - if (buf == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - return ENOMEM; - } - - do { - ret = encode_KDC_REQ_BODY(buf + buf_size - 1, buf_size, - body, &len); - if (ret){ - if (ret == ASN1_OVERFLOW) { - u_char *tmp; - - buf_size *= 2; - tmp = realloc (buf, buf_size); - if (tmp == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - buf = tmp; - } else { - goto out; - } - } - } while (ret == ASN1_OVERFLOW); + ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret); + if (ret) + goto out; + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); in_data.length = len; - in_data.data = buf + buf_size - len; + in_data.data = buf; ret = krb5_mk_req_internal(context, &ac, 0, &in_data, creds, &padata->padata_value, KRB5_KU_TGS_REQ_AUTH_CKSUM, @@ -113,18 +91,9 @@ set_auth_data (krb5_context context, krb5_crypto crypto; krb5_error_code ret; - len = length_AuthorizationData(authdata); - buf = malloc(len); - if (buf == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - return ENOMEM; - } - ret = encode_AuthorizationData(buf + len - 1, - len, authdata, &len); - if (ret) { - free (buf); + ASN1_MALLOC_ENCODE(AuthorizationData, buf, len, authdata, &len, ret); + if (ret) return ret; - } ALLOC(req_body->enc_authorization_data, 1); if (req_body->enc_authorization_data == NULL) { @@ -173,16 +142,19 @@ init_tgs_req (krb5_context context, TGS_REQ *t, krb5_key_usage usage) { - krb5_error_code ret; + krb5_error_code ret = 0; memset(t, 0, sizeof(*t)); t->pvno = 5; t->msg_type = krb_tgs_req; if (in_creds->session.keytype) { - ret = krb5_keytype_to_enctypes_default (context, - in_creds->session.keytype, - &t->req_body.etype.len, - &t->req_body.etype.val); + ALLOC_SEQ(&t->req_body.etype, 1); + if(t->req_body.etype.val == NULL) { + ret = ENOMEM; + krb5_set_error_string(context, "malloc: out of memory"); + goto fail; + } + t->req_body.etype.val[0] = in_creds->session.keytype; } else { ret = krb5_init_etype(context, &t->req_body.etype.len, @@ -431,34 +403,11 @@ get_cred_kdc_usage(krb5_context context, if (ret) goto out; - buf_size = 1024; - buf = malloc (buf_size); - if (buf == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; + ASN1_MALLOC_ENCODE(TGS_REQ, buf, buf_size, &req, &enc.length, ret); + if (ret) goto out; - } - - do { - ret = encode_TGS_REQ (buf + buf_size - 1, buf_size, - &req, &enc.length); - if (ret) { - if (ret == ASN1_OVERFLOW) { - u_char *tmp; - - buf_size *= 2; - tmp = realloc (buf, buf_size); - if (tmp == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - buf = tmp; - } else { - goto out; - } - } - } while (ret == ASN1_OVERFLOW); + if(enc.length != buf_size) + krb5_abortx(context, "internal error in ASN.1 encoder"); /* don't free addresses */ req.req_body.addresses = NULL; @@ -712,8 +661,17 @@ get_cred_from_kdc_flags(krb5_context context, krb5_set_error_string(context, "malloc: out of memory"); ret = ENOMEM; } else { - ret = get_cred_kdc_la(context, ccache, flags, - in_creds, &tgts, *out_creds); + krb5_boolean noaddr; + + krb5_appdefault_boolean(context, NULL, tgts.server->realm, + "no-addresses", FALSE, &noaddr); + + if (noaddr) + ret = get_cred_kdc(context, ccache, flags, NULL, + in_creds, &tgts, *out_creds); + else + ret = get_cred_kdc_la(context, ccache, flags, + in_creds, &tgts, *out_creds); if (ret) { free (*out_creds); *out_creds = NULL; @@ -772,8 +730,16 @@ get_cred_from_kdc_flags(krb5_context context, krb5_set_error_string(context, "malloc: out of memory"); ret = ENOMEM; } else { - ret = get_cred_kdc_la(context, ccache, flags, - in_creds, tgt, *out_creds); + krb5_boolean noaddr; + + krb5_appdefault_boolean(context, NULL, tgt->server->realm, + "no-addresses", FALSE, &noaddr); + if (noaddr) + ret = get_cred_kdc (context, ccache, flags, NULL, + in_creds, tgt, *out_creds); + else + ret = get_cred_kdc_la(context, ccache, flags, + in_creds, tgt, *out_creds); if (ret) { free (*out_creds); *out_creds = NULL; diff --git a/kerberosV/src/lib/krb5/get_for_creds.c b/kerberosV/src/lib/krb5/get_for_creds.c index 97c70af33d9..abe09f7c83b 100644 --- a/kerberosV/src/lib/krb5/get_for_creds.c +++ b/kerberosV/src/lib/krb5/get_for_creds.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: get_for_creds.c,v 1.31 2001/07/19 17:33:22 assar Exp $"); +RCSID("$KTH: get_for_creds.c,v 1.34 2002/09/04 16:26:04 joda Exp $"); static krb5_error_code add_addrs(krb5_context context, @@ -162,12 +162,14 @@ krb5_get_forwarded_creds (krb5_context context, KrbCredInfo *krb_cred_info; EncKrbCredPart enc_krb_cred_part; size_t len; - u_char buf[1024]; + unsigned char *buf; + size_t buf_size; int32_t sec, usec; krb5_kdc_flags kdc_flags; krb5_crypto crypto; struct addrinfo *ai; int save_errno; + krb5_keyblock *key; addrs.len = 0; addrs.val = NULL; @@ -257,17 +259,34 @@ krb5_get_forwarded_creds (krb5_context context, } if (auth_context->remote_address) { - ALLOC(enc_krb_cred_part.r_address, 1); - if (enc_krb_cred_part.r_address == NULL) { - ret = ENOMEM; - krb5_set_error_string(context, "malloc: out of memory"); - goto out4; - } + if (auth_context->remote_port) { + krb5_boolean noaddr; + const krb5_realm *realm; + + realm = krb5_princ_realm(context, out_creds->server); + krb5_appdefault_boolean(context, NULL, *realm, "no-addresses", + FALSE, &noaddr); + if (!noaddr) { + ret = krb5_make_addrport (context, + &enc_krb_cred_part.r_address, + auth_context->remote_address, + auth_context->remote_port); + if (ret) + goto out4; + } + } else { + ALLOC(enc_krb_cred_part.r_address, 1); + if (enc_krb_cred_part.r_address == NULL) { + ret = ENOMEM; + krb5_set_error_string(context, "malloc: out of memory"); + goto out4; + } - ret = krb5_copy_address (context, auth_context->remote_address, - enc_krb_cred_part.r_address); - if (ret) - goto out4; + ret = krb5_copy_address (context, auth_context->remote_address, + enc_krb_cred_part.r_address); + if (ret) + goto out4; + } } /* fill ticket_info.val[0] */ @@ -302,45 +321,51 @@ krb5_get_forwarded_creds (krb5_context context, /* encode EncKrbCredPart */ - ret = krb5_encode_EncKrbCredPart (context, - buf + sizeof(buf) - 1, sizeof(buf), - &enc_krb_cred_part, &len); + ASN1_MALLOC_ENCODE(EncKrbCredPart, buf, buf_size, + &enc_krb_cred_part, &len, ret); free_EncKrbCredPart (&enc_krb_cred_part); if (ret) { free_KRB_CRED(&cred); return ret; - } + } + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); + + if (auth_context->local_subkey) + key = auth_context->local_subkey; + else if (auth_context->remote_subkey) + key = auth_context->remote_subkey; + else + key = auth_context->keyblock; - ret = krb5_crypto_init(context, auth_context->local_subkey, 0, &crypto); + ret = krb5_crypto_init(context, key, 0, &crypto); if (ret) { + free(buf); free_KRB_CRED(&cred); return ret; } ret = krb5_encrypt_EncryptedData (context, crypto, KRB5_KU_KRB_CRED, - buf + sizeof(buf) - len, + buf, len, 0, &cred.enc_part); + free(buf); krb5_crypto_destroy(context, crypto); if (ret) { free_KRB_CRED(&cred); return ret; } - ret = encode_KRB_CRED (buf + sizeof(buf) - 1, sizeof(buf), - &cred, &len); + ASN1_MALLOC_ENCODE(KRB_CRED, buf, buf_size, &cred, &len, ret); free_KRB_CRED (&cred); if (ret) return ret; + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); out_data->length = len; - out_data->data = malloc(len); - if (out_data->data == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - return ENOMEM; - } - memcpy (out_data->data, buf + sizeof(buf) - len, len); + out_data->data = buf; return 0; out4: free_EncKrbCredPart(&enc_krb_cred_part); diff --git a/kerberosV/src/lib/krb5/get_in_tkt.c b/kerberosV/src/lib/krb5/get_in_tkt.c index 5cd937c9ec5..7d29297e66e 100644 --- a/kerberosV/src/lib/krb5/get_in_tkt.c +++ b/kerberosV/src/lib/krb5/get_in_tkt.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,42 +33,41 @@ #include "krb5_locl.h" -RCSID("$KTH: get_in_tkt.c,v 1.102 2001/07/02 22:30:48 joda Exp $"); +RCSID("$KTH: get_in_tkt.c,v 1.107 2003/02/16 06:41:25 nectar Exp $"); krb5_error_code krb5_init_etype (krb5_context context, unsigned *len, - int **val, + krb5_enctype **val, const krb5_enctype *etypes) { int i; krb5_error_code ret; - krb5_enctype *tmp; + krb5_enctype *tmp = NULL; ret = 0; - if (etypes) - tmp = (krb5_enctype*)etypes; - else { + if (etypes == NULL) { ret = krb5_get_default_in_tkt_etypes(context, &tmp); if (ret) return ret; + etypes = tmp; } - for (i = 0; tmp[i]; ++i) + for (i = 0; etypes[i]; ++i) ; *len = i; - *val = malloc(i * sizeof(int)); + *val = malloc(i * sizeof(**val)); if (i != 0 && *val == NULL) { ret = ENOMEM; krb5_set_error_string(context, "malloc: out of memory"); goto cleanup; } memmove (*val, - tmp, + etypes, i * sizeof(*tmp)); cleanup: - if (etypes == NULL) + if (tmp != NULL) free (tmp); return ret; } @@ -159,22 +158,12 @@ _krb5_extract_ticket(krb5_context context, creds->client = tmp_principal; /* extract ticket */ - { - unsigned char *buf; - size_t len; - len = length_Ticket(&rep->kdc_rep.ticket); - buf = malloc(len); - if(buf == NULL) { - krb5_set_error_string(context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - encode_Ticket(buf + len - 1, len, &rep->kdc_rep.ticket, &len); - creds->ticket.data = buf; - creds->ticket.length = len; - creds->second_ticket.length = 0; - creds->second_ticket.data = NULL; - } + ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length, + &rep->kdc_rep.ticket, &creds->ticket.length, ret); + if(ret) + goto out; + creds->second_ticket.length = 0; + creds->second_ticket.data = NULL; /* compare server */ @@ -224,7 +213,8 @@ _krb5_extract_ticket(krb5_context context, /* set kdc-offset */ krb5_timeofday (context, &sec_now); - if (context->kdc_sec_offset == 0 + if (rep->enc_part.flags.initial + && context->kdc_sec_offset == 0 && krb5_config_get_bool (context, NULL, "libdefaults", "kdc_timesync", @@ -315,7 +305,8 @@ make_pa_enc_timestamp(krb5_context context, PA_DATA *pa, krb5_enctype etype, krb5_keyblock *key) { PA_ENC_TS_ENC p; - u_char buf[1024]; + unsigned char *buf; + size_t buf_size; size_t len; EncryptedData encdata; krb5_error_code ret; @@ -328,39 +319,37 @@ make_pa_enc_timestamp(krb5_context context, PA_DATA *pa, usec2 = usec; p.pausec = &usec2; - ret = encode_PA_ENC_TS_ENC(buf + sizeof(buf) - 1, - sizeof(buf), - &p, - &len); + ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret); if (ret) return ret; - + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); ret = krb5_crypto_init(context, key, 0, &crypto); - if (ret) + if (ret) { + free(buf); return ret; + } ret = krb5_encrypt_EncryptedData(context, crypto, KRB5_KU_PA_ENC_TIMESTAMP, - buf + sizeof(buf) - len, + buf, len, 0, &encdata); + free(buf); krb5_crypto_destroy(context, crypto); if (ret) return ret; - ret = encode_EncryptedData(buf + sizeof(buf) - 1, - sizeof(buf), - &encdata, - &len); + ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret); free_EncryptedData(&encdata); if (ret) return ret; + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP; - pa->padata_value.length = 0; - krb5_data_copy(&pa->padata_value, - buf + sizeof(buf) - len, - len); + pa->padata_value.length = len; + pa->padata_value.data = buf; return 0; } @@ -370,14 +359,14 @@ add_padata(krb5_context context, krb5_principal client, krb5_key_proc key_proc, krb5_const_pointer keyseed, - int *enctypes, + krb5_enctype *enctypes, unsigned netypes, krb5_salt *salt) { krb5_error_code ret; PA_DATA *pa2; krb5_salt salt2; - int *ep; + krb5_enctype *ep; int i; if(salt == NULL) { @@ -386,7 +375,7 @@ add_padata(krb5_context context, salt = &salt2; } if (!enctypes) { - enctypes = (int *)context->etypes; /* XXX */ + enctypes = context->etypes; netypes = 0; for (ep = enctypes; *ep != ETYPE_NULL; ep++) netypes++; @@ -553,10 +542,12 @@ init_as_req (krb5_context context, sp = NULL; else krb5_data_zero(&salt.saltvalue); - add_padata(context, a->padata, creds->client, + ret = add_padata(context, a->padata, creds->client, key_proc, keyseed, &preauth->val[i].info.val[j].etype, 1, sp); + if (ret == 0) + break; } } } @@ -657,7 +648,7 @@ krb5_get_in_cred(krb5_context context, AS_REQ a; krb5_kdc_rep rep; krb5_data req, resp; - char buf[BUFSIZ]; + size_t len; krb5_salt salt; krb5_keyblock *key; size_t size; @@ -693,17 +684,15 @@ krb5_get_in_cred(krb5_context context, if (ret) return ret; - ret = encode_AS_REQ ((unsigned char*)buf + sizeof(buf) - 1, - sizeof(buf), - &a, - &req.length); + ASN1_MALLOC_ENCODE(AS_REQ, req.data, req.length, &a, &len, ret); free_AS_REQ(&a); if (ret) return ret; - - req.data = buf + sizeof(buf) - req.length; + if(len != req.length) + krb5_abortx(context, "internal error in ASN.1 encoder"); ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp); + krb5_data_free(&req); if (ret) return ret; diff --git a/kerberosV/src/lib/krb5/init_creds_pw.c b/kerberosV/src/lib/krb5/init_creds_pw.c index 4615d276901..901462078bd 100644 --- a/kerberosV/src/lib/krb5/init_creds_pw.c +++ b/kerberosV/src/lib/krb5/init_creds_pw.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: init_creds_pw.c,v 1.50 2001/09/05 17:40:03 nectar Exp $"); +RCSID("$KTH: init_creds_pw.c,v 1.55 2003/03/20 18:07:31 lha Exp $"); static int get_config_time (krb5_context context, @@ -108,7 +108,7 @@ init_cred (krb5_context context, if (ret) goto out; server_realm = strdup (*client_realm); - free (cred->server->realm); + free (*krb5_princ_realm(context, cred->server)); krb5_princ_set_realm (context, cred->server, &server_realm); } else { ret = krb5_make_principal(context, &cred->server, @@ -125,6 +125,24 @@ out: } /* + * Print a message (str) to the user about the expiration in `lr' + */ + +static void +report_expiration (krb5_context context, + krb5_prompter_fct prompter, + krb5_data *data, + const char *str, + time_t time) +{ + char *p; + + asprintf (&p, "%s%s", str, ctime(&time)); + (*prompter) (context, data, NULL, p, 0, NULL); + free (p); +} + +/* * Parse the last_req data and show it to the user if it's interesting */ @@ -139,6 +157,7 @@ print_expire (krb5_context context, LastReq *lr = &rep->enc_part.last_req; krb5_timestamp sec; time_t t; + krb5_boolean reported = FALSE; krb5_timeofday (context, &sec); @@ -148,26 +167,30 @@ print_expire (krb5_context context, 7 * 24 * 60 * 60); for (i = 0; i < lr->len; ++i) { - if (abs(lr->val[i].lr_type) == LR_PW_EXPTIME - && lr->val[i].lr_value <= t) { - char *p; - time_t tmp = lr->val[i].lr_value; - - asprintf (&p, "Your password will expire at %s", ctime(&tmp)); - (*prompter) (context, data, NULL, p, 0, NULL); - free (p); - return; + if (lr->val[i].lr_value <= t) { + switch (abs(lr->val[i].lr_type)) { + case LR_PW_EXPTIME : + report_expiration(context, prompter, data, + "Your password will expire at ", + lr->val[i].lr_value); + reported = TRUE; + break; + case LR_ACCT_EXPTIME : + report_expiration(context, prompter, data, + "Your account will expire at ", + lr->val[i].lr_value); + reported = TRUE; + break; + } } } - if (rep->enc_part.key_expiration + if (!reported + && rep->enc_part.key_expiration && *rep->enc_part.key_expiration <= t) { - char *p; - time_t t = *rep->enc_part.key_expiration; - - asprintf (&p, "Your password/account will expire at %s", ctime(&t)); - (*prompter) (context, data, NULL, p, 0, NULL); - free (p); + report_expiration(context, prompter, data, + "Your password/account will expire at ", + *rep->enc_part.key_expiration); } } @@ -384,11 +407,12 @@ krb5_get_init_creds_password(krb5_context context, if (password == NULL) { krb5_prompt prompt; - char *p; + char *p, *q; krb5_unparse_name (context, this_cred.client, &p); - asprintf (&prompt.prompt, "%s's Password: ", p); + asprintf (&q, "%s's Password: ", p); free (p); + prompt.prompt = q; password_data.data = buf; password_data.length = sizeof(buf); prompt.hidden = 1; @@ -396,7 +420,7 @@ krb5_get_init_creds_password(krb5_context context, prompt.type = KRB5_PROMPT_TYPE_PASSWORD; ret = (*prompter) (context, data, NULL, NULL, 1, &prompt); - free (prompt.prompt); + free (q); if (ret) { memset (buf, 0, sizeof(buf)); ret = KRB5_LIBOS_PWDINTR; @@ -428,6 +452,9 @@ krb5_get_init_creds_password(krb5_context context, case KRB5KDC_ERR_KEY_EXPIRED : /* try to avoid recursion */ + if (prompter == NULL) + goto out; + krb5_clear_error_string (context); if (in_tkt_service != NULL @@ -526,6 +553,8 @@ krb5_get_init_creds_keytab(krb5_context context, NULL, &this_cred, NULL); + free (a); + if (ret) goto out; free (pre_auth_types); diff --git a/kerberosV/src/lib/krb5/keytab.c b/kerberosV/src/lib/krb5/keytab.c index a1464fe0f53..2df16bcfa81 100644 --- a/kerberosV/src/lib/krb5/keytab.c +++ b/kerberosV/src/lib/krb5/keytab.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: keytab.c,v 1.50 2001/05/14 06:14:48 assar Exp $"); +RCSID("$KTH: keytab.c,v 1.55 2003/03/27 03:45:01 lha Exp $"); /* * Register a new keytab in `ops' @@ -46,6 +46,11 @@ krb5_kt_register(krb5_context context, { struct krb5_keytab_data *tmp; + if (strlen(ops->prefix) > KRB5_KT_PREFIX_MAX_LEN - 1) { + krb5_set_error_string(context, "krb5_kt_register; prefix too long"); + return KRB5_KT_NAME_TOOLONG; + } + tmp = realloc(context->kt_types, (context->num_kt_types + 1) * sizeof(*context->kt_types)); if(tmp == NULL) { @@ -88,7 +93,7 @@ krb5_kt_resolve(krb5_context context, } for(i = 0; i < context->num_kt_types; i++) { - if(strncmp(type, context->kt_types[i].prefix, type_len) == 0) + if(strncasecmp(type, context->kt_types[i].prefix, type_len) == 0) break; } if(i == context->num_kt_types) { @@ -136,7 +141,23 @@ krb5_kt_default_name(krb5_context context, char *name, size_t namesize) krb5_error_code krb5_kt_default_modify_name(krb5_context context, char *name, size_t namesize) { - if (strlcpy (name, context->default_keytab_modify, namesize) >= namesize) { + const char *kt = NULL; + if(context->default_keytab_modify == NULL) { + if(strncasecmp(context->default_keytab, "ANY:", 4) != 0) + kt = context->default_keytab; + else { + size_t len = strcspn(context->default_keytab + 4, ","); + if(len >= namesize) { + krb5_clear_error_string(context); + return KRB5_CONFIG_NOTENUFSPACE; + } + strlcpy(name, context->default_keytab + 4, namesize); + name[len] = '\0'; + return 0; + } + } else + kt = context->default_keytab_modify; + if (strlcpy (name, kt, namesize) >= namesize) { krb5_clear_error_string (context); return KRB5_CONFIG_NOTENUFSPACE; } @@ -190,6 +211,21 @@ krb5_kt_read_service_key(krb5_context context, } /* + * Return the type of the `keytab' in the string `prefix of length + * `prefixsize'. + */ + +krb5_error_code +krb5_kt_get_type(krb5_context context, + krb5_keytab keytab, + char *prefix, + size_t prefixsize) +{ + strlcpy(prefix, keytab->prefix, prefixsize); + return 0; +} + +/* * Retrieve the name of the keytab `keytab' into `name', `namesize' * Return 0 or an error. */ @@ -246,6 +282,7 @@ krb5_kt_compare(krb5_context context, /* * Retrieve the keytab entry for `principal, kvno, enctype' into `entry' * from the keytab `id'. + * kvno == 0 is a wildcard and gives the keytab with the highest vno. * Return 0 or an error. */ @@ -271,7 +308,10 @@ krb5_kt_get_entry(krb5_context context, entry->vno = 0; while (krb5_kt_next_entry(context, id, &tmp, &cursor) == 0) { if (krb5_kt_compare(context, &tmp, principal, 0, enctype)) { - if (kvno == tmp.vno) { + /* the file keytab might only store the lower 8 bits of + the kvno, so only compare those bits */ + if (kvno == tmp.vno + || (tmp.vno < 256 && kvno % 256 == tmp.vno)) { krb5_kt_copy_entry_contents (context, &tmp, entry); krb5_kt_free_entry (context, &tmp); krb5_kt_end_seq_get(context, id, &cursor); @@ -288,22 +328,28 @@ krb5_kt_get_entry(krb5_context context, if (entry->vno) { return 0; } else { - char princ[256], kt_name[256]; + char princ[256], kt_name[256], kvno_str[25]; krb5_unparse_name_fixed (context, principal, princ, sizeof(princ)); krb5_kt_get_name (context, id, kt_name, sizeof(kt_name)); + if (kvno) + snprintf(kvno_str, sizeof(kvno_str), "(kvno %d)", kvno); + else + kvno_str[0] = '\0'; + krb5_set_error_string (context, - "failed to find %s in keytab %s", - princ, kt_name); + "failed to find %s%s in keytab %s", + princ, + kvno_str, + kt_name); return KRB5_KT_NOTFOUND; } } /* * Copy the contents of `in' into `out'. - * Return 0 or an error. - */ + * Return 0 or an error. */ krb5_error_code krb5_kt_copy_entry_contents(krb5_context context, diff --git a/kerberosV/src/lib/krb5/keytab_keyfile.c b/kerberosV/src/lib/krb5/keytab_keyfile.c index b358075aab7..7a484507eb0 100644 --- a/kerberosV/src/lib/krb5/keytab_keyfile.c +++ b/kerberosV/src/lib/krb5/keytab_keyfile.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: keytab_keyfile.c,v 1.11 2001/05/14 06:14:49 assar Exp $"); +RCSID("$KTH: keytab_keyfile.c,v 1.15 2002/10/21 15:42:06 joda Exp $"); /* afs keyfile operations --------------------------------------- */ @@ -82,8 +82,7 @@ get_cell_and_realm (krb5_context context, krb5_set_error_string (context, "no cell in %s", AFS_SERVERTHISCELL); return EINVAL; } - if (buf[strlen(buf) - 1] == '\n') - buf[strlen(buf) - 1] = '\0'; + buf[strcspn(buf, "\n")] = '\0'; fclose(f); d->cell = strdup (buf); @@ -100,8 +99,7 @@ get_cell_and_realm (krb5_context context, AFS_SERVERMAGICKRBCONF); return EINVAL; } - if (buf[strlen(buf)-1] == '\n') - buf[strlen(buf)-1] = '\0'; + buf[strcspn(buf, "\n")] = '\0'; fclose(f); } /* uppercase */ @@ -208,7 +206,7 @@ akf_start_seq_get(krb5_context context, krb5_storage_free(c->sp); close(c->fd); krb5_clear_error_string (context); - if(ret == KRB5_CC_END) + if(ret == KRB5_KT_END) return KRB5_KT_NOTFOUND; return ret; } @@ -227,7 +225,7 @@ akf_next_entry(krb5_context context, off_t pos; int ret; - pos = cursor->sp->seek(cursor->sp, 0, SEEK_CUR); + pos = krb5_storage_seek(cursor->sp, 0, SEEK_CUR); if ((pos - 4) / (4 + 8) >= d->num_entries) return KRB5_KT_END; @@ -255,7 +253,7 @@ akf_next_entry(krb5_context context, goto out; } - ret = cursor->sp->fetch(cursor->sp, entry->keyblock.keyvalue.data, 8); + ret = krb5_storage_read(cursor->sp, entry->keyblock.keyvalue.data, 8); if(ret != 8) ret = (ret < 0) ? errno : KRB5_KT_END; else @@ -264,7 +262,7 @@ akf_next_entry(krb5_context context, entry->timestamp = time(NULL); out: - cursor->sp->seek(cursor->sp, pos + 4 + 8, SEEK_SET); + krb5_storage_seek(cursor->sp, pos + 4 + 8, SEEK_SET); return ret; } @@ -286,11 +284,18 @@ akf_add_entry(krb5_context context, struct akf_data *d = id->data; int fd, created = 0; krb5_error_code ret; + int32_t len; + krb5_storage *sp; + + + if (entry->keyblock.keyvalue.length != 8 + || entry->keyblock.keytype != ETYPE_DES_CBC_MD5) + return 0; fd = open (d->filename, O_RDWR | O_BINARY); if (fd < 0) { fd = open (d->filename, - O_RDWR | O_BINARY | O_CREAT, 0600); + O_RDWR | O_BINARY | O_CREAT | O_EXCL, 0600); if (fd < 0) { ret = errno; krb5_set_error_string(context, "open(%s): %s", d->filename, @@ -300,79 +305,72 @@ akf_add_entry(krb5_context context, created = 1; } - if (entry->keyblock.keyvalue.length == 8 - && entry->keyblock.keytype == ETYPE_DES_CBC_MD5) { - - int32_t len; - krb5_storage *sp; - - sp = krb5_storage_from_fd(fd); - if(sp == NULL) { - close(fd); - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - if (created) - len = 0; - else { - if((*sp->seek)(sp, 0, SEEK_SET) < 0) { - ret = errno; - krb5_storage_free(sp); - close(fd); - krb5_set_error_string (context, "seek: %s", strerror(ret)); - return ret; - } - - ret = krb5_ret_int32(sp, &len); - if(ret) { - krb5_storage_free(sp); - close(fd); - return ret; - } - } - len++; - - if((*sp->seek)(sp, 0, SEEK_SET) < 0) { + sp = krb5_storage_from_fd(fd); + if(sp == NULL) { + close(fd); + krb5_set_error_string (context, "malloc: out of memory"); + return ENOMEM; + } + if (created) + len = 0; + else { + if(krb5_storage_seek(sp, 0, SEEK_SET) < 0) { ret = errno; krb5_storage_free(sp); close(fd); krb5_set_error_string (context, "seek: %s", strerror(ret)); return ret; } - - ret = krb5_store_int32(sp, len); + + ret = krb5_ret_int32(sp, &len); if(ret) { krb5_storage_free(sp); close(fd); return ret; } + } + len++; + + if(krb5_storage_seek(sp, 0, SEEK_SET) < 0) { + ret = errno; + krb5_storage_free(sp); + close(fd); + krb5_set_error_string (context, "seek: %s", strerror(ret)); + return ret; + } + + ret = krb5_store_int32(sp, len); + if(ret) { + krb5_storage_free(sp); + close(fd); + return ret; + } - if((*sp->seek)(sp, (len - 1) * (8 + 4), SEEK_CUR) < 0) { - ret = errno; - krb5_storage_free(sp); - close(fd); - krb5_set_error_string (context, "seek: %s", strerror(ret)); - return ret; - } + if(krb5_storage_seek(sp, (len - 1) * (8 + 4), SEEK_CUR) < 0) { + ret = errno; + krb5_storage_free(sp); + close(fd); + krb5_set_error_string (context, "seek: %s", strerror(ret)); + return ret; + } - ret = krb5_store_int32(sp, entry->vno); - if(ret) { - krb5_storage_free(sp); - close(fd); - return ret; - } - ret = sp->store(sp, entry->keyblock.keyvalue.data, - entry->keyblock.keyvalue.length); - if(ret != entry->keyblock.keyvalue.length) { - krb5_storage_free(sp); - close(fd); - if(ret < 0) - return errno; - return ENOTTY; - } + ret = krb5_store_int32(sp, entry->vno); + if(ret) { + krb5_storage_free(sp); + close(fd); + return ret; + } + ret = krb5_storage_write(sp, entry->keyblock.keyvalue.data, + entry->keyblock.keyvalue.length); + if(ret != entry->keyblock.keyvalue.length) { krb5_storage_free(sp); + close(fd); + if(ret < 0) + return errno; + return ENOTTY; } + krb5_storage_free(sp); close (fd); return 0; } diff --git a/kerberosV/src/lib/krb5/krb5-private.h b/kerberosV/src/lib/krb5/krb5-private.h index c6536950605..b2471317e33 100644 --- a/kerberosV/src/lib/krb5/krb5-private.h +++ b/kerberosV/src/lib/krb5/krb5-private.h @@ -2,58 +2,68 @@ #ifndef __krb5_private_h__ #define __krb5_private_h__ -#ifdef __STDC__ #include <stdarg.h> -#ifndef __P -#define __P(x) x -#endif -#else -#ifndef __P -#define __P(x) () -#endif -#endif void -_krb5_crc_init_table __P((void)); +_krb5_aes_cts_encrypt ( + const unsigned char */*in*/, + unsigned char */*out*/, + size_t /*len*/, + const void */*aes_key*/, + unsigned char */*ivec*/, + const int /*enc*/); + +void +_krb5_crc_init_table (void); u_int32_t -_krb5_crc_update __P(( - const char *p, - size_t len, - u_int32_t res)); +_krb5_crc_update ( + const char */*p*/, + size_t /*len*/, + u_int32_t /*res*/); int -_krb5_extract_ticket __P(( - krb5_context context, - krb5_kdc_rep *rep, - krb5_creds *creds, - krb5_keyblock *key, - krb5_const_pointer keyseed, - krb5_key_usage key_usage, - krb5_addresses *addrs, - unsigned nonce, - krb5_boolean allow_server_mismatch, - krb5_boolean ignore_cname, - krb5_decrypt_proc decrypt_proc, - krb5_const_pointer decryptarg)); - -ssize_t -_krb5_get_int __P(( - void *buffer, - unsigned long *value, - size_t size)); +_krb5_extract_ticket ( + krb5_context /*context*/, + krb5_kdc_rep */*rep*/, + krb5_creds */*creds*/, + krb5_keyblock */*key*/, + krb5_const_pointer /*keyseed*/, + krb5_key_usage /*key_usage*/, + krb5_addresses */*addrs*/, + unsigned /*nonce*/, + krb5_boolean /*allow_server_mismatch*/, + krb5_boolean /*ignore_cname*/, + krb5_decrypt_proc /*decrypt_proc*/, + krb5_const_pointer /*decryptarg*/); + +krb5_ssize_t +_krb5_get_int ( + void */*buffer*/, + unsigned long */*value*/, + size_t /*size*/); + +time_t +_krb5_krb_life_to_time ( + int /*start*/, + int /*life_*/); + +int +_krb5_krb_time_to_life ( + time_t /*start*/, + time_t /*end*/); void -_krb5_n_fold __P(( - const void *str, - size_t len, - void *key, - size_t size)); - -ssize_t -_krb5_put_int __P(( - void *buffer, - unsigned long value, - size_t size)); +_krb5_n_fold ( + const void */*str*/, + size_t /*len*/, + void */*key*/, + size_t /*size*/); + +krb5_ssize_t +_krb5_put_int ( + void */*buffer*/, + unsigned long /*value*/, + size_t /*size*/); #endif /* __krb5_private_h__ */ diff --git a/kerberosV/src/lib/krb5/krb5-v4compat.h b/kerberosV/src/lib/krb5/krb5-v4compat.h new file mode 100644 index 00000000000..4f8d02f786b --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5-v4compat.h @@ -0,0 +1,93 @@ +/* + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +/* $KTH: krb5-v4compat.h,v 1.2 2003/03/18 03:08:20 lha Exp $ */ + +#ifndef __KRB5_V4COMPAT_H__ +#define __KRB5_V4COMPAT_H__ + +/* + * This file must only be included with v4 compat glue stuff in + * heimdal sources. + * + * It MUST NOT be installed. + */ + +#define MAX_KTXT_LEN 1250 + +#define ANAME_SZ 40 +#define REALM_SZ 40 +#define SNAME_SZ 40 +#define INST_SZ 40 + +struct ktext { + unsigned int length; /* Length of the text */ + unsigned char dat[MAX_KTXT_LEN]; /* The data itself */ + u_int32_t mbz; /* zero to catch runaway strings */ +}; + +struct credentials { + char service[ANAME_SZ]; /* Service name */ + char instance[INST_SZ]; /* Instance */ + char realm[REALM_SZ]; /* Auth domain */ + des_cblock session; /* Session key */ + int lifetime; /* Lifetime */ + int kvno; /* Key version number */ + struct ktext ticket_st; /* The ticket itself */ + int32_t issue_date; /* The issue time */ + char pname[ANAME_SZ]; /* Principal's name */ + char pinst[INST_SZ]; /* Principal's instance */ +}; + + +#define TKTLIFENUMFIXED 64 +#define TKTLIFEMINFIXED 0x80 +#define TKTLIFEMAXFIXED 0xBF +#define TKTLIFENOEXPIRE 0xFF +#define MAXTKTLIFETIME (30*24*3600) /* 30 days */ +#ifndef NEVERDATE +#define NEVERDATE ((time_t)0x7fffffffL) +#endif + +#define KERB_ERR_NULL_KEY 10 + +int +_krb5_krb_time_to_life(time_t start, time_t end); + +time_t +_krb5_krb_life_to_time(int start, int life_); + +#define krb_time_to_life _krb5_krb_time_to_life +#define krb_life_to_time _krb5_krb_life_to_time + +#endif /* __KRB5_V4COMPAT_H__ */ diff --git a/kerberosV/src/lib/krb5/krb5.3 b/kerberosV/src/lib/krb5/krb5.3 new file mode 100644 index 00000000000..8e169a0ca67 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5.3 @@ -0,0 +1,240 @@ +.\" Copyright (c) 2001, 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.Dd March 20, 2003 +.Dt KRB5 3 +.Os +.Sh NAME +.Nm krb5 +.Nd kerberos 5 library +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh DESCRIPTION +These functions constitute the Kerberos 5 library, +.Em libkrb5 . +Declarations for these functions may be obtained from the include file +.Pa krb5.h . +.Sh LIST OF FUNCTIONS +.sp 2 +.nf +.ta \w'krb5_checksum_is_collision_proof.3'u+2n +\w'Description goes here'u +\fIName/Page\fP \fIDescription\fP +.ta \w'krb5_checksum_is_collision_proof.3'u+2n +\w'Description goes here'u+6nC +.sp 5p +krb5_425_conv_principal.3 +krb5_425_conv_principal_ext.3 +krb5_524_conv_principal.3 +krb5_addlog_dest.3 +krb5_addlog_func.3 +krb5_addr2sockaddr.3 +krb5_address.3 +krb5_address_compare.3 +krb5_address_order.3 +krb5_address_search.3 +krb5_addresses.3 +krb5_anyaddr.3 +krb5_appdefault_boolean.3 +krb5_appdefault_string.3 +krb5_appdefault_time.3 +krb5_append_addresses.3 +krb5_auth_con_free.3 +krb5_auth_con_genaddrs.3 +krb5_auth_con_getaddrs.3 +krb5_auth_con_getflags.3 +krb5_auth_con_getkey.3 +krb5_auth_con_getlocalsubkey.3 +krb5_auth_con_getrcache.3 +krb5_auth_con_getremotesubkey.3 +krb5_auth_con_getuserkey.3 +krb5_auth_con_init.3 +krb5_auth_con_initivector.3 +krb5_auth_con_setaddrs.3 +krb5_auth_con_setaddrs_from_fd.3 +krb5_auth_con_setflags.3 +krb5_auth_con_setivector.3 +krb5_auth_con_setkey.3 +krb5_auth_con_setlocalsubkey.3 +krb5_auth_con_setrcache.3 +krb5_auth_con_setremotesubkey.3 +krb5_auth_con_setuserkey.3 +krb5_auth_context.3 +krb5_auth_getauthenticator.3 +krb5_auth_getcksumtype.3 +krb5_auth_getkeytype.3 +krb5_auth_getlocalseqnumber.3 +krb5_auth_getremoteseqnumber.3 +krb5_auth_setcksumtype.3 +krb5_auth_setkeytype.3 +krb5_auth_setlocalseqnumber.3 +krb5_auth_setremoteseqnumber.3 +krb5_build_principal.3 +krb5_build_principal_ext.3 +krb5_build_principal_va.3 +krb5_build_principal_va_ext.3 +krb5_cc_close.3 +krb5_cc_copy_cache.3 +krb5_cc_default.3 +krb5_cc_default_name.3 +krb5_cc_destroy.3 +krb5_cc_end_seq_get.3 +krb5_cc_gen_new.3 +krb5_cc_get_name.3 +krb5_cc_get_principal.3 +krb5_cc_get_type.3 +krb5_cc_get_version.3 +krb5_cc_initialize.3 +krb5_cc_next_cred.3 +krb5_cc_register.3 +krb5_cc_remove_cred.3 +krb5_cc_resolve.3 +krb5_cc_retrieve_cred.3 +krb5_cc_set_default_name.3 +krb5_cc_set_flags.3 +krb5_cc_store_cred.3 +krb5_checksum_is_collision_proof.3 +krb5_checksum_is_keyed.3 +krb5_checksumsize.3 +krb5_closelog.3 +krb5_config_get_bool_default.3 +krb5_config_get_int_default.3 +krb5_config_get_string_default.3 +krb5_config_get_time_default.3 +krb5_context.3 +krb5_copy_address.3 +krb5_copy_addresses.3 +krb5_copy_data.3 +krb5_create_checksum.3 +krb5_crypto_destroy.3 +krb5_crypto_init.3 +krb5_data_alloc.3 +krb5_data_copy.3 +krb5_data_free.3 +krb5_data_realloc.3 +krb5_data_zero.3 +krb5_decrypt.3 +krb5_decrypt_EncryptedData.3 +krb5_encrypt.3 +krb5_encrypt_EncryptedData.3 +krb5_err.3 +krb5_errx.3 +krb5_free_address.3 +krb5_free_addresses.3 +krb5_free_context.3 +krb5_free_data.3 +krb5_free_data_contents.3 +krb5_free_host_realm.3 +krb5_free_krbhst.3 +krb5_free_principal.3 +krb5_get_all_client_addrs.3 +krb5_get_all_server_addrs.3 +krb5_get_default_realm.3 +krb5_get_default_realms.3 +krb5_get_host_realm.3 +krb5_get_krb524hst.3 +krb5_get_krb_admin_hst.3 +krb5_get_krb_changepw_hst.3 +krb5_get_krbhst.3 +krb5_h_addr2addr.3 +krb5_h_addr2sockaddr.3 +krb5_init_context.3 +krb5_initlog.3 +krb5_keytab_entry.3 +krb5_krbhst_format_string.3 +krb5_krbhst_free.3 +krb5_krbhst_get_addrinfo.3 +krb5_krbhst_init.3 +krb5_krbhst_next.3 +krb5_krbhst_next_as_string.3 +krb5_krbhst_reset.3 +krb5_kt_add_entry.3 +krb5_kt_close.3 +krb5_kt_compare.3 +krb5_kt_copy_entry_contents.3 +krb5_kt_cursor.3 +krb5_kt_cursor.3 +krb5_kt_default.3 +krb5_kt_default_name.3 +krb5_kt_end_seq_get.3 +krb5_kt_free_entry.3 +krb5_kt_get_entry.3 +krb5_kt_get_name.3 +krb5_kt_next_entry.3 +krb5_kt_ops.3 +krb5_kt_read_service_key.3 +krb5_kt_register.3 +krb5_kt_remove_entry.3 +krb5_kt_resolve.3.3 +krb5_kt_start_seq_get +krb5_log.3 +krb5_log_msg.3 +krb5_make_addrport.3 +krb5_make_principal.3 +krb5_max_sockaddr_size.3 +krb5_openlog.3 +krb5_parse_address.3 +krb5_parse_name.3 +krb5_principal.3 +krb5_principal_get_comp_string.3 +krb5_principal_get_realm.3 +krb5_print_address.3 +krb5_set_default_realm.3 +krb5_set_warn_dest.3 +krb5_sname_to_principal.3 +krb5_sock_to_principal.3 +krb5_sockaddr2address.3 +krb5_sockaddr2port.3 +krb5_sockaddr_uninteresting.3 +krb5_timeofday.3 +krb5_unparse_name.3 +krb5_us_timeofday.3 +krb5_verify_checksum.3 +krb5_verify_opt_init.3 +krb5_verify_opt_set_flags.3 +krb5_verify_opt_set_keytab.3 +krb5_verify_opt_set_secure.3 +krb5_verify_opt_set_service.3 +krb5_verify_user.3 +krb5_verify_user_lrealm.3 +krb5_verify_user_opt.3 +krb5_verr.3 +krb5_verrx.3 +krb5_vlog.3 +krb5_vlog_msg.3 +krb5_vwarn.3 +krb5_vwarnx.3 +krb5_warn.3 +krb5_warnx.3 +krn5_kuserok.3 +.ta +.Fi +.Sh SEE ALSO +.Xr krb5.conf 5 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/krb5/krb5_425_conv_principal.3 b/kerberosV/src/lib/krb5/krb5_425_conv_principal.3 index 539f08559aa..4833f29de54 100644 --- a/kerberosV/src/lib/krb5/krb5_425_conv_principal.3 +++ b/kerberosV/src/lib/krb5/krb5_425_conv_principal.3 @@ -1,5 +1,36 @@ -.\" Copyright (c) 1997 Kungliga Tekniska Högskolan -.\" $KTH: krb5_425_conv_principal.3,v 1.5 2001/05/02 08:59:23 assar Exp $ +.\" Copyright (c) 1997-2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_425_conv_principal.3,v 1.10 2003/04/16 13:58:13 lha Exp $ +.\" .Dd April 11, 1999 .Dt KRB5_425_CONV_PRINCIPAL 3 .Os HEIMDAL @@ -8,8 +39,10 @@ .Nm krb5_425_conv_principal_ext , .Nm krb5_524_conv_principal .Nd converts to and from version 4 principals +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) .Sh SYNOPSIS -.Fd #include <krb5.h> +.In krb5.h .Ft krb5_error_code .Fn krb5_425_conv_principal "krb5_context context" "const char *name" "const char *instance" "const char *realm" "krb5_principal *principal" .Ft krb5_error_code @@ -26,8 +59,8 @@ realm. In some cases also the first component/name will differ between version 4 and version 5. Furthermore the second component of a host principal will be the fully qualified domain name of the host in question, while the instance of a version 4 principal will only -contain the first component. Because of these problems the conversion -between principals will have to be site customized. +contain the first part (short hostname). Because of these problems +the conversion between principals will have to be site customized. .Pp .Fn krb5_425_conv_principal_ext will try to convert a version 4 principal, given by @@ -42,11 +75,11 @@ is non-NULL, it will be called for each candidate principal. .Fa func should return true if the principal was .Dq good . -To accomplish this, -.Fn krb5_425_conv_principal_ext +To accomplish this, +.Fn krb5_425_conv_principal_ext will look up the name in .Pa krb5.conf . -It first looks in the +It first looks in the .Li v4_name_convert/host subsection, which should contain a list of version 4 names whose instance should be treated as a hostname. This list can be specified @@ -57,7 +90,7 @@ section), or in the section. If the name is found the resulting name of the principal will be the value of this binding. The instance is then first looked up in -.Li v4_instance_convert +.Li v4_instance_convert for the specified realm. If found the resulting value will be used as instance (this can be used for special cases), no further attempts will be made to find a conversion if this fails (with @@ -74,7 +107,7 @@ specific realm. .Pp On the other hand, if the name is not found in a .Li host -section, it is looked up in a +section, it is looked up in a .Li v4_name_convert/plain binding. If found here the name will be converted, but the instance will be untouched. @@ -85,8 +118,10 @@ v4_name_convert = { host = { ftp = ftp hprop = hprop + imap = imap pop = pop rcmd = host + smtp = smtp } } .Ed @@ -97,9 +132,9 @@ config file, so you can override these defaults. .Fn krb5_425_conv_principal will call .Fn krb5_425_conv_principal_ext -with +with .Dv NULL -as +as .Fa func , and the value of .Li v4_instance_resolve @@ -109,24 +144,24 @@ section) as .Fa resolve . .Pp .Fn krb5_524_conv_principal -basically does the opposite of +basically does the opposite of .Fn krb5_425_conv_principal , it just doesn't have to look up any names, but will instead truncate instances found to belong to a host principal. The -.Fa name , -.Fa instance , -and +.Fa name , +.Fa instance , +and .Fa realm should be at least 40 characters long. .Sh EXAMPLES Since this is confusing an example is in place. .Pp -Assume that we have the -.Dq foo.com , -and -.Dq bar.com -domains that have shared a single version 4 realm, FOO.COM. The version 4 -.Pa krb.realms +Assume that we have the +.Dq foo.com , +and +.Dq bar.com +domains that have shared a single version 4 realm, FOO.COM. The version 4 +.Pa krb.realms file looked like: .Bd -literal -offset indent foo.com FOO.COM @@ -165,19 +200,19 @@ ftp.other \(-> ftp/other.foo.com other.a-host \(-> other/a-host .Ed .Pp -The first three are what you expect. If you remove the +The first three are what you expect. If you remove the .Dq v4_domains , the fourth entry will result in an error (since the host .Dq other -can't be found). Even if -.Dq a-host +can't be found). Even if +.Dq a-host is a valid host name, the last entry will not be converted, since the .Dq other name is not known to represent a host-type principal. If you turn off .Dq v4_instance_resolve the second example will result in -.Dq ftp/b-host.foo.com +.Dq ftp/b-host.foo.com (because of the default domain). And all of this is of course only valid if you have working name resolving. .Sh SEE ALSO diff --git a/kerberosV/src/lib/krb5/krb5_address.3 b/kerberosV/src/lib/krb5/krb5_address.3 new file mode 100644 index 00000000000..5867662ea87 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_address.3 @@ -0,0 +1,355 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_address.3,v 1.4 2003/04/16 13:58:12 lha Exp $ +.\" +.Dd March 11, 2002 +.Dt KRB5_ADDRESS 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_address , +.Nm krb5_addresses , +.Nm krb5_sockaddr2address , +.Nm krb5_sockaddr2port , +.Nm krb5_addr2sockaddr , +.Nm krb5_max_sockaddr_size , +.Nm krb5_sockaddr_uninteresting , +.Nm krb5_h_addr2sockaddr , +.Nm krb5_h_addr2addr , +.Nm krb5_anyaddr , +.Nm krb5_print_address , +.Nm krb5_parse_address , +.Nm krb5_address_order , +.Nm krb5_address_compare , +.Nm krb5_address_search , +.Nm krb5_free_address , +.Nm krb5_free_addresses , +.Nm krb5_copy_address , +.Nm krb5_copy_addresses , +.Nm krb5_append_addresses , +.Nm krb5_make_addrport +.Nd mange addresses in Kerberos. +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Pp +.Ft krb5_error_code +.Fo krb5_sockaddr2address +.Fa "krb5_context context" +.Fa "const struct sockaddr *sa" +.Fa "krb5_address *addr" +.Fc +.Ft krb5_error_code +.Fo krb5_sockaddr2port +.Fa "krb5_context context" +.Fa "const struct sockaddr *sa" +.Fa "int16_t *port" +.Fc +.Ft krb5_error_code +.Fo krb5_addr2sockaddr +.Fa "krb5_context context" +.Fa "const krb5_address *addr" +.Fa "struct sockaddr *sa" +.Fa "krb5_socklen_t *sa_size" +.Fa "int port" +.Fc +.Ft size_t +.Fo krb5_max_sockaddr_size +.Fa "void" +.Fc +.Ft "krb5_boolean" +.Fo krb5_sockaddr_uninteresting +.Fa "const struct sockaddr *sa" +.Fc +.Ft krb5_error_code +.Fo krb5_h_addr2sockaddr +.Fa "krb5_context context" +.Fa "int af" +.Fa "const char *addr" +.Fa "struct sockaddr *sa" +.Fa "krb5_socklen_t *sa_size" +.Fa "int port" +.Fc +.Ft krb5_error_code +.Fo krb5_h_addr2addr +.Fa "krb5_context context" +.Fa "int af" +.Fa "const char *haddr" +.Fa "krb5_address *addr" +.Fc +.Ft krb5_error_code +.Fo krb5_anyaddr +.Fa "krb5_context context" +.Fa "int af" +.Fa "struct sockaddr *sa" +.Fa "krb5_socklen_t *sa_size" +.Fa "int port" +.Fc +.Ft krb5_error_code +.Fo krb5_print_address +.Fa "const krb5_address *addr" +.Fa "char *str" +.Fa "size_t len" +.Fa "size_t *ret_len" +.Fc +.Ft krb5_error_code +.Fo krb5_parse_address +.Fa "krb5_context context" +.Fa "const char *string" +.Fa "krb5_addresses *addresses" +.Fc +.Ft int +.Fo "krb5_address_order" +.Fa "krb5_context context" +.Fa "const krb5_address *addr1" +.Fa "const krb5_address *addr2" +.Fc +.Ft "krb5_boolean" +.Fo krb5_address_compare +.Fa "krb5_context context" +.Fa "const krb5_address *addr1" +.Fa "const krb5_address *addr2" +.Fc +.Ft "krb5_boolean" +.Fo krb5_address_search +.Fa "krb5_context context" +.Fa "const krb5_address *addr" +.Fa "const krb5_addresses *addrlist" +.Fc +.Ft krb5_error_code +.Fo krb5_free_address +.Fa "krb5_context context" +.Fa "krb5_address *address" +.Fc +.Ft krb5_error_code +.Fo krb5_free_addresses +.Fa "krb5_context context" +.Fa "krb5_addresses *addresses" +.Fc +.Ft krb5_error_code +.Fo krb5_copy_address +.Fa "krb5_context context" +.Fa "const krb5_address *inaddr" +.Fa "krb5_address *outaddr" +.Fc +.Ft krb5_error_code +.Fo krb5_copy_addresses +.Fa "krb5_context context" +.Fa "const krb5_addresses *inaddr" +.Fa "krb5_addresses *outaddr" +.Fc +.Ft krb5_error_code +.Fo krb5_append_addresses +.Fa "krb5_context context" +.Fa "krb5_addresses *dest" +.Fa "const krb5_addresses *source" +.Fc +.Ft krb5_error_code +.Fo krb5_make_addrport +.Fa "krb5_context context" +.Fa "krb5_address **res" +.Fa "const krb5_address *addr" +.Fa "int16_t port" +.Fc +.Sh DESCRIPTION +The +.Li krb5_address +structure holds a address that can be used in Kerberos API +calls. There are help functions to set and extract address information +of the address. +.Pp +The +.Li krb5_addresses +structure holds a set of krb5_address:es. +.Pp +.Fn krb5_sockaddr2address +stores a address a +.Li "struct sockaddr" +.Fa sa +in the krb5_address +.Fa addr . +.Pp +.Fn krb5_sockaddr2port +extracts a +.Fa port +(if possible) from a +.Li "struct sockaddr" +.Fa sa . +.Pp +.Fn krb5_addr2sockaddr +sets the +struct sockaddr +.Fa sockaddr +from +.Fa addr +and +.Fa port . +.Fa Sa_size +should be initially contain the size of the +.Fa sa , +and after the call, it will contain the actual length of the address. +.Pp +.Fn krb5_max_sockaddr_size +returns the max size of the +.Li struct sockaddr +that the Kerberos library will return. +.Pp +.Fn krb5_sockaddr_uninteresting +returns +.Dv TRUE +for all +.Fa sa +that for that the kerberos library thinks are uninteresting. +One example are link local addresses. +.Pp +.Fn krb5_h_addr2sockaddr +initializes a +.Li "struct sockaddr" +.Fa sa +from +.Fa af +and the +.Li "struct hostent" +(see +.Xr gethostbyname 3 ) +.Fa h_addr_list +component. +.Fa Sa_size +should be initially contain the size of the +.Fa sa , +and after the call, it will contain the actual length of the address. +.Fa sa +argument. +.Pp +.Fn krb5_h_addr2addr +works like +.Fn krb5_h_addr2sockaddr +with the exception that it operates on a +.Li krb5_address +instead of a +.Li struct sockaddr +.Pp +.Fn krb5_anyaddr +fills in a +.Li "struct sockaddr" +.Fa sa +that can be used to +.Xf bind 3 +to. +.Fa Sa_size +should be initially contain the size of the +.Fa sa , +and after the call, it will contain the actual length of the address. +.Pp +.Fn krb5_print_address +prints the address in +.Fa addr +to the a string +.Fa string +that have the length +.Fa len . +If +.Fa ret_len +if not +.Dv NULL , +it will be filled in length of the string. +.Pp +.Fn krb5_parse_address +Returns the resolving a hostname in +.Fa string +to the +.Li krb5_addresses +.Fa addresses . +.Pp +.Fn krb5_address_order +compares to addresses +.Fa addr1 +and +.Fa addr2 +so that it can be used for sorting addresses. If the addresses are the +same address +.Fa krb5_address_order will be return 0. +.Pp +.Fn krb5_address_compare +compares the addresses +.Fa addr1 +and +.Fa addr2 . +returns +.Dv TRUE +if the two addresses are the same. +.Pp +.Fn krb5_address_search +checks if the address +.Fa addr +is a member of the address set list +.Fa addrlist . +.Pp +.Fn krb5_free_address +frees the data stored in the +.Fa address +that is alloced with any of the krb5_address functions. +.Pp +.Fn krb5_free_addresses +frees the data stored in the +.Fa addresses +that is alloced with any of the krb5_address functions. +.Pp +.Fn krb5_copy_address +copies the content of address +.Fa inaddr +to +.Fa outaddr . +.Pp +.Fn krb5_copy_addresses +copies the content of the address list +.Fa inaddr +to +.Fa outaddr . +.Pp +.Fn krb5_append_addresses +adds the set of addresses in +.Fa source +to +.Fa dest . +While copying the addresses, duplicates are also sorted out. +.Pp +.Fn krb5_make_addrport +allocates and creates an +krb5_address in +.Fa res +of type KRB5_ADDRESS_ADDRPORT from +.Fa ( addr , port ) . +.Sh SEE ALSO +.Xr krb5 3 , +.Xr krb5.conf 5 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/krb5/krb5_aname_to_localname.3 b/kerberosV/src/lib/krb5/krb5_aname_to_localname.3 new file mode 100644 index 00000000000..2e896978a0f --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_aname_to_localname.3 @@ -0,0 +1,80 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_aname_to_localname.3,v 1.2 2003/04/16 13:58:13 lha Exp $ +.\" +.Dd March 17, 2003 +.Dt KRB5_ANAME_TO_LOCALNAME 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_aname_to_localname +.Nd converts a principal to a system local name. +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Ft krb5_boolean +.Fo krb5_aname_to_localname +.Fa "krb5_context context" +.Fa "krb5_const_principal name" +.Fa "size_t lnsize" +.Fa "char *lname" +.Fc +.Sh DESCRIPTION +This function takes a principal +.Fa name , +verifies its in the local realm (using +.Fn krb5_get_default_realms ) +and then returns the local name of the principal. +.Pp +If +.Fa name +isn't in one of the local realms and error is returned. +.Pp +If size +.Fa ( lnsize ) +of the local name +.Fa ( lname ) +is to small, an error is returned. +.Pp +.Fn krb5_aname_to_localname +should only be use by application that implements protocols that +doesn't transport the login name and thus needs to convert a principal +to a local name. +.Pp +Protocols should be designed so that the it autheticates using +Kerberos, send over the login name and then verifies in the principal +that authenticated is allowed to login and the login name. +A way to check if a user is allowed to login is using the function +.Fn krb5_kuserok . +.Sh SEE ALSO +.Xr krb5_get_default_realms 3 , +.Xr krb5_kuserok 3 diff --git a/kerberosV/src/lib/krb5/krb5_appdefault.3 b/kerberosV/src/lib/krb5/krb5_appdefault.3 index e0162e4a3c1..a2aa5a654e2 100644 --- a/kerberosV/src/lib/krb5/krb5_appdefault.3 +++ b/kerberosV/src/lib/krb5/krb5_appdefault.3 @@ -1,5 +1,36 @@ .\" Copyright (c) 2000 Kungliga Tekniska Högskolan -.\" $KTH: krb5_appdefault.3,v 1.5 2001/06/23 22:35:19 assar Exp $ +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_appdefault.3,v 1.10 2003/04/16 13:58:10 lha Exp $ +.\" .Dd July 25, 2000 .Dt KRB5_APPDEFAULT 3 .Os HEIMDAL @@ -8,8 +39,10 @@ .Nm krb5_appdefault_string , .Nm krb5_appdefault_time .Nd get application configuration value +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) .Sh SYNOPSIS -.Fd #include <krb5.h> +.In krb5.h .Ft void .Fn krb5_appdefault_boolean "krb5_context context" "const char *appname" "krb5_realm realm" "const char *option" "krb5_boolean def_val" "krb5_boolean *ret_val" .Ft void @@ -17,14 +50,14 @@ .Ft void .Fn krb5_appdefault_time "krb5_context context" "const char *appname" "krb5_realm realm" "const char *option" "time_t def_val" "time_t *ret_val" .Sh DESCRIPTION -These functions get application application defaults from the +These functions get application defaults from the .Dv appdefaults section of the -.Xr krb5.conf 5 +.Xr krb5.conf 5 configuration file. These defaults can be specified per application, and/or per realm. .Pp -These values will be looked for in +These values will be looked for in .Xr krb5.conf 5 , in order of descending importance. .Bd -literal -offset indent @@ -46,7 +79,7 @@ in order of descending importance. is the name of the application, and .Fa realm is the realm name. If the realm is omitted it will not be used for -resolving values. +resolving values. .Fa def_val is the value to return if no value is found in .Xr krb5.conf 5 . diff --git a/kerberosV/src/lib/krb5/krb5_auth_context.3 b/kerberosV/src/lib/krb5/krb5_auth_context.3 index cdfd31f1ce6..8b07a76e60f 100644 --- a/kerberosV/src/lib/krb5/krb5_auth_context.3 +++ b/kerberosV/src/lib/krb5/krb5_auth_context.3 @@ -1,6 +1,37 @@ -.\" Copyright (c) 2001 Kungliga Tekniska Högskolan -.\" $KTH: krb5_auth_context.3,v 1.2 2001/05/02 08:59:23 assar Exp $ -.Dd Jan 21, 2001 +.\" Copyright (c) 2001 - 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_auth_context.3,v 1.8 2003/04/16 13:58:13 lha Exp $ +.\" +.Dd January 21, 2001 .Dt KRB5_AUTH_CONTEXT 3 .Os HEIMDAL .Sh NAME @@ -34,9 +65,11 @@ .Nm krb5_auth_con_setrcache , .Nm krb5_auth_con_initivector , .Nm krb5_auth_con_setivector -.Nd manage authetication on connection level +.Nd manage authentication on connection level +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) .Sh SYNOPSIS -.Fd #include <krb5.h> +.In krb5.h .Ft krb5_error_code .Fo krb5_auth_con_init .Fa "krb5_context context" @@ -119,18 +152,18 @@ The .Nm krb5_auth_context structure holds all context related to an authenticated connection, in -a similar way to +a similar way to .Nm krb5_context -that holds the context for the thread or process. +that holds the context for the thread or process. .Nm krb5_auth_context is used by various functions that are directly related to authentication between the server/client. Example of data that this -structure contains are varius flags, addresses of client and server, +structure contains are various flags, addresses of client and server, port numbers, keyblocks (and subkeys), sequence numbers, replay cache, and checksum-type. .Pp .Fn krb5_auth_con_init -allocates and initilizes the +allocates and initializes the .Nm krb5_auth_context structure. Default values can be changed with .Fn krb5_auth_con_setcksumtype @@ -138,18 +171,18 @@ and .Fn krb5_auth_con_setflags . The .Nm auth_context -structure must be freed by +structure must be freed by .Fn krb5_auth_con_free . .Pp .Fn krb5_auth_con_getflags and .Fn krb5_auth_con_setflags -gets and modifies the flags for a +gets and modifies the flags for a .Nm krb5_auth_context structure. Possible flags to set are: .Bl -tag -width Ds .It Dv KRB5_AUTH_CONTEXT_DO_TIME -check timestamp on incoming packets. +check timestamp on incoming packets. .\".It Dv KRB5_AUTH_CONTEXT_RET_TIME .It Dv KRB5_AUTH_CONTEXT_DO_SEQUENCE Generate and check sequence-number on each packet. @@ -186,7 +219,7 @@ fetches the addresses from a file descriptor. .Pp .Fn krb5_auth_con_genaddrs fetches the address information from the given file descriptor -.Fa fd +.Fa fd depending on the bitmap argument .Fa flags . .Pp @@ -219,7 +252,7 @@ and thus no special handling is needed. is not a valid keyblock to .Fn krb5_auth_con_setkey . .Pp -.Fn krb5_auth_con_setuserkey +.Fn krb5_auth_con_setuserkey is only useful when doing user to user authentication. .Fn krb5_auth_con_setkey is equivalent to @@ -230,7 +263,7 @@ is equivalent to .Fn krb5_auth_con_getremotesubkey and .Fn krb5_auth_con_setremotesubkey -gets and sets the keyblock for the local and remote subkey. The keyblock returned by +gets and sets the keyblock for the local and remote subkey. The keyblock returned by .Fn krb5_auth_con_getlocalsubkey and .Fn krb5_auth_con_getremotesubkey @@ -259,7 +292,7 @@ gets and gets the keytype of the keyblock in .Pp .Fn krb5_auth_getauthenticator Retrieves the authenticator that was used during mutual -authentication. The +authentication. The .Dv authenticator returned should be freed by calling .Fn krb5_free_authenticator . @@ -275,7 +308,7 @@ allocates memory for and zeros the initial vector in the keyblock. .Pp .Fn krb5_auth_con_setivector -sets the i_vector portion of +sets the i_vector portion of .Fa auth_context to .Fa ivector . diff --git a/kerberosV/src/lib/krb5/krb5_ccache.3 b/kerberosV/src/lib/krb5/krb5_ccache.3 new file mode 100644 index 00000000000..3b5045997c9 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_ccache.3 @@ -0,0 +1,356 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_ccache.3,v 1.7 2003/04/16 13:58:12 lha Exp $ +.\" +.Dd March 16, 2003 +.Dt KRB5_CCACHE 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_ccache , +.Nm krb5_cc_cursor , +.Nm krb5_cc_ops , +.Nm krb5_fcc_ops , +.Nm krb5_mcc_ops , +.Nm krb5_cc_close , +.Nm krb5_cc_copy_cache , +.Nm krb5_cc_default , +.Nm krb5_cc_default_name , +.Nm krb5_cc_destroy , +.Nm krb5_cc_end_seq_get , +.Nm krb5_cc_gen_new , +.Nm krb5_cc_get_name , +.Nm krb5_cc_get_principal , +.Nm krb5_cc_get_type , +.Nm krb5_cc_get_ops , +.Nm krb5_cc_get_version , +.Nm krb5_cc_initialize , +.Nm krb5_cc_register , +.Nm krb5_cc_resolve , +.Nm krb5_cc_retrieve_cred , +.Nm krb5_cc_remove_cred , +.Nm krb5_cc_set_default_name , +.Nm krb5_cc_store_cred , +.Nm krb5_cc_set_flags , +.Nm krb5_cc_next_cred +.Nd mange credential cache. +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Pp +.Li "struct krb5_ccache;" +.Pp +.Li "struct krb5_cc_cursor;" +.Pp +.Li "struct krb5_cc_ops;" +.Pp +.Li "struct krb5_cc_ops *krb5_fcc_ops;" +.Pp +.Li "struct krb5_cc_ops *krb5_mcc_ops;" +.Pp +.Ft krb5_error_code +.Fo krb5_cc_close +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_copy_cache +.Fa "krb5_context *context" +.Fa "const krb5_ccache from" +.Fa "krb5_ccache to" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_default +.Fa "krb5_context *context" +.Fa "krb5_ccache *id" +.Fc +.Ft "const char *" +.Fo krb5_cc_default_name +.Fa "krb5_context *context" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_destroy +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_end_seq_get +.Fa "krb5_context *context" +.Fa "const krb5_ccache id" +.Fa "krb5_cc_cursor *cursor" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_gen_new +.Fa "krb5_context *context" +.Fa "const krb5_cc_ops *ops" +.Fa "krb5_ccache *id" +.Fc +.Ft "const char *" +.Fo krb5_cc_get_name +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_get_principal +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fa "krb5_principal *principal" +.Fc +.Ft "const char *" +.Fo krb5_cc_get_type +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fc +.Ft "const krb5_cc_ops *" +.Fo krb5_cc_get_ops +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_get_version +.Fa "krb5_context *context" +.Fa "const krb5_ccache id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_initialize +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fa "krb5_principal primary_principal" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_register +.Fa "krb5_context *context" +.Fa "const krb5_cc_ops *ops" +.Fa "krb5_boolean override" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_resolve +.Fa "krb5_context *context" +.Fa "const char *name" +.Fa "krb5_ccache *id" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_retrieve_cred +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fa "krb5_flags whichfields" +.Fa "const krb5_creds *mcreds" +.Fa "krb5_creds *creds" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_remove_cred +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fa "krb5_flags which" +.Fa "krb5_creds *cred" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_set_default_name +.Fa "krb5_context *context" +.Fa "const char *name" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_store_cred +.Fa "krb5_context *context" +.Fa "krb5_ccache id" +.Fa "krb5_creds *creds" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_set_flags +.Fa "krb5_context *context" +.Fa "krb5_cc_set_flags id" +.Fa "krb5_flags flags" +.Fc +.Ft krb5_error_code +.Fo krb5_cc_next_cred +.Fa "krb5_context *context" +.Fa "const krb5_ccache id" +.Fa "krb5_cc_cursor *cursor" +.Fa "krb5_creds *creds" +.Fc +.Sh DESCRIPTION +The +.Li krb5_ccache +structure holds a Kerberos credential cache. +.Pp +The +.Li krb5_cc_cursor +structure holds current position in a credential cache when +iterating over the cache. +.Pp +The +.Li krb5_cc_ops +structure holds a set of operations that can me preformed on a +credential cache. +.Pp +There is no component inside +.Li krb5_ccache , +.Li krb5_cc_cursor +nor +.Li krb5_fcc_ops +that is directly referable. +.Pp +The +.Li krb5_creds +holds a Kerberos credential, see manpage for +.Xr krb5_creds 3 . +.Pp +.Fn krb5_cc_default_name +and +.Fn krb5_cc_set_default_name +gets and sets the default name for the +.Fa context . +.Pp +.Fn krb5_cc_default +opens the default ccache in +.Fa id . +Return 0 or an error code. +.Pp +.Fn krb5_cc_gen_new +generates a new ccache of type +.Fa ops +in +.Fa id . +Return 0 or an error code. +.Pp +.Fn krb5_cc_resolve +finds and allocates a ccache in +.Fa id +from the specification in +.Fa residual . +If the ccache name doesn't contain any colon (:), interpret it as a +file name. +Return 0 or an error code. +.Pp +.Fn krb5_cc_initialize +creates a new ccache in +.Fa id +for +.Fa primary_principal . +Return 0 or an error code. +.Pp +.Fn krb5_cc_close +stops using the ccache +.Fa id +and frees the related resources. +Return 0 or an error code. +.Fn krb5_cc_destroy +removes the ccache +and closes (by calling +.Fn krb5_cc_close ) +.Fa id . +Return 0 or an error code. +.Pp +.Fn krb5_cc_copy_cache +copys the contents of +.Fa from +to +.Fa to . +.Pp +.Fn krb5_cc_get_name +returns the name of the ccache +.Fa id . +.Pp +.Fn krb5_cc_get_principal +returns the principal of +.Fa id +in +.Fa principal . +Return 0 or an error code. +.Pp +.Fn krb5_cc_get_type +returns the type of the ccache +.Fa id . +.Pp +.Fn krb5_cc_get_ops +returns the ops of the ccache +.Fa id . +.Pp +.Fn krb5_cc_get_version +returns the version of +.Fa id . +.Pp +.Fn krb5_cc_register +Adds a new ccache type with operations +.Fa ops , +overwriting any existing one if +.Fa override . +Return an error code or 0. +.Pp +.Fn krb5_cc_remove_cred +removes the credential identified by +.Fa ( cred , +.Fa which ) +from +.Fa id . +.Pp +.Fn krb5_cc_store_cred +stores +.Fa creds +in the ccache +.Fa id . +Return 0 or an error code. +.Pp +.Fn krb5_cc_set_flags +sets the flags of +.Fa id +to +.Fa flags . +.Pp +.Fn krb5_cc_retrieve_cred , +retrieves the credential identified by +.Fa mcreds +(and +.Fa whichfields ) +from +.Fa id +in +.Fa creds . +Return 0 or an error code. +.Pp +.Fn krb5_cc_next_cred +retrieves the next cred pointed to by +.Fa ( id , +.Fa cursor ) +in +.Fa creds , +and advance +.Fa cursor . +Return 0 or an error code. +.Pp +.Fn krb5_cc_end_seq_get +Destroys the cursor +.Fa cursor . +.Sh SEE ALSO +.Xr krb5 3 , +.Xr krb5.conf 5 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/krb5/krb5_data.3 b/kerberosV/src/lib/krb5/krb5_data.3 new file mode 100644 index 00000000000..27bb59a4f09 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_data.3 @@ -0,0 +1,149 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_data.3,v 1.4 2003/04/16 13:58:13 lha Exp $ +.\" +.Dd March 20, 2003 +.Dt KRB5_DATA 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_data +.Nm krb5_data_zero +.Nm krb5_data_free +.Nm krb5_free_data_contents +.Nm krb5_free_data +.Nm krb5_data_alloc +.Nm krb5_data_realloc +.Nm krb5_data_copy +.Nm krb5_copy_data +.Nd operates on the Kerberos datatype krb5_data. +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Pp +.Li "struct krb5_data;" +.Ft void +.Fn krb5_data_zero "krb5_data *p" +.Ft void +.Fn krb5_data_free "krb5_data *p" +.Ft void +.Fn krb5_free_data_contents "krb5_context context" "krb5_data *p" +.Ft void +.Fn krb5_free_data "krb5_context context" "krb5_data *p" +.Ft krb5_error_code +.Fn krb5_data_alloc "krb5_data *p" "int len" +.Ft krb5_error_code +.Fn krb5_data_realloc "krb5_data *p" "int len" +.Ft krb5_error_code +.Fn krb5_data_copy "krb5_data *p" "const void *data" "size_t len" +.Ft krb5_error_code +.Fn krb5_copy_data "krb5_context context" "const krb5_data *indata" "krb5_data **outdata" +.Sh DESCRIPTION +The +.Li krb5_data +structure holds a data element. +The structure contains two public accessible elements +.Fa length +(the length of data) +and +.Fa data +(the data itself). +The structure must always be initiated and freed by the functions +documented in this manual. +.Pp +.Fn krb5_data_zero +resets the content of +.Fa p . +.Pp +.Fn krb5_data_free +free the data in +.Fa p . +.Pp +.Fn krb5_free_data_contents +works the same way as +.Fa krb5_data_free . +The diffrence is that krb5_free_data_contents is more portable (exists +in MIT api). +.Pp +.Fn krb5_free_data +frees the data in +.Fa p +and +.Fa p +itself . +.Pp +.Fn krb5_data_alloc +allocates +.Fa len +bytes in +.Fa p +Returns 0 or an error. +.Pp +.Fn krb5_data_realloc +reallocates the length of +.Fa p +to the length in +.Fa len . +Returns 0 or an error. +.Pp +.Fn krb5_data_copy +copies the +.Fa data +that have the length +.Fa len +into +.Fa p . +.Fa p +is not freed so the calling function should make sure the +.Fa p +doesn't contain anything needs to be freed. +Returns 0 or an error. +.Pp +.Fn krb5_copy_data +copies the +.Li krb5_data +in +.Fa indata +to +.Fa outdata . +.Fa outdata +is not freed so the calling function should make sure the +.Fa outdata +doesn't contain anything needs to be freed. +.Fa outdata +should be freed using +.Fn krb5_free_data . +Returns 0 or an error. +.Sh SEE ALSO +.Xr krb5 3 , +.Xr krb5_storage 3 , +.Xr kerberos 8 diff --git a/kerberosV/src/lib/krb5/krb5_free_addresses.3 b/kerberosV/src/lib/krb5/krb5_free_addresses.3 new file mode 100644 index 00000000000..06fcbe68686 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_free_addresses.3 @@ -0,0 +1,53 @@ +.\" Copyright (c) 2001 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_free_addresses.3,v 1.5 2003/04/16 13:58:15 lha Exp $ +.\" +.Dd November 20, 2001 +.Dt KRB5_FREE_ADDRESSES 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_free_addresses +.Nd free list of addresses +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Ft void +.Fn krb5_free_addresses "krb5_context context" "krb5_addresses *addresses" +.Sh DESCRIPTION +The +.Fn krb5_free_addresses +will free a list of addresses that has been created with +.Fn krb5_get_all_client_addrs +or with some other function. +.Sh SEE ALSO +.Xr krb5_get_all_client_addrs 3 diff --git a/kerberosV/src/lib/krb5/krb5_kuserok.3 b/kerberosV/src/lib/krb5/krb5_kuserok.3 new file mode 100644 index 00000000000..df902a647b6 --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_kuserok.3 @@ -0,0 +1,94 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_kuserok.3,v 1.5 2003/04/16 13:58:10 lha Exp $ +.\" +.Dd Oct 17, 2002 +.Dt KRB5_KUSEROK 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_kuserok +.Nd verifies if a principal can log in as a user +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Ft krb5_boolean +.Fo krb5_kuserok +.Fa "krb5_context context" +.Fa "krb5_principal principal" +.Fa "const char *name" +.Fc +.Sh DESCRIPTION +This function takes a local user +.Fa name +and verifies if +.Fa principal +is allowed to log in as that user. +.Pp +First +.Nm +check if there is a local account name +.Fa username. +If there isn't, +.Nm +returns +.Dv FALSE . +.Pp +Then +.Nm +checks if principal is the same as user@realm in any of the default +realms. If that is the case, +.Nm +returns +.Dv TRUE . +.Pp +After that it reads the file +.Pa .k5login +(if it exists) in the users home directory and checks if +.Fa principal +is in the file. +If it does exists, +.Dv TRUE +is returned. +If neither of the above turns out to be true, +.DV FALSE +is returned. +.Pp +The +.Pa .k5login +should contain one principal per line. +.Sh SEE ALSO +.Xr krb5_get_default_realms 3 , +.Xr krb5_verify_user 3 , +.Xr krb5_verify_user_lrealm 3 , +.Xr krb5_verify_user_opt 3, +.Xr krb5.conf 5 diff --git a/kerberosV/src/lib/krb5/krb5_openlog.3 b/kerberosV/src/lib/krb5/krb5_openlog.3 index f93716c7f7c..cfde57af578 100644 --- a/kerberosV/src/lib/krb5/krb5_openlog.3 +++ b/kerberosV/src/lib/krb5/krb5_openlog.3 @@ -1,5 +1,35 @@ -.\" Copyright (c) 1997 Kungliga Tekniska Högskolan -.\" $KTH: krb5_openlog.3,v 1.5 2001/01/26 22:43:22 assar Exp $ +.\" Copyright (c) 1997, 1999, 2001 - 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_openlog.3,v 1.9 2003/04/16 13:58:12 lha Exp $ .Dd August 6, 1997 .Dt KRB5_OPENLOG 3 .Os HEIMDAL @@ -12,14 +42,16 @@ .Nm krb5_log , .Nm krb5_vlog , .Nm krb5_log_msg , -.Nm krb5_vlog_msg +.Nm krb5_vlog_msg .Nd Heimdal logging functions +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) .Sh SYNOPSIS -.Fd #include <krb5.h> +.In krb5.h .Ft "typedef void" -.Fn "\*(lp*krb5_log_log_func_t\*(rp" "const char *time" "const char *message" "void *data" +.Fn "\*(lp*krb5_log_log_func_t\*(rp" "const char *time" "const char *message" "void *data" .Ft "typedef void" -.Fn "\*(lp*krb5_log_close_func_t\*(rp" "void *data" +.Fn "\*(lp*krb5_log_close_func_t\*(rp" "void *data" .Ft krb5_error_code .Fn krb5_addlog_dest "krb5_context context" "krb5_log_facility *facility" "const char *destination" .Ft krb5_error_code @@ -43,7 +75,7 @@ These functions logs messages to one or more destinations. .Pp The .Fn krb5_openlog -function creates a logging +function creates a logging .Fa facility , that is used to log messages. A facility consists of one or more destinations (which can be files or syslog or some other device). The @@ -59,7 +91,7 @@ configuration file. If no entry is found for the entry for .Li default is used, or if that is missing too, -.Li SYSLOG +.Li SYSLOG will be used as destination. .Pp To close a logging facility, use the @@ -72,7 +104,7 @@ To log a message to a facility use one of the functions .Fn krb5_vlog , or .Fn krb5_vlog_msg . -The functions ending in +The functions ending in .Li _msg return in .Fa reply @@ -81,45 +113,45 @@ and should be freed with .Fn free . The .Fa format -is a standard +is a standard .Fn printf style format string (but see the BUGS section). .Pp -If you want better control of where things gets logged, you can instead of using +If you want better control of where things gets logged, you can instead of using .Fn krb5_openlog -call +call .Fn krb5_initlog , which just initializes a facility, but doesn't define any actual logging destinations. You can then add destinations with the .Fn krb5_addlog_dest and -.Fn krb5_addlog_func +.Fn krb5_addlog_func functions. The first of these takes a string specifying a logging destination, and adds this to the facility. If you want to do some non-standard logging you can use the .Fn krb5_addlog_func function, which takes a function to use when logging. -The +The .Fa log function is called for each message with .Fa time being a string specifying the current time, and .Fa message -the message to log. +the message to log. .Fa close -is called when the facility is closed. You can pass application specific data in the -.Fa data +is called when the facility is closed. You can pass application specific data in the +.Fa data parameter. The .Fa min -and +and .Fa max parameter are the same as in a destination (defined below). To specify a max of infinity, pass -1. .Pp .Fn krb5_openlog -calls +calls .Fn krb5_initlog -and then calls +and then calls .Fn krb5_addlog_dest for each destination found. .Ss Destinations @@ -148,9 +180,9 @@ get the name for one of these, you take the name of the macro passed to .Xr syslog 3 , and remove the leading -.Li LOG_ +.Li LOG_ .No ( Li LOG_NOTICE -becomes +becomes .Li NOTICE ) . The default values (as well as the values used for unrecognised values), are @@ -182,8 +214,8 @@ specified value. If no range is specified, all messages gets logged. default = STDERR .Ed .Pp -This will log all messages from the -.Nm kdc +This will log all messages from the +.Nm kdc program with level 0 to .Pa /var/log/kdc.log , other messages will be logged to syslog with priority diff --git a/kerberosV/src/lib/krb5/krb5_set_default_realm.3 b/kerberosV/src/lib/krb5/krb5_set_default_realm.3 new file mode 100644 index 00000000000..1e43094d9df --- /dev/null +++ b/kerberosV/src/lib/krb5/krb5_set_default_realm.3 @@ -0,0 +1,144 @@ +.\" Copyright (c) 2003 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_set_default_realm.3,v 1.2 2003/04/16 13:58:11 lha Exp $ +.\" +.Dd Mar 16, 2003 +.Dt KRB5_SET_DEFAULT_REALM 3 +.Os HEIMDAL +.Sh NAME +.Nm krb5_free_host_realm +.Nm krb5_get_default_realm +.Nm krb5_get_default_realms +.Nm krb5_get_host_realm +.Nm krb5_set_default_realm +.Nd default and host realm read and manipulation routines +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) +.Sh SYNOPSIS +.In krb5.h +.Ft krb5_error_code +.Fo krb5_free_host_realm +.Fa "krb5_context context" +.Fa "krb5_realm *realmlist" +.Fc +.Ft krb5_error_code +.Fo krb5_get_default_realm +.Fa "krb5_context context" +.Fa "krb5_realm *realm" +.Fc +.Ft krb5_error_code +.Fo krb5_get_default_realms +.Fa "krb5_context context" +.Fa "krb5_realm **realm" +.Fc +.Ft krb5_error_code +.Fo krb5_get_host_realm +.Fa "krb5_context context" +.Fa "const char *host" +.Fa "krb5_realm **realms" +.Fc +.Ft krb5_error_code +.Fo krb5_set_default_realm +.Fa "krb5_context context" +.Fa "const char *realm" +.Fc +.Sh DESCRIPTION +.Fn krb5_free_host_realm +frees all memory allocated by +.Fa realmlist . +.Pp +.Fn krb5_get_default_realm +returns the first default realm for this host. +The realm returned should be free with +.Fn free . +.Pp +.Fn krb5_get_default_realms +returns a +.Dv NULL +terminated list of default realms for this context. +Realms returned by +.Fn krb5_get_default_realms +should be free with +.Fn krb5_free_host_realm . +.Pp +.Fn krb5_get_host_realm +returns a +.Dv NULL +terminated list of realms for +.Fa host +by looking up the information in the +.Li [domain_realm] +in +.Pa krb5.conf +or in +.Li DNS . +If the mapping in +.Li [domain_realm] +results in the string +.Li dns_locate , +DNS is used to lookup the realm. +.Pp +When using +.Li DNS +to a resolve the domain for the host a.b.c, +.Fn krb5_get_host_realm +looks for a +.Dv TXT +resource record named +.Li _kerberos.a.b.c , +and if not found, it strips off the first component and tries a again +(_kerberos.b.c) until it reaches the root. +.Pp +If there is no configuration or DNS information found, +.Fn krb5_get_host_realm +assumes it can use the domain part of the +.Fa host +to form a realm. +.Pp +.Fn krb5_set_default_realm +sets the default realm for the +.Fa context . +If +.Dv NULL +is used as a +.Fa realm , +the +.Li [libdefaults]default_realm +stanza in +.Pa krb5.conf +is used. +If there is no such stanza in the configuration file, the +.Fn krb5_get_host_realm +function is used to form a default realm. +.Sh SEE ALSO +.Xr krb5.conf 5 , +.Xr free 3 diff --git a/kerberosV/src/lib/krb5/krb5_unparse_name.3 b/kerberosV/src/lib/krb5/krb5_unparse_name.3 index bcafeac86ef..cd5d6818487 100644 --- a/kerberosV/src/lib/krb5/krb5_unparse_name.3 +++ b/kerberosV/src/lib/krb5/krb5_unparse_name.3 @@ -1,5 +1,36 @@ .\" Copyright (c) 1997 Kungliga Tekniska Högskolan -.\" $KTH: krb5_unparse_name.3,v 1.3 2001/05/02 08:59:23 assar Exp $ +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5_unparse_name.3,v 1.8 2003/04/16 13:58:18 lha Exp $ +.\" .Dd August 8, 1997 .Dt KRB5_UNPARSE_NAME 3 .Os HEIMDAL @@ -7,8 +38,10 @@ .Nm krb5_unparse_name .\" .Nm krb5_unparse_name_ext .Nd principal to string conversion +.Sh LIBRARY +Kerberos 5 Library (libkrb5, -lkrb5) .Sh SYNOPSIS -.Fd #include <krb5.h> +.In krb5.h .Ft krb5_error_code .Fn krb5_unparse_name "krb5_context context" "krb5_principal principal" "char **name" .\" .Ft krb5_error_code @@ -16,9 +49,10 @@ .Sh DESCRIPTION This function takes a .Fa principal , -and will convert in to a printable representation with the same syntax as decribed in +and will convert in to a printable representation with the same syntax +as described in .Xr krb5_parse_name 3 . -.Fa *name +.Fa *name will point to allocated data and should be freed by the caller. .Sh SEE ALSO .Xr krb5_425_conv_principal 3 , diff --git a/kerberosV/src/lib/krb5/krbhst-test.c b/kerberosV/src/lib/krb5/krbhst-test.c index a987e3a81f6..df252d120b0 100644 --- a/kerberosV/src/lib/krb5/krbhst-test.c +++ b/kerberosV/src/lib/krb5/krbhst-test.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2001 Kungliga Tekniska Högskolan + * Copyright (c) 2001 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,30 @@ #include "krb5_locl.h" -RCSID("$KTH: krbhst-test.c,v 1.2 2001/06/17 12:22:59 assar Exp $"); +#include <err.h> +#include <getarg.h> + +RCSID("$KTH: krbhst-test.c,v 1.3 2002/08/23 03:43:18 assar Exp $"); + +static int version_flag = 0; +static int help_flag = 0; + +static struct getargs args[] = { + {"version", 0, arg_flag, &version_flag, + "print version", NULL }, + {"help", 0, arg_flag, &help_flag, + NULL, NULL } +}; + +static void +usage (int ret) +{ + arg_printusage (args, + sizeof(args)/sizeof(*args), + NULL, + "[realms ...]"); + exit (ret); +} int main(int argc, char **argv) @@ -43,9 +66,26 @@ main(int argc, char **argv) int types[] = {KRB5_KRBHST_KDC, KRB5_KRBHST_ADMIN, KRB5_KRBHST_CHANGEPW, KRB5_KRBHST_KRB524}; const char *type_str[] = {"kdc", "admin", "changepw", "krb524"}; + int optind = 0; + setprogname (argv[0]); + + if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind)) + usage(1); + + if (help_flag) + usage (0); + + if(version_flag){ + print_version(NULL); + exit(0); + } + + argc -= optind; + argv += optind; + krb5_init_context (&context); - for(i = 1; i < argc; i++) { + for(i = 0; i < argc; i++) { krb5_krbhst_handle handle; char host[MAXHOSTNAMELEN]; diff --git a/kerberosV/src/lib/krb5/kuserok.c b/kerberosV/src/lib/krb5/kuserok.c index a7704258809..3a5d7218a1b 100644 --- a/kerberosV/src/lib/krb5/kuserok.c +++ b/kerberosV/src/lib/krb5/kuserok.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: kuserok.c,v 1.5 1999/12/02 17:05:11 joda Exp $"); +RCSID("$KTH: kuserok.c,v 1.7 2003/03/13 19:53:43 lha Exp $"); /* * Return TRUE iff `principal' is allowed to login as `luser'. @@ -51,6 +51,10 @@ krb5_kuserok (krb5_context context, krb5_error_code ret; krb5_boolean b; + pwd = getpwnam (luser); /* XXX - Should use k_getpwnam? */ + if (pwd == NULL) + return FALSE; + ret = krb5_get_default_realms (context, &realms); if (ret) return FALSE; @@ -78,9 +82,6 @@ krb5_kuserok (krb5_context context, } krb5_free_host_realm (context, realms); - pwd = getpwnam (luser); /* XXX - Should use k_getpwnam? */ - if (pwd == NULL) - return FALSE; snprintf (buf, sizeof(buf), "%s/.k5login", pwd->pw_dir); f = fopen (buf, "r"); if (f == NULL) @@ -88,9 +89,7 @@ krb5_kuserok (krb5_context context, while (fgets (buf, sizeof(buf), f) != NULL) { krb5_principal tmp; - if(buf[strlen(buf) - 1] == '\n') - buf[strlen(buf) - 1] = '\0'; - + buf[strcspn(buf, "\n")] = '\0'; ret = krb5_parse_name (context, buf, &tmp); if (ret) { fclose (f); diff --git a/kerberosV/src/lib/krb5/mcache.c b/kerberosV/src/lib/krb5/mcache.c index 5db29b4a669..6767e4e0587 100644 --- a/kerberosV/src/lib/krb5/mcache.c +++ b/kerberosV/src/lib/krb5/mcache.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: mcache.c,v 1.14 2001/06/17 23:13:02 assar Exp $"); +RCSID("$KTH: mcache.c,v 1.15 2002/04/18 09:40:33 joda Exp $"); typedef struct krb5_mcache { char *name; @@ -54,7 +54,7 @@ static struct krb5_mcache *mcc_head; #define MCC_CURSOR(C) ((struct link*)(C)) -static char* +static const char* mcc_get_name(krb5_context context, krb5_ccache id) { diff --git a/kerberosV/src/lib/krb5/mk_error.c b/kerberosV/src/lib/krb5/mk_error.c index 6a53702c281..ca81c1d8012 100644 --- a/kerberosV/src/lib/krb5/mk_error.c +++ b/kerberosV/src/lib/krb5/mk_error.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: mk_error.c,v 1.16 2001/05/14 06:14:49 assar Exp $"); +RCSID("$KTH: mk_error.c,v 1.18 2002/09/04 16:26:04 joda Exp $"); krb5_error_code krb5_mk_error(krb5_context context, @@ -42,13 +42,11 @@ krb5_mk_error(krb5_context context, const krb5_data *e_data, const krb5_principal client, const krb5_principal server, - time_t *ctime, - int *cusec, + time_t *client_time, + int *client_usec, krb5_data *reply) { KRB_ERROR msg; - u_char *buf; - size_t buf_size; int32_t sec, usec; size_t len; krb5_error_code ret = 0; @@ -60,8 +58,8 @@ krb5_mk_error(krb5_context context, msg.msg_type = krb_error; msg.stime = sec; msg.susec = usec; - msg.ctime = ctime; - msg.cusec = cusec; + msg.ctime = client_time; + msg.cusec = client_usec; /* Make sure we only send `protocol' error codes */ if(error_code < KRB5KDC_ERR_NONE || error_code >= KRB5_ERR_RCSID) { if(e_text == NULL) @@ -84,45 +82,10 @@ krb5_mk_error(krb5_context context, msg.cname = &client->name; } - buf_size = 1024; - buf = malloc (buf_size); - if (buf == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - - do { - ret = encode_KRB_ERROR(buf + buf_size - 1, - buf_size, - &msg, - &len); - if (ret) { - if (ret == ASN1_OVERFLOW) { - u_char *tmp; - - buf_size *= 2; - tmp = realloc (buf, buf_size); - if (tmp == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - buf = tmp; - } else { - goto out; - } - } - } while (ret == ASN1_OVERFLOW); - - reply->length = len; - reply->data = malloc(len); - if (reply->data == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - ret = ENOMEM; - goto out; - } - memcpy (reply->data, buf + buf_size - len, len); -out: - free (buf); - return ret; + ASN1_MALLOC_ENCODE(KRB_ERROR, reply->data, reply->length, &msg, &len, ret); + if (ret) + return ret; + if(reply->length != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); + return 0; } diff --git a/kerberosV/src/lib/krb5/mk_priv.c b/kerberosV/src/lib/krb5/mk_priv.c index f5057f8eaf3..7cac7b7c327 100644 --- a/kerberosV/src/lib/krb5/mk_priv.c +++ b/kerberosV/src/lib/krb5/mk_priv.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,12 +33,9 @@ #include <krb5_locl.h> -RCSID("$KTH: mk_priv.c,v 1.30 2001/06/18 02:44:54 assar Exp $"); - -/* - * - */ +RCSID("$KTH: mk_priv.c,v 1.31 2002/09/04 16:26:04 joda Exp $"); + krb5_error_code krb5_mk_priv(krb5_context context, krb5_auth_context auth_context, @@ -83,35 +80,11 @@ krb5_mk_priv(krb5_context context, part.s_address = auth_context->local_address; part.r_address = auth_context->remote_address; - buf_size = 1024; - buf = malloc (buf_size); - if (buf == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - krb5_data_zero (&s.enc_part.cipher); - do { - ret = encode_EncKrbPrivPart (buf + buf_size - 1, buf_size, - &part, &len); - if (ret) { - if (ret == ASN1_OVERFLOW) { - u_char *tmp; - - buf_size *= 2; - tmp = realloc (buf, buf_size); - if (tmp == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - ret = ENOMEM; - goto fail; - } - buf = tmp; - } else { - goto fail; - } - } - } while(ret == ASN1_OVERFLOW); + ASN1_MALLOC_ENCODE(EncKrbPrivPart, buf, buf_size, &part, &len, ret); + if (ret) + goto fail; s.pvno = 5; s.msg_type = krb_priv; @@ -134,37 +107,21 @@ krb5_mk_priv(krb5_context context, free(buf); return ret; } + free(buf); + - do { - ret = encode_KRB_PRIV (buf + buf_size - 1, buf_size, &s, &len); - - if (ret){ - if (ret == ASN1_OVERFLOW) { - u_char *tmp; - - buf_size *= 2; - tmp = realloc (buf, buf_size); - if (tmp == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - ret = ENOMEM; - goto fail; - } - buf = tmp; - } else { - goto fail; - } - } - } while(ret == ASN1_OVERFLOW); + ASN1_MALLOC_ENCODE(KRB_PRIV, buf, buf_size, &s, &len, ret); + + if(ret) + goto fail; krb5_data_free (&s.enc_part.cipher); - outbuf->length = len; - outbuf->data = malloc (len); - if (outbuf->data == NULL) { + ret = krb5_data_copy(outbuf, buf + buf_size - len, len); + if (ret) { krb5_set_error_string (context, "malloc: out of memory"); free(buf); return ENOMEM; } - memcpy (outbuf->data, buf + buf_size - len, len); free (buf); if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) auth_context->local_seqnumber = diff --git a/kerberosV/src/lib/krb5/mk_rep.c b/kerberosV/src/lib/krb5/mk_rep.c index 3f2952a6afd..d5522a48462 100644 --- a/kerberosV/src/lib/krb5/mk_rep.c +++ b/kerberosV/src/lib/krb5/mk_rep.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,92 +33,67 @@ #include <krb5_locl.h> -RCSID("$KTH: mk_rep.c,v 1.19 2001/05/14 06:14:49 assar Exp $"); +RCSID("$KTH: mk_rep.c,v 1.21 2002/12/19 13:30:36 joda Exp $"); krb5_error_code krb5_mk_rep(krb5_context context, krb5_auth_context auth_context, krb5_data *outbuf) { - krb5_error_code ret; - AP_REP ap; - EncAPRepPart body; - u_char *buf = NULL; - size_t buf_size; - size_t len; - krb5_crypto crypto; + krb5_error_code ret; + AP_REP ap; + EncAPRepPart body; + u_char *buf = NULL; + size_t buf_size; + size_t len; + krb5_crypto crypto; - ap.pvno = 5; - ap.msg_type = krb_ap_rep; + ap.pvno = 5; + ap.msg_type = krb_ap_rep; - memset (&body, 0, sizeof(body)); + memset (&body, 0, sizeof(body)); - body.ctime = auth_context->authenticator->ctime; - body.cusec = auth_context->authenticator->cusec; - body.subkey = NULL; - if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) { - krb5_generate_seq_number (context, - auth_context->keyblock, - &auth_context->local_seqnumber); - body.seq_number = malloc (sizeof(*body.seq_number)); - if (body.seq_number == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - *(body.seq_number) = auth_context->local_seqnumber; - } else - body.seq_number = NULL; - - ap.enc_part.etype = auth_context->keyblock->keytype; - ap.enc_part.kvno = NULL; - - buf_size = length_EncAPRepPart(&body); - buf = malloc (buf_size); - if (buf == NULL) { - free_EncAPRepPart (&body); - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } + body.ctime = auth_context->authenticator->ctime; + body.cusec = auth_context->authenticator->cusec; + body.subkey = NULL; + if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) { + krb5_generate_seq_number (context, + auth_context->keyblock, + &auth_context->local_seqnumber); + body.seq_number = malloc (sizeof(*body.seq_number)); + if (body.seq_number == NULL) { + krb5_set_error_string (context, "malloc: out of memory"); + return ENOMEM; + } + *(body.seq_number) = auth_context->local_seqnumber; + } else + body.seq_number = NULL; - ret = krb5_encode_EncAPRepPart (context, - buf + buf_size - 1, - buf_size, - &body, - &len); + ap.enc_part.etype = auth_context->keyblock->keytype; + ap.enc_part.kvno = NULL; - free_EncAPRepPart (&body); - ret = krb5_crypto_init(context, auth_context->keyblock, - 0 /* ap.enc_part.etype */, &crypto); - if (ret) { - free (buf); - return ret; - } - ret = krb5_encrypt (context, - crypto, - KRB5_KU_AP_REQ_ENC_PART, - buf + buf_size - len, - len, - &ap.enc_part.cipher); - krb5_crypto_destroy(context, crypto); - if (ret) { - free(buf); - return ret; - } - - buf_size = length_AP_REP(&ap); - buf = realloc(buf, buf_size); - if(buf == NULL) { - free_AP_REP (&ap); - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - ret = encode_AP_REP (buf + buf_size - 1, buf_size, &ap, &len); - - free_AP_REP (&ap); + ASN1_MALLOC_ENCODE(EncAPRepPart, buf, buf_size, &body, &len, ret); + free_EncAPRepPart (&body); + if(ret) + return ret; + ret = krb5_crypto_init(context, auth_context->keyblock, + 0 /* ap.enc_part.etype */, &crypto); + if (ret) { + free (buf); + return ret; + } + ret = krb5_encrypt (context, + crypto, + KRB5_KU_AP_REQ_ENC_PART, + buf + buf_size - len, + len, + &ap.enc_part.cipher); + krb5_crypto_destroy(context, crypto); + free(buf); + if (ret) + return ret; - if(len != buf_size) - krb5_abortx(context, "krb5_mk_rep: encoded length != calculated length"); - outbuf->data = buf; - outbuf->length = len; - return 0; + ASN1_MALLOC_ENCODE(AP_REP, outbuf->data, outbuf->length, &ap, &len, ret); + free_AP_REP (&ap); + return ret; } diff --git a/kerberosV/src/lib/krb5/mk_safe.c b/kerberosV/src/lib/krb5/mk_safe.c index 41acdc03ed3..2301de51242 100644 --- a/kerberosV/src/lib/krb5/mk_safe.c +++ b/kerberosV/src/lib/krb5/mk_safe.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: mk_safe.c,v 1.27 2001/06/18 02:45:15 assar Exp $"); +RCSID("$KTH: mk_safe.c,v 1.28 2002/09/04 16:26:05 joda Exp $"); krb5_error_code krb5_mk_safe(krb5_context context, @@ -48,7 +48,6 @@ krb5_mk_safe(krb5_context context, KerberosTime sec2; int usec2; u_char *buf = NULL; - void *tmp; size_t buf_size; size_t len; u_int32_t tmp_seq; @@ -85,17 +84,11 @@ krb5_mk_safe(krb5_context context, s.cksum.checksum.data = NULL; s.cksum.checksum.length = 0; - buf_size = length_KRB_SAFE(&s); - buf = malloc(buf_size + 128); /* add some for checksum */ - if(buf == NULL) { - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - ret = encode_KRB_SAFE (buf + buf_size - 1, buf_size, &s, &len); - if (ret) { - free (buf); + ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, &s, &len, ret); + if (ret) return ret; - } + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); ret = krb5_crypto_init(context, key, 0, &crypto); if (ret) { free (buf); @@ -105,7 +98,7 @@ krb5_mk_safe(krb5_context context, crypto, KRB5_KU_KRB_SAFE_CKSUM, 0, - buf + buf_size - len, + buf, len, &s.cksum); krb5_crypto_destroy(context, crypto); @@ -114,27 +107,16 @@ krb5_mk_safe(krb5_context context, return ret; } - buf_size = length_KRB_SAFE(&s); - tmp = realloc(buf, buf_size); - if(tmp == NULL) { - free(buf); - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - buf = tmp; - - ret = encode_KRB_SAFE (buf + buf_size - 1, buf_size, &s, &len); + free(buf); + ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, &s, &len, ret); free_Checksum (&s.cksum); + if(ret) + return ret; + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); outbuf->length = len; - outbuf->data = malloc (len); - if (outbuf->data == NULL) { - free (buf); - krb5_set_error_string (context, "malloc: out of memory"); - return ENOMEM; - } - memcpy (outbuf->data, buf + buf_size - len, len); - free (buf); + outbuf->data = buf; if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) auth_context->local_seqnumber = (auth_context->local_seqnumber + 1) & 0xFFFFFFFF; diff --git a/kerberosV/src/lib/krb5/name-45-test.c b/kerberosV/src/lib/krb5/name-45-test.c new file mode 100644 index 00000000000..de0ed78bc7f --- /dev/null +++ b/kerberosV/src/lib/krb5/name-45-test.c @@ -0,0 +1,277 @@ +/* + * Copyright (c) 2002 - 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "krb5_locl.h" + +RCSID("$KTH: name-45-test.c,v 1.3 2003/04/17 05:44:40 lha Exp $"); + +enum { MAX_COMPONENTS = 3 }; + +static struct testcase { + const char *v4_name; + const char *v4_inst; + const char *v4_realm; + + krb5_realm v5_realm; + unsigned ncomponents; + char *comp_val[MAX_COMPONENTS]; + + const char *config_file; + krb5_error_code ret; /* expected error code from 524 */ + + krb5_error_code ret2; /* expected error code from 425 */ +} tests[] = { + {"", "", "", "", 1, {""}, NULL, 0, 0}, + {"a", "", "", "", 1, {"a"}, NULL, 0, 0}, + {"a", "b", "", "", 2, {"a", "b"}, NULL, 0, 0}, + {"a", "b", "c", "c", 2, {"a", "b"}, NULL, 0, 0}, + + {"krbtgt", "FOO.SE", "FOO.SE", "FOO.SE", 2, + {"krbtgt", "FOO.SE"}, NULL, 0, 0}, + + {"foo", "bar", "BAZ", "BAZ", 2, + {"foo", "bar"}, NULL, 0, 0}, + {"foo", "bar", "BAZ", "BAZ", 2, + {"foo", "bar"}, + "[libdefaults]\n" + " v4_name_convert = {\n" + " host = {\n" + " foo = foo5\n" + " }\n" + "}\n", + HEIM_ERR_V4_PRINC_NO_CONV, 0}, + {"foo", "bar", "BAZ", "BAZ", 2, + {"foo5", "bar.baz"}, + "[realms]\n" + " BAZ = {\n" + " v4_name_convert = {\n" + " host = {\n" + " foo = foo5\n" + " }\n" + " }\n" + " v4_instance_convert = {\n" + " bar = bar.baz\n" + " }\n" + " }\n", + 0, 0}, + + {"rcmd", "foo", "realm", "realm", 2, {"host", "foo"}, NULL, + HEIM_ERR_V4_PRINC_NO_CONV, 0}, + {"rcmd", "foo", "realm", "realm", 2, {"host", "foo.realm"}, + "[realms]\n" + " realm = {\n" + " v4_instance_convert = {\n" + " foo = foo.realm\n" + " }\n" + " }\n", + 0, 0}, + + {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2, + {"pop", "mail0.nada.kth.se"}, NULL, HEIM_ERR_V4_PRINC_NO_CONV, 0}, + {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2, + {"pop", "mail0.nada.kth.se"}, + "[realms]\n" + " NADA.KTH.SE = {\n" + " default_domain = nada.kth.se\n" + " }\n", + 0, 0}, + {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2, + {"pop", "mail0.nada.kth.se"}, + "[libdefaults]\n" + " v4_instance_resolve = true\n", + HEIM_ERR_V4_PRINC_NO_CONV, 0}, + + {"rcmd", "hokkigai", "NADA.KTH.SE", "NADA.KTH.SE", 2, + {"host", "hokkigai.pdc.kth.se"}, NULL, HEIM_ERR_V4_PRINC_NO_CONV, 0}, + {"rcmd", "hokkigai", "NADA.KTH.SE", "NADA.KTH.SE", 2, + {"host", "hokkigai.pdc.kth.se"}, + "[libdefaults]\n" + " v4_instance_resolve = true\n" + "[realms]\n" + " NADA.KTH.SE = {\n" + " v4_name_convert = {\n" + " host = {\n" + " rcmd = host\n" + " }\n" + " }\n" + " default_domain = pdc.kth.se\n" + " }\n", + 0, 0}, + + {"0123456789012345678901234567890123456789", + "0123456789012345678901234567890123456789", + "0123456789012345678901234567890123456789", + "0123456789012345678901234567890123456789", + 2, {"0123456789012345678901234567890123456789", + "0123456789012345678901234567890123456789"}, NULL, + 0, KRB5_PARSE_MALFORMED}, + + {"012345678901234567890123456789012345678", + "012345678901234567890123456789012345678", + "012345678901234567890123456789012345678", + "012345678901234567890123456789012345678", + 2, {"012345678901234567890123456789012345678", + "012345678901234567890123456789012345678"}, NULL, + 0, 0}, + + {NULL, NULL, NULL, NULL, 0, {}, NULL, 0} +}; + +int +main(int argc, char **argv) +{ + struct testcase *t; + krb5_context context; + krb5_error_code ret; + int val = 0; + + for (t = tests; t->v4_name; ++t) { + krb5_principal princ; + int i; + char name[40], inst[40], realm[40]; + char printable_princ[256]; + + ret = krb5_init_context (&context); + if (ret) + errx (1, "krb5_init_context failed: %d", ret); + + if (t->config_file != NULL) { + char template[] = "/tmp/krb5-conf-XXXXXX"; + int fd = mkstemp(template); + char *files[2]; + + if (fd < 0) + krb5_err (context, 1, errno, "mkstemp %s", template); + + if (write (fd, t->config_file, strlen(t->config_file)) + != strlen(t->config_file)) + krb5_err (context, 1, errno, "write %s", template); + close (fd); + files[0] = template; + files[1] = NULL; + + ret = krb5_set_config_files (context, files); + unlink (template); + if (ret) + krb5_err (context, 1, ret, "krb5_set_config_files"); + } + + ret = krb5_425_conv_principal (context, + t->v4_name, + t->v4_inst, + t->v4_realm, + &princ); + if (ret) { + if (ret != t->ret) { + krb5_warn (context, ret, + "krb5_425_conv_principal %s.%s@%s", + t->v4_name, t->v4_inst, t->v4_realm); + val = 1; + } + } else { + if (t->ret) { + krb5_warnx (context, + "krb5_425_conv_principal %s.%s@%s " + "passed unexpected", + t->v4_name, t->v4_inst, t->v4_realm); + val = 1; + continue; + } + } + + if (ret) + continue; + + if (strcmp (t->v5_realm, princ->realm) != 0) { + printf ("wrong realm (\"%s\" should be \"%s\")" + " for \"%s.%s@%s\"\n", + princ->realm, t->v5_realm, + t->v4_name, + t->v4_inst, + t->v4_realm); + val = 1; + } + + if (t->ncomponents != princ->name.name_string.len) { + printf ("wrong number of components (%u should be %u)" + " for \"%s.%s@%s\"\n", + princ->name.name_string.len, t->ncomponents, + t->v4_name, + t->v4_inst, + t->v4_realm); + val = 1; + } else { + for (i = 0; i < t->ncomponents; ++i) { + if (strcmp(t->comp_val[i], + princ->name.name_string.val[i]) != 0) { + printf ("bad component %d (\"%s\" should be \"%s\")" + " for \"%s.%s@%s\"\n", + i, + princ->name.name_string.val[i], + t->comp_val[i], + t->v4_name, + t->v4_inst, + t->v4_realm); + val = 1; + } + } + } + ret = krb5_524_conv_principal (context, princ, + name, inst, realm); + if (krb5_unparse_name_fixed(context, princ, + printable_princ, sizeof(printable_princ))) + strlcpy(printable_princ, "unknown principal", + sizeof(printable_princ)); + if (ret) { + if (ret != t->ret2) { + krb5_warn (context, ret, + "krb5_524_conv_principal %s", printable_princ); + val = 1; + } + } else { + if (t->ret2) { + krb5_warnx (context, + "krb5_524_conv_principal %s " + "passed unexpected", printable_princ); + val = 1; + continue; + } + } + if (ret) { + krb5_free_principal (context, princ); + continue; + } + + krb5_free_principal (context, princ); + } + return val; +} diff --git a/kerberosV/src/lib/krb5/net_read.c b/kerberosV/src/lib/krb5/net_read.c index 95c2b87b2eb..829fd0b8180 100644 --- a/kerberosV/src/lib/krb5/net_read.c +++ b/kerberosV/src/lib/krb5/net_read.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997, 1998 Kungliga Tekniska Högskolan + * Copyright (c) 1997, 1998, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,9 +33,9 @@ #include "krb5_locl.h" -RCSID("$KTH: net_read.c,v 1.5 1999/12/02 17:05:11 joda Exp $"); +RCSID("$KTH: net_read.c,v 1.6 2002/08/21 09:08:06 joda Exp $"); -ssize_t +krb5_ssize_t krb5_net_read (krb5_context context, void *p_fd, void *buf, diff --git a/kerberosV/src/lib/krb5/net_write.c b/kerberosV/src/lib/krb5/net_write.c index ce54ad642e4..9d2e2bf97ca 100644 --- a/kerberosV/src/lib/krb5/net_write.c +++ b/kerberosV/src/lib/krb5/net_write.c @@ -33,9 +33,9 @@ #include "krb5_locl.h" -RCSID("$KTH: net_write.c,v 1.6 1999/12/02 17:05:11 joda Exp $"); +RCSID("$KTH: net_write.c,v 1.7 2002/08/21 09:08:07 joda Exp $"); -ssize_t +krb5_ssize_t krb5_net_write (krb5_context context, void *p_fd, const void *buf, diff --git a/kerberosV/src/lib/krb5/parse-name-test.c b/kerberosV/src/lib/krb5/parse-name-test.c new file mode 100644 index 00000000000..1f70bf61123 --- /dev/null +++ b/kerberosV/src/lib/krb5/parse-name-test.c @@ -0,0 +1,192 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "krb5_locl.h" + +RCSID("$KTH: parse-name-test.c,v 1.3 2002/08/30 03:20:11 assar Exp $"); + +enum { MAX_COMPONENTS = 3 }; + +static struct testcase { + const char *input_string; + const char *output_string; + krb5_realm realm; + unsigned ncomponents; + char *comp_val[MAX_COMPONENTS]; + int realmp; +} tests[] = { + {"", "@", "", 1, {""}, FALSE}, + {"a", "a@", "", 1, {"a"}, FALSE}, + {"\\n", "\\n@", "", 1, {"\n"}, FALSE}, + {"\\ ", "\\ @", "", 1, {" "}, FALSE}, + {"\\t", "\\t@", "", 1, {"\t"}, FALSE}, + {"\\b", "\\b@", "", 1, {"\b"}, FALSE}, + {"\\\\", "\\\\@", "", 1, {"\\"}, FALSE}, + {"\\/", "\\/@", "", 1, {"/"}, FALSE}, + {"\\@", "\\@@", "", 1, {"@"}, FALSE}, + {"@", "@", "", 1, {""}, TRUE}, + {"a/b", "a/b@", "", 2, {"a", "b"}, FALSE}, + {"a/", "a/@", "", 2, {"a", ""}, FALSE}, + {"a\\//\\/", "a\\//\\/@", "", 2, {"a/", "/"}, FALSE}, + {"/a", "/a@", "", 2, {"", "a"}, FALSE}, + {"\\@@\\@", "\\@@\\@", "@", 1, {"@"}, TRUE}, + {"a/b/c", "a/b/c@", "", 3, {"a", "b", "c"}, FALSE}, + {NULL, NULL, "", 0, {}, FALSE}}; + +int +main(int argc, char **argv) +{ + struct testcase *t; + krb5_context context; + krb5_error_code ret; + int val = 0; + + ret = krb5_init_context (&context); + if (ret) + errx (1, "krb5_init_context failed: %d", ret); + + /* to enable realm-less principal name above */ + + krb5_set_default_realm(context, ""); + + for (t = tests; t->input_string; ++t) { + krb5_principal princ; + int i, j; + char name_buf[1024]; + char *s; + + ret = krb5_parse_name(context, t->input_string, &princ); + if (ret) + krb5_err (context, 1, ret, "krb5_parse_name %s", + t->input_string); + if (strcmp (t->realm, princ->realm) != 0) { + printf ("wrong realm (\"%s\" should be \"%s\")" + " for \"%s\"\n", + princ->realm, t->realm, + t->input_string); + val = 1; + } + + if (t->ncomponents != princ->name.name_string.len) { + printf ("wrong number of components (%u should be %u)" + " for \"%s\"\n", + princ->name.name_string.len, t->ncomponents, + t->input_string); + val = 1; + } else { + for (i = 0; i < t->ncomponents; ++i) { + if (strcmp(t->comp_val[i], + princ->name.name_string.val[i]) != 0) { + printf ("bad component %d (\"%s\" should be \"%s\")" + " for \"%s\"\n", + i, + princ->name.name_string.val[i], + t->comp_val[i], + t->input_string); + val = 1; + } + } + } + for (j = 0; j < strlen(t->output_string); ++j) { + ret = krb5_unparse_name_fixed(context, princ, + name_buf, j); + if (ret != ERANGE) { + printf ("unparse_name %s with length %d should have failed\n", + t->input_string, j); + val = 1; + break; + } + } + ret = krb5_unparse_name_fixed(context, princ, + name_buf, sizeof(name_buf)); + if (ret) + krb5_err (context, 1, ret, "krb5_unparse_name_fixed"); + + if (strcmp (t->output_string, name_buf) != 0) { + printf ("failed comparing the re-parsed" + " (\"%s\" should be \"%s\")\n", + name_buf, t->output_string); + val = 1; + } + + ret = krb5_unparse_name(context, princ, &s); + if (ret) + krb5_err (context, 1, ret, "krb5_unparse_name"); + + if (strcmp (t->output_string, s) != 0) { + printf ("failed comparing the re-parsed" + " (\"%s\" should be \"%s\"\n", + s, t->output_string); + val = 1; + } + free(s); + + if (!t->realmp) { + for (j = 0; j < strlen(t->input_string); ++j) { + ret = krb5_unparse_name_fixed_short(context, princ, + name_buf, j); + if (ret != ERANGE) { + printf ("unparse_name_short %s with length %d" + " should have failed\n", + t->input_string, j); + val = 1; + break; + } + } + ret = krb5_unparse_name_fixed_short(context, princ, + name_buf, sizeof(name_buf)); + if (ret) + krb5_err (context, 1, ret, "krb5_unparse_name_fixed"); + + if (strcmp (t->input_string, name_buf) != 0) { + printf ("failed comparing the re-parsed" + " (\"%s\" should be \"%s\")\n", + name_buf, t->input_string); + val = 1; + } + + ret = krb5_unparse_name_short(context, princ, &s); + if (ret) + krb5_err (context, 1, ret, "krb5_unparse_name_short"); + + if (strcmp (t->input_string, s) != 0) { + printf ("failed comparing the re-parsed" + " (\"%s\" should be \"%s\"\n", + s, t->input_string); + val = 1; + } + free(s); + } + krb5_free_principal (context, princ); + } + return val; +} diff --git a/kerberosV/src/lib/krb5/prompter_posix.c b/kerberosV/src/lib/krb5/prompter_posix.c index 8996c6c2d49..b7851e07c22 100644 --- a/kerberosV/src/lib/krb5/prompter_posix.c +++ b/kerberosV/src/lib/krb5/prompter_posix.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: prompter_posix.c,v 1.6 2001/05/11 20:26:49 assar Exp $"); +RCSID("$KTH: prompter_posix.c,v 1.7 2002/09/16 17:32:11 nectar Exp $"); int krb5_prompter_posix (krb5_context context, @@ -65,8 +65,7 @@ krb5_prompter_posix (krb5_context context, prompts[i].reply->length, stdin) == NULL) return 1; - if(s[strlen(s) - 1] == '\n') - s[strlen(s) - 1] = '\0'; + s[strcspn(s, "\n")] = '\0'; } } return 0; diff --git a/kerberosV/src/lib/krb5/rd_cred.c b/kerberosV/src/lib/krb5/rd_cred.c index f5f4e920dc5..4966f00049e 100644 --- a/kerberosV/src/lib/krb5/rd_cred.c +++ b/kerberosV/src/lib/krb5/rd_cred.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: rd_cred.c,v 1.15 2001/06/29 14:53:44 assar Exp $"); +RCSID("$KTH: rd_cred.c,v 1.18 2002/09/04 16:26:05 joda Exp $"); krb5_error_code krb5_rd_cred(krb5_context context, @@ -136,13 +136,37 @@ krb5_rd_cred(krb5_context context, /* check receiver address */ if (enc_krb_cred_part.r_address - && auth_context->local_address - && !krb5_address_compare (context, - auth_context->local_address, - enc_krb_cred_part.r_address)) { - krb5_clear_error_string (context); - ret = KRB5KRB_AP_ERR_BADADDR; - goto out; + && auth_context->local_address) { + if(auth_context->local_port && + enc_krb_cred_part.r_address->addr_type == KRB5_ADDRESS_ADDRPORT) { + krb5_address *a; + int cmp; + ret = krb5_make_addrport (context, &a, + auth_context->local_address, + auth_context->local_port); + if (ret) + goto out; + + cmp = krb5_address_compare (context, + a, + enc_krb_cred_part.r_address); + krb5_free_address (context, a); + free (a); + + if (cmp == 0) { + krb5_clear_error_string (context); + ret = KRB5KRB_AP_ERR_BADADDR; + goto out; + } + } else { + if(!krb5_address_compare (context, + auth_context->local_address, + enc_krb_cred_part.r_address)) { + krb5_clear_error_string (context); + ret = KRB5KRB_AP_ERR_BADADDR; + goto out; + } + } } /* check timestamp */ @@ -190,7 +214,6 @@ krb5_rd_cred(krb5_context context, for (i = 0; i < enc_krb_cred_part.ticket_info.len; ++i) { KrbCredInfo *kci = &enc_krb_cred_part.ticket_info.val[i]; krb5_creds *creds; - u_char buf[1024]; size_t len; creds = calloc(1, sizeof(*creds)); @@ -200,12 +223,12 @@ krb5_rd_cred(krb5_context context, goto out; } - ret = encode_Ticket (buf + sizeof(buf) - 1, sizeof(buf), - &cred.tickets.val[i], - &len); + ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length, + &cred.tickets.val[i], &len, ret); if (ret) goto out; - krb5_data_copy (&creds->ticket, buf + sizeof(buf) - len, len); + if(creds->ticket.length != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); copy_EncryptionKey (&kci->key, &creds->session); if (kci->prealm && kci->pname) principalname2krb5_principal (&creds->client, diff --git a/kerberosV/src/lib/krb5/rd_safe.c b/kerberosV/src/lib/krb5/rd_safe.c index e26a32a2682..492467f3e0f 100644 --- a/kerberosV/src/lib/krb5/rd_safe.c +++ b/kerberosV/src/lib/krb5/rd_safe.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include <krb5_locl.h> -RCSID("$KTH: rd_safe.c,v 1.25 2001/06/18 02:47:30 assar Exp $"); +RCSID("$KTH: rd_safe.c,v 1.27 2002/09/04 16:26:05 joda Exp $"); static krb5_error_code verify_checksum(krb5_context context, @@ -53,19 +53,11 @@ verify_checksum(krb5_context context, safe->cksum.checksum.data = NULL; safe->cksum.checksum.length = 0; - buf_size = length_KRB_SAFE(safe); - buf = malloc(buf_size); - - if (buf == NULL) { - ret = ENOMEM; - krb5_set_error_string (context, "malloc: out of memory"); - goto out; - } - - ret = encode_KRB_SAFE (buf + buf_size - 1, - buf_size, - safe, - &len); + ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, safe, &len, ret); + if(ret) + return ret; + if(buf_size != len) + krb5_abortx(context, "internal error in ASN.1 encoder"); if (auth_context->remote_subkey) key = auth_context->remote_subkey; @@ -74,7 +66,7 @@ verify_checksum(krb5_context context, else key = auth_context->keyblock; - ret = krb5_crypto_init(context, auth_context->keyblock, 0, &crypto); + ret = krb5_crypto_init(context, key, 0, &crypto); if (ret) goto out; ret = krb5_verify_checksum (context, diff --git a/kerberosV/src/lib/krb5/recvauth.c b/kerberosV/src/lib/krb5/recvauth.c index 5a07a7fbbb7..b9a7d9c9bf9 100644 --- a/kerberosV/src/lib/krb5/recvauth.c +++ b/kerberosV/src/lib/krb5/recvauth.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,14 +33,14 @@ #include "krb5_locl.h" -RCSID("$KTH: recvauth.c,v 1.15 2001/05/14 06:14:51 assar Exp $"); +RCSID("$KTH: recvauth.c,v 1.16 2002/04/18 09:41:33 joda Exp $"); /* * See `sendauth.c' for the format. */ static krb5_boolean -match_exact(void *data, const char *appl_version) +match_exact(const void *data, const char *appl_version) { return strcmp(data, appl_version) == 0; } @@ -49,7 +49,7 @@ krb5_error_code krb5_recvauth(krb5_context context, krb5_auth_context *auth_context, krb5_pointer p_fd, - char *appl_version, + const char *appl_version, krb5_principal server, int32_t flags, krb5_keytab keytab, @@ -65,9 +65,9 @@ krb5_error_code krb5_recvauth_match_version(krb5_context context, krb5_auth_context *auth_context, krb5_pointer p_fd, - krb5_boolean (*match_appl_version)(void *, + krb5_boolean (*match_appl_version)(const void *, const char*), - void *match_data, + const void *match_data, krb5_principal server, int32_t flags, krb5_keytab keytab, diff --git a/kerberosV/src/lib/krb5/send_to_kdc.c b/kerberosV/src/lib/krb5/send_to_kdc.c index 1c6627634b8..394abf8144a 100644 --- a/kerberosV/src/lib/krb5/send_to_kdc.c +++ b/kerberosV/src/lib/krb5/send_to_kdc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: send_to_kdc.c,v 1.47 2001/07/03 19:35:46 assar Exp $"); +RCSID("$KTH: send_to_kdc.c,v 1.48 2002/03/27 09:32:50 joda Exp $"); /* * send the data in `req' on the socket `fd' (which is datagram iff udp) @@ -238,7 +238,7 @@ init_port(const char *s, int fallback) static int send_via_proxy (krb5_context context, const krb5_krbhst_info *hi, - const krb5_data *send, + const krb5_data *send_data, krb5_data *receive) { char *proxy2 = strdup(context->http_proxy); @@ -291,7 +291,7 @@ send_via_proxy (krb5_context context, return 1; } ret = send_and_recv_http(s, context->kdc_timeout, - prefix, send, receive); + prefix, send_data, receive); close (s); free(prefix); if(ret == 0 && receive->length != 0) @@ -306,7 +306,7 @@ send_via_proxy (krb5_context context, krb5_error_code krb5_sendto (krb5_context context, - const krb5_data *send, + const krb5_data *send_data, krb5_krbhst_handle handle, krb5_data *receive) { @@ -322,7 +322,7 @@ krb5_sendto (krb5_context context, struct addrinfo *ai, *a; if(hi->proto == KRB5_KRBHST_HTTP && context->http_proxy) { - if (send_via_proxy (context, hi, send, receive)) + if (send_via_proxy (context, hi, send_data, receive)) continue; else goto out; @@ -343,15 +343,15 @@ krb5_sendto (krb5_context context, switch (hi->proto) { case KRB5_KRBHST_HTTP : ret = send_and_recv_http(fd, context->kdc_timeout, - "", send, receive); + "", send_data, receive); break; case KRB5_KRBHST_TCP : ret = send_and_recv_tcp (fd, context->kdc_timeout, - send, receive); + send_data, receive); break; case KRB5_KRBHST_UDP : ret = send_and_recv_udp (fd, context->kdc_timeout, - send, receive); + send_data, receive); break; } close (fd); @@ -369,7 +369,7 @@ out: krb5_error_code krb5_sendto_kdc2(krb5_context context, - const krb5_data *send, + const krb5_data *send_data, const krb5_realm *realm, krb5_data *receive, krb5_boolean master) @@ -387,7 +387,7 @@ krb5_sendto_kdc2(krb5_context context, if (ret) return ret; - ret = krb5_sendto(context, send, handle, receive); + ret = krb5_sendto(context, send_data, handle, receive); krb5_krbhst_free(context, handle); if (ret == KRB5_KDC_UNREACH) krb5_set_error_string(context, @@ -397,9 +397,9 @@ krb5_sendto_kdc2(krb5_context context, krb5_error_code krb5_sendto_kdc(krb5_context context, - const krb5_data *send, + const krb5_data *send_data, const krb5_realm *realm, krb5_data *receive) { - return krb5_sendto_kdc2(context, send, realm, receive, FALSE); + return krb5_sendto_kdc2(context, send_data, realm, receive, FALSE); } diff --git a/kerberosV/src/lib/krb5/sendauth.c b/kerberosV/src/lib/krb5/sendauth.c index 6e44487c5c4..e213eb22a21 100644 --- a/kerberosV/src/lib/krb5/sendauth.c +++ b/kerberosV/src/lib/krb5/sendauth.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: sendauth.c,v 1.18 2001/05/14 06:14:51 assar Exp $"); +RCSID("$KTH: sendauth.c,v 1.19 2002/09/04 21:34:43 joda Exp $"); /* * The format seems to be: @@ -86,6 +86,7 @@ krb5_sendauth(krb5_context context, krb5_principal this_client = NULL; krb5_creds *creds; ssize_t sret; + krb5_boolean my_ccache = FALSE; len = strlen(version) + 1; net_len = htonl(len); @@ -125,12 +126,16 @@ krb5_sendauth(krb5_context context, ret = krb5_cc_default (context, &ccache); if (ret) return ret; + my_ccache = TRUE; } if (client == NULL) { ret = krb5_cc_get_principal (context, ccache, &this_client); - if (ret) + if (ret) { + if(my_ccache) + krb5_cc_close(context, ccache); return ret; + } client = this_client; } memset(&this_cred, 0, sizeof(this_cred)); @@ -142,11 +147,16 @@ krb5_sendauth(krb5_context context, } if (in_creds->ticket.length == 0) { ret = krb5_get_credentials (context, 0, ccache, in_creds, &creds); - if (ret) + if (ret) { + if(my_ccache) + krb5_cc_close(context, ccache); return ret; + } } else { creds = in_creds; } + if(my_ccache) + krb5_cc_close(context, ccache); ret = krb5_mk_req_extended (context, auth_context, ap_req_options, diff --git a/kerberosV/src/lib/krb5/set_default_realm.c b/kerberosV/src/lib/krb5/set_default_realm.c index 06874674c01..53e9d87bac5 100644 --- a/kerberosV/src/lib/krb5/set_default_realm.c +++ b/kerberosV/src/lib/krb5/set_default_realm.c @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: set_default_realm.c,v 1.12 2001/05/14 06:14:51 assar Exp $"); +RCSID("$KTH: set_default_realm.c,v 1.13 2001/09/18 09:43:31 joda Exp $"); /* * Convert the simple string `s' into a NULL-terminated and freshly allocated @@ -67,7 +67,7 @@ string_to_list (krb5_context context, const char *s, krb5_realm **list) krb5_error_code krb5_set_default_realm(krb5_context context, - char *realm) + const char *realm) { krb5_error_code ret = 0; krb5_realm *realms = NULL; diff --git a/kerberosV/src/lib/krb5/store-int.h b/kerberosV/src/lib/krb5/store-int.h new file mode 100644 index 00000000000..42e695a11bc --- /dev/null +++ b/kerberosV/src/lib/krb5/store-int.h @@ -0,0 +1,47 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifndef __store_int_h__ +#define __store_int_h__ + +struct krb5_storage_data { + void *data; + ssize_t (*fetch)(struct krb5_storage_data*, void*, size_t); + ssize_t (*store)(struct krb5_storage_data*, const void*, size_t); + off_t (*seek)(struct krb5_storage_data*, off_t, int); + void (*free)(struct krb5_storage_data*); + krb5_flags flags; + int eof_code; +}; + +#endif /* __store_int_h__ */ diff --git a/kerberosV/src/lib/krb5/store_emem.c b/kerberosV/src/lib/krb5/store_emem.c index 948c1028118..f92f8354341 100644 --- a/kerberosV/src/lib/krb5/store_emem.c +++ b/kerberosV/src/lib/krb5/store_emem.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 200 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,8 +32,9 @@ */ #include "krb5_locl.h" +#include "store-int.h" -RCSID("$KTH: store_emem.c,v 1.10 2000/05/19 14:39:49 assar Exp $"); +RCSID("$KTH: store_emem.c,v 1.13 2002/10/21 15:36:23 joda Exp $"); typedef struct emem_storage{ unsigned char *base; @@ -60,8 +61,10 @@ emem_store(krb5_storage *sp, const void *data, size_t size) if(size > s->base + s->size - s->ptr){ void *base; size_t sz, off; - sz = 2 * (size + (s->ptr - s->base)); /* XXX */ off = s->ptr - s->base; + sz = off + size; + if (sz < 4096) + sz *= 2; base = realloc(s->base, sz); if(base == NULL) return 0; @@ -104,7 +107,9 @@ emem_seek(krb5_storage *sp, off_t offset, int whence) static void emem_free(krb5_storage *sp) { - free(((emem_storage*)sp->data)->base); + emem_storage *s = sp->data; + memset(s->base, 0, s->len); + free(s->base); } krb5_storage * @@ -114,6 +119,7 @@ krb5_storage_emem(void) emem_storage *s = malloc(sizeof(*s)); sp->data = s; sp->flags = 0; + sp->eof_code = HEIM_ERR_EOF; s->size = 1024; s->base = malloc(s->size); s->len = 0; diff --git a/kerberosV/src/lib/krb5/store_fd.c b/kerberosV/src/lib/krb5/store_fd.c index 52b934ec660..420c132c690 100644 --- a/kerberosV/src/lib/krb5/store_fd.c +++ b/kerberosV/src/lib/krb5/store_fd.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,8 +32,9 @@ */ #include "krb5_locl.h" +#include "store-int.h" -RCSID("$KTH: store_fd.c,v 1.9 2001/06/24 05:39:51 assar Exp $"); +RCSID("$KTH: store_fd.c,v 1.10 2002/04/18 14:00:39 joda Exp $"); typedef struct fd_storage{ int fd; @@ -73,6 +74,7 @@ krb5_storage_from_fd(int fd) return NULL; } sp->flags = 0; + sp->eof_code = HEIM_ERR_EOF; FD(sp) = fd; sp->fetch = fd_fetch; sp->store = fd_store; diff --git a/kerberosV/src/lib/krb5/store_mem.c b/kerberosV/src/lib/krb5/store_mem.c index 29ab266cc8a..5d89b1f764f 100644 --- a/kerberosV/src/lib/krb5/store_mem.c +++ b/kerberosV/src/lib/krb5/store_mem.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2000, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,8 +32,9 @@ */ #include "krb5_locl.h" +#include "store-int.h" -RCSID("$KTH: store_mem.c,v 1.10 2000/05/19 14:39:02 assar Exp $"); +RCSID("$KTH: store_mem.c,v 1.11 2002/04/18 14:00:44 joda Exp $"); typedef struct mem_storage{ unsigned char *base; @@ -100,6 +101,7 @@ krb5_storage_from_mem(void *buf, size_t len) } sp->data = s; sp->flags = 0; + sp->eof_code = HEIM_ERR_EOF; s->base = buf; s->size = len; s->ptr = buf; diff --git a/kerberosV/src/lib/krb5/test_alname.c b/kerberosV/src/lib/krb5/test_alname.c new file mode 100644 index 00000000000..1f8e4e38508 --- /dev/null +++ b/kerberosV/src/lib/krb5/test_alname.c @@ -0,0 +1,156 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "krb5_locl.h" +#include <getarg.h> +#include <err.h> + +RCSID("$KTH: test_alname.c,v 1.4 2003/04/17 05:46:45 lha Exp $"); + +static void +test_alname(krb5_context context, krb5_realm realm, + const char *user, const char *inst, + const char *localuser, int ok) +{ + krb5_principal p; + char localname[1024]; + krb5_error_code ret; + char *princ; + + ret = krb5_make_principal(context, &p, realm, user, inst, NULL); + if (ret) + krb5_err(context, 1, ret, "krb5_build_principal"); + + ret = krb5_unparse_name(context, p, &princ); + if (ret) + krb5_err(context, 1, ret, "krb5_unparse_name"); + + ret = krb5_aname_to_localname(context, p, sizeof(localname), localname); + krb5_free_principal(context, p); + free(princ); + if (ret) { + if (!ok) + return; + krb5_err(context, 1, ret, "krb5_aname_to_localname: %s -> %s", + princ, localuser); + } + + if (strcmp(localname, localuser) != 0) { + if (ok) + errx(1, "compared failed %s != %s (should have succeded)", + localname, localuser); + } else { + if (!ok) + errx(1, "compared failed %s == %s (should have failed)", + localname, localuser); + } + +} + +static int version_flag = 0; +static int help_flag = 0; + +static struct getargs args[] = { + {"version", 0, arg_flag, &version_flag, + "print version", NULL }, + {"help", 0, arg_flag, &help_flag, + NULL, NULL } +}; + +static void +usage (int ret) +{ + arg_printusage (args, + sizeof(args)/sizeof(*args), + NULL, + ""); + exit (ret); +} + +int +main(int argc, char **argv) +{ + krb5_context context; + krb5_error_code ret; + krb5_realm realm; + int optind = 0; + char *user; + + setprogname(argv[0]); + + if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind)) + usage(1); + + if (help_flag) + usage (0); + + if(version_flag){ + print_version(NULL); + exit(0); + } + + argc -= optind; + argv += optind; + + if (argc != 1) + errx(1, "first argument should be a local user that in root .k5login"); + + user = argv[0]; + + ret = krb5_init_context(&context); + if (ret) + errx (1, "krb5_init_context failed: %d", ret); + + ret = krb5_get_default_realm(context, &realm); + if (ret) + krb5_err(context, 1, ret, "krb5_get_default_realm"); + + test_alname(context, realm, user, NULL, user, 1); + test_alname(context, realm, user, "root", "root", 1); + + test_alname(context, "FOO.BAR.BAZ.KAKA", user, NULL, user, 0); + test_alname(context, "FOO.BAR.BAZ.KAKA", user, "root", "root", 0); + + test_alname(context, realm, user, NULL, + "not-same-as-user", 0); + test_alname(context, realm, user, "root", + "not-same-as-user", 0); + + test_alname(context, "FOO.BAR.BAZ.KAKA", user, NULL, + "not-same-as-user", 0); + test_alname(context, "FOO.BAR.BAZ.KAKA", user, "root", + "not-same-as-user", 0); + + krb5_free_context(context); + + return 0; +} diff --git a/kerberosV/src/lib/krb5/test_cc.c b/kerberosV/src/lib/krb5/test_cc.c new file mode 100644 index 00000000000..c9d9c7a09d8 --- /dev/null +++ b/kerberosV/src/lib/krb5/test_cc.c @@ -0,0 +1,86 @@ +/* + * Copyright (c) 2003 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of KTH nor the names of its contributors may be + * used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "krb5_locl.h" +#include <err.h> + +RCSID("$KTH: test_cc.c,v 1.1 2003/03/10 00:26:40 lha Exp $"); + +#define TEST_CC_NAME "/tmp/foo" + +int +main(int argc, char **argv) +{ + krb5_context context; + krb5_error_code ret; + char *p1, *p2, *p3; + const char *p; + + setprogname(argv[0]); + + ret = krb5_init_context(&context); + if (ret) + errx (1, "krb5_init_context failed: %d", ret); + + p = krb5_cc_default_name(context); + if (p == NULL) + krb5_errx (context, 1, "krb5_cc_default_name 1 failed"); + p1 = estrdup(p); + + ret = krb5_cc_set_default_name(context, NULL); + if (p == NULL) + krb5_errx (context, 1, "krb5_cc_set_default_name failed"); + + p = krb5_cc_default_name(context); + if (p == NULL) + krb5_errx (context, 1, "krb5_cc_default_name 2 failed"); + p2 = estrdup(p); + + if (strcmp(p1, p2) != 0) + krb5_errx (context, 1, "krb5_cc_default_name no longer same"); + + ret = krb5_cc_set_default_name(context, TEST_CC_NAME); + if (p == NULL) + krb5_errx (context, 1, "krb5_cc_set_default_name 1 failed"); + + p = krb5_cc_default_name(context); + if (p == NULL) + krb5_errx (context, 1, "krb5_cc_default_name 2 failed"); + p3 = estrdup(p); + + if (strcmp(p3, TEST_CC_NAME) != 0) + krb5_errx (context, 1, "krb5_cc_set_default_name 1 failed"); + + krb5_free_context(context); + + return 0; +} diff --git a/kerberosV/src/lib/krb5/test_get_addrs.c b/kerberosV/src/lib/krb5/test_get_addrs.c index 012392e41ce..ed0aba36e4d 100644 --- a/kerberosV/src/lib/krb5/test_get_addrs.c +++ b/kerberosV/src/lib/krb5/test_get_addrs.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 2000 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,8 +32,9 @@ #include "krb5_locl.h" #include <err.h> +#include <getarg.h> -RCSID("$KTH: test_get_addrs.c,v 1.3 2001/01/25 12:45:15 assar Exp $"); +RCSID("$KTH: test_get_addrs.c,v 1.4 2002/08/23 03:42:54 assar Exp $"); /* print all addresses that we find */ @@ -50,12 +51,49 @@ print_addresses (krb5_context context, const krb5_addresses *addrs) } } +static int version_flag = 0; +static int help_flag = 0; + +static struct getargs args[] = { + {"version", 0, arg_flag, &version_flag, + "print version", NULL }, + {"help", 0, arg_flag, &help_flag, + NULL, NULL } +}; + +static void +usage (int ret) +{ + arg_printusage (args, + sizeof(args)/sizeof(*args), + NULL, + ""); + exit (ret); +} + int main(int argc, char **argv) { krb5_context context; krb5_error_code ret; krb5_addresses addrs; + int optind = 0; + + setprogname (argv[0]); + + if(getarg(args, sizeof(args) / sizeof(args[0]), argc, argv, &optind)) + usage(1); + + if (help_flag) + usage (0); + + if(version_flag){ + print_version(NULL); + exit(0); + } + + argc -= optind; + argv += optind; ret = krb5_init_context(&context); if (ret) diff --git a/kerberosV/src/lib/krb5/verify_init.c b/kerberosV/src/lib/krb5/verify_init.c index e5621c49500..bbe2787932a 100644 --- a/kerberosV/src/lib/krb5/verify_init.c +++ b/kerberosV/src/lib/krb5/verify_init.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: verify_init.c,v 1.14 2001/05/14 06:14:52 assar Exp $"); +RCSID("$KTH: verify_init.c,v 1.17 2002/08/20 14:47:59 joda Exp $"); void krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options) @@ -58,7 +58,7 @@ fail_verify_is_ok (krb5_context context, krb5_verify_init_creds_opt *options) { if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL - && options->ap_req_nofail == 1) + && options->ap_req_nofail != 0) || krb5_config_get_bool (context, NULL, "libdefaults", @@ -94,7 +94,7 @@ krb5_verify_init_creds(krb5_context context, if (gethostname (local_hostname, sizeof(local_hostname)) < 0) { ret = errno; - krb5_set_error_string (context, "getsockname: %s", + krb5_set_error_string (context, "gethostname: %s", strerror(ret)); return ret; } diff --git a/kerberosV/src/lib/krb5/verify_user.c b/kerberosV/src/lib/krb5/verify_user.c index 337df495598..ffa58d2936c 100644 --- a/kerberosV/src/lib/krb5/verify_user.c +++ b/kerberosV/src/lib/krb5/verify_user.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997-2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #include "krb5_locl.h" -RCSID("$KTH: verify_user.c,v 1.14 2001/05/14 09:06:53 joda Exp $"); +RCSID("$KTH: verify_user.c,v 1.17 2002/08/20 14:48:31 joda Exp $"); static krb5_error_code verify_common (krb5_context context, @@ -146,7 +146,7 @@ verify_user_opt_int(krb5_context context, ret = krb5_get_init_creds_password (context, &cred, principal, - (char*)password, + password, krb5_prompter_posix, NULL, 0, diff --git a/kerberosV/src/lib/roken/ChangeLog b/kerberosV/src/lib/roken/ChangeLog index 99c45168af7..971bc90c42b 100644 --- a/kerberosV/src/lib/roken/ChangeLog +++ b/kerberosV/src/lib/roken/ChangeLog @@ -1,9 +1,223 @@ +2003-04-22 Love <lha@stacken.kth.se> + + * resolve.c: 1.38->1.39: copy NUL too, from janj@wenf.org via + openbsd + +2003-04-16 Love <lha@stacken.kth.se> + + * parse_units.h: remove typedef for units to avoid problems with + shadowing + + * resolve.c: use strlcpy, from openbsd + + * getcap.c: use strlcpy, from openbsd + + * getarg.3: Change .Fd #include <header.h> to .In header.h + from Thomas Klausner <wiz@netbsd.org> + +2003-04-15 Love <lha@stacken.kth.se> + + * socket.c (socket_set_tos): if setsockopt failed with EINVAL + failed, just ignore it, sock was probably a just a non AF_INET + socket + +2003-04-14 Love <lha@stacken.kth.se> + + * strncasecmp.c: cast argument to toupper to unsigned char, from + Christian Biere <christianbiere@gmx.de> via NetBSD + + * strlwr.c: cast argument to tolower to unsigned char, from + Christian Biere <christianbiere@gmx.de> via NetBSD + + * strcasecmp.c: cast argument to toupper to unsigned char, from + Christian Biere <christianbiere@gmx.de> via NetBSD + +2003-03-19 Love <lha@stacken.kth.se> + + * getarg.3: spelling, from <jmc@prioris.mini.pw.edu.pl> + +2003-03-07 Love <lha@stacken.kth.se> + + * parse_bytes.c: use struct units instead of units + + * parse_time.c: use struct units instead of units + +2003-03-04 Love <lha@stacken.kth.se> + + * roken.awk: use full prototype for main + +2002-10-15 Johan Danielsson <joda@pdc.kth.se> + + * resolve.c: check length of txt records + +2002-09-10 Johan Danielsson <joda@pdc.kth.se> + + * roken.awk: include config.h before stdio.h (breaks with + _FILE_OFFSET_BITS on solaris otherwise) + +2002-09-09 Johan Danielsson <joda@pdc.kth.se> + + * resolve.c: fix res_nsearch call, but don't use it for now, AIX5 + has a broken version that trashes memory + + * roken-common.h: fix typo in previous + + * roken-common.h: change IRIX == 4 to IRIX4 + +2002-09-04 Assar Westerlund <assar@kth.se> + + * getifaddrs.c: remove some warnings from the linux-portion + + * getnameinfo_verified.c (getnameinfo_verified): handle the case + of forward but no backward DNS information, and also describe the + desired behaviour. from Love <lha@stacken.kth.se> + +2002-09-04 Johan Danielsson <joda@pdc.kth.se> + + * rtbl.c (rtbl_destroy): free whole table + + * resolve.c: use res_nsearch if we have it (from Larry Greenfield) + +2002-09-03 Assar Westerlund <assar@kth.se> + + * getifaddrs.c: add Linux AF_NETLINK getifaddrs from Hideaki + YOSHIFUJI of the Usagi project + + * parse_reply-test.c: make this build and return 77 if there is no + mmap + + * Makefile.am (parse_reply-test): add + * parse_reply-test.c: add a test case for parse_reply reading past + the given buffer + * resolve.c (parse_reply): update the arguments to more reasonable + types. allow parse_reply-test to call it + +2002-08-28 Johan Danielsson <joda@pdc.kth.se> + + * resolve.c (dns_srv_order): do alignment tricks with the random() + state (from NetBSD) + +2002-08-27 Assar Westerlund <assar@kth.se> + + * resolve.c (parse_reply): verify the lengths (both external and + internal) are consistent and not too long + (dns_lookup_int): be conservative in the length sent in to to + parse_reply + +2002-08-26 Assar Westerlund <assar@kth.se> + + * roken.h.in: add prototypes for str, unvis functions + * resolve.h: add fallback definition for T_AAAA + +2002-08-22 Johan Danielsson <joda@pdc.kth.se> + + * roken.h.in: we may need a prototype for strndup + +2002-08-20 Johan Danielsson <joda@pdc.kth.se> + + * roken.h.in: typedef ssize_t here + + * getarg.c: don't put Ns before comma + + * resolve.c: _res might not be available + + * localtime_r.c: include stdio.h and roken.h + + * strftime.c: only use altzone if we have it + + * roken-common.h: AI_NUMERICHOST needs special handling + + * strlcat.c: add some consistency checks + + * strlcpy.c: make the logic simpler, and handle dst_sz == 0 + +2002-08-19 Johan Danielsson <joda@pdc.kth.se> + + * resolve.h: prefix these functions to avoid conflicts with other + packages + +2002-08-14 Johan Danielsson <joda@pdc.kth.se> + + * strsep_copy.c: don't write to buf if len == 0 + +2002-05-31 Assar Westerlund <assar@pdc.kth.se> + + * Makefile.am: *_LDADD: add LDADD, so that libroken is used + +2002-05-17 Johan Danielsson <joda@pdc.kth.se> + + * xdbm.h: remove old dbm part + +2002-04-30 Johan Danielsson <joda@pdc.kth.se> + + * ndbm_wrap.{c,h}: ndbm wrapper for newer db libraries + +2002-04-18 Johan Danielsson <joda@pdc.kth.se> + + * roken.h.in: move mini_inetd protos to after addrinfo definition + + * snprintf.c (append_number): make rep const + + * getarg.h: rename optind and optarg to avoid some gcc warnings + + * getarg.c: rename optind and optarg to avoid some gcc warnings + +2002-02-18 Johan Danielsson <joda@pdc.kth.se> + + * mini_inetd.c: mini_inetd_addrinfo that takes an addrinfo instead + of a port number + +2001-11-30 Assar Westerlund <assar@sics.se> + + * getifaddrs.c: support SIOCGLIFCONF and SIOCGLIFFLAGS which are + used on Solaris 8 to retrieve addresses larger than `struct + sockaddr'. From Magnus Ahltorp <ahltorp@nada.kth.se> (with some + modifications by me) + +2001-10-27 Assar Westerlund <assar@sics.se> + + * Makefile.am (libroken_la_LDFLAGS): set version to 15:0:6 + +2001-10-22 Assar Westerlund <assar@sics.se> + + * localtime_r.c: add + +2001-10-02 Johan Danielsson <joda@pdc.kth.se> + + * resolve.c (dns_srv_order): don't try to return a value + +2001-09-24 Johan Danielsson <joda@pdc.kth.se> + + * snprintf.c: va_{start,end} fixes; from Thomas Klausner + +2001-09-20 Assar Westerlund <assar@sics.se> + + * resolve.c (dns_srv_order): make sure of not reading after the + array + +2001-09-17 Assar Westerlund <assar@sics.se> + + * Makefile.am (libroken_la_LDFLAGS): bump to 14:4:5 + * snprintf.c: rename 'struct state' -> 'struct snprintf_test' to + avoid collision with resolv.h on aix + +2001-09-04 Assar Westerlund <assar@sics.se> + + * parse_bytes-test.c, parse_bytes.c, parse_bytes.h, parse_units.c, + parse_units.h: use int instead of size_t as return values to be + compatible with snprintf + + * strftime.c (strftime): check for return values from snprintf() < + 0 + 2001-09-03 Johan Danielsson <joda@pdc.kth.se> * socket.c: restrict is a keyword 2001-09-03 Assar Westerlund <assar@sics.se> + * write_pid.c: handle atexit or on_exit + * Makefile.am (EXTRA_libroken_la_SOURCES): add vis.hin to help solaris make diff --git a/kerberosV/src/lib/roken/getarg.3 b/kerberosV/src/lib/roken/getarg.3 index 4cc4d109018..25d9a77aba0 100644 --- a/kerberosV/src/lib/roken/getarg.3 +++ b/kerberosV/src/lib/roken/getarg.3 @@ -1,26 +1,56 @@ -.\" Copyright (c) 1999 Kungliga Tekniska Högskolan -.\" $KTH: getarg.3,v 1.3 2001/01/11 16:16:30 assar Exp $ +.\" Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: getarg.3,v 1.7 2003/04/16 13:58:24 lha Exp $ .Dd September 24, 1999 .Dt GETARG 3 .Os ROKEN .Sh NAME -.Nm getarg , +.Nm getarg , .Nm arg_printusage .Nd collect command line options .Sh SYNOPSIS -.Fd #include <getarg.h> +.In getarg.h .Ft int .Fn getarg "struct getargs *args" "size_t num_args" "int argc" "char **argv" "int *optind" .Ft void .Fn arg_printusage "struct getargs *args" "size_t num_args" "const char *progname" "const char *extra_string" .Sh DESCRIPTION .Fn getarg -collects any command line options given to a program in an easily used way. -.Fn arg_printusage +collects any command line options given to a program in an easily used way. +.Fn arg_printusage pretty-prints the available options, with a short help text. .Pp .Fa args -is the option specification to use, and it's an array of +is the option specification to use, and it's an array of .Fa struct getargs elements. .Fa num_args @@ -43,7 +73,7 @@ and .Fa num_args as getarg; .Fa progname -is the name of the program (to be used in the help text), and +is the name of the program (to be used in the help text), and .Fa extra_string is a string to print after the actual options to indicate more arguments. The usefulness of this function is realised only be people @@ -57,10 +87,10 @@ struct has the following elements. struct getargs{ const char *long_name; char short_name; - enum { arg_integer, - arg_string, - arg_flag, - arg_negative_flag, + enum { arg_integer, + arg_string, + arg_flag, + arg_negative_flag, arg_strings, arg_double, arg_collect @@ -72,14 +102,14 @@ struct getargs{ .Ed .Pp .Fa long_name -is the long name of the option, it can be +is the long name of the option, it can be .Dv NULL , if you don't want a long name. -.Fa short_name +.Fa short_name is the characted to use as short option, it can be zero. If the option has a value the .Fa value -field gets filled in with that value interpreted as specified by the +field gets filled in with that value interpreted as specified by the .Fa type field. .Fa help @@ -107,13 +137,13 @@ should point to a the argument is a flag, and .Fa value should point to a -.Fa int . +.Fa int . It gets filled in with either zero or one, depending on how the option -is given, the normal case beeing one. Note that if the option isn't +is given, the normal case being one. Note that if the option isn't given, the value isn't altered, so it should be initialised to some useful default. .It Fa arg_negative_flag -this is the same as +this is the same as .Fa arg_flag but it reverses the meaning of the flag (a given short option clears the flag), and the synopsis of a long option is negated. @@ -121,7 +151,7 @@ the flag), and the synopsis of a long option is negated. the argument can be given multiple times, and the values are collected in an array; .Fa value -should be a pointer to a +should be a pointer to a .Fa struct getarg_strings structure, which holds a length and a string pointer. .It Fa arg_double @@ -132,7 +162,7 @@ should point to a .It Fa arg_collect allows more fine-grained control of the option parsing process. .Fa value -should be a pointer to a +should be a pointer to a .Fa getarg_collect_info structure: .Bd -literal @@ -151,7 +181,7 @@ typedef struct getarg_collect_info { .Pp With the .Fa func -member set to a function to call, and +member set to a function to call, and .Fa data to some application specific data. The parameters to the collect function are: .Bl -inset @@ -169,27 +199,27 @@ application specific data .Pp You can modify .Fa *optind , -and +and .Fa *optarg , but to do this correct you (more or less) have to know about the inner workings of getarg. -.Pp +.Pp You can skip parts of arguments by increasing .Fa *optarg (you could -implement the +implement the .Fl z Ns Ar 3 set of flags from .Nm gzip with this), or whole argument strings by increasing .Fa *optind -(let's say you want a flag +(let's say you want a flag .Fl c Ar x y z to specify a coordinate); if you also have to set .Fa *optarg to a sane value. .Pp -The collect function should return one of +The collect function should return one of .Dv ARG_ERR_NO_MATCH , ARG_ERR_BAD_ARG , ARG_ERR_NO_ARG on error, zero otherwise. .Pp @@ -201,7 +231,7 @@ arguments, sans data, that where given to the collection function. Don't use this more this unless you absolutely have to. .El .Pp -Option parsing is similar to what +Option parsing is similar to what .Xr getopt uses. Short options without arguments can be compressed .Pf ( Fl xyz @@ -217,18 +247,18 @@ or Long option names are prefixed with -- (double dash), and the value with a = (equal), .Fl -foo= Ns Ar bar . -Long option flags can either be specified as they are +Long option flags can either be specified as they are .Pf ( Fl -help ) , or with an (boolean parsable) option .Pf ( Fl -help= Ns Ar yes , .Fl -help= Ns Ar true , -or similar), or they can also be negated +or similar), or they can also be negated .Pf ( Fl -no-help -is the same as +is the same as .Fl -help= Ns no ) , and if you're really confused you can do it multiple times .Pf ( Fl -no-no-help= Ns Ar false , -or even +or even .Fl -no-no-help= Ns Ar maybe ) . .Sh EXAMPLE .Bd -literal @@ -243,13 +273,13 @@ int include_catalog = 1; int help_flag; struct getargs args[] = { - { "source", 's', arg_string, &source, + { "source", 's', arg_string, &source, "source of shippment", "city" }, - { "destination", 'd', arg_string, &destination, + { "destination", 'd', arg_string, &destination, "destination of shippment", "city" }, - { "weight", 'w', arg_integer, &weight, + { "weight", 'w', arg_integer, &weight, "weight of shippment", "tons" }, - { "catalog", 'c', arg_negative_flag, &include_catalog, + { "catalog", 'c', arg_negative_flag, &include_catalog, "include product catalog" }, { "help", 'h', arg_flag, &help_flag } }; @@ -285,7 +315,7 @@ main(int argc, char **argv) .Pp The output help output from this program looks like this: .Bd -literal -$ ship++ --help +$ ship++ --help Usage: ship++ [--source=city] [-s city] [--destination=city] [-d city] [--weight=tons] [-w tons] [--no-catalog] [-c] [--help] [-h] stuff... -s city, --source=city source of shippment @@ -297,7 +327,7 @@ Usage: ship++ [--source=city] [-s city] [--destination=city] [-d city] It should be more flexible, so it would be possible to use other more complicated option syntaxes, such as what .Xr ps 1 , -and +and .Xr tar 1 , uses, or the AFS model where you can skip the flag names as long as the options come in the correct order. diff --git a/kerberosV/src/lib/roken/getarg.h b/kerberosV/src/lib/roken/getarg.h index a5716edbf05..5224a1a4bee 100644 --- a/kerberosV/src/lib/roken/getarg.h +++ b/kerberosV/src/lib/roken/getarg.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: getarg.h,v 1.11 2001/04/25 12:06:37 assar Exp $ */ +/* $KTH: getarg.h,v 1.12 2002/04/18 08:50:08 joda Exp $ */ #ifndef __GETARG_H__ #define __GETARG_H__ @@ -69,8 +69,8 @@ typedef struct getarg_strings { typedef int (*getarg_collect_func)(int short_opt, int argc, char **argv, - int *optind, - int *optarg, + int *goptind, + int *goptarg, void *data); typedef struct getarg_collect_info { @@ -79,7 +79,7 @@ typedef struct getarg_collect_info { } getarg_collect_info; int getarg(struct getargs *args, size_t num_args, - int argc, char **argv, int *optind); + int argc, char **argv, int *goptind); void arg_printusage (struct getargs *args, size_t num_args, diff --git a/kerberosV/src/lib/roken/getifaddrs.c b/kerberosV/src/lib/roken/getifaddrs.c index 2e547393f36..80509950da4 100644 --- a/kerberosV/src/lib/roken/getifaddrs.c +++ b/kerberosV/src/lib/roken/getifaddrs.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 2000 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: getifaddrs.c,v 1.6 2001/07/31 01:15:41 assar Exp $"); +RCSID("$KTH: getifaddrs.c,v 1.9 2002/09/05 03:36:23 assar Exp $"); #endif #include "roken.h" @@ -56,6 +56,782 @@ struct mbuf; #include <ifaddrs.h> +#ifdef AF_NETLINK + +/* + * The linux - AF_NETLINK version of getifaddrs - from Usagi. + * Linux does not return v6 addresses from SIOCGIFCONF. + */ + +/* $USAGI: ifaddrs.c,v 1.18 2002/03/06 01:50:46 yoshfuji Exp $ */ + +/************************************************************************** + * ifaddrs.c + * Copyright (C)2000 Hideaki YOSHIFUJI, All Rights Reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the author nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "config.h" + +#include <string.h> +#include <time.h> +#include <malloc.h> +#include <errno.h> +#include <unistd.h> + +#include <sys/socket.h> +#include <asm/types.h> +#include <linux/netlink.h> +#include <linux/rtnetlink.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <netpacket/packet.h> +#include <net/ethernet.h> /* the L2 protocols */ +#include <sys/uio.h> +#include <net/if.h> +#include <net/if_arp.h> +#include <ifaddrs.h> +#include <netinet/in.h> + +#define __set_errno(e) (errno = (e)) +#define __close(fd) (close(fd)) +#undef ifa_broadaddr +#define ifa_broadaddr ifa_dstaddr +#define IFA_NETMASK + +/* ====================================================================== */ +struct nlmsg_list{ + struct nlmsg_list *nlm_next; + struct nlmsghdr *nlh; + int size; + time_t seq; +}; + +struct rtmaddr_ifamap { + void *address; + void *local; +#ifdef IFA_NETMASK + void *netmask; +#endif + void *broadcast; +#ifdef HAVE_IFADDRS_IFA_ANYCAST + void *anycast; +#endif + int address_len; + int local_len; +#ifdef IFA_NETMASK + int netmask_len; +#endif + int broadcast_len; +#ifdef HAVE_IFADDRS_IFA_ANYCAST + int anycast_len; +#endif +}; + +/* ====================================================================== */ +static size_t +ifa_sa_len(sa_family_t family, int len) +{ + size_t size; + switch(family){ + case AF_INET: + size = sizeof(struct sockaddr_in); + break; + case AF_INET6: + size = sizeof(struct sockaddr_in6); + break; + case AF_PACKET: + size = (size_t)(((struct sockaddr_ll *)NULL)->sll_addr) + len; + if (size < sizeof(struct sockaddr_ll)) + size = sizeof(struct sockaddr_ll); + break; + default: + size = (size_t)(((struct sockaddr *)NULL)->sa_data) + len; + if (size < sizeof(struct sockaddr)) + size = sizeof(struct sockaddr); + } + return size; +} + +static void +ifa_make_sockaddr(sa_family_t family, + struct sockaddr *sa, + void *p, size_t len, + uint32_t scope, uint32_t scopeid) +{ + if (sa == NULL) return; + switch(family){ + case AF_INET: + memcpy(&((struct sockaddr_in*)sa)->sin_addr, (char *)p, len); + break; + case AF_INET6: + memcpy(&((struct sockaddr_in6*)sa)->sin6_addr, (char *)p, len); + if (IN6_IS_ADDR_LINKLOCAL(p) || + IN6_IS_ADDR_MC_LINKLOCAL(p)){ + ((struct sockaddr_in6*)sa)->sin6_scope_id = scopeid; + } + break; + case AF_PACKET: + memcpy(((struct sockaddr_ll*)sa)->sll_addr, (char *)p, len); + ((struct sockaddr_ll*)sa)->sll_halen = len; + break; + default: + memcpy(sa->sa_data, p, len); /*XXX*/ + break; + } + sa->sa_family = family; +#ifdef HAVE_SOCKADDR_SA_LEN + sa->sa_len = ifa_sa_len(family, len); +#endif +} + +#ifndef IFA_NETMASK +static struct sockaddr * +ifa_make_sockaddr_mask(sa_family_t family, + struct sockaddr *sa, + uint32_t prefixlen) +{ + int i; + char *p = NULL, c; + uint32_t max_prefixlen = 0; + + if (sa == NULL) return NULL; + switch(family){ + case AF_INET: + memset(&((struct sockaddr_in*)sa)->sin_addr, 0, sizeof(((struct sockaddr_in*)sa)->sin_addr)); + p = (char *)&((struct sockaddr_in*)sa)->sin_addr; + max_prefixlen = 32; + break; + case AF_INET6: + memset(&((struct sockaddr_in6*)sa)->sin6_addr, 0, sizeof(((struct sockaddr_in6*)sa)->sin6_addr)); + p = (char *)&((struct sockaddr_in6*)sa)->sin6_addr; +#if 0 /* XXX: fill scope-id? */ + if (IN6_IS_ADDR_LINKLOCAL(p) || + IN6_IS_ADDR_MC_LINKLOCAL(p)){ + ((struct sockaddr_in6*)sa)->sin6_scope_id = scopeid; + } +#endif + max_prefixlen = 128; + break; + default: + return NULL; + } + sa->sa_family = family; +#ifdef HAVE_SOCKADDR_SA_LEN + sa->sa_len = ifa_sa_len(family, len); +#endif + if (p){ + if (prefixlen > max_prefixlen) + prefixlen = max_prefixlen; + for (i=0; i<(prefixlen / 8); i++) + *p++ = 0xff; + c = 0xff; + c <<= (8 - (prefixlen % 8)); + *p = c; + } + return sa; +} +#endif + +/* ====================================================================== */ +static int +nl_sendreq(int sd, int request, int flags, int *seq) +{ + char reqbuf[NLMSG_ALIGN(sizeof(struct nlmsghdr)) + + NLMSG_ALIGN(sizeof(struct rtgenmsg))]; + struct sockaddr_nl nladdr; + struct nlmsghdr *req_hdr; + struct rtgenmsg *req_msg; + time_t t = time(NULL); + + if (seq) *seq = t; + memset(&reqbuf, 0, sizeof(reqbuf)); + req_hdr = (struct nlmsghdr *)reqbuf; + req_msg = (struct rtgenmsg *)NLMSG_DATA(req_hdr); + req_hdr->nlmsg_len = NLMSG_LENGTH(sizeof(*req_msg)); + req_hdr->nlmsg_type = request; + req_hdr->nlmsg_flags = flags | NLM_F_REQUEST; + req_hdr->nlmsg_pid = 0; + req_hdr->nlmsg_seq = t; + req_msg->rtgen_family = AF_UNSPEC; + memset(&nladdr, 0, sizeof(nladdr)); + nladdr.nl_family = AF_NETLINK; + return (sendto(sd, (void *)req_hdr, req_hdr->nlmsg_len, 0, + (struct sockaddr *)&nladdr, sizeof(nladdr))); +} + +static int +nl_recvmsg(int sd, int request, int seq, + void *buf, size_t buflen, + int *flags) +{ + struct msghdr msg; + struct iovec iov = { buf, buflen }; + struct sockaddr_nl nladdr; + int read_len; + + for (;;){ + msg.msg_name = (void *)&nladdr; + msg.msg_namelen = sizeof(nladdr); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = NULL; + msg.msg_controllen = 0; + msg.msg_flags = 0; + read_len = recvmsg(sd, &msg, 0); + if ((read_len < 0 && errno == EINTR) || (msg.msg_flags & MSG_TRUNC)) + continue; + if (flags) *flags = msg.msg_flags; + break; + } + return read_len; +} + +static int +nl_getmsg(int sd, int request, int seq, + struct nlmsghdr **nlhp, + int *done) +{ + struct nlmsghdr *nh; + size_t bufsize = 65536, lastbufsize = 0; + void *buff = NULL; + int result = 0, read_size; + int msg_flags; + pid_t pid = getpid(); + for (;;){ + void *newbuff = realloc(buff, bufsize); + if (newbuff == NULL || bufsize < lastbufsize) { + result = -1; + break; + } + buff = newbuff; + result = read_size = nl_recvmsg(sd, request, seq, buff, bufsize, &msg_flags); + if (read_size < 0 || (msg_flags & MSG_TRUNC)){ + lastbufsize = bufsize; + bufsize *= 2; + continue; + } + if (read_size == 0) break; + nh = (struct nlmsghdr *)buff; + for (nh = (struct nlmsghdr *)buff; + NLMSG_OK(nh, read_size); + nh = (struct nlmsghdr *)NLMSG_NEXT(nh, read_size)){ + if (nh->nlmsg_pid != pid || + nh->nlmsg_seq != seq) + continue; + if (nh->nlmsg_type == NLMSG_DONE){ + (*done)++; + break; /* ok */ + } + if (nh->nlmsg_type == NLMSG_ERROR){ + struct nlmsgerr *nlerr = (struct nlmsgerr *)NLMSG_DATA(nh); + result = -1; + if (nh->nlmsg_len < NLMSG_LENGTH(sizeof(struct nlmsgerr))) + __set_errno(EIO); + else + __set_errno(-nlerr->error); + break; + } + } + break; + } + if (result < 0) + if (buff){ + int saved_errno = errno; + free(buff); + __set_errno(saved_errno); + } + *nlhp = (struct nlmsghdr *)buff; + return result; +} + +static int +nl_getlist(int sd, int seq, + int request, + struct nlmsg_list **nlm_list, + struct nlmsg_list **nlm_end) +{ + struct nlmsghdr *nlh = NULL; + int status; + int done = 0; + + status = nl_sendreq(sd, request, NLM_F_ROOT|NLM_F_MATCH, &seq); + if (status < 0) + return status; + if (seq == 0) + seq = (int)time(NULL); + while(!done){ + status = nl_getmsg(sd, request, seq, &nlh, &done); + if (status < 0) + return status; + if (nlh){ + struct nlmsg_list *nlm_next = (struct nlmsg_list *)malloc(sizeof(struct nlmsg_list)); + if (nlm_next == NULL){ + int saved_errno = errno; + free(nlh); + __set_errno(saved_errno); + status = -1; + } else { + nlm_next->nlm_next = NULL; + nlm_next->nlh = (struct nlmsghdr *)nlh; + nlm_next->size = status; + nlm_next->seq = seq; + if (*nlm_list == NULL){ + *nlm_list = nlm_next; + *nlm_end = nlm_next; + } else { + (*nlm_end)->nlm_next = nlm_next; + *nlm_end = nlm_next; + } + } + } + } + return status >= 0 ? seq : status; +} + +/* ---------------------------------------------------------------------- */ +static void +free_nlmsglist(struct nlmsg_list *nlm0) +{ + struct nlmsg_list *nlm; + int saved_errno; + if (!nlm0) + return; + saved_errno = errno; + for (nlm=nlm0; nlm; nlm=nlm->nlm_next){ + if (nlm->nlh) + free(nlm->nlh); + } + free(nlm0); + __set_errno(saved_errno); +} + +static void +free_data(void *data, void *ifdata) +{ + int saved_errno = errno; + if (data != NULL) free(data); + if (ifdata != NULL) free(ifdata); + __set_errno(saved_errno); +} + +/* ---------------------------------------------------------------------- */ +static void +nl_close(int sd) +{ + int saved_errno = errno; + if (sd >= 0) __close(sd); + __set_errno(saved_errno); +} + +/* ---------------------------------------------------------------------- */ +static int +nl_open(void) +{ + struct sockaddr_nl nladdr; + int sd; + + sd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE); + if (sd < 0) return -1; + memset(&nladdr, 0, sizeof(nladdr)); + nladdr.nl_family = AF_NETLINK; + if (bind(sd, (struct sockaddr*)&nladdr, sizeof(nladdr)) < 0){ + nl_close(sd); + return -1; + } + return sd; +} + +/* ====================================================================== */ +int getifaddrs(struct ifaddrs **ifap) +{ + int sd; + struct nlmsg_list *nlmsg_list, *nlmsg_end, *nlm; + /* - - - - - - - - - - - - - - - */ + int icnt; + size_t dlen, xlen, nlen; + uint32_t max_ifindex = 0; + + pid_t pid = getpid(); + int seq; + int result; + int build ; /* 0 or 1 */ + +/* ---------------------------------- */ + /* initialize */ + icnt = dlen = xlen = nlen = 0; + nlmsg_list = nlmsg_end = NULL; + + if (ifap) + *ifap = NULL; + +/* ---------------------------------- */ + /* open socket and bind */ + sd = nl_open(); + if (sd < 0) + return -1; + +/* ---------------------------------- */ + /* gather info */ + if ((seq = nl_getlist(sd, 0, RTM_GETLINK, + &nlmsg_list, &nlmsg_end)) < 0){ + free_nlmsglist(nlmsg_list); + nl_close(sd); + return -1; + } + if ((seq = nl_getlist(sd, seq+1, RTM_GETADDR, + &nlmsg_list, &nlmsg_end)) < 0){ + free_nlmsglist(nlmsg_list); + nl_close(sd); + return -1; + } + +/* ---------------------------------- */ + /* Estimate size of result buffer and fill it */ + for (build=0; build<=1; build++){ + struct ifaddrs *ifl = NULL, *ifa = NULL; + struct nlmsghdr *nlh, *nlh0; + char *data = NULL, *xdata = NULL; + void *ifdata = NULL; + char *ifname = NULL, **iflist = NULL; + uint16_t *ifflist = NULL; + struct rtmaddr_ifamap ifamap; + + if (build){ + data = calloc(1, + NLMSG_ALIGN(sizeof(struct ifaddrs[icnt])) + + dlen + xlen + nlen); + ifa = (struct ifaddrs *)data; + ifdata = calloc(1, + NLMSG_ALIGN(sizeof(char *[max_ifindex+1])) + + NLMSG_ALIGN(sizeof(uint16_t [max_ifindex+1]))); + if (ifap != NULL) + *ifap = (ifdata != NULL) ? ifa : NULL; + else{ + free_data(data, ifdata); + result = 0; + break; + } + if (data == NULL || ifdata == NULL){ + free_data(data, ifdata); + result = -1; + break; + } + ifl = NULL; + data += NLMSG_ALIGN(sizeof(struct ifaddrs)) * icnt; + xdata = data + dlen; + ifname = xdata + xlen; + iflist = ifdata; + ifflist = (uint16_t *)(((char *)iflist) + NLMSG_ALIGN(sizeof(char *[max_ifindex+1]))); + } + + for (nlm=nlmsg_list; nlm; nlm=nlm->nlm_next){ + int nlmlen = nlm->size; + if (!(nlh0 = nlm->nlh)) + continue; + for (nlh = nlh0; + NLMSG_OK(nlh, nlmlen); + nlh=NLMSG_NEXT(nlh,nlmlen)){ + struct ifinfomsg *ifim = NULL; + struct ifaddrmsg *ifam = NULL; + struct rtattr *rta; + + size_t nlm_struct_size = 0; + sa_family_t nlm_family = 0; + uint32_t nlm_scope = 0, nlm_index = 0; + size_t sockaddr_size = 0; + uint32_t nlm_prefixlen = 0; + size_t rtasize; + + memset(&ifamap, 0, sizeof(ifamap)); + + /* check if the message is what we want */ + if (nlh->nlmsg_pid != pid || + nlh->nlmsg_seq != nlm->seq) + continue; + if (nlh->nlmsg_type == NLMSG_DONE){ + break; /* ok */ + } + switch (nlh->nlmsg_type){ + case RTM_NEWLINK: + ifim = (struct ifinfomsg *)NLMSG_DATA(nlh); + nlm_struct_size = sizeof(*ifim); + nlm_family = ifim->ifi_family; + nlm_scope = 0; + nlm_index = ifim->ifi_index; + nlm_prefixlen = 0; + if (build) + ifflist[nlm_index] = ifa->ifa_flags = ifim->ifi_flags; + break; + case RTM_NEWADDR: + ifam = (struct ifaddrmsg *)NLMSG_DATA(nlh); + nlm_struct_size = sizeof(*ifam); + nlm_family = ifam->ifa_family; + nlm_scope = ifam->ifa_scope; + nlm_index = ifam->ifa_index; + nlm_prefixlen = ifam->ifa_prefixlen; + if (build) + ifa->ifa_flags = ifflist[nlm_index]; + break; + default: + continue; + } + + if (!build){ + if (max_ifindex < nlm_index) + max_ifindex = nlm_index; + } else { + if (ifl != NULL) + ifl->ifa_next = ifa; + } + + rtasize = NLMSG_PAYLOAD(nlh, nlmlen) - NLMSG_ALIGN(nlm_struct_size); + for (rta = (struct rtattr *)(((char *)NLMSG_DATA(nlh)) + NLMSG_ALIGN(nlm_struct_size)); + RTA_OK(rta, rtasize); + rta = RTA_NEXT(rta, rtasize)){ + struct sockaddr **sap = NULL; + void *rtadata = RTA_DATA(rta); + size_t rtapayload = RTA_PAYLOAD(rta); + socklen_t sa_len; + + switch(nlh->nlmsg_type){ + case RTM_NEWLINK: + switch(rta->rta_type){ + case IFLA_ADDRESS: + case IFLA_BROADCAST: + if (build){ + sap = (rta->rta_type == IFLA_ADDRESS) ? &ifa->ifa_addr : &ifa->ifa_broadaddr; + *sap = (struct sockaddr *)data; + } + sa_len = ifa_sa_len(AF_PACKET, rtapayload); + if (rta->rta_type == IFLA_ADDRESS) + sockaddr_size = NLMSG_ALIGN(sa_len); + if (!build){ + dlen += NLMSG_ALIGN(sa_len); + } else { + memset(*sap, 0, sa_len); + ifa_make_sockaddr(AF_PACKET, *sap, rtadata,rtapayload, 0,0); + ((struct sockaddr_ll *)*sap)->sll_ifindex = nlm_index; + ((struct sockaddr_ll *)*sap)->sll_hatype = ifim->ifi_type; + data += NLMSG_ALIGN(sa_len); + } + break; + case IFLA_IFNAME:/* Name of Interface */ + if (!build) + nlen += NLMSG_ALIGN(rtapayload + 1); + else{ + ifa->ifa_name = ifname; + if (iflist[nlm_index] == NULL) + iflist[nlm_index] = ifa->ifa_name; + strncpy(ifa->ifa_name, rtadata, rtapayload); + ifa->ifa_name[rtapayload] = '\0'; + ifname += NLMSG_ALIGN(rtapayload + 1); + } + break; + case IFLA_STATS:/* Statistics of Interface */ + if (!build) + xlen += NLMSG_ALIGN(rtapayload); + else{ + ifa->ifa_data = xdata; + memcpy(ifa->ifa_data, rtadata, rtapayload); + xdata += NLMSG_ALIGN(rtapayload); + } + break; + case IFLA_UNSPEC: + break; + case IFLA_MTU: + break; + case IFLA_LINK: + break; + case IFLA_QDISC: + break; + default: + } + break; + case RTM_NEWADDR: + if (nlm_family == AF_PACKET) break; + switch(rta->rta_type){ + case IFA_ADDRESS: + ifamap.address = rtadata; + ifamap.address_len = rtapayload; + break; + case IFA_LOCAL: + ifamap.local = rtadata; + ifamap.local_len = rtapayload; + break; + case IFA_BROADCAST: + ifamap.broadcast = rtadata; + ifamap.broadcast_len = rtapayload; + break; +#ifdef HAVE_IFADDRS_IFA_ANYCAST + case IFA_ANYCAST: + ifamap.anycast = rtadata; + ifamap.anycast_len = rtapayload; + break; +#endif + case IFA_LABEL: + if (!build) + nlen += NLMSG_ALIGN(rtapayload + 1); + else{ + ifa->ifa_name = ifname; + if (iflist[nlm_index] == NULL) + iflist[nlm_index] = ifname; + strncpy(ifa->ifa_name, rtadata, rtapayload); + ifa->ifa_name[rtapayload] = '\0'; + ifname += NLMSG_ALIGN(rtapayload + 1); + } + break; + case IFA_UNSPEC: + break; + case IFA_CACHEINFO: + break; + default: + } + } + } + if (nlh->nlmsg_type == RTM_NEWADDR && + nlm_family != AF_PACKET) { + if (!ifamap.local) { + ifamap.local = ifamap.address; + ifamap.local_len = ifamap.address_len; + } + if (!ifamap.address) { + ifamap.address = ifamap.local; + ifamap.address_len = ifamap.local_len; + } + if (ifamap.address_len != ifamap.local_len || + (ifamap.address != NULL && + memcmp(ifamap.address, ifamap.local, ifamap.address_len))) { + /* p2p; address is peer and local is ours */ + ifamap.broadcast = ifamap.address; + ifamap.broadcast_len = ifamap.address_len; + ifamap.address = ifamap.local; + ifamap.address_len = ifamap.local_len; + } + if (ifamap.address) { +#ifndef IFA_NETMASK + sockaddr_size = NLMSG_ALIGN(ifa_sa_len(nlm_family,ifamap.address_len)); +#endif + if (!build) + dlen += NLMSG_ALIGN(ifa_sa_len(nlm_family,ifamap.address_len)); + else { + ifa->ifa_addr = (struct sockaddr *)data; + ifa_make_sockaddr(nlm_family, ifa->ifa_addr, ifamap.address, ifamap.address_len, + nlm_scope, nlm_index); + data += NLMSG_ALIGN(ifa_sa_len(nlm_family, ifamap.address_len)); + } + } +#ifdef IFA_NETMASK + if (ifamap.netmask) { + if (!build) + dlen += NLMSG_ALIGN(ifa_sa_len(nlm_family,ifamap.netmask_len)); + else { + ifa->ifa_netmask = (struct sockaddr *)data; + ifa_make_sockaddr(nlm_family, ifa->ifa_netmask, ifamap.netmask, ifamap.netmask_len, + nlm_scope, nlm_index); + data += NLMSG_ALIGN(ifa_sa_len(nlm_family, ifamap.netmask_len)); + } + } +#endif + if (ifamap.broadcast) { + if (!build) + dlen += NLMSG_ALIGN(ifa_sa_len(nlm_family,ifamap.broadcast_len)); + else { + ifa->ifa_broadaddr = (struct sockaddr *)data; + ifa_make_sockaddr(nlm_family, ifa->ifa_broadaddr, ifamap.broadcast, ifamap.broadcast_len, + nlm_scope, nlm_index); + data += NLMSG_ALIGN(ifa_sa_len(nlm_family, ifamap.broadcast_len)); + } + } +#ifdef HAVE_IFADDRS_IFA_ANYCAST + if (ifamap.anycast) { + if (!build) + dlen += NLMSG_ALIGN(ifa_sa_len(nlm_family,ifamap.anycast_len)); + else { + ifa->ifa_anycast = (struct sockaddr *)data; + ifa_make_sockaddr(nlm_family, ifa->ifa_anyaddr, ifamap.anycast, ifamap.anycast_len, + nlm_scope, nlm_index); + data += NLMSG_ALIGN(ifa_sa_len(nlm_family, ifamap.anycast_len)); + } + } +#endif + } + if (!build){ +#ifndef IFA_NETMASK + dlen += sockaddr_size; +#endif + icnt++; + } else { + if (ifa->ifa_name == NULL) + ifa->ifa_name = iflist[nlm_index]; +#ifndef IFA_NETMASK + if (ifa->ifa_addr && + ifa->ifa_addr->sa_family != AF_UNSPEC && + ifa->ifa_addr->sa_family != AF_PACKET){ + ifa->ifa_netmask = (struct sockaddr *)data; + ifa_make_sockaddr_mask(ifa->ifa_addr->sa_family, ifa->ifa_netmask, nlm_prefixlen); + } + data += sockaddr_size; +#endif + ifl = ifa++; + } + } + } + if (!build){ + if (icnt == 0 && (dlen + nlen + xlen == 0)){ + if (ifap != NULL) + *ifap = NULL; + break; /* cannot found any addresses */ + } + } + else + free_data(NULL, ifdata); + } + +/* ---------------------------------- */ + /* Finalize */ + free_nlmsglist(nlmsg_list); + nl_close(sd); + return 0; +} + +/* ---------------------------------------------------------------------- */ +void +freeifaddrs(struct ifaddrs *ifa) +{ + free(ifa); +} + + +#else /* !AF_NETLINK */ + +/* + * The generic SIOCGIFCONF version. + */ + static int getifaddrs2(struct ifaddrs **ifap, int af, int siocgifconf, int siocgifflags, @@ -70,8 +846,7 @@ getifaddrs2(struct ifaddrs **ifap, size_t sz; struct sockaddr sa_zero; struct ifreq *ifr; - - struct ifaddrs *start, **end = &start; + struct ifaddrs *start = NULL, **end = &start; buf = NULL; @@ -137,6 +912,10 @@ getifaddrs2(struct ifaddrs **ifap, } *end = malloc(sizeof(**end)); + if (*end == NULL) { + ret = ENOMEM; + goto error_out; + } (*end)->ifa_next = NULL; (*end)->ifa_name = strdup(ifr->ifr_name); @@ -171,11 +950,137 @@ getifaddrs2(struct ifaddrs **ifap, free(buf); return 0; error_out: + freeifaddrs(start); + close(fd); + free(buf); + errno = ret; + return -1; +} + +#if defined(HAVE_IPV6) && defined(SIOCGLIFCONF) && defined(SIOCGLIFFLAGS) +static int +getlifaddrs2(struct ifaddrs **ifap, + int af, int siocgifconf, int siocgifflags, + size_t ifreq_sz) +{ + int ret; + int fd; + size_t buf_size; + char *buf; + struct lifconf ifconf; + char *p; + size_t sz; + struct sockaddr sa_zero; + struct lifreq *ifr; + struct ifaddrs *start = NULL, **end = &start; + + buf = NULL; + + memset (&sa_zero, 0, sizeof(sa_zero)); + fd = socket(af, SOCK_DGRAM, 0); + if (fd < 0) + return -1; + + buf_size = 8192; + for (;;) { + buf = calloc(1, buf_size); + if (buf == NULL) { + ret = ENOMEM; + goto error_out; + } + ifconf.lifc_family = AF_UNSPEC; + ifconf.lifc_flags = 0; + ifconf.lifc_len = buf_size; + ifconf.lifc_buf = buf; + + /* + * Solaris returns EINVAL when the buffer is too small. + */ + if (ioctl (fd, siocgifconf, &ifconf) < 0 && errno != EINVAL) { + ret = errno; + goto error_out; + } + /* + * Can the difference between a full and a overfull buf + * be determined? + */ + + if (ifconf.lifc_len < buf_size) + break; + free (buf); + buf_size *= 2; + } + + for (p = ifconf.lifc_buf; + p < ifconf.lifc_buf + ifconf.lifc_len; + p += sz) { + struct lifreq ifreq; + struct sockaddr_storage *sa; + size_t salen; + + ifr = (struct lifreq *)p; + sa = &ifr->lifr_addr; + + sz = ifreq_sz; + salen = sizeof(struct sockaddr_storage); +#ifdef HAVE_STRUCT_SOCKADDR_SA_LEN + salen = sa->sa_len; + sz = max(sz, sizeof(ifr->ifr_name) + sa->sa_len); +#endif +#ifdef SA_LEN + salen = SA_LEN(sa); + sz = max(sz, sizeof(ifr->ifr_name) + SA_LEN(sa)); +#endif + memset (&ifreq, 0, sizeof(ifreq)); + memcpy (ifreq.lifr_name, ifr->lifr_name, sizeof(ifr->lifr_name)); + + if (ioctl(fd, siocgifflags, &ifreq) < 0) { + ret = errno; + goto error_out; + } + + *end = malloc(sizeof(**end)); + + (*end)->ifa_next = NULL; + (*end)->ifa_name = strdup(ifr->lifr_name); + (*end)->ifa_flags = ifreq.lifr_flags; + (*end)->ifa_addr = malloc(salen); + memcpy((*end)->ifa_addr, sa, salen); + (*end)->ifa_netmask = NULL; + +#if 0 + /* fix these when we actually need them */ + if(ifreq.ifr_flags & IFF_BROADCAST) { + (*end)->ifa_broadaddr = malloc(sizeof(ifr->ifr_broadaddr)); + memcpy((*end)->ifa_broadaddr, &ifr->ifr_broadaddr, + sizeof(ifr->ifr_broadaddr)); + } else if(ifreq.ifr_flags & IFF_POINTOPOINT) { + (*end)->ifa_dstaddr = malloc(sizeof(ifr->ifr_dstaddr)); + memcpy((*end)->ifa_dstaddr, &ifr->ifr_dstaddr, + sizeof(ifr->ifr_dstaddr)); + } else + (*end)->ifa_dstaddr = NULL; +#else + (*end)->ifa_dstaddr = NULL; +#endif + + (*end)->ifa_data = NULL; + + end = &(*end)->ifa_next; + + } + *ifap = start; + close(fd); + free(buf); + return 0; + error_out: + freeifaddrs(start); close(fd); free(buf); errno = ret; return -1; } +#endif /* defined(HAVE_IPV6) && defined(SIOCGLIFCONF) && defined(SIOCGLIFFLAGS) */ int getifaddrs(struct ifaddrs **ifap) @@ -187,6 +1092,11 @@ getifaddrs(struct ifaddrs **ifap) ret = getifaddrs2 (ifap, AF_INET6, SIOCGIF6CONF, SIOCGIF6FLAGS, sizeof(struct in6_ifreq)); #endif +#if defined(HAVE_IPV6) && defined(SIOCGLIFCONF) && defined(SIOCGLIFFLAGS) + if (ret) + ret = getlifaddrs2 (ifap, AF_INET6, SIOCGLIFCONF, SIOCGLIFFLAGS, + sizeof(struct lifreq)); +#endif #if defined(HAVE_IPV6) && defined(SIOCGIFCONF) if (ret) ret = getifaddrs2 (ifap, AF_INET6, SIOCGIFCONF, SIOCGIFFLAGS, @@ -221,6 +1131,8 @@ freeifaddrs(struct ifaddrs *ifp) } } +#endif /* !AF_NETLINK */ + #ifdef TEST void diff --git a/kerberosV/src/lib/roken/getnameinfo_verified.c b/kerberosV/src/lib/roken/getnameinfo_verified.c index a8a3751404e..2ef42411a8f 100644 --- a/kerberosV/src/lib/roken/getnameinfo_verified.c +++ b/kerberosV/src/lib/roken/getnameinfo_verified.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,11 +33,19 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: getnameinfo_verified.c,v 1.5 2001/02/12 13:55:07 assar Exp $"); +RCSID("$KTH: getnameinfo_verified.c,v 1.6 2002/09/05 01:36:27 assar Exp $"); #endif #include "roken.h" +/* + * Try to obtain a verified name for the address in `sa, salen' (much + * similar to getnameinfo). + * Verified in this context means that forwards and backwards lookups + * in DNS are consistent. If that fails, return an error if the + * NI_NAMEREQD flag is set or return the numeric address as a string. + */ + int getnameinfo_verified(const struct sockaddr *sa, socklen_t salen, char *host, size_t hostlen, @@ -60,13 +68,13 @@ getnameinfo_verified(const struct sockaddr *sa, socklen_t salen, ret = getnameinfo (sa, salen, host, hostlen, serv, servlen, flags | NI_NUMERICSERV); if (ret) - return ret; + goto fail; memset (&hints, 0, sizeof(hints)); hints.ai_socktype = SOCK_STREAM; ret = getaddrinfo (host, serv, &hints, &ai); if (ret) - return ret; + goto fail; for (a = ai; a != NULL; a = a->ai_next) { if (a->ai_addrlen == salen && memcmp (a->ai_addr, sa, salen) == 0) { @@ -75,6 +83,7 @@ getnameinfo_verified(const struct sockaddr *sa, socklen_t salen, } } freeaddrinfo (ai); + fail: if (flags & NI_NAMEREQD) return EAI_NONAME; ret = getnameinfo (sa, salen, host, hostlen, serv, servlen, diff --git a/kerberosV/src/lib/roken/localtime_r.c b/kerberosV/src/lib/roken/localtime_r.c new file mode 100644 index 00000000000..c82d1bb2f67 --- /dev/null +++ b/kerberosV/src/lib/roken/localtime_r.c @@ -0,0 +1,57 @@ +/* + * Copyright (c) 2000 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +RCSID("$KTH: localtime_r.c,v 1.2 2002/08/20 13:00:35 joda Exp $"); +#endif + +#include <stdio.h> +#include <time.h> +#include "roken.h" + +#ifndef HAVE_LOCALTIME_R + +struct tm * +localtime_r(const time_t *timer, struct tm *result) +{ + struct tm *tm; + + tm = localtime((time_t *)timer); + if (tm == NULL) + return NULL; + *result = *tm; + return result; +} + +#endif diff --git a/kerberosV/src/lib/roken/ndbm_wrap.c b/kerberosV/src/lib/roken/ndbm_wrap.c new file mode 100644 index 00000000000..03a99ae58c4 --- /dev/null +++ b/kerberosV/src/lib/roken/ndbm_wrap.c @@ -0,0 +1,211 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +RCSID("$KTH: ndbm_wrap.c,v 1.1 2002/04/30 16:37:08 joda Exp $"); +#endif + +#include "ndbm_wrap.h" +#if defined(HAVE_DB4_DB_H) +#include <db4/db.h> +#elif defined(HAVE_DB3_DB_H) +#include <db3/db.h> +#else +#include <db.h> +#endif + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <fcntl.h> + + +#define DBT2DATUM(DBT, DATUM) do { (DATUM)->dptr = (DBT)->data; (DATUM)->dsize = (DBT)->size; } while(0) +#define DATUM2DBT(DATUM, DBT) do { (DBT)->data = (DATUM)->dptr; (DBT)->size = (DATUM)->dsize; } while(0) +#define RETURN(X) return ((X) == 0) ? 0 : -1 + +#ifdef HAVE_DB3 +static DBC *cursor; +#endif + +#define D(X) ((DB*)(X)) + +void +dbm_close (DBM *db) +{ +#ifdef HAVE_DB3 + D(db)->close(D(db), 0); + cursor = NULL; +#else + D(db)->close(D(db)); +#endif +} + +int +dbm_delete (DBM *db, datum dkey) +{ + DBT key; + DATUM2DBT(&dkey, &key); +#ifdef HAVE_DB3 + RETURN(D(db)->del(D(db), NULL, &key, 0)); +#else + RETURN(D(db)->del(D(db), &key, 0)); +#endif +} + +datum +dbm_fetch (DBM *db, datum dkey) +{ + datum dvalue; + DBT key, value; + DATUM2DBT(&dkey, &key); + if(D(db)->get(D(db), +#ifdef HAVE_DB3 + NULL, +#endif + &key, &value, 0) != 0) + dvalue.dptr = NULL; + else + DBT2DATUM(&value, &dvalue); + + return dvalue; +} + +static datum +dbm_get (DB *db, int flags) +{ + DBT key, value; + datum datum; +#ifdef HAVE_DB3 + if(cursor == NULL) + db->cursor(db, NULL, &cursor, 0); + if(cursor->c_get(cursor, &key, &value, flags) != 0) + datum.dptr = NULL; + else + DBT2DATUM(&value, &datum); +#else + db->seq(db, &key, &value, flags); +#endif + return datum; +} + +#ifndef DB_FIRST +#define DB_FIRST R_FIRST +#define DB_NEXT R_NEXT +#define DB_NOOVERWRITE R_NOOVERWRITE +#define DB_KEYEXIST 1 +#endif + +datum +dbm_firstkey (DBM *db) +{ + return dbm_get(D(db), DB_FIRST); +} + +datum +dbm_nextkey (DBM *db) +{ + return dbm_get(D(db), DB_NEXT); +} + +DBM* +dbm_open (const char *file, int flags, mode_t mode) +{ + DB *db; + int myflags = 0; + char *fn = malloc(strlen(file) + 4); + if(fn == NULL) + return NULL; + strcpy(fn, file); + strcat(fn, ".db"); +#ifdef HAVE_DB3 + if (flags & O_CREAT) + myflags |= DB_CREATE; + + if (flags & O_EXCL) + myflags |= DB_EXCL; + + if (flags & O_RDONLY) + myflags |= DB_RDONLY; + + if (flags & O_TRUNC) + myflags |= DB_TRUNCATE; + if(db_create(&db, NULL, 0) != 0) { + free(fn); + return NULL; + } + if(db->open(db, fn, NULL, DB_BTREE, myflags, mode) != 0) { + free(fn); + db->close(db, 0); + return NULL; + } +#else + db = dbopen(fn, flags, mode, DB_BTREE, NULL); +#endif + free(fn); + return (DBM*)db; +} + +int +dbm_store (DBM *db, datum dkey, datum dvalue, int flags) +{ + int ret; + DBT key, value; + int myflags = 0; + if((flags & DBM_REPLACE) == 0) + myflags |= DB_NOOVERWRITE; + DATUM2DBT(&dkey, &key); + DATUM2DBT(&dvalue, &value); + ret = D(db)->put(D(db), +#ifdef HAVE_DB3 + NULL, +#endif +&key, &value, myflags); + if(ret == DB_KEYEXIST) + return 1; + RETURN(ret); +} + +int +dbm_error (DBM *db) +{ + return 0; +} + +int +dbm_clearerr (DBM *db) +{ + return 0; +} + diff --git a/kerberosV/src/lib/roken/ndbm_wrap.h b/kerberosV/src/lib/roken/ndbm_wrap.h new file mode 100644 index 00000000000..8f12d33c192 --- /dev/null +++ b/kerberosV/src/lib/roken/ndbm_wrap.h @@ -0,0 +1,83 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +/* $KTH: ndbm_wrap.h,v 1.1 2002/04/30 16:37:20 joda Exp $ */ + +#ifndef __ndbm_wrap_h__ +#define __ndbm_wrap_h__ + +#include <stdio.h> +#include <sys/types.h> + +#ifndef dbm_rename +#define dbm_rename(X) __roken_ ## X +#endif + +#define dbm_open dbm_rename(dbm_open) +#define dbm_close dbm_rename(dbm_close) +#define dbm_delete dbm_rename(dbm_delete) +#define dbm_fetch dbm_rename(dbm_fetch) +#define dbm_get dbm_rename(dbm_get) +#define dbm_firstkey dbm_rename(dbm_firstkey) +#define dbm_nextkey dbm_rename(dbm_nextkey) +#define dbm_store dbm_rename(dbm_store) +#define dbm_error dbm_rename(dbm_error) +#define dbm_clearerr dbm_rename(dbm_clearerr) + +#define datum dbm_rename(datum) + +typedef struct { + void *dptr; + size_t dsize; +} datum; + +#define DBM_REPLACE 1 +typedef struct DBM DBM; + +#if 0 +typedef struct { + int dummy; +} DBM; +#endif + +int dbm_clearerr (DBM*); +void dbm_close (DBM*); +int dbm_delete (DBM*, datum); +int dbm_error (DBM*); +datum dbm_fetch (DBM*, datum); +datum dbm_firstkey (DBM*); +datum dbm_nextkey (DBM*); +DBM* dbm_open (const char*, int, mode_t); +int dbm_store (DBM*, datum, datum, int); + +#endif /* __ndbm_wrap_h__ */ diff --git a/kerberosV/src/lib/roken/parse_bytes-test.c b/kerberosV/src/lib/roken/parse_bytes-test.c index ea575a91efc..db119bc38b7 100644 --- a/kerberosV/src/lib/roken/parse_bytes-test.c +++ b/kerberosV/src/lib/roken/parse_bytes-test.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: parse_bytes-test.c,v 1.2 1999/12/02 16:58:51 joda Exp $"); +RCSID("$KTH: parse_bytes-test.c,v 1.3 2001/09/04 09:56:00 assar Exp $"); #endif #include "roken.h" @@ -66,7 +66,7 @@ main(int argc, char **argv) for (i = 0; i < sizeof(tests)/sizeof(tests[0]); ++i) { char buf[256]; int val = parse_bytes (tests[i].str, tests[i].def_unit); - size_t len; + int len; if (val != tests[i].val) { printf ("parse_bytes (%s, %s) = %d != %d\n", diff --git a/kerberosV/src/lib/roken/parse_bytes.c b/kerberosV/src/lib/roken/parse_bytes.c index b2c43a21ee9..efd5f130e2b 100644 --- a/kerberosV/src/lib/roken/parse_bytes.c +++ b/kerberosV/src/lib/roken/parse_bytes.c @@ -33,13 +33,13 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: parse_bytes.c,v 1.2 1999/12/02 16:58:51 joda Exp $"); +RCSID("$KTH: parse_bytes.c,v 1.4 2003/03/07 15:51:53 lha Exp $"); #endif #include <parse_units.h> #include "parse_bytes.h" -static units bytes_units[] = { +static struct units bytes_units[] = { { "gigabyte", 1024 * 1024 * 1024 }, { "gbyte", 1024 * 1024 * 1024 }, { "GB", 1024 * 1024 * 1024 }, @@ -52,7 +52,7 @@ static units bytes_units[] = { { NULL, 0 } }; -static units bytes_short_units[] = { +static struct units bytes_short_units[] = { { "GB", 1024 * 1024 * 1024 }, { "MB", 1024 * 1024 }, { "KB", 1024 }, @@ -65,13 +65,13 @@ parse_bytes (const char *s, const char *def_unit) return parse_units (s, bytes_units, def_unit); } -size_t +int unparse_bytes (int t, char *s, size_t len) { return unparse_units (t, bytes_units, s, len); } -size_t +int unparse_bytes_short (int t, char *s, size_t len) { return unparse_units_approx (t, bytes_short_units, s, len); diff --git a/kerberosV/src/lib/roken/parse_bytes.h b/kerberosV/src/lib/roken/parse_bytes.h index 7a5ef24b554..ac6ff9555cf 100644 --- a/kerberosV/src/lib/roken/parse_bytes.h +++ b/kerberosV/src/lib/roken/parse_bytes.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1999 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: parse_bytes.h,v 1.2 1999/12/02 16:58:51 joda Exp $ */ +/* $KTH: parse_bytes.h,v 1.3 2001/09/04 09:56:00 assar Exp $ */ #ifndef __PARSE_BYTES_H__ #define __PARSE_BYTES_H__ @@ -39,10 +39,10 @@ int parse_bytes (const char *s, const char *def_unit); -size_t +int unparse_bytes (int t, char *s, size_t len); -size_t +int unparse_bytes_short (int t, char *s, size_t len); #endif /* __PARSE_BYTES_H__ */ diff --git a/kerberosV/src/lib/roken/parse_reply-test.c b/kerberosV/src/lib/roken/parse_reply-test.c new file mode 100644 index 00000000000..9808a01388c --- /dev/null +++ b/kerberosV/src/lib/roken/parse_reply-test.c @@ -0,0 +1,129 @@ +/* + * Copyright (c) 2002 Kungliga Tekniska Högskolan + * (Royal Institute of Technology, Stockholm, Sweden). + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * 3. Neither the name of the Institute nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +RCSID("$KTH: parse_reply-test.c,v 1.2 2002/09/04 03:25:06 assar Exp $"); +#endif + +#include <sys/types.h> +#ifdef HAVE_SYS_MMAN_H +#include <sys/mman.h> +#endif +#include <fcntl.h> + +#include "roken.h" +#include "resolve.h" + +struct dns_reply* +parse_reply(const unsigned char *, size_t); + +enum { MAX_BUF = 36}; + +static struct testcase { + unsigned char buf[MAX_BUF]; + size_t buf_len; +} tests[] = { + {{0x12, 0x67, 0x84, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x03, 'f', 'o', 'o', 0x00, + 0x00, 0x10, 0x00, 0x01, + 0x03, 'f', 'o', 'o', 0x00, + 0x00, 0x10, 0x00, 0x01, + 0x00, 0x00, 0x12, 0x67, 0xff, 0xff}, 36} +}; + +#ifndef MAP_FAILED +#define MAP_FAILED (-1) +#endif + +static sig_atomic_t val = 0; + +static RETSIGTYPE +segv_handler(int sig) +{ + val = 1; +} + +int +main(int argc, char **argv) +{ +#ifndef HAVE_MMAP + return 77; /* signal to automake that this test + cannot be run */ +#else /* HAVE_MMAP */ + int ret; + int i; + struct sigaction sa; + + sigemptyset (&sa.sa_mask); + sa.sa_flags = 0; + sa.sa_handler = segv_handler; + sigaction (SIGSEGV, &sa, NULL); + + for (i = 0; val == 0 && i < sizeof(tests)/sizeof(tests[0]); ++i) { + const struct testcase *t = &tests[i]; + unsigned char *p1, *p2; + int flags; + int fd; + size_t pagesize = getpagesize(); + unsigned char *buf; + +#ifdef MAP_ANON + flags = MAP_ANON; + fd = -1; +#else + flags = 0; + fd = open ("/dev/zero", O_RDONLY); + if(fd < 0) + err (1, "open /dev/zero"); +#endif + flags |= MAP_PRIVATE; + + p1 = (char *)mmap(0, 2 * pagesize, PROT_READ | PROT_WRITE, + flags, fd, 0); + if (p1 == (unsigned char *)MAP_FAILED) + err (1, "mmap"); + p2 = p1 + pagesize; + ret = mprotect (p2, pagesize, 0); + if (ret < 0) + err (1, "mprotect"); + buf = p2 - t->buf_len; + memcpy (buf, t->buf, t->buf_len); + parse_reply (buf, t->buf_len); + ret = munmap (p1, 2 * pagesize); + if (ret < 0) + err (1, "munmap"); + } + return val; +#endif /* HAVE_MMAP */ +} diff --git a/kerberosV/src/lib/roken/parse_time.c b/kerberosV/src/lib/roken/parse_time.c index 39b7257ce62..6970ef8b415 100644 --- a/kerberosV/src/lib/roken/parse_time.c +++ b/kerberosV/src/lib/roken/parse_time.c @@ -33,13 +33,13 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: parse_time.c,v 1.5 1999/12/02 16:58:51 joda Exp $"); +RCSID("$KTH: parse_time.c,v 1.6 2003/03/07 15:51:06 lha Exp $"); #endif #include <parse_units.h> #include "parse_time.h" -static units time_units[] = { +static struct units time_units[] = { {"year", 365 * 24 * 60 * 60}, {"month", 30 * 24 * 60 * 60}, {"week", 7 * 24 * 60 * 60}, diff --git a/kerberosV/src/lib/roken/parse_units.h b/kerberosV/src/lib/roken/parse_units.h index d4dfa2f3815..9883d8e87d9 100644 --- a/kerberosV/src/lib/roken/parse_units.h +++ b/kerberosV/src/lib/roken/parse_units.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1997 Kungliga Tekniska Högskolan + * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: parse_units.h,v 1.6 1999/12/02 16:58:51 joda Exp $ */ +/* $KTH: parse_units.h,v 1.8 2003/04/16 17:30:54 lha Exp $ */ #ifndef __PARSE_UNITS_H__ #define __PARSE_UNITS_H__ @@ -44,8 +44,6 @@ struct units { unsigned mult; }; -typedef struct units units; - int parse_units (const char *s, const struct units *units, const char *def_unit); @@ -57,14 +55,14 @@ int parse_flags (const char *s, const struct units *units, int orig); -size_t +int unparse_units (int num, const struct units *units, char *s, size_t len); -size_t +int unparse_units_approx (int num, const struct units *units, char *s, size_t len); -size_t +int unparse_flags (int num, const struct units *units, char *s, size_t len); void diff --git a/kerberosV/src/lib/roken/resolve.h b/kerberosV/src/lib/roken/resolve.h index 08d8f361aec..2abe1f97bf6 100644 --- a/kerberosV/src/lib/roken/resolve.h +++ b/kerberosV/src/lib/roken/resolve.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: resolve.h,v 1.13 2001/06/09 01:35:04 joda Exp $ */ +/* $KTH: resolve.h,v 1.15 2002/08/26 13:30:16 assar Exp $ */ #ifndef __RESOLVE_H__ #define __RESOLVE_H__ @@ -50,6 +50,9 @@ #ifndef T_KEY #define T_KEY 25 #endif +#ifndef T_AAAA +#define T_AAAA 28 +#endif #ifndef T_SRV #define T_SRV 33 #endif @@ -60,6 +63,21 @@ #define T_CERT 37 #endif +#define dns_query rk_dns_query +#define mx_record rk_mx_record +#define srv_record rk_srv_record +#define key_record rk_key_record +#define sig_record rk_sig_record +#define cert_record rk_cert_record +#define resource_record rk_resource_record +#define dns_reply rk_dns_reply + +#define dns_lookup rk_dns_lookup +#define dns_free_data rk_dns_free_data +#define dns_string_to_type rk_dns_string_to_type +#define dns_type_to_string rk_dns_type_to_string +#define dns_srv_order rk_dns_srv_order + struct dns_query{ char *domain; unsigned type; diff --git a/kerberosV/src/lib/roken/roken-common.h b/kerberosV/src/lib/roken/roken-common.h index 6cd21c47602..593d2591e95 100644 --- a/kerberosV/src/lib/roken/roken-common.h +++ b/kerberosV/src/lib/roken/roken-common.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: roken-common.h,v 1.48 2001/09/03 12:04:34 joda Exp $ */ +/* $KTH: roken-common.h,v 1.51 2002/09/09 13:41:12 joda Exp $ */ #ifndef __ROKEN_COMMON_H__ #define __ROKEN_COMMON_H__ @@ -191,13 +191,14 @@ /* flags for getaddrinfo() */ #ifndef AI_PASSIVE - #define AI_PASSIVE 0x01 #define AI_CANONNAME 0x02 -#define AI_NUMERICHOST 0x04 - #endif /* AI_PASSIVE */ +#ifndef AI_NUMERICHOST +#define AI_NUMERICHOST 0x04 +#endif + /* flags for getnameinfo() */ #ifndef NI_DGRAM @@ -251,7 +252,7 @@ ROKEN_CPP_START -#if IRIX != 4 /* fix for compiler bug */ +#ifndef IRIX4 /* fix for compiler bug */ #ifdef RETSIGTYPE typedef RETSIGTYPE (*SigAction)(int); SigAction signal(int iSig, SigAction pAction); /* BSD compatible */ diff --git a/kerberosV/src/lib/roken/roken.awk b/kerberosV/src/lib/roken/roken.awk index 364f79286aa..1cbd614f12c 100644 --- a/kerberosV/src/lib/roken/roken.awk +++ b/kerberosV/src/lib/roken/roken.awk @@ -1,12 +1,12 @@ -# $KTH: roken.awk,v 1.7 2001/03/26 09:26:35 joda Exp $ +# $KTH: roken.awk,v 1.9 2003/03/04 10:37:26 lha Exp $ BEGIN { - print "#include <stdio.h>" print "#ifdef HAVE_CONFIG_H" print "#include <config.h>" print "#endif" + print "#include <stdio.h>" print "" - print "int main()" + print "int main(int argc, char **argv)" print "{" print "puts(\"/* This is an OS dependent, generated file */\");" print "puts(\"\\n\");" diff --git a/kerberosV/src/lib/roken/roken.h.in b/kerberosV/src/lib/roken/roken.h.in index 26b13f4cc50..0ab2e6f42df 100644 --- a/kerberosV/src/lib/roken/roken.h.in +++ b/kerberosV/src/lib/roken/roken.h.in @@ -1,6 +1,6 @@ /* -*- C -*- */ /* - * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -32,7 +32,7 @@ * SUCH DAMAGE. */ -/* $KTH: roken.h.in,v 1.159 2001/08/21 15:32:05 assar Exp $ */ +/* $KTH: roken.h.in,v 1.169 2002/08/26 21:43:38 assar Exp $ */ #include <stdio.h> #include <stdlib.h> @@ -92,6 +92,12 @@ struct sockaddr_dl; #ifdef HAVE_NETDB_H #include <netdb.h> #endif +#ifdef HAVE_ARPA_NAMESER_H +#include <arpa/nameser.h> +#endif +#ifdef HAVE_RESOLV_H +#include <resolv.h> +#endif #ifdef HAVE_SYSLOG_H #include <syslog.h> #endif @@ -134,6 +140,10 @@ struct sockaddr_dl; #endif #endif +#ifndef HAVE_SSIZE_T +typedef int ssize_t; +#endif + #include <roken-common.h> ROKEN_CPP_START @@ -193,7 +203,7 @@ int vasnprintf (char **ret, size_t max_sz, const char *format, va_list ap) char * strdup(const char *old); #endif -#ifndef HAVE_STRNDUP +#if !defined(HAVE_STRNDUP) || defined(NEED_STRNDUP_PROTO) char * strndup(const char *old, size_t sz); #endif @@ -390,8 +400,6 @@ time_t tm2time (struct tm tm, int local); int unix_verify_user(char *user, char *password); -void mini_inetd (int port); - int roken_concat (char *s, size_t len, ...); size_t roken_mconcat (char **s, size_t max_len, ...); @@ -625,7 +633,50 @@ void setprogname(const char *argv0); const char *getprogname(void); #endif +void mini_inetd_addrinfo (struct addrinfo*); +void mini_inetd (int port); + void set_progname(char *argv0); const char *get_progname(void); +#ifndef HAVE_LOCALTIME_R +struct tm * +localtime_r(const time_t *timer, struct tm *result); +#endif + +#if !defined(HAVE_STRSVIS) || defined(NEED_STRSVIS_PROTO) +int +strsvis(char *dst, const char *src, int flag, const char *extra); +#endif + +#if !defined(HAVE_STRUNVIS) || defined(NEED_STRUNVIS_PROTO) +int +strunvis(char *dst, const char *src); +#endif + +#if !defined(HAVE_STRVIS) || defined(NEED_STRVIS_PROTO) +int +strvis(char *dst, const char *src, int flag); +#endif + +#if !defined(HAVE_STRVISX) || defined(NEED_STRVISX_PROTO) +int +strvisx(char *dst, const char *src, size_t len, int flag); +#endif + +#if !defined(HAVE_SVIS) || defined(NEED_SVIS_PROTO) +char * +svis(char *dst, int c, int flag, int nextc, const char *extra); +#endif + +#if !defined(HAVE_UNVIS) || defined(NEED_UNVIS_PROTO) +int +unvis(char *cp, int c, int *astate, int flag); +#endif + +#if !defined(HAVE_VIS) || defined(NEED_VIS_PROTO) +char * +vis(char *dst, int c, int flag, int nextc); +#endif + ROKEN_CPP_END diff --git a/kerberosV/src/lib/roken/rtbl.c b/kerberosV/src/lib/roken/rtbl.c index 091e36bdcae..97005c152e6 100644 --- a/kerberosV/src/lib/roken/rtbl.c +++ b/kerberosV/src/lib/roken/rtbl.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000 Kungliga Tekniska Högskolan + * Copyright (c) 2000, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID ("$KTH: rtbl.c,v 1.3 2000/07/20 14:42:31 assar Exp $"); +RCSID ("$KTH: rtbl.c,v 1.4 2002/09/04 21:25:09 joda Exp $"); #endif #include "roken.h" #include "rtbl.h" @@ -83,12 +83,14 @@ rtbl_destroy (rtbl_t table) for (j = 0; j < c->num_rows; j++) free (c->rows[j].data); + free (c->rows); free (c->header); free (c->prefix); free (c); } free (table->column_prefix); free (table->columns); + free (table); } int diff --git a/kerberosV/src/lib/roken/socket.c b/kerberosV/src/lib/roken/socket.c index 513448d7dfa..d3d1f74c59f 100644 --- a/kerberosV/src/lib/roken/socket.c +++ b/kerberosV/src/lib/roken/socket.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: socket.c,v 1.7 2001/09/03 12:04:23 joda Exp $"); +RCSID("$KTH: socket.c,v 1.8 2003/04/15 03:26:51 lha Exp $"); #endif #include <roken.h> @@ -270,7 +270,8 @@ socket_set_tos (int sock, int tos) { #if defined(IP_TOS) && defined(HAVE_SETSOCKOPT) if (setsockopt (sock, IPPROTO_IP, IP_TOS, (void *) &tos, sizeof (int)) < 0) - warn ("setsockopt TOS (ignored)"); + if (errno != EINVAL) + warn ("setsockopt TOS (ignored)"); #endif } diff --git a/kerberosV/src/lib/roken/strcasecmp.c b/kerberosV/src/lib/roken/strcasecmp.c index b8f633e97bd..995fc07febc 100644 --- a/kerberosV/src/lib/roken/strcasecmp.c +++ b/kerberosV/src/lib/roken/strcasecmp.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: strcasecmp.c,v 1.9 1999/12/02 16:58:52 joda Exp $"); +RCSID("$KTH: strcasecmp.c,v 1.10 2003/04/14 11:26:27 lha Exp $"); #endif #include <string.h> @@ -46,13 +46,13 @@ RCSID("$KTH: strcasecmp.c,v 1.9 1999/12/02 16:58:52 joda Exp $"); int strcasecmp(const char *s1, const char *s2) { - while(toupper(*s1) == toupper(*s2)) { + while(toupper((unsigned char)*s1) == toupper((unsigned char)*s2)) { if(*s1 == '\0') return 0; s1++; s2++; } - return toupper(*s1) - toupper(*s2); + return toupper((unsigned char)*s1) - toupper((unsigned char)*s2); } #endif diff --git a/kerberosV/src/lib/roken/strlcat.c b/kerberosV/src/lib/roken/strlcat.c index c235b04a731..46d469139cf 100644 --- a/kerberosV/src/lib/roken/strlcat.c +++ b/kerberosV/src/lib/roken/strlcat.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1995-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -36,7 +36,7 @@ #endif #include "roken.h" -RCSID("$KTH: strlcat.c,v 1.5 1999/12/02 16:58:53 joda Exp $"); +RCSID("$KTH: strlcat.c,v 1.6 2002/08/20 09:46:20 joda Exp $"); #ifndef HAVE_STRLCAT @@ -45,6 +45,12 @@ strlcat (char *dst, const char *src, size_t dst_sz) { size_t len = strlen(dst); + if (dst_sz < len) + /* the total size of dst is less than the string it contains; + this could be considered bad input, but we might as well + handle it */ + return len + strlen(src); + return len + strlcpy (dst + len, src, dst_sz - len); } #endif diff --git a/kerberosV/src/lib/roken/strlcpy.c b/kerberosV/src/lib/roken/strlcpy.c index 156b95b8791..175f80bb277 100644 --- a/kerberosV/src/lib/roken/strlcpy.c +++ b/kerberosV/src/lib/roken/strlcpy.c @@ -1,23 +1,23 @@ /* - * Copyright (c) 1995 - 1999 Kungliga Tekniska Högskolan + * Copyright (c) 1995-2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. - * + * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * + * * 3. Neither the name of the Institute nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE @@ -36,7 +36,7 @@ #endif #include "roken.h" -RCSID("$KTH: strlcpy.c,v 1.5 1999/12/02 16:58:53 joda Exp $"); +RCSID("$KTH: strlcpy.c,v 1.6 2002/08/20 09:42:08 joda Exp $"); #ifndef HAVE_STRLCPY @@ -44,17 +44,17 @@ size_t strlcpy (char *dst, const char *src, size_t dst_sz) { size_t n; - char *p; - for (p = dst, n = 0; - n + 1 < dst_sz && *src != '\0'; - ++p, ++src, ++n) - *p = *src; - *p = '\0'; - if (*src == '\0') + for (n = 0; n < dst_sz; n++) { + if ((*dst++ = *src++) == '\0') + break; + } + + if (n < dst_sz) return n; - else - return n + strlen (src); + if (n > 0) + *(dst - 1) = '\0'; + return n + strlen (src); } #endif diff --git a/kerberosV/src/lib/roken/strlwr.c b/kerberosV/src/lib/roken/strlwr.c index a3c2514ce60..514c3ee2ed6 100644 --- a/kerberosV/src/lib/roken/strlwr.c +++ b/kerberosV/src/lib/roken/strlwr.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: strlwr.c,v 1.4 1999/12/02 16:58:53 joda Exp $"); +RCSID("$KTH: strlwr.c,v 1.5 2003/04/14 11:44:34 lha Exp $"); #endif #include <string.h> #include <ctype.h> @@ -47,7 +47,7 @@ strlwr(char *str) char *s; for(s = str; *s; s++) - *s = tolower(*s); + *s = tolower((unsigned char)*s); return str; } #endif diff --git a/kerberosV/src/lib/roken/strncasecmp.c b/kerberosV/src/lib/roken/strncasecmp.c index 07f631de0d1..93658103526 100644 --- a/kerberosV/src/lib/roken/strncasecmp.c +++ b/kerberosV/src/lib/roken/strncasecmp.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: strncasecmp.c,v 1.2 1999/12/02 16:58:53 joda Exp $"); +RCSID("$KTH: strncasecmp.c,v 1.3 2003/04/14 11:46:04 lha Exp $"); #endif #include <string.h> @@ -45,7 +45,9 @@ RCSID("$KTH: strncasecmp.c,v 1.2 1999/12/02 16:58:53 joda Exp $"); int strncasecmp(const char *s1, const char *s2, size_t n) { - while(n > 0 && toupper(*s1) == toupper(*s2)) { + while(n > 0 + && toupper((unsigned char)*s1) == toupper((unsigned char)*s2)) + { if(*s1 == '\0') return 0; s1++; @@ -54,7 +56,7 @@ strncasecmp(const char *s1, const char *s2, size_t n) } if(n == 0) return 0; - return toupper(*s1) - toupper(*s2); + return toupper((unsigned char)*s1) - toupper((unsigned char)*s2); } #endif diff --git a/kerberosV/src/lib/roken/strsep_copy.c b/kerberosV/src/lib/roken/strsep_copy.c index 31ebb245ba9..d391f5706b3 100644 --- a/kerberosV/src/lib/roken/strsep_copy.c +++ b/kerberosV/src/lib/roken/strsep_copy.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000 Kungliga Tekniska Högskolan + * Copyright (c) 2000, 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: strsep_copy.c,v 1.3 2000/06/29 03:13:36 assar Exp $"); +RCSID("$KTH: strsep_copy.c,v 1.4 2002/08/14 17:20:40 joda Exp $"); #endif #include <string.h> @@ -53,8 +53,10 @@ strsep_copy(const char **stringp, const char *delim, char *buf, size_t len) return -1; *stringp = *stringp + strcspn(*stringp, delim); l = min(len, *stringp - save); - memcpy(buf, save, l); - buf[l] = '\0'; + if(len > 0) { + memcpy(buf, save, l); + buf[l] = '\0'; + } l = *stringp - save; if(**stringp == '\0') diff --git a/kerberosV/src/lib/roken/strupr.c b/kerberosV/src/lib/roken/strupr.c index a9d77efa269..9f22f95909f 100644 --- a/kerberosV/src/lib/roken/strupr.c +++ b/kerberosV/src/lib/roken/strupr.c @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: strupr.c,v 1.4 1999/12/02 16:58:53 joda Exp $"); +RCSID("$KTH: strupr.c,v 1.5 2003/04/14 11:46:41 lha Exp $"); #endif #include <string.h> #include <ctype.h> @@ -47,7 +47,7 @@ strupr(char *str) char *s; for(s = str; *s; s++) - *s = toupper(*s); + *s = toupper((unsigned char)*s); return str; } #endif diff --git a/kerberosV/src/lib/roken/xdbm.h b/kerberosV/src/lib/roken/xdbm.h index c11c4446483..a8fb31b87a3 100644 --- a/kerberosV/src/lib/roken/xdbm.h +++ b/kerberosV/src/lib/roken/xdbm.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 1995 - 2001 Kungliga Tekniska Högskolan + * Copyright (c) 1995 - 2002 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -31,7 +31,7 @@ * SUCH DAMAGE. */ -/* $KTH: xdbm.h,v 1.14 2001/09/03 05:03:00 assar Exp $ */ +/* $KTH: xdbm.h,v 1.15 2002/05/17 16:02:22 joda Exp $ */ /* Generic *dbm include file */ @@ -46,32 +46,7 @@ #include <gdbm/ndbm.h> #elif defined(HAVE_NDBM_H) #include <ndbm.h> -#elif defined(HAVE_DBM_H) -#include <dbm.h> #endif #endif /* HAVE_NDBM */ -#if 0 -/* Macros to convert ndbm names to dbm names. - * Note that dbm_nextkey() cannot be simply converted using a macro, since - * it is invoked giving the database, and nextkey() needs the previous key. - * - * Instead, all routines call "dbm_next" instead. - */ - -#if !defined(NDBM) && !defined(HAVE_DB_H) -typedef char DBM; - -#define dbm_open(file, flags, mode) ((dbminit(file) == 0)?"":((char *)0)) -#define dbm_fetch(db, key) fetch(key) -#define dbm_store(db, key, content, flag) store(key, content) -#define dbm_delete(db, key) delete(key) -#define dbm_firstkey(db) firstkey() -#define dbm_next(db,key) nextkey(key) -#define dbm_close(db) dbmclose() -#else -#define dbm_next(db,key) dbm_nextkey(db) -#endif -#endif - #endif /* __XDBM_H__ */ diff --git a/kerberosV/src/lib/sl/ChangeLog b/kerberosV/src/lib/sl/ChangeLog index ea3d76ff50f..e25ae812d91 100644 --- a/kerberosV/src/lib/sl/ChangeLog +++ b/kerberosV/src/lib/sl/ChangeLog @@ -1,3 +1,8 @@ +2002-05-19 Johan Danielsson <joda@pdc.kth.se> + + * Makefile.am: just link mk_cmds against libsl; avoids libtool + problem + 2001-07-09 Assar Westerlund <assar@sics.se> * Makefile.am: add getprogname.c libss.la:add libcom_err.la noted diff --git a/kerberosV/src/lib/sl/lex.l b/kerberosV/src/lib/sl/lex.l index 594db7fe420..398518bb6d2 100644 --- a/kerberosV/src/lib/sl/lex.l +++ b/kerberosV/src/lib/sl/lex.l @@ -1,6 +1,6 @@ %{ /* - * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1998 - 2001 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -37,13 +37,15 @@ #include "make_cmds.h" #include "parse.h" -RCSID("$KTH: lex.l,v 1.5 2000/12/05 09:21:46 joda Exp $"); +RCSID("$KTH: lex.l,v 1.6 2001/09/16 23:10:10 assar Exp $"); static unsigned lineno = 1; static int getstring(void); #define YY_NO_UNPUT +#undef ECHO + %} diff --git a/kerberosV/src/lib/vers/ChangeLog b/kerberosV/src/lib/vers/ChangeLog index 93d0731b712..f5a869d585f 100644 --- a/kerberosV/src/lib/vers/ChangeLog +++ b/kerberosV/src/lib/vers/ChangeLog @@ -1,3 +1,23 @@ +2003-01-02 Johan Danielsson <joda@pdc.kth.se> + + * print_version.c: considerable clean up + + * make-print-version.c: make VERSIONLIST a string instead of an + array of strings + +2002-08-28 Assar Westerlund <assar@kth.se> + + * Makefile.am (make_print_version_LDADD): do not hardcode -ldes, + use $(LIB_des) + +2002-08-19 Johan Danielsson <joda@pdc.kth.se> + + * print_version.c: add bug-report message + +2002-05-20 Johan Danielsson <joda@pdc.kth.se> + + * print_version.c: update year + 2001-08-24 Assar Westerlund <assar@sics.se> * Makefile.am (make_print_version_LDADD): use = instead of += (be diff --git a/kerberosV/src/lib/vers/make-print-version.c b/kerberosV/src/lib/vers/make-print-version.c index f7d12833772..1679f27f4f9 100644 --- a/kerberosV/src/lib/vers/make-print-version.c +++ b/kerberosV/src/lib/vers/make-print-version.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1998 - 2000 Kungliga Tekniska Högskolan + * Copyright (c) 1998 - 2003 Kungliga Tekniska Högskolan * (Royal Institute of Technology, Stockholm, Sweden). * All rights reserved. * @@ -33,7 +33,7 @@ #ifdef HAVE_CONFIG_H #include <config.h> -RCSID("$KTH: make-print-version.c,v 1.2 2000/07/08 10:46:36 assar Exp $"); +RCSID("$KTH: make-print-version.c,v 1.3 2003/01/02 15:31:38 joda Exp $"); #endif #include <stdio.h> @@ -55,14 +55,17 @@ main(int argc, char **argv) f = fopen(argv[1], "w"); if(f == NULL) return 1; - fprintf(f, "#define VERSIONLIST { "); + fprintf(f, "#define VERSIONLIST \""); #ifdef KRB5 - fprintf(f, "\"%s\", ", heimdal_version); + fprintf(f, "%s", heimdal_version); #endif #ifdef KRB4 - fprintf(f, "\"%s\", ", krb4_version); +#ifdef KRB5 + fprintf(f, ", "); +#endif + fprintf(f, "%s", krb4_version); #endif - fprintf(f, "}\n"); + fprintf(f, "\"\n"); fclose(f); return 0; } diff --git a/kerberosV/src/tools/build.sh b/kerberosV/src/tools/build.sh new file mode 100644 index 00000000000..06a53dc99b4 --- /dev/null +++ b/kerberosV/src/tools/build.sh @@ -0,0 +1,212 @@ +#!/bin/sh +# +# Build many combinations of kth-krb/heimdal/openssl +# +# $KTH: build.sh,v 1.8 2003/04/17 12:55:02 lha Exp $ + +opt_n= #: +make_f= #-j + +heimdal_versions="0.5.2 0.6pre4" +krb4_versions="1.2.2" +openssl_versions="0.9.6i 0.9.7a 0.9.7b" + +make_check_version=".*heimdal-0.6.*" + +# 0.5 dont eat 0.9.7 +dont_build="openssl-0.9.7.*heimdal-0.5.*" +# 1.2 dont eat 0.9.7 +dont_build="openssl-0.9.7.*krb4-1.2.* ${dont_build}" +#yacc problems +dont_build="openssl-0.9.6.*heimdal-0.5.*osf4.* ${dont_build}" +#local openssl 09.7 and broken kuser/Makefile.am +dont_build="openssl-0.9.6.*heimdal-0.5.*freebsd4.8.* ${dont_build}" +failed= + +# Allow override +for a in $HOME . /etc ; do + [ -f $a/.heimdal-build ] && . $a/.heimdal-build +done + +targetdir=${targetdir:-/scratch/heimdal-test} +logfile="${targetdir}/buildlog" + +distdirs="${distdirs} /afs/su.se/home/l/h/lha/Public/openssl" +distdirs="${distdirs} /afs/pdc.kth.se/public/ftp/pub/heimdal/src" +distdirs="${distdirs} /afs/pdc.kth.se/public/ftp/pub/heimdal/src/snapshots" +distdirs="${distdirs} /afs/pdc.kth.se/public/ftp/pub/krb/src" + + +logprint () { + d=`date '+%Y-%m-%d %H:%M:%S'` + echo "${d}: $*" + echo "${d}: --- $*" >> ${logfile} +} + +logerror () { + echo "$*" + exit 1 +} + +find_unzip_prog () { + unzip_prog= + oldIFS="$IFS" + IFS=: + set -- $PATH + IFS="$oldIFS" + for a in $* ; do + if [ -x $a/gzip ] ; then + unzip_prog="$a/gzip -dc" + break + elif [ -x $a/gunzip ] ; then + unzip_prog="$a/gunzip -c" + break + fi + done + [ "$unzip_prog" = "" ] && logerror failed to find unzip program +} + +find_canon_name () { + canon_name= + for a in ${distdirs} ; do + if [ -f $a/config.guess ] ; then + canon_name=`$a/config.guess` + fi + if [ "${canon_name}" != "" ] ; then + break + fi + done + [ "${canon_name}" = "" ] && logerror "cant find config.guess" +} + +do_check_p () { + eval check_var=\$"$1" + for a in ${check_var} ; do + expr "$2${canon_name}" : "${a}" > /dev/null 2>&1 && return 1 + done + return 0 +} + +unpack_tar () { + for a in ${distdirs} ; do + if [ -f $a/$1 ] ; then + ${opt_n} ${unzip_prog} ${a}/$1 | ${opt_n} tar xf - + return 0 + fi + done + logerror "did not find $1" +} + +build () { + real_ver=$1 + prog=$2 + ver=$3 + confprog=$4 + checks=$5 + pv=${prog}-${ver} + mkdir tmp || logerror "failed to build tmpdir" + cd tmp || logerror "failed to change dir to tmpdir" + do_check_p dont_build ${real_ver} || \ + { cd .. ; rmdir tmp ; logprint "not building $1" && return 0 ; } + cd .. || logerror "failed to change back from tmpdir" + rmdir tmp || logerror "failed to remove tmpdir" + logprint "preparing for ${pv}" + ${opt_n} rm -rf ${targetdir}/${prog}-${ver} + ${opt_n} rm -rf ${prog}-${ver} + unpack_tar ${pv}.tar.gz + ${opt_n} cd ${pv} || logerror directory ${pv} not there + logprint "configure ${prog} ${ver} (${confprog})" + ${opt_n} ./${confprog} \ + --prefix=${targetdir}/${pv} >> ${logfile} 2>&1 || \ + { logprint failed to configure ${pv} ; return 1 ; } + logprint "make ${prog} ${ver}" + ${opt_n} make ${make_f} >> ${logfile} 2>&1 || \ + { logprint failed to make ${pv} ; return 1 ; } + ${opt_n} make install >> ${logfile} 2>&1 || \ + { logprint failed to install ${pv} ; return 1 ; } + do_check_p make_check_version ${real_ver} || \ + { ${opt_n} make check >> ${logfile} 2>&1 || return 1 ; } + ${opt_n} cd .. + [ "${checks}" != "" ] && ${opt_n} ${checks} >> ${logfile} 2>&1 + return 0 +} + +find_canon_name + +logprint using host `hostname` +logprint `uname -a` +logprint canonical name ${canon_name} + +logprint clearing logfile +> ${logfile} + +find_unzip_prog + +logprint using target dir ${targetdir} +mkdir -p ${targetdir}/src +cd ${targetdir}/src || exit 1 +rm -rf heimdal* openssl* krb4* + +logprint === building openssl versions +for vo in ${openssl_versions} ; do + build openssl-${vo} openssl $vo config +done + +wssl="--with-openssl=${targetdir}/openssl" +wssli="--with-openssl-include=${targetdir}/openssl" #this is a hack for broken heimdal 0.5.x autoconf test +wossl="--without-openssl" +wk4c="--with-krb4-config=${targetdir}/krb4" +bk4c="/bin/krb4-config" +wok4="--without-krb4" + +logprint === building heimdal w/o krb4 versions +for vo in ${openssl_versions} ; do + for vh in ${heimdal_versions} ; do + v="openssl-${vo}-heimdal-${vh}" + build "${v}" \ + heimdal ${vh} \ + "configure ${wok4} ${wssl}-${vo} ${wssli}-${vo}/include" \ + "${targetdir}/heimdal-${vh}/bin/krb5-config --libs | grep lcrypto" \ || \ + { failed="${failed} ${v}" ; logprint ${v} failed ; } + done +done + +logprint === building krb4 +for vo in ${openssl_versions} ; do + for vk in ${krb4_versions} ; do + v="openssl-${vo}-krb4-${vk}" + build "${v}" \ + krb4 ${vk} \ + "configure ${wssl}-${vo}" \ + "${targetdir}/krb4-${vk}/bin/krb4-config --libs | grep lcrypto"|| \ + { failed="${failed} ${v}" ; logprint ${v} failed ; } + done +done + +logprint === building heimdal with krb4 versions +for vo in ${openssl_versions} ; do + for vk in ${krb4_versions} ; do + for vh in ${heimdal_versions} ; do + v="openssl-${vo}-krb4-${vk}-heimdal-${vh}" + build "${v}" \ + heimdal ${vh} \ + "configure ${wk4c}-${vk}${bk4c} ${wssl}-${vo} ${wssli}-${vo}/include" \ + "${targetdir}/heimdal-${vh}/bin/krb5-config --libs | grep lcrypto && ${targetdir}/heimdal-${vh}/bin/krb5-config --libs | grep krb4" \ + || \ + { failed="${failed} ${v}" ; logprint ${v} failed ; } + done + done +done + +logprint === building heimdal without krb4 and openssl versions +for vh in ${heimdal_versions} ; do + v="des-heimdal-${vh}" + build "${v}" \ + heimdal ${vh} \ + "configure ${wok4} ${wossl}" || \ + { failed="${failed} ${v}" ; logprint ${v} failed ; } +done + +logprint all done +[ "${failed}" != "" ] && logprint "failed: ${failed}" +exit 0 diff --git a/kerberosV/src/tools/krb5-config.1 b/kerberosV/src/tools/krb5-config.1 index 132ac1f8a7a..960d1e9de3e 100644 --- a/kerberosV/src/tools/krb5-config.1 +++ b/kerberosV/src/tools/krb5-config.1 @@ -1,4 +1,35 @@ -.\" $KTH: krb5-config.1,v 1.4 2001/05/02 08:59:23 assar Exp $ +.\" Copyright (c) 2000 - 2001 Kungliga Tekniska Högskolan +.\" (Royal Institute of Technology, Stockholm, Sweden). +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" 3. Neither the name of the Institute nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" $KTH: krb5-config.1,v 1.5 2003/02/16 21:10:32 lha Exp $ .\" .Dd November 30, 2000 .Dt KRB5-CONFIG 1 diff --git a/kerberosV/src/tools/krb5-config.in b/kerberosV/src/tools/krb5-config.in index 400e47a8f53..292f3f8854f 100644 --- a/kerberosV/src/tools/krb5-config.in +++ b/kerberosV/src/tools/krb5-config.in @@ -1,5 +1,5 @@ #!/bin/sh -# $KTH: krb5-config.in,v 1.8 2001/01/29 06:56:51 assar Exp $ +# $KTH: krb5-config.in,v 1.9 2002/09/09 22:29:06 joda Exp $ do_libs=no do_cflags=no @@ -21,7 +21,7 @@ for i in $*; do ;; --version) echo "@PACKAGE@ @VERSION@" - echo '$KTH: krb5-config.in,v 1.8 2001/01/29 06:56:51 assar Exp $' + echo '$KTH: krb5-config.in,v 1.9 2002/09/09 22:29:06 joda Exp $' exit 0 ;; --prefix=*) @@ -104,7 +104,7 @@ if test "$do_libs" = "yes"; then echo $lib_flags fi if test "$do_cflags" = "yes"; then - echo "-I${includedir}" + echo "-I${includedir} @INCLUDE_des@" fi exit 0 |